Function at 0x416280
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b34ae
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x23c], esi
xor ebx, ebx
mov dword [ebp - 0x240], 0
push 0x1000
push ebx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x118], bl
mov byte [ebp - 0x220], bl
mov dword [ebp - 0x244], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x25c], eax
test eax, eax
je 0x4169ac
lea eax, [ebp - 0x240]
push eax
push 0x4c95ec
push 1
push ebx
push 0x4c95dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x416997
push 0xc
cmp dword [0x4d3fb0], ebx
je 0x4163a1
call fcn.004609df
mov esi, eax
add esp, 4
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x416381
push str.ROOTSecurityCenter2
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x4169f4
jmp 0x416383
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x224], esi
test esi, esi
je 0x4169fe
mov dword [ebp - 4], 1
jmp 0x4163ff
call fcn.004609df
mov esi, eax
add esp, 4
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], 2
test esi, esi
je 0x4163e1
push str.ROOTSecurityCenter
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x416a08
jmp 0x4163e3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x224], esi
test esi, esi
je 0x416a12
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x22c]
push edx
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push dword [esi]
push eax
call dword [ecx + 0xc]
mov edi, eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 8], eax
dec eax
jne 0x416466
mov eax, dword [esi]
test eax, eax
je 0x416444
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call eax
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41645b
push eax
call fcn.00460a0f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004609d1
add esp, 8
test edi, edi
jne 0x416991
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push dword [ebp - 0x22c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x416991
push 0xc
call fcn.004609df
mov esi, eax
add esp, 4
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], 4
test esi, esi
je 0x4164c1
push str.SELECT__FROM_AntiVirusProduct
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call fcn.004624d0
mov dword [esi], eax
jmp 0x4164c3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x224], esi
test esi, esi
je 0x416a1c
push 0xc
mov dword [ebp - 4], 5
call fcn.004609df
mov edi, eax
add esp, 4
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 6
test edi, edi
je 0x416515
push 0x4c27f8
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.004624d0
mov dword [edi], eax
jmp 0x416517
xor edi, edi
mov byte [ebp - 4], 5
mov dword [ebp - 0x230], edi
test edi, edi
je 0x416a26
lea edx, [ebp - 0x228]
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x22c]
push edx
push 0
push 0x30
push dword [esi]
mov ecx, dword [eax]
push dword [edi]
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x224], eax
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x41658e
mov eax, dword [edi]
test eax, eax
je 0x41656c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x416583
push eax
call fcn.00460a0f
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004609d1
add esp, 8
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4165d5
mov eax, dword [esi]
test eax, eax
je 0x4165b3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4165ca
push eax
call fcn.00460a0f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004609d1
add esp, 8
cmp dword [ebp - 0x224], 0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jne 0x41671e
mov ecx, dword [ebp - 0x228]
test ecx, ecx
je 0x416718
mov eax, dword [ecx]
lea edx, [ebp - 0x238]
push edx
lea edx, [ebp - 0x234]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x238], 0
je 0x416712
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x258]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push 0x4c27fc
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x416682
mov edx, dword [ebp - 0x250]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416650
sub ecx, esi
sar ecx, 1
add ebx, ecx
cmp ebx, 0x104
ja 0x416712
push 0x104
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.0048f122
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
call edi
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x258]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push str.productUptoDate
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x4166bc
movsx eax, word [ebp - 0x250]
mov dword [ebp - 0x244], eax
jmp 0x4166f9
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x258]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push str.productState
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x4166f9
mov eax, dword [ebp - 0x250]
xor ecx, ecx
and eax, 0x1010
cmp eax, 0x1010
sete cl
mov dword [ebp - 0x244], ecx
lea eax, [ebp - 0x258]
push eax
call edi
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x4165f6
jmp 0x416718
mov ecx, dword [ebp - 0x228]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 0xc
call fcn.004609df
mov esi, eax
add esp, 4
mov dword [ebp - 0x230], esi
mov dword [ebp - 4], 8
test esi, esi
je 0x416757
push str.SELECT__FROM_FireWallProduct
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004624d0
mov dword [esi], eax
jmp 0x416759
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x230], esi
test esi, esi
je 0x416a30
push 0xc
mov dword [ebp - 4], 9
call fcn.004609df
mov edi, eax
add esp, 4
mov dword [ebp - 0x224], edi
mov byte [ebp - 4], 0xa
test edi, edi
je 0x4167ab
push 0x4c27f8
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.004624d0
mov dword [edi], eax
jmp 0x4167ad
xor edi, edi
mov byte [ebp - 4], 9
mov dword [ebp - 0x224], edi
test edi, edi
je 0x416a3a
lea edx, [ebp - 0x228]
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x22c]
push edx
push 0
push 0x30
push dword [esi]
mov ecx, dword [eax]
push dword [edi]
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x224], eax
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x416824
mov eax, dword [edi]
test eax, eax
je 0x416802
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x416819
push eax
call fcn.00460a0f
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004609d1
add esp, 8
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x41686b
mov eax, dword [esi]
test eax, eax
je 0x416849
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416860
push eax
call fcn.00460a0f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004609d1
add esp, 8
cmp dword [ebp - 0x224], 0
jne 0x416933
mov ecx, dword [ebp - 0x228]
test ecx, ecx
je 0x41692d
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x238]
push edx
lea edx, [ebp - 0x234]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x238], 0
je 0x416927
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x258]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push 0x4c27fc
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x41690e
mov edx, dword [ebp - 0x250]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4168e0
sub ecx, esi
sar ecx, 1
add ebx, ecx
cmp ebx, 0x104
ja 0x416927
push 0x104
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.0048f122
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
call edi
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x416890
jmp 0x41692d
mov ecx, dword [ebp - 0x228]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [ebp - 0x118], 0
mov esi, dword [ebp - 0x23c]
je 0x41696f
lea eax, [ebp - 0x118]
push eax
push str.tpav_s
push esi
call fcn.00401a50
add esp, 0xc
add esi, eax
push dword [ebp - 0x244]
push str.tpavsts_d
push esi
call fcn.00401a50
add esp, 0xc
add esi, eax
cmp byte [ebp - 0x220], 0
je 0x416997
lea eax, [ebp - 0x220]
push eax
push str.tpfw_s
push esi
call fcn.00401a50
add esp, 0xc
add esi, eax
jmp 0x416997
mov esi, dword [ebp - 0x23c]
push dword [ebp - 0x25c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x4169c6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x22c], 0
mov edx, dword [ebp - 0x240]
test edx, edx
je 0x4169d6
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
push 0x8007000e
call fcn.00462250
int3