Function at 0x429eca
Capabilities:
Reference wmi statements

Disassembly:
push 0x2f4
mov eax, 0x473933
call fcn.0044edbf
mov edi, dword [ebp + 8]
mov dword [ebp - 0x244], edi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x300]
call fcn.004023df
mov byte [ebp - 4], 3
push dword [eax]
lea ecx, [ebp - 0x230]
call fcn.004038ab
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 0x10
jb 0x429f22
mov eax, dword [eax + 4]
jmp 0x429f25
add eax, 4
push eax
call fcn.0041d692
pop ecx
mov byte [ebp - 4], 3
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.00402a7d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2fc]
cmp dword [ebp - 0x300], eax
je 0x429f5b
push dword [ebp - 0x300]
call fcn.0044e653
pop ecx
lea ecx, [ebp - 0x238]
call fcn.004028a9
mov byte [ebp - 4], 5
lea ecx, [ebp + 0xc]
call fcn.004093e9
push eax
lea ecx, [ebp + 0xc]
call fcn.004078fa
push 0x47a658
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a0bc
lea ecx, [ebp - 0x230]
call fcn.00402e36
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
push str.Version
push 0x477a5d
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
lea eax, [ebp - 0x26c]
push eax
call fcn.00428e1c
add esp, 0x14
mov byte [ebp - 4], 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x230]
call fcn.0040344d
mov byte [ebp - 4], 7
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00402a7d
mov dword [ebp - 4], 6
jmp 0x42a043
cmp dword [ebp - 0x218], 0x10
mov eax, dword [ebp - 0x22c]
jae 0x42a058
lea eax, [ebp - 0x22c]
push eax
push 0x477bbc
mov edi, 0x49bba8
push edi
call fcn.00403570
add esp, 0xc
mov eax, dword [0x49bba8]
cmp dword [eax - 0xc], ebx
jne 0x42a082
push 0x47c434
mov ecx, edi
call fcn.004034df
push edi
mov ecx, dword [ebp - 0x244]
call fcn.00402e10
mov dword [ebp - 0x23c], esi
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.00402a7d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.004028d3
mov byte [ebp - 4], bl
jmp 0x42a5de
push str.osname
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a16b
mov eax, dword [0x49bbac]
cmp dword [eax - 0xc], ebx
jne 0x42a138
lea eax, [ebp - 0x26c]
push eax
call fcn.00429a24
pop ecx
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x18], 0x10
jb 0x42a0fa
mov eax, dword [eax + 4]
jmp 0x42a0fd
add eax, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00403654
mov byte [ebp - 4], 0xc
push eax
mov ecx, 0x49bbac
call fcn.004078fa
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x234]
call fcn.004028d3
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00402a7d
push 0x49bbac
mov ecx, edi
call fcn.00402e10
mov dword [ebp - 0x23c], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.004028d3
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.004028d3
mov eax, edi
jmp 0x42a5ec
push 0x47c430
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a18d
push 0x477a5d
mov ecx, edi
call fcn.00403654
jmp 0x42a144
push 0x47ade8
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a1ea
mov eax, dword [0x49bbb4]
cmp dword [eax - 0xc], ebx
je 0x42a1b2
push 0x49bbb4
jmp 0x42a13d
call fcn.004287e1
mov edi, 0x49bbb4
mov ecx, edi
test eax, eax
je 0x42a1c9
push 0x47c42c
jmp 0x42a1ce
push 0x47c428
call fcn.00402e55
push edi
mov ecx, dword [ebp - 0x244]
call fcn.00402e10
mov dword [ebp - 0x23c], esi
jmp 0x42a0a5
push 0x47c424
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a291
mov eax, dword [0x49bbb8]
cmp dword [eax - 0xc], ebx
jne 0x42a287
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x234], esp
push str.nothing
call fcn.004038ab
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x248], esp
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
call fcn.004038ab
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push str.HKEY_LOCAL_MACHINE
call fcn.00403654
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xe
call fcn.00426185
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.004262b5
add esp, 0x40
push 0x47c0e4
mov ecx, 0x49bb74
call fcn.004288cc
push eax
mov ecx, 0x49bbb8
call fcn.004078fa
push 0x49bbb8
jmp 0x42a13d
push 0x47add0
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a336
mov eax, dword [0x49bbbc]
cmp dword [eax - 0xc], ebx
jne 0x42a32c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x240], esp
push str.AntivirusProduct
call fcn.004038ab
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x26c]
push eax
mov byte [ebp - 4], 5
call fcn.004294e0
add esp, 0x20
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x18], 0x10
jb 0x42a2ee
mov eax, dword [eax + 4]
jmp 0x42a2f1
add eax, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00403654
mov byte [ebp - 4], 0x12
push eax
mov ecx, 0x49bbbc
call fcn.004078fa
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x234]
call fcn.004028d3
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00402a7d
push 0x49bbbc
jmp 0x42a13d
push 0x47adb8
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a3db
mov eax, dword [0x49bbc0]
cmp dword [eax - 0xc], ebx
jne 0x42a3d1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x240], esp
push str.FirewallProduct
call fcn.004038ab
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x26c]
push eax
mov byte [ebp - 4], 5
call fcn.004294e0
add esp, 0x20
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x18], 0x10
jb 0x42a393
mov eax, dword [eax + 4]
jmp 0x42a396
add eax, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00403654
mov byte [ebp - 4], 0x15
push eax
mov ecx, 0x49bbc0
call fcn.004078fa
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x234]
call fcn.004028d3
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00402a7d
push 0x49bbc0
jmp 0x42a13d
push 0x47ada0
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a480
mov eax, dword [0x49bbc4]
cmp dword [eax - 0xc], ebx
jne 0x42a476
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x240], esp
push str.AntiSpywareProduct
call fcn.004038ab
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x26c]
push eax
mov byte [ebp - 4], 5
call fcn.004294e0
add esp, 0x20
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 0x10
jb 0x42a438
mov eax, dword [eax + 4]
jmp 0x42a43b
add eax, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00403654
mov byte [ebp - 4], 0x18
push eax
mov ecx, 0x49bbc4
call fcn.004078fa
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x234]
call fcn.004028d3
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.00402a7d
push 0x49bbc4
jmp 0x42a13d
push 0x47c3bc
lea eax, [ebp + 0xc]
push eax
call fcn.00417b5d
pop ecx
pop ecx
test al, al
je 0x42a17f
mov eax, dword [0x49bbc8]
cmp dword [eax - 0xc], ebx
jne 0x42a4cd
lea eax, [ebp - 0x234]
push eax
call fcn.00429a6e
pop ecx
mov byte [ebp - 4], 0x19
push eax
mov ecx, 0x49bbc8
call fcn.004078fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x234]
call fcn.004028d3
push 0x49bbc8
jmp 0x42a13d
lea ecx, [ebp + 0xc]
call fcn.004028d3
mov eax, dword [ebp - 0x244]
call fcn.0044ee1b
ret