Function at 0x4100b0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x440008]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x24], 0
push 0x4386b0
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], str.vboxvideo
mov dword [esp + 0x18], str.VBoxVideoW8
mov dword [esp + 0x1c], str.VBoxWddm
call fcn.004126d0
add esp, 4
test eax, eax
je 0x4102c9
lea eax, [esp + 0x20]
push str.SELECT__FROM_Win32_NTEventlogFile
push eax
lea edx, [esp + 0x30]
lea ecx, [esp + 0x2c]
call fcn.004127f0
add esp, 8
test eax, eax
je 0x4102c9
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x48], esi
test ecx, ecx
je 0x4102a9
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jne 0x4102a9
mov eax, dword [ecx]
lea edx, [esp + 0x48]
push edx
lea edx, [esp + 0x20]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [esp + 0x48], esi
je 0x4102a5
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push esi
push esi
push edx
mov ecx, dword [eax]
push esi
push str.FileName
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x410282
mov ax, word [esp + 0x30]
cmp ax, 1
je 0x410282
test al, 8
je 0x41027b
push str.System
push dword [esp + 0x3c]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x41027b
lea eax, [esp + 0x30]
push eax
call edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push esi
push esi
push edx
mov ecx, dword [eax]
push esi
push str.Sources
push eax
call dword [ecx + 0x10]
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x40]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
js 0x41027b
lea eax, [esp + 0x50]
push eax
push 1
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea eax, [esp + 0x4c]
push eax
push 1
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov edi, dword [esp + 0x4c]
sub edi, dword [esp + 0x50]
inc edi
mov dword [esp + 0x44], esi
test edi, edi
jle 0x41026e
nop dword [eax]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x48]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
xor esi, esi
push dword [esp + esi*4 + 0x10]
push dword [esp + 0x30]
call fcn.0041aa01
add esp, 8
test eax, eax
je 0x41029a
inc esi
cmp esi, 3
jb 0x410243
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, edi
jl 0x410230
mov esi, dword [esp + 0xc]
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x30]
push eax
call edi
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x410156
jmp 0x4102a9
mov esi, 1
mov dword [esp + 0xc], esi
jmp 0x41026e
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x24]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x28]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041396d
mov esp, ebp
pop ebp
ret