Function at 0x406f89
Capabilities:
Connect to wmi namespace via wbemlocator
Get hostname
Query or enumerate registry value
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
sub esp, 0x654
lea ebp, [esp - 4]
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x654], eax
push 0x104
mov eax, 0x43206a
call fcn.00421ae0
mov eax, dword [ebp + 0x660]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
jge 0x406fe3
cmp eax, 0x80010119
jne 0x407554
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x34]
push eax
push 0x4350dc
push 1
push ebx
push 0x4351ac
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x407543
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x34]
push 0x4362c0
lea esi, [ebp - 0x18]
call fcn.004086b5
lea edx, [ebp - 0x28]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ecx, dword [edi]
push ebx
push eax
push edi
call dword [ecx + 0xc]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
call edi
cmp esi, ebx
jl 0x407533
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, ebx
jl 0x407533
mov dword [ebp - 0x110], 0x4362d8
mov dword [ebp - 0x10c], 0x43634c
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], 0x436370
mov dword [ebp - 0x100], 0x4363ec
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], 0x436408
mov dword [ebp - 0xf4], 0x4364c8
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 0x4364e0
mov dword [ebp - 0xe8], 0x4365b0
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0xe0], 0x4365c8
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], 0x436648
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], 0x436690
mov dword [ebp - 0xc4], 0x4366d8
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], 0x4366f0
mov dword [ebp - 0xb8], 0x436730
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], 0x436738
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], GetSystemTimeAsFileTime
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x50]
jge 0x407533
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
push dword [ebp + eax*4 - 0x110]
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x1c], ecx
call fcn.004086b5
mov dword [ebp - 0x18], eax
push 0x4367b8
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00408683
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
lea esi, [ebp - 0x20]
push esi
push ebx
push 0x30
push ecx
push eax
push dword [ebp - 0x1c]
call dword [edx + 0x50]
push dword [ebp - 0x44]
mov esi, eax
call edi
push dword [ebp - 0x4c]
call edi
cmp esi, ebx
jl 0x4074f7
cmp dword [ebp - 0x20], ebx
je 0x4074f7
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x30], ebx
mov word [ebp + 0x20], ax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x4074d1
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x1c]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x18], 0x80004005
call dword [ecx + reloc.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 7
jmp 0x407230
cmp dword [ebp - 0x18], ebx
jl 0x4074c0
cmp dword [ebp - 0x1c], ebx
je 0x4074c0
cmp dword [ebp - 0x30], ebx
je 0x4074c0
push 0x4367bc
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 0x11], bl
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1c]
push 0x4367c4
lea esi, [ebp - 0x54]
mov dword [ebp - 0x18], eax
call fcn.00408683
push ebx
push ebx
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x74]
push esi
push ebx
push eax
push ecx
call dword [edx + reloc.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], 0xa
push dword [ebp - 0x54]
mov esi, eax
call edi
cmp esi, ebx
jl 0x4072bf
cmp word [ebp - 0x74], 8
jne 0x4072bf
cmp dword [ebp - 0x6c], ebx
je 0x4072bf
push dword [ebp - 0x6c]
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
mov byte [ebp - 0x11], 1
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x1c]
push 0x4367d4
lea esi, [ebp - 0x38]
mov dword [ebp - 0x18], eax
call fcn.00408683
push ebx
push ebx
mov byte [ebp - 4], LoadLibraryW
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x64]
push esi
push ebx
push eax
push ecx
call dword [edx + reloc.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], 0xc
push dword [ebp - 0x38]
mov esi, eax
call edi
cmp esi, ebx
jl 0x407322
cmp word [ebp - 0x64], 8
jne 0x407322
cmp dword [ebp - 0x5c], ebx
je 0x407322
push dword [ebp - 0x5c]
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0x10c]
cmp esi, ebx
je 0x40738f
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push ebx
push ebx
lea edx, [ebp - 0x94]
push edx
push ebx
mov byte [ebp - 4], LoadLibraryW
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + reloc.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
jl 0x40737e
cmp word [ebp - 0x94], 8
jne 0x40737e
cmp dword [ebp - 0x8c], ebx
je 0x40737e
push dword [ebp - 0x8c]
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
mov byte [ebp - 0x11], 1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x94]
push eax
call esi
jmp 0x407395
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp byte [ebp - 0x11], bl
je 0x4074a8
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], LoadLibraryW
mov eax, dword [ebp - 0x1c]
push 0x4367e0
lea esi, [ebp - 0x40]
mov dword [ebp - 0x18], eax
call fcn.00408683
push ebx
push ebx
mov byte [ebp - 4], reloc.KERNEL32.dll_LoadLibraryW
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x84]
push esi
push ebx
push eax
push ecx
call dword [edx + reloc.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], LoadLibraryW
push dword [ebp - 0x40]
mov esi, eax
call edi
cmp esi, ebx
jl 0x407414
cmp word [ebp - 0x84], 8
jne 0x407414
cmp dword [ebp - 0x7c], ebx
je 0x407414
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
push 0x436ef8
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1c]
push 0x4367e8
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x18], eax
call fcn.00408683
push ebx
push ebx
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0xa4]
push esi
push ebx
push eax
push ecx
call dword [edx + reloc.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], 0x11
push dword [ebp - 0x3c]
mov esi, eax
call edi
cmp esi, ebx
jl 0x407490
cmp word [ebp - 0xa4], 8
jne 0x407490
cmp dword [ebp - 0x9c], ebx
je 0x407490
push dword [ebp - 0x9c]
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
push 0x436ef8
lea eax, [ebp + 0x1c]
push eax
call fcn.00405e4f
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xa4]
push eax
call esi
lea eax, [ebp - 0x84]
push eax
call esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x108], ebx
lea eax, [ebp - 0x64]
push eax
jne 0x407511
call esi
lea eax, [ebp - 0x74]
push eax
call esi
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4074d1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x4367f8
push dword [ebp - 0x2c]
call fcn.00405e4f
mov ecx, dword [ebp - 0x2c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1c]
call fcn.00405f88
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.004064c2
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x407508
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add dword [ebp - 0x24], 3
jmp 0x407152
call esi
lea eax, [ebp - 0x74]
push eax
call esi
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4071e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4071e1
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x407543
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x407554
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], ebx
jne 0x4076c1
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x44e]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x44c]
push eax
lea eax, [ebp - 0x20]
push eax
mov edi, 0x4367fc
push edi
push 0x436818
push 0x80000002
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4075ce
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], bx
je 0x4075ce
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x44c]
call fcn.00405e78
jmp 0x40765e
call fcn.00410d73
test eax, eax
je 0x40765e
lea eax, [ebp - 0x28]
push eax
push 0x20119
push ebx
push 0x436818
push 0x80000002
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40765e
cmp dword [ebp - 0x28], ebx
je 0x40765e
push 0x208
lea eax, [ebp + 0x44c]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x44c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407655
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], bx
je 0x407655
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x44c]
call fcn.00405e78
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push esi
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x246]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x244]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x436858
push 0x436878
push 0x80000001
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4076c1
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], bx
je 0x4076c1
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x244]
call fcn.00405e78
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], LoadLibraryW
call fcn.00408a32
push 0x13
pop esi
lea eax, [ebp]
mov dword [ebp - 4], esi
push eax
mov byte [ebp - 4], 0x14
call fcn.00406d69
pop ecx
mov dword [ebp - 4], esi
jmp 0x4076f9
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 4]
jae 0x407705
lea ecx, [ebp + 4]
lea eax, [ebp + 0x1c]
push eax
call fcn.004101df
pop ecx
mov ecx, dword [ebp - 0x2c]
push 0xffffffffffffffff
push ebx
mov byte [ebp - 4], 0x16
call fcn.00405f88
push ebx
push 1
lea esi, [ebp + 0x1c]
mov byte [ebp - 4], 0x13
call fcn.004064c2
xor eax, eax
push 0x208
mov word [ebp + 0x38], ax
lea eax, [ebp + 0x3a]
push ebx
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push 4
mov dword [ebp - 0x48], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x2c]
call fcn.00405e4f
push ebx
push 1
lea ecx, [ebp]
call fcn.0040896d
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x654]
xor ecx, ebp
call fcn.0041f23c
add ebp, 0x658
leave
ret