Function at 0x405790
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4160e0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x478010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], str.ckEaE6PsGjmfzp7zsKT1zCuCGXPuoztRPPNNsbBBcMU9y4seNqRJwJyvLQ3Nth0XJiiJfFUaPuwbaHNbLBdi7gA7mAD1WrxBkjTqe30ws3S7bEVAWESE6lhadh9aTU53SAbRdDukeBSLvHxmNaulO3KJqIjjuRzmv1lzyIvwD3BX61ibzMlkbjC8oj4xYWSk7AjwepChvPkwX8MumnuaGWSTQ6yUF7RxstJhJJP406zhfYBu5UFSpI5USN8zYKjm8WVSeCCByB187Thatui2Yd7fQJkBoFXQysVSmRUR1KzUQBgf8mwGDWohuSUarYxUWzvmoc57vAlyMdXfrUcqbiMEQRQoMiEco14VcbVQuNCXneNqEIQm0zBfiVgt8vW5MBMFbjMSJIV35w6PNpK73VzgxYyAh0XKPnvekWlfojYKwp7gNOPMQrU6CxgU5sd86sKJenNgTbH3lw8ilTJ4y5jsTOaGv2aUY6PQ3IOv2zbThWig0KR6OGRj4Ad8ydfBEKFJv3tORoLh99Lf7CeyWYaS7mCvmUOobWV6VhjjRaYdPWF8UQDDMCdFpcJ36pcjpoY7bekmM3yIkB1xp0w4K7urCQ931oF62VTxLD0CHQpOFIPRsH43QSVcKICMtVuiAxszH6dY23Fz0k5hKL9mGcUf7NbBRuNbql7YC7lDwIH3uOEHO9ldpih9pMYMHUKPGA41I4b1fB3jt0rOXTUqKdkIzWrGyrs5qFbtNf1PB4quh4e7ngSf3WL2Wf9G5IVuqa3EcNx2j8NFlANM4zTvcnPtagS70LcsoJXmRNXSrrkYdySPPnmwEeaCddFo70b4NcTUjdRQmilAti91mhm7vaQpm0ISkdMeWvzbCPnKNDpCMzdR65HEmIsVf5p3BCSB1NmvtrYzN3iiUwGDmHR0qjYEPDoiXNgAWjnK7DGDHJXLHH6pjd5xvgSforr5xIInyppkoVVueyzg21U0TNeaXM6CyVBRxLVVtCX8FJBYp1u0ULBYVQUiKXX2eb59eGAXaDhAYl3dzfjdpFxH0OtPnNkVHSkoXDiWTffDQU4wp2M9FP5iAkThVbs5zoV8caE9NptIqyTxVNT6SIwCWbUx8R5uKHKSpbayOchOrefbtBPkod8ldfV7cwmqusOcc0kXIPHpbMhzI9Y9yA7QjB60XGWqnUmCfmyU6JsuwWAaCLUROuBlYqdHSNUijYNKhlgInmYATogCyssOJXKLQ4OfUeO7weOa8sLrPooJnDNU7QzmUtBNjX99DaDeBQfsHAnWwBxsx5bhkbsQ2ObWCK9ucJPepE7gY0kPnVVPz3NasnxESesrQbqPjVhYc9Hc1lOs7sQrgJzlaYpbikmiU9mgiFlDtrrWVH0YkodnVfNPpaQPb6LfxFXm2IPz9h1aXv0jp6FevxhVtMU3zVwRhV1hYL1tq4gwoBQ5z3z9vveaYhMgxCorwgWDbnzgOPhIBdALRSXKXTllSLSVfk84u6Uzf0G9cgiu1WaxboCeAnLyr0PwVCqwe3MLnYYzJFMycPuodu0dzt6agntwTtUsBP6okAvhY2sEHgr2vefUJDnKiTNrxccekm98tUOgKVayg0QXrOf2ub6dLh3NlxPWUCSdI0RLfCY2BgutbzyMLkeGiMF8QDkwILYlAL5kVYdSAB6zL0rTabbzLohYG07BW8OMb0mKFwkT7Yl32GSDKIMzsGIUzwDDA8si7n25Bp1VcLSsFqzKgRnAUU3whwfOvmG8FvSCesbNTGiac6RxYoHQ3VupEFf5mxY5FRaYl7UnmR7dTKRMKW1N5gvaF4UaDvxttNz15rwwPQQuYAmN16Xdz3Jrl9uzGif76yfPWcu7CyWBqTPqMjF5p72RKO8xD2Gk5jNPIHx46gOW3auYETIDNRs64iX5t0bYx5hDw1ziJHNGtYcmN79siphPze511DGrdNbcOJHJ5UeJc6ATX4rkJrWKzDwRTuVAmhuFnbfkKqlKwpWwuLwilk8ytYgXBijOSeBvjhH3r5mezUiCg8NHD3IXN3gooQW3cepq5AORU8rmjOk7LW7athKI52o1qcDGkNcoqkvM4fJ8vpsr5TJv1gxAXywpCqTISjLFslTOMrjiN8OyPzsRNWwkbzq0LOWz32lLB7k07aamBAcUgpsEDSpIxuTStMIfz7ArANjl8fjBeu9x8MpvIh5zT3B2bROcMCEJw9AVYRF5JHSSPVonvXDHfqf49LytCu8YNz8PWE8A5gj0j10pQrlVz9ossj0Axy2Ia929lAxH0j6o72e6TOH81bEq2sRzDxROEyGXy4FM58y8kUz97Rq8LOwUClAXy4zlG7Bp4QiUJaJKEtUxiYoP6OtHOcjRwBzHYPyCs760dYmmmoFxBdI7lgVg0qRQkBGvzivKkoIDziSxhiDEugIUWFiRpzN2mjfEQMAXqFNgHWsnPD7FJrT8oUSz7in0AUYkvbcswfR2lXVx1NPDsIXIgiYbYpxTyt8Wz2QpuRsS3sQ8q3YR8HPCetOfKRVnmXldqvm3iE1waHtOdwcWvECP2vB6WMVBHdJ6KqGAW6XpV8KM6gzHGsFksRtQWnzgRYTNyg0jy7GLohnHoeFh6Cu6roxmX3EwGSOQb6EriYvCoRFM0ft1wlObUjPh2iB8Bs1YkGhhroGICIJKo0qA2qzCXgmXXMDiC5oeXpC6kpsABOlOA7tS2kTrHf5BvjAKk5lTqhFdmv1wHiWLf5V4i88IkGU87O3LREGwoXCX4wvA6oJPxiEBQyOy9mIeaoi71RJUPMSFYG0BLwAOg2Rc91G1utklOgj54Hdc3E2HMFxaye70LskMSuIeOBtI5KMtV1lHIbRqbt8D8cyd1DbD7E2kEITlLp7B5zJ4Lzod0vJ8YeVLuw3feMYsAbiXwQnky1w9xIOu8BexrjVviW3nWP9LjIg7QRnY1Sf7C6yFvUtvCwXN6DE4jnhrxvp42oBqEAUn0Sead5jtv96waeTBFCkF83gRftg3gt0B
push 0x42a8ce
lea eax, [ebp + 8]
push eax
call fcn.00403380
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x405804
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x11]
jmp 0x4058c3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call fcn.00403940
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push str.Name
push 0x42a8cf
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x405870
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x12]
jmp 0x4058c3
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x13]
jmp 0x4058c3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18