Function at 0x469400
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c66f
mov eax, dword fs:[0]
push eax
sub esp, 0x8a0
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x280]
call fcn.00406020
mov dword [ebp - 4], 0
lea eax, [ebp - 0x280]
push eax
call fcn.00418320
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x46947b
lea edx, [ebp - 0x280]
push edx
mov ecx, 0x640af0
call fcn.004060f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.004060d0
jmp 0x469e40
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x550], esp
push 0x5eaa20
call fcn.00406050
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x798], eax
mov byte [ebp - 4], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x554], esp
push str.Win32_BIOS
call fcn.00406050
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x79c]
mov dword [ebp - 0x7a0], ecx
mov byte [ebp - 4], 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x558], esp
push 0x5eaa3c
call fcn.00406050
mov dword [ebp - 0x7a4], eax
lea edx, [ebp - 0x2d4]
push edx
mov byte [ebp - 4], 0
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x7a8], eax
mov byte [ebp - 4], 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x55c], esp
push 0x5eaa48
call fcn.00406050
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x7b0], eax
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x5eaa58
call fcn.00406050
mov dword [ebp - 0x7b4], eax
mov ecx, dword [ebp - 0x7b4]
mov dword [ebp - 0x7b8], ecx
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x564], esp
push 0x5eaa68
call fcn.00406050
mov dword [ebp - 0x7bc], eax
lea edx, [ebp - 0x264]
push edx
mov byte [ebp - 4], 3
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x7c0], eax
mov byte [ebp - 4], 6
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x568], esp
push str.UUID
call fcn.00406050
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x7c8], eax
mov byte [ebp - 4], 7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x56c], esp
push str.Win32_ComputerSystemProduct
call fcn.00406050
mov dword [ebp - 0x7cc], eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d0], ecx
mov byte [ebp - 4], 8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x570], esp
push 0x5eaa98
call fcn.00406050
mov dword [ebp - 0x7d4], eax
lea edx, [ebp - 0x2f0]
push edx
mov byte [ebp - 4], 6
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x7d8], eax
mov byte [ebp - 4], 9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x574], esp
push 0x5eaaa4
call fcn.00406050
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x7e0], eax
mov byte [ebp - 4], 0xa
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x578], esp
push 0x5eaaac
call fcn.00406050
mov dword [ebp - 0x7e4], eax
mov ecx, dword [ebp - 0x7e4]
mov dword [ebp - 0x7e8], ecx
mov byte [ebp - 4], 0xb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x5eaac4
call fcn.00406050
mov dword [ebp - 0x7ec], eax
lea edx, [ebp - 0x2b8]
push edx
mov byte [ebp - 4], 9
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x7f0], eax
mov byte [ebp - 4], 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x5eaad0
call fcn.00406050
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x7f8], eax
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x584], esp
push str._Win32_OperatingSystem
call fcn.00406050
mov dword [ebp - 0x7fc], eax
mov ecx, dword [ebp - 0x7fc]
mov dword [ebp - 0x800], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x588], esp
push 0x5eaaf0
call fcn.00406050
mov dword [ebp - 0x804], eax
lea edx, [ebp - 0x248]
push edx
mov byte [ebp - 4], 0xc
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x808], eax
mov byte [ebp - 4], 0xf
push 0x59a8e6
lea ecx, [ebp - 0x29c]
call fcn.00406050
mov byte [ebp - 4], 0x10
mov byte [ebp - 0x22c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x22b]
push eax
call fcn.00568440
add esp, 0xc
push 0x200
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x4698a4
movzx edx, byte [ebp - 0x22c]
push edx
call fcn.004184c0
add esp, 4
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
jb 0x4698a4
mov byte [ebp - 0x4f4], 0
push 0x1ff
push 0
lea eax, [ebp - 0x4f3]
push eax
call fcn.00568440
add esp, 0xc
mov ecx, dword [ebp - 0x2f4]
push ecx
push str.Win32_DiskDrive_WHERE_Index_d
lea edx, [ebp - 0x4f4]
push edx
call fcn.004708b0
add esp, 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x58c], esp
push 0x5eab1c
call fcn.00406050
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x810], eax
mov byte [ebp - 4], 0x11
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x590], esp
lea edx, [ebp - 0x4f4]
push edx
call fcn.00406050
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 0x12
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x594], esp
push 0x5eab2c
call fcn.00406050
mov dword [ebp - 0x81c], eax
lea ecx, [ebp - 0x5b0]
push ecx
mov byte [ebp - 4], 0x10
call fcn.00416900
add esp, 0x58
mov dword [ebp - 0x820], eax
mov edx, dword [ebp - 0x820]
mov dword [ebp - 0x824], edx
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x824]
push eax
lea ecx, [ebp - 0x29c]
call fcn.004060f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x5b0]
call fcn.004060d0
push 0x59a8e7
lea ecx, [ebp - 0x2c]
call fcn.00406050
mov byte [ebp - 4], 0x14
call fcn.004143a0
test eax, eax
je 0x469ad7
push 0x5eab38
lea ecx, [ebp - 0x5cc]
call fcn.00406050
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], ecx
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x264]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x5e8]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x830], eax
mov edx, dword [ebp - 0x830]
mov dword [ebp - 0x834], edx
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x2f0]
push eax
mov ecx, dword [ebp - 0x834]
push ecx
lea edx, [ebp - 0x604]
push edx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x83c], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x29c]
push ecx
mov edx, dword [ebp - 0x83c]
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
mov dword [ebp - 0x844], ecx
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x2b8]
push edx
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x658]
push edx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x854], eax
mov byte [ebp - 4], 0x1a
push str.x86_64
mov ecx, dword [ebp - 0x854]
push ecx
lea edx, [ebp - 0x674]
push edx
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x85c], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
lea eax, [ebp - 0x690]
push eax
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x864], ecx
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x864]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004060f0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x690]
call fcn.004060d0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x674]
call fcn.004060d0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x658]
call fcn.004060d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x63c]
call fcn.004060d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x620]
call fcn.004060d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x604]
call fcn.004060d0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5e8]
call fcn.004060d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x5cc]
call fcn.004060d0
jmp 0x469ce7
push 0x5eab50
lea ecx, [ebp - 0x6ac]
call fcn.00406050
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x86c], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x264]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x6c8]
push eax
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x870]
mov dword [ebp - 0x874], ecx
mov byte [ebp - 4], 0x1e
lea edx, [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x874]
push eax
lea ecx, [ebp - 0x6e4]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x878], eax
mov edx, dword [ebp - 0x878]
mov dword [ebp - 0x87c], edx
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x29c]
push eax
mov ecx, dword [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x700]
push edx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x884], eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2b8]
push ecx
mov edx, dword [ebp - 0x884]
push edx
lea eax, [ebp - 0x71c]
push eax
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x888], eax
mov ecx, dword [ebp - 0x888]
mov dword [ebp - 0x88c], ecx
mov byte [ebp - 4], 0x21
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x88c]
push eax
lea ecx, [ebp - 0x738]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x890], eax
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x894], edx
mov byte [ebp - 4], 0x22
push 0x5eab60
mov eax, dword [ebp - 0x894]
push eax
lea ecx, [ebp - 0x754]
push ecx
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x898], eax
mov edx, dword [ebp - 0x898]
mov dword [ebp - 0x89c], edx
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp - 0x89c]
push ecx
lea edx, [ebp - 0x770]
push edx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x8a4], eax
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x8a4]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004060f0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x770]
call fcn.004060d0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x754]
call fcn.004060d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x738]
call fcn.004060d0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x71c]
call fcn.004060d0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x700]
call fcn.004060d0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6e4]
call fcn.004060d0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x6c8]
call fcn.004060d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6ac]
call fcn.004060d0
push 0x5eab64
lea ecx, [ebp - 0x790]
call fcn.00406050
mov dword [ebp - 0x8a8], eax
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8ac], edx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004708e0
add esp, 8
mov byte [ebp - 0x771], al
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x790]
call fcn.004060d0
movzx edx, byte [ebp - 0x771]
test edx, edx
je 0x469dba
mov byte [ebp - 0x53c], 0
push 0x3f
push 0
lea eax, [ebp - 0x53b]
push eax
call fcn.00568440
add esp, 0xc
call fcn.00402270
mov dword [ebp - 0x548], eax
lea ecx, [ebp - 0x2c]
call fcn.004061b0
push eax
push 0x40
lea ecx, [ebp - 0x53c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00406190
push eax
call fcn.00412710
add esp, 0x10
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
je 0x469daa
lea edx, [ebp - 0x53c]
push edx
mov ecx, 0x640af0
call fcn.00406110
jmp 0x469db8
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x640af0
call fcn.004060f0
jmp 0x469dc8
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x640af0
call fcn.004060f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
call fcn.004060d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x29c]
call fcn.004060d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x248]
call fcn.004060d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
call fcn.004060d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2f0]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x264]
call fcn.004060d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2d4]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.004060d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret