Function at 0x427489
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x350
mov eax, 0x4621a8
call fcn.0043c4da
mov eax, ecx
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x340], eax
xor ebx, ebx
mov dword [ebp - 0x35c], eax
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x358], ebx
push ebx
push eax
call fcn.0043e920
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push str._______invalid_file_path
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x42753e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.GetVolumePathName___failed
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.004062f0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
movzx eax, si
push edi
or eax, 0x80070000
test esi, esi
push 0x8d5
push str.srcupdtSHIMEnum.cpp
cmovle eax, esi
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00422738
push 0x487c98
lea eax, [ebp - 0x2e4]
push eax
call fcn.00440ad9
lea eax, [ebp - 0x21c]
push eax
call fcn.00446deb
pop ecx
test eax, eax
jne 0x42757b
push str.GetVolumePathName___returned_empty_drive_letter._Unable_to_proceed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov dword [ebp - 4], 2
push 0x8da
mov edx, str.srcupdtSHIMEnum.cpp
lea ecx, [ebp - 0x234]
call fcn.004023ea
push 2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x314]
call fcn.00406321
mov dword [ebp - 4], 3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 4
test eax, eax
jns 0x4275db
push str.COM_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x340]
push 1
push 0x8e7
push str.srcupdtSHIMEnum.cpp
call fcn.00420973
jmp 0x42751a
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jns 0x427660
cmp esi, 0x80010119
jne 0x4276a8
lea ecx, [ebp - 0x2fc]
call fcn.00406224
mov esi, eax
mov byte [ebp - 4], 6
mov edx, str.It_is_too_late_for_CoInitializeSecurity__trying_to_proceed_anyway.
mov ecx, esi
call fcn.0040c870
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.0040620b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x234]
call fcn.00406259
push 2
mov edx, eax
pop ecx
call fcn.0041dcb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x234]
call fcn.00406270
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.0040266e
mov dword [ebp - 0x334], ebx
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x334]
push eax
push 0x46fea4
xor edi, edi
inc edi
push edi
push ebx
push 0x46fe94
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x4276ce
push str.CoCreateInstance___failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0xb
push edi
push 0x912
jmp 0x4276c3
push str.COM_security_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 8
push 1
push 0x904
push str.srcupdtSHIMEnum.cpp
push esi
jmp 0x42751b
mov dword [ebp - 0x320], ebx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x318]
mov ebx, dword [ebp - 0x334]
push str.ROOTCIMV2
call fcn.004273a8
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
test eax, eax
je 0x4276fc
mov eax, dword [eax]
jmp 0x4276fe
xor eax, eax
mov esi, dword [ebx]
lea ecx, [ebp - 0x320]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ebx
call dword [0x463290]
call dword [esi + 0xc]
mov esi, eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x42773c
call fcn.0042743c
xor ebx, ebx
mov dword [ebp - 0x318], ebx
jmp 0x42773e
xor ebx, ebx
test esi, esi
jns 0x427761
push str.ConnectServer___failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0xf
push edi
push 0x923
jmp 0x4276c3
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x320]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x42779c
push str.CoSetProxyBlanket___failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x10
push edi
push 0x934
jmp 0x4276c3
push str.ASSOCIATORS_OF_Win32_LogicalDisk.DeviceID
lea ecx, [ebp - 0x264]
call fcn.004062f0
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x314]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x264]
call fcn.0040a4b8
mov esi, str._WHERE_AssocClass__Win32_LogicalDiskToPartition
push esi
call fcn.004012d2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.0040a414
mov dword [ebp - 0x330], ebx
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x264]
mov ebx, dword [ebp - 0x320]
call fcn.00406259
push eax
lea ecx, [ebp - 0x31c]
call fcn.004273a8
mov esi, eax
mov byte [ebp - 4], 0x14
push ecx
lea ecx, [ebp - 0x318]
call fcn.0042734c
mov byte [ebp - 4], 0x15
mov ecx, dword [esi]
test ecx, ecx
je 0x427825
mov ecx, dword [ecx]
jmp 0x427827
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x427831
mov eax, dword [eax]
jmp 0x427833
xor eax, eax
mov esi, dword [ebx]
lea edx, [ebp - 0x330]
push edx
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push eax
push ebx
call dword [0x463290]
call dword [esi + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x42786e
call fcn.0042743c
xor ebx, ebx
mov dword [ebp - 0x318], ebx
jmp 0x427870
xor ebx, ebx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
je 0x427889
call fcn.0042743c
mov dword [ebp - 0x31c], ebx
test esi, esi
jns 0x4278ac
push 0x47dd6c
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x16
push edi
push 0x946
jmp 0x4276c3
mov dword [ebp - 0x32c], ebx
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], ebx
test eax, eax
je 0x427de4
mov esi, dword [eax]
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x32c]
push ecx
mov ecx, dword [esi + 0x10]
push edi
push 0xffffffffffffffff
push eax
call dword [0x463290]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
jns 0x42790f
push str.Enumeration_failed
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x19
push edi
push 0x952
jmp 0x4276c3
cmp dword [ebp - 0x338], 0
jne 0x427936
push str.Empty_response_for_DiskToPartition_mapping
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x1a
push 0x957
jmp 0x42756b
push 0x10
lea eax, [ebp - 0x350]
push ebx
push eax
call fcn.0043e920
add esp, 0xc
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x324]
mov ebx, dword [ebp - 0x32c]
push str.DeviceID
call fcn.004273a8
mov byte [ebp - 4], 0x1c
mov eax, dword [eax]
test eax, eax
je 0x42797d
mov eax, dword [eax]
jmp 0x42797f
xor eax, eax
mov esi, dword [ebx]
lea ecx, [ebp - 0x350]
push 0
push 0
push ecx
mov ecx, dword [esi + 0x10]
push 0
push eax
push ebx
call dword [0x463290]
call dword [esi + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x4279b8
call fcn.0042743c
and dword [ebp - 0x324], 0
test esi, esi
jns 0x4279db
push str.Cant_get_DeviceID
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x1d
push edi
push 0x95e
jmp 0x4276c3
push 8
pop eax
cmp word [ebp - 0x350], ax
jne 0x427e02
cmp dword [ebp - 0x348], 0
je 0x427e02
mov esi, str.Associators_of_Win32_DiskPartition.DeviceID
push esi
call fcn.004012d2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.00408ab3
push dword [ebp - 0x348]
call fcn.004012d2
pop ecx
push eax
push dword [ebp - 0x348]
lea ecx, [ebp - 0x264]
call fcn.0040a414
mov esi, str._where_ResultClassWin32_DiskDrive
push esi
call fcn.004012d2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.0040a414
and dword [ebp - 0x318], 0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x264]
mov ebx, dword [ebp - 0x320]
call fcn.00406259
push eax
lea ecx, [ebp - 0x328]
call fcn.004273a8
mov esi, eax
mov byte [ebp - 4], 0x21
push ecx
lea ecx, [ebp - 0x324]
call fcn.0042734c
mov byte [ebp - 4], 0x22
mov ecx, dword [esi]
test ecx, ecx
je 0x427a90
mov ecx, dword [ecx]
jmp 0x427a92
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x427a9c
mov eax, dword [eax]
jmp 0x427a9e
xor eax, eax
mov esi, dword [ebx]
lea edx, [ebp - 0x318]
push edx
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push eax
push ebx
call dword [0x463290]
call dword [esi + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x427ad9
call fcn.0042743c
xor ebx, ebx
mov dword [ebp - 0x324], ebx
jmp 0x427adb
xor ebx, ebx
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x427af4
call fcn.0042743c
mov dword [ebp - 0x328], ebx
test esi, esi
jns 0x427b17
push 0x47dd6c
lea ecx, [ebp - 0x234]
call fcn.004062f0
mov byte [ebp - 4], 0x23
push edi
push 0x979
jmp 0x4276c3
mov dword [ebp - 0x31c], ebx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x33c], ebx
test eax, eax
je 0x427db7
mov esi, dword [eax]
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x31c]
push ecx
mov ecx, dword [esi + 0x10]
push edi
push 0xffffffffffffffff
push eax
call dword [0x463290]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
jns 0x427b86
push str.Enumeration_failed
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x26
push edi
push 0x984
push str.srcupdtSHIMEnum.cpp
push esi
lea eax, [ebp - 0x24c]
jmp 0x427521
cmp dword [ebp - 0x33c], 0
jne 0x427bb8
push str.Empty_response_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x27
push 0x989
mov edx, str.srcupdtSHIMEnum.cpp
lea ecx, [ebp - 0x24c]
jmp 0x427576
push 0x10
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.0043e920
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x328]
mov ebx, dword [ebp - 0x31c]
push str.SerialNumber
call fcn.004273a8
mov byte [ebp - 4], 0x29
mov eax, dword [eax]
test eax, eax
je 0x427bff
mov eax, dword [eax]
jmp 0x427c01
xor eax, eax
mov esi, dword [ebx]
lea ecx, [ebp - 0x22c]
push 0
push 0
push ecx
mov ecx, dword [esi + 0x10]
push 0
push eax
push ebx
call dword [0x463290]
call dword [esi + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x427c3a
call fcn.0042743c
and dword [ebp - 0x328], 0
test esi, esi
jns 0x427c5d
push str.Cant_get_SerialNumber
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x2a
push edi
push 0x990
jmp 0x427b75
push 8
pop eax
cmp word [ebp - 0x22c], ax
jne 0x427d99
cmp dword [ebp - 0x224], 0
je 0x427d99
push dword [ebp - 0x224]
mov ebx, dword [ebp - 0x354]
mov ecx, ebx
call fcn.004062f0
mov dword [ebp - 0x358], edi
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x427cc2
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x427ce0
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x427d0f
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x330]
test eax, eax
je 0x427d2d
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x264]
call fcn.00406270
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x427d5a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x427d78
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x463290]
call esi
mov byte [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x314]
call fcn.00406270
mov eax, ebx
call fcn.0043c484
ret
push str.No_SerialNumber_found_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x2b
push 0x995
jmp 0x427ba8
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x31c]
call fcn.00427e20
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x318]
call fcn.00427e20
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x350]
call fcn.00427481
push str.WMI_query_failed
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x32
push 0x99c
jmp 0x427ba8
push str.No_DeviceID_found_in_DiskToPartition_mapping
lea ecx, [ebp - 0x24c]
call fcn.004062f0
mov byte [ebp - 4], 0x1e
push 0x963
jmp 0x427ba8