Function at 0x4b55a0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x754
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x750], eax
mov eax, edi
mov dword [ebp - 0x748], edx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x74c], edi
lea edx, [eax + 2]
xor ebx, ebx
jmp 0x4b55e0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b55e0
sub eax, edx
sar eax, 1
je 0x4b5715
mov eax, edi
xor esi, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5600
sub eax, edx
sar eax, 1
je 0x4b5643
movzx eax, word [edi + esi*2]
push eax
call fcn.004e5c73
mov word [edi + esi*2], ax
mov eax, edi
add esp, 4
inc esi
lea edx, [eax + 2]
jmp 0x4b5630
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5630
sub eax, edx
sar eax, 1
cmp esi, eax
jb 0x4b5611
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x53b5fd], bl
je 0x4b5715
lea ecx, [ebp - 0x710]
push ecx
push 0x502118
mov esi, 1
push esi
push ebx
push 0x5021e8
mov dword [ebp - 0x710], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4b570f
mov eax, dword [ebp - 0x710]
lea ecx, [ebp - 0x70c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x70c], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x52619c
push eax
call edx
test eax, eax
js 0x4b5701
mov eax, dword [ebp - 0x70c]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x70c]
js 0x4b56f9
lea edx, [ebp - 0x718]
push edx
push ebx
push 0x30
push str.SELECT_LogonId_StartTime_FROM_Win32_LogonSession_WHERE_LogonType__2
mov dword [ebp - 0x718], ebx
mov ecx, dword [eax]
push 0x526208
push eax
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jns 0x4b5728
mov eax, dword [ebp - 0x70c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x710]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
push 0x400
mov dword [ebp - 0x720], ebx
mov dword [ebp - 0x738], ebx
call fcn.004e4240
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x718]
add esp, 4
cmp eax, ebx
je 0x4b5c7a
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4b5760
cmp dword [ebp - 0x720], ebx
jne 0x4b5c7a
mov ecx, dword [eax]
lea edx, [ebp - 0x738]
push edx
lea edx, [ebp - 0x73c]
push edx
push esi
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x738], ebx
je 0x4b5c7a
push 0x3e
lea edx, [ebp - 0x86]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x88], cx
call fcn.004e7d90
push 0x3e
lea ecx, [ebp - 0x46]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x48], ax
call fcn.004e7d90
mov eax, dword [ebp - 0x73c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
add esp, 0x18
push ebx
push ebx
lea ecx, [ebp - 0x730]
push ecx
push ebx
push str.LogonId
push eax
call edx
test eax, eax
jne 0x4b5827
cmp word [ebp - 0x730], si
je 0x4b5827
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x88]
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x4b57f6
lea eax, [ebp - 0x730]
push eax
call edi
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x48]
push 0x5270c4
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x7e
lea ecx, [ebp - 0x106]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x108], ax
call fcn.004e7d90
mov eax, dword [ebp - 0x73c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
add esp, 0xc
push ebx
push ebx
lea ecx, [ebp - 0x730]
push ecx
push ebx
push str.StartTime
push eax
call edx
test eax, eax
jne 0x4b588d
cmp word [ebp - 0x730], si
je 0x4b588d
mov eax, dword [ebp - 0x728]
push 0xe
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e4726
add esp, 0xc
lea edx, [ebp - 0x730]
push edx
call edi
mov eax, dword [ebp - 0x714]
push 0x400
push ebx
push eax
call fcn.004e7d90
mov eax, dword [ebp - 0x70c]
add esp, 0xc
lea edx, [ebp - 0x71c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_LoggedOnUser
mov dword [ebp - 0x71c], ebx
mov ecx, dword [eax]
push 0x526208
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x734], ebx
cmp eax, ebx
je 0x4b5c64
jmp 0x4b58eb
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, 1
cmp dword [ebp - 0x720], ebx
jne 0x4b5c64
mov ecx, dword [eax]
lea edx, [ebp - 0x734]
push edx
lea edx, [ebp - 0x740]
push edx
push esi
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x734], ebx
je 0x4b5ccc
push 0xfe
lea edx, [ebp - 0x706]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x708], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x740]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x730]
push edx
push ebx
push str.Dependent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b598a
cmp word [ebp - 0x730], si
je 0x4b598a
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x708]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b5972
lea ecx, [ebp - 0x730]
push ecx
call edi
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x708]
push eax
call fcn.004e49bf
add esp, 8
test eax, eax
je 0x4b5c4b
push 0xfe
lea edx, [ebp - 0x406]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x408], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x740]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x730]
push edx
push ebx
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b5a1c
cmp word [ebp - 0x730], 1
je 0x4b5a1c
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x408]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b5a00
lea ecx, [ebp - 0x730]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x408]
push 0x3d
push edx
call fcn.004e46a9
mov esi, eax
lea eax, [ebp - 0x408]
push 0x2c
push eax
call fcn.004e46a9
push 0xfe
lea edx, [ebp - 0x306]
xor ecx, ecx
push ebx
push edx
mov edi, eax
mov word [ebp - 0x308], cx
call fcn.004e7d90
push 0xfe
lea ecx, [ebp - 0x206]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x208], ax
call fcn.004e7d90
push 0xfe
lea eax, [ebp - 0x506]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x508], dx
call fcn.004e7d90
push 0xfe
lea edx, [ebp - 0x606]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x608], cx
call fcn.004e7d90
mov eax, edi
sub eax, esi
sar eax, 1
add esp, 0x40
sub eax, 3
push eax
add esi, 4
lea ecx, [ebp - 0x308]
push esi
push ecx
call fcn.004e4726
lea eax, [edi + 0xe]
lea edx, [ebp - 0x208]
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x4b5ad3
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
jmp 0x4b5af0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5af0
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x20a], dx
lea eax, [ebp - 0x308]
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5b14
sub eax, edx
sar eax, 1
je 0x4b5b66
jmp 0x4b5b30
movzx eax, word [ebp + esi*2 - 0x308]
push eax
call fcn.004e5c73
mov word [ebp + esi*2 - 0x508], ax
lea eax, [ebp - 0x308]
add esp, 4
inc esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5b53
sub eax, edx
sar eax, 1
cmp esi, eax
jb 0x4b5b30
lea eax, [ebp - 0x208]
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5b71
sub eax, edx
sar eax, 1
mov edi, eax
je 0x4b5bae
jmp 0x4b5b90
movzx ecx, word [ebp + esi*2 - 0x208]
push ecx
call fcn.004e5c73
mov word [ebp + esi*2 - 0x608], ax
inc esi
add esp, 4
cmp esi, edi
jb 0x4b5b90
mov esi, dword [ebp - 0x74c]
lea edx, [ebp - 0x508]
push edx
push esi
call fcn.004e49bf
add esp, 8
test eax, eax
je 0x4b5c4b
lea eax, [ebp - 0x608]
push eax
push esi
call fcn.004e49bf
add esp, 8
test eax, eax
je 0x4b5c4b
mov edx, dword [ebp - 0x750]
lea eax, [ebp - 0x308]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b5bf4
mov edx, dword [ebp - 0x744]
lea eax, [ebp - 0x208]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b5c13
mov edx, dword [ebp - 0x748]
lea eax, [ebp - 0x108]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b5c32
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x71c]
cmp eax, ebx
jne 0x4b58e0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, 1
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x718]
cmp eax, ebx
jne 0x4b5760
mov ecx, dword [ebp - 0x714]
push ecx
call fcn.004e424b
mov eax, dword [ebp - 0x718]
mov edx, dword [eax]
add esp, 4
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x70c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x710]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x71c]
jmp 0x4b5c64