Function at 0x43c570
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b0b6
mov eax, dword fs:[0]
push eax
sub esp, 0x760
mov eax, dword [0x5503dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x664], ecx
push 0x200
push 0
mov eax, dword [ebp - 0x664]
push eax
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x664]
add ecx, 0x200
push ecx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x664]
add edx, 0x400
push edx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x664]
add eax, 0x600
push eax
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x664]
add ecx, 0x800
push ecx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x664]
add edx, 0xa00
push edx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x664]
add eax, 0xc00
push eax
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x664]
add ecx, 0xe00
push ecx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x664]
add edx, 0x1000
push edx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x664]
add eax, 0x1200
push eax
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x664]
add ecx, 0x1400
push ecx
call fcn.004debe0
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x664]
add edx, 0x1600
push edx
call fcn.004debe0
add esp, 0xc
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d072
mov dword [ebp - 0x688], 0
lea eax, [ebp - 0x688]
push eax
push 0x52d748
push 1
push 0
push 0x52d818
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d072
mov dword [ebp - 0x668], 0
lea ecx, [ebp - 0x668]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x512164
mov edx, dword [ebp - 0x688]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x688]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d05e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d04a
mov dword [ebp - 0x660], 0
lea ecx, [ebp - 0x660]
push ecx
push 0
push 0x30
push 0x512180
push 0x5121d4
mov edx, dword [ebp - 0x668]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x668]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43c910
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x66c], 0
lea eax, [ebp - 0x6b8]
push eax
lea ecx, [ebp - 0x66c]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43c8fc
cmp dword [ebp - 0x6b8], 0
jbe 0x43c8fc
xor eax, eax
mov word [ebp - 0x708], ax
xor ecx, ecx
mov dword [ebp - 0x706], ecx
mov dword [ebp - 0x702], ecx
mov dword [ebp - 0x6fe], ecx
mov word [ebp - 0x6fa], cx
push 0
push 0
lea edx, [ebp - 0x708]
push edx
push 0
push str.UUID
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x66c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43c8e8
push 0x100
mov ecx, dword [ebp - 0x700]
push ecx
mov edx, dword [ebp - 0x664]
add edx, 0x600
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x708]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x66c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x66c]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x51223c
mov ecx, dword [ebp - 0x668]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x668]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43ca53
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x670], 0
lea edx, [ebp - 0x6bc]
push edx
lea eax, [ebp - 0x670]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x660]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43ca3f
cmp dword [ebp - 0x6bc], 0
jbe 0x43ca3f
xor edx, edx
mov word [ebp - 0x718], dx
xor eax, eax
mov dword [ebp - 0x716], eax
mov dword [ebp - 0x712], eax
mov dword [ebp - 0x70e], eax
mov word [ebp - 0x70a], ax
push 0
push 0
lea ecx, [ebp - 0x718]
push ecx
push 0
push str.Name
mov edx, dword [ebp - 0x670]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43ca2b
push 0x100
mov eax, dword [ebp - 0x710]
push eax
mov ecx, dword [ebp - 0x664]
add ecx, 0x800
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x718]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x670]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x660]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [edx + 8]
call ecx
lea edx, [ebp - 0x660]
push edx
push 0
push 0x30
push 0x512250
push 0x512298
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x668]
push edx
mov eax, dword [ecx + 0x50]
call eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cb95
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x674], 0
lea ecx, [ebp - 0x6c0]
push ecx
lea edx, [ebp - 0x674]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x660]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cb81
cmp dword [ebp - 0x6c0], 0
jbe 0x43cb81
xor ecx, ecx
mov word [ebp - 0x728], cx
xor edx, edx
mov dword [ebp - 0x726], edx
mov dword [ebp - 0x722], edx
mov dword [ebp - 0x71e], edx
mov word [ebp - 0x71a], dx
push 0
push 0
lea eax, [ebp - 0x728]
push eax
push 0
push 0x5122a0
mov ecx, dword [ebp - 0x674]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x674]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cb6d
push 0x100
mov edx, dword [ebp - 0x720]
push edx
mov eax, dword [ebp - 0x664]
add eax, 0xa00
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [ebp - 0x728]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x674]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x674]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x660]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x660]
push ecx
push 0
push 0x30
push str.SELECT__FROM_Win32_OperatingSystem
push 0x5122bc
mov edx, dword [ebp - 0x668]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x668]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cdc4
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x67c], 0
lea eax, [ebp - 0x6c4]
push eax
lea ecx, [ebp - 0x67c]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cdb0
cmp dword [ebp - 0x6c4], 0
jbe 0x43cdb0
xor eax, eax
mov word [ebp - 0x738], ax
xor ecx, ecx
mov dword [ebp - 0x736], ecx
mov dword [ebp - 0x732], ecx
mov dword [ebp - 0x72e], ecx
mov word [ebp - 0x72a], cx
push 0
push 0
lea edx, [ebp - 0x738]
push edx
push 0
push 0xb
push 0x512158
lea ecx, [ebp - 0x658]
call fcn.00418a5d
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x6f0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6f0]
call fcn.00418ff7
push eax
lea ecx, [ebp - 0x640]
push ecx
call fcn.00418f14
add esp, 8
mov dword [ebp - 0x754], eax
mov edx, dword [ebp - 0x754]
mov dword [ebp - 0x758], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x758]
call fcn.00407740
push eax
mov eax, dword [ebp - 0x67c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x67c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x640]
call fcn.00407750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.00418ab3
cmp dword [ebp - 0x65c], 0
jl 0x43cd9c
push 0x100
mov ecx, dword [ebp - 0x730]
push ecx
mov edx, dword [ebp - 0x664]
add edx, 0xc00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x678], 0
jmp 0x43cd46
mov eax, dword [ebp - 0x678]
add eax, 1
mov dword [ebp - 0x678], eax
mov ecx, dword [ebp - 0x678]
mov edx, dword [ebp - 0x664]
movzx eax, word [edx + ecx*2 + 0xc00]
test eax, eax
je 0x43cd8f
mov ecx, dword [ebp - 0x678]
mov edx, dword [ebp - 0x664]
movzx eax, word [edx + ecx*2 + 0xc00]
cmp eax, 0x2e
jne 0x43cd8d
xor ecx, ecx
mov edx, dword [ebp - 0x678]
mov eax, dword [ebp - 0x664]
mov word [eax + edx*2 + 0xc00], cx
jmp 0x43cd37
lea ecx, [ebp - 0x738]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x67c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x67c]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x660]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x660]
push ecx
push 0
push 0x30
push 0x5122c4
push 0x512340
mov edx, dword [ebp - 0x668]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x668]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cf07
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x680], 0
lea eax, [ebp - 0x6c8]
push eax
lea ecx, [ebp - 0x680]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cef3
cmp dword [ebp - 0x6c8], 0
jbe 0x43cef3
xor eax, eax
mov word [ebp - 0x76c], ax
xor ecx, ecx
mov dword [ebp - 0x76a], ecx
mov dword [ebp - 0x766], ecx
mov dword [ebp - 0x762], ecx
mov word [ebp - 0x75e], cx
push 0
push 0
lea edx, [ebp - 0x76c]
push edx
push 0
push str.SerialNumber
mov eax, dword [ebp - 0x680]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x680]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43cedf
push 0x100
mov ecx, dword [ebp - 0x764]
push ecx
mov edx, dword [ebp - 0x664]
add edx, 0xe00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x76c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x680]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x680]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x660]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_BIOS
push 0x512398
mov ecx, dword [ebp - 0x668]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x668]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d04a
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x684], 0
lea edx, [ebp - 0x6cc]
push edx
lea eax, [ebp - 0x684]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x660]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d036
cmp dword [ebp - 0x6cc], 0
jbe 0x43d036
xor edx, edx
mov word [ebp - 0x750], dx
xor eax, eax
mov dword [ebp - 0x74e], eax
mov dword [ebp - 0x74a], eax
mov dword [ebp - 0x746], eax
mov word [ebp - 0x742], ax
push 0
push 0
lea ecx, [ebp - 0x750]
push ecx
push 0
push str.SMBIOSBIOSVersion
mov edx, dword [ebp - 0x684]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x684]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d022
push 0x100
mov eax, dword [ebp - 0x748]
push eax
mov ecx, dword [ebp - 0x664]
add ecx, 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x750]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x684]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x684]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x660]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x668]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x668]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x688]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x688]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x6ac], 0
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x6b0], edx
mov dword [ebp - 0x6ac], eax
mov ecx, dword [ebp - 0x6ac]
push ecx
mov edx, dword [ebp - 0x6b0]
push edx
push 0x5123c4
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x690], 0
jmp 0x43d0d9
mov ecx, dword [ebp - 0x690]
add ecx, 1
mov dword [ebp - 0x690], ecx
cmp dword [ebp - 0x690], 0xa
jge 0x43d139
xor edx, edx
mov word [ebp - 0x628], dx
push 0x1fe
push 0
lea eax, [ebp - 0x626]
push eax
call fcn.004debe0
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp - 0x690]
push edx
call fcn.0043d860
add esp, 8
test eax, eax
je 0x43d137
lea eax, [ebp - 0x628]
push eax
mov ecx, dword [ebp - 0x664]
add ecx, 0x200
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x43d139
jmp 0x43d0ca
mov byte [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x17], edx
mov byte [ebp - 0x13], dl
mov dword [ebp - 0x694], 0
lea eax, [ebp - 0x694]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0x694]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0
je 0x43d20b
lea edx, [ebp - 0x694]
push edx
mov eax, dword [ebp - 0x698]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x43d20b
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x68c], ecx
jmp 0x43d1b2
mov edx, dword [ebp - 0x68c]
mov eax, dword [edx]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0
je 0x43d20b
mov ecx, dword [ebp - 0x68c]
add ecx, 8
push ecx
call fcn.0043dac0
add esp, 4
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 1
je 0x43d1e5
cmp dword [ebp - 0x69c], 0
jne 0x43d209
mov edx, dword [ebp - 0x68c]
add edx, 0x194
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov cx, word [edx + 4]
mov word [ebp - 0x14], cx
cmp dword [ebp - 0x69c], 0
jne 0x43d209
jmp 0x43d20b
jmp 0x43d1a4
mov edx, 1
imul eax, edx, 5
movzx ecx, byte [ebp + eax - 0x18]
push ecx
mov edx, 1
shl edx, 2
movzx eax, byte [ebp + edx - 0x18]
push eax
mov ecx, 1
imul edx, ecx, 3
movzx eax, byte [ebp + edx - 0x18]
push eax
mov ecx, 1
shl ecx, 1
movzx edx, byte [ebp + ecx - 0x18]
push edx
mov eax, 1
shl eax, 0
movzx ecx, byte [ebp + eax - 0x18]
push ecx
mov edx, 1
imul eax, edx, 0
movzx ecx, byte [ebp + eax - 0x18]
push ecx
push 0x5123d8
mov edx, dword [ebp - 0x664]
add edx, 0x400
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov dword [ebp - 0x6b4], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x6b4]
push eax
push 0
push 0
push 0x512414
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43d2c7
mov ecx, dword [ebp - 0x6b4]
push ecx
push str._08X
mov edx, dword [ebp - 0x664]
add edx, 0x1200
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.004debe0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x220], dx
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004debe0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x6dc], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x6d4], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x6e4], xmm0
lea ecx, [ebp - 0x428]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x43d534
push 0x512428
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43d3f0
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0xffffffff
je 0x43d3f0
mov dword [ebp - 0x6ec], 0
xor edx, edx
mov dword [ebp - 0x6e8], edx
push 0
push 0
lea eax, [ebp - 0x6ec]
push eax
mov ecx, dword [ebp - 0x6a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x43d3e3
lea edx, [ebp - 0x6ec]
push edx
call fcn.0043d7e0
add esp, 4
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], edx
mov eax, dword [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x512444
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43d492
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0xffffffff
je 0x43d492
mov dword [ebp - 0x740], 0
xor ecx, ecx
mov dword [ebp - 0x73c], ecx
push 0
push 0
lea edx, [ebp - 0x740]
push edx
mov eax, dword [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x43d485
lea ecx, [ebp - 0x740]
push ecx
call fcn.0043d7e0
add esp, 4
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], edx
mov edx, dword [ebp - 0x6a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.notepad.exe
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43d534
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0xffffffff
je 0x43d534
mov dword [ebp - 0x6f8], 0
xor eax, eax
mov dword [ebp - 0x6f4], eax
push 0
push 0
lea ecx, [ebp - 0x6f8]
push ecx
mov edx, dword [ebp - 0x6a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x43d527
lea eax, [ebp - 0x6f8]
push eax
call fcn.0043d7e0
add esp, 4
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x6e0], edx
mov ecx, dword [ebp - 0x6a8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x6e0]
push edx
mov eax, dword [ebp - 0x6e4]
push eax
mov ecx, dword [ebp - 0x6d0]
push ecx
mov edx, dword [ebp - 0x6d4]
push edx
mov eax, dword [ebp - 0x6d8]
push eax
mov ecx, dword [ebp - 0x6dc]
push ecx
push str._llu__llu__llu
push 0x100
mov edx, dword [ebp - 0x664]
add edx, 0x1400
push edx
call fcn.0043dc60
add esp, 0x24
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9018
mov esp, ebp
pop ebp
ret