Function at 0x405710
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4160f0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x479010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], str.R0MuN7tLBBDJPgms9vWFNIlF0ns10D0jMGkU3FAgNogdCVlGCPqnpvcdL6LgV0lNovTNGzYv2yBi6i29y8UJDE3yX3EM6BXQnMEFKGfp5NuNJGDHFNJhmqyV6FR9AYUsWtCwtaB2IR5wPjuVbN6WJp1LIyvOjvkgP5HMowWEJCWcoc45NF8aavpHmj7iVmvEiFGjhANLVW3teb09OyMLkXizBDzXTyUI5Vitdvk49SJ1SV3MX9059nVq1kdbnV6dr553vLkqdsLpHY6pwIwRPCcuefHik9NDcWwgKdfXYQgcNVwFwoNRWocbgfCD8PF8cwO1EN8KSmwcr2HDqgwFv9lwTyMs1zKqIXxSjlOBKlqXF2jQgidjVNOuD3yASo5Q3djDwkzqIJ0Y21tnbRF6G3UShb31vvtNXCWMHl42WK8c0Mao7SgeGPe7Ppt6ARyLY7SJLelVNBNS2UahFKVPimHgye5BOaMrj75K33JhRx7KvM6uaodRl7B2O8gFNTrDQy74lcWQUNbUMtrFAhce6PwMiBqP6jFifS7HSiX3VGeQaTqAFkxGixouNd52hqnuM5NFpd9X6ryrSGd9P4xT6usNmuPBL1mswCsN479hLoyVbfGpdr0q9fjYeYle3BcA9vYRrsXlzPF1cKDyB0mHwBPWOgm2uyjm7gOtCSU8i8rH3aFUzJA3MDhgNUHurS0sxT096nEhTBtrOaaXkcgHTGd51zgvatiEgY7lR9a2CCs4ugpkNrwMklvhuP2lWU8SOynllGIjPzbN4GrIE28iXtpkvm4EXAgdsexmpK0FaPtgsqc5e5l7bfskuLvwmCeR74WtmlVhoPgqygopx943K2v28JynhVrcqGvF1LPYx0yHcJASmnLKWuNQgXw3Jb7HLdKOAxiePKrR99aQ8otOtzQPX9KMLNk1biIGMvi8Gy46aymJ1lNGvtvDvYIbk0UTp46UIJ5rHTEWUOc8RTVIEEYAmdWglJChUe750zgxHfyo4vyNffF80OLDcA2qGKYeSWzzGCMtJ79Kd09Bq3l540JoSRDsbylVaVQKgLST12SLTruzmySzNr27wOzwBnTIkpVOGaa9YvmzDHWQIsOwFFbEnfDeGhG5E6nSncx9g7aGSsGJS2cJws0xVXKv62yD6ghVayfvGp0038JGV1ISJSDWTLVIvdaalEnSnaRsjYGPuVVgDFAz4hBGawfBt81wMzTtNfiRnq4QwMWduOFhMcHbN5OjxTtMuMLoCgKfll59qrhnFJklyv4w8jUmemF8gDndxVNKPnJcpofK4fx3YNFvXpRa4BHN6QbylIUAxjX4gtrX2TOWNVm4EsW5OycRqwIQsjYI0UROAU4Hnk6elubJLurlKAmAru4AlqeHFrAqSqYJHu7dbaNXTSJfrskcw1GVd12NTekLsvjLjSaSh01GRgH7iaAvrBrOrgw3JmprKio6qRbPlvtyjdxvkkUcAwJCPntoau8Ma2NA0fCIQ8ixBwxE07ystd1FqmjSE33D7W0sqO5dzESqTM7uhhG0RosufjQuviUuCQlmlMIciXYT7sMBFalVPaNOnnk9MkBBb76nHCoLR1KCULhlaGuQEUtBQOkJg68SMFn7F9Bc5QKcKPoIjkWMUpwYNXQ7xlCX05eyHws1NyUdPz7u8asgrGDijch3WEnbPqybxdISUlzb8Hy5aQBbl9b7
mov byte [ebp - 4], 1
push 0x42fc57
lea eax, [ebp + 8]
push eax
call fcn.00403320
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x405784
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x11]
jmp 0x40585b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call fcn.004038f0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push str.Name
push 0x4315dd
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x4057f0
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x12]
jmp 0x40585b
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401820
mov al, byte [ebp - 0x13]
jmp 0x40585b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18