Function at 0x421ac0
Capabilities:
Connect to wmi namespace via wbemlocator
Get hostname
Query or enumerate registry value
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5722f1
mov eax, dword fs:[0]
push eax
sub esp, 0x750
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x6f0], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x421b2b
cmp eax, 0x80010119
jne 0x422201
mov dword [ebp - 0x6ec], 0
lea eax, [ebp - 0x6ec]
mov dword [ebp - 4], 0
push eax
push 0x587110
push 1
push 0
push 0x5871e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4221ea
mov dword [ebp - 0x6f8], 0
mov edi, dword [ebp - 0x6ec]
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x704], esi
lea ecx, [ebp - 0x6f8]
mov byte [ebp - 4], 2
mov eax, dword [edi]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [eax + 0xc]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x4221d6
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x6f8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4221d6
mov ecx, 0x1b
mov dword [ebp - 0x6ac], 0x596c60
mov dword [ebp - 0x6a8], str.SoftwareElementID
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], str.SELECT__FROM_Win32_Processor_WHERE__ProcessorId_IS_NOT_NULL_
mov dword [ebp - 0x69c], str.ProcessorId
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], str.SELECT__FROM_Win32_DiskDrive_WHERE__PNPDeviceID_IS_NOT_NULL__AND__NOT__InterfaceType__USB__
mov dword [ebp - 0x690], str.Signature
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], str.SELECT__FROM_Win32_NetworkAdapter_WHERE__MACAddress_IS_NOT_NULL__AND__NOT__PNPDeviceID_LIKE_ROOT___
mov dword [ebp - 0x684], str.MACAddress
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x67c], str.SELECT__FROM_Win32_BaseBoard_WHERE__SerialNumber_IS_NOT_NULL_
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], str.SELECT__FROM_Win32_OperatingSystem
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x664], str.SELECT__FROM_Win32_PhysicalMemory
mov dword [ebp - 0x660], str.PartNumber
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], str.SELECT__FROM_Win32_UserAccount
mov dword [ebp - 0x654], 0x5970b8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], str.SELECT__FROM_Win32_SoundDevice_WHERE__PNPDeviceID_IS_NOT_NULL_
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x6fc], eax
cmp eax, ecx
jge 0x4221d6
mov dword [ebp - 0x6e8], 0
mov eax, dword [ebp + eax*4 - 0x6ac]
mov ebx, dword [ebp - 0x6f8]
test eax, eax
jne 0x421d1b
xor edi, edi
jmp 0x421d24
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x6e4], edi
push 3
push 0x597140
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 5
mov eax, dword [ebx]
push ecx
push 0
push 0x30
push edi
push esi
push ebx
call dword [eax + 0x50]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
push edi
call esi
mov eax, dword [ebp - 0x6e8]
test ebx, ebx
js 0x4221ae
test eax, eax
je 0x4221ae
xor ecx, ecx
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
mov word [ebp - 0x6c4], cx
mov byte [ebp - 4], 6
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x421db0
test eax, eax
je 0x42212e
mov dword [ebp - 0x6e4], 0
lea edx, [ebp - 0x700]
mov dword [ebp - 0x700], 0
push edx
lea edx, [ebp - 0x6e4]
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov dword [ebp - 4], 7
test eax, eax
mov eax, dword [ebp - 0x6e4]
js 0x422120
test eax, eax
je 0x422120
cmp dword [ebp - 0x700], 0
je 0x422120
push 2
push 0x597144
lea ecx, [ebp - 0x6c4]
call fcn.0041c0b0
lea eax, [ebp - 0x71c]
mov byte [ebp - 0x6dd], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.SerialNumber
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xb
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x421ea3
cmp word [ebp - 0x71c], 8
jne 0x421ea3
mov eax, dword [ebp - 0x714]
test eax, eax
je 0x421ea3
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xb
push str.PNPDeviceID
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0xd
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xc
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x421f1b
cmp word [ebp - 0x72c], 8
jne 0x421f1b
mov eax, dword [ebp - 0x724]
test eax, eax
je 0x421f1b
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
mov byte [ebp - 0x6dd], 1
mov esi, dword [ebp - 0x6fc]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [ebp + esi*4 - 0x6a8]
test esi, esi
je 0x421f8d
lea eax, [ebp - 0x75c]
push eax
call edi
push 0
push 0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x75c]
mov eax, dword [ebp - 0x6e4]
push edx
push 0
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x421f84
cmp word [ebp - 0x75c], 8
jne 0x421f84
mov eax, dword [ebp - 0x754]
test eax, eax
je 0x421f84
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x75c]
push eax
call ebx
cmp byte [ebp - 0x6dd], 0
je 0x4220aa
lea eax, [ebp - 0x73c]
push eax
call edi
mov edi, dword [ebp - 0x6e4]
push 4
push 0x597168
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0x10
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x422017
cmp word [ebp - 0x73c], 8
jne 0x422017
mov eax, dword [ebp - 0x734]
test eax, eax
je 0x422017
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
push 0x597170
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.Manufacturer
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 0x12
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0x11
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x422098
cmp word [ebp - 0x74c], 8
jne 0x422098
mov eax, dword [ebp - 0x744]
test eax, eax
je 0x422098
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
push 0x597170
lea ecx, [ebp - 0x6c4]
call fcn.0041b8e0
lea eax, [ebp - 0x74c]
push eax
call ebx
lea eax, [ebp - 0x73c]
push eax
call ebx
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp + eax*4 - 0x6a4], 0
lea eax, [ebp - 0x72c]
push eax
jne 0x4220d8
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
jmp 0x422124
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
test eax, eax
jne 0x4220fc
mov eax, dword [ebp - 0x6e8]
jmp 0x421db0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6e8]
jmp 0x421db0
mov byte [ebp - 4], 6
test eax, eax
je 0x42212e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov ecx, ebx
push 0x597184
call fcn.0041b8e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c4]
mov ecx, ebx
push eax
call fcn.0041c7e0
cmp dword [ebp - 0x6b0], 8
jb 0x422169
push dword [ebp - 0x6c4]
call fcn.0053ba8c
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x6c4], ax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
test eax, eax
je 0x4221c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421cee
mov byte [ebp - 4], 1
test eax, eax
je 0x4221bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421cee
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6f8]
test eax, eax
je 0x4221ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6ec]
test eax, eax
je 0x422201
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebx + 0x10], 0
jne 0x42242e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push eax
call fcn.0053ca90
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x6e8]
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0x597188
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4222a3
cmp word [ebp - 0x224], ax
je 0x4222a3
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422280
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004203d0
jmp 0x42239c
push str.IsWow64Process
push 0x5946b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x6ec], 0
test esi, esi
je 0x42239c
lea eax, [ebp - 0x6ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x42239c
cmp dword [ebp - 0x6ec], 0
je 0x42239c
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42239c
mov esi, dword [ebp - 0x6ec]
test esi, esi
je 0x42239c
push 0x208
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0x597188
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422390
cmp word [ebp - 0x224], ax
je 0x422390
lea eax, [ebp - 0x224]
mov ecx, ebx
push eax
call fcn.0041b870
push dword [ebp - 0x6ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x63c], ax
lea eax, [ebp - 0x63a]
push eax
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x6e4], 1
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], 0x206
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x6e4]
push eax
push str.Default_User_ID
push str.Identities
push SysReAllocString
call edi
test eax, eax
jne 0x42242e
cmp word [ebp - 0x63c], ax
je 0x42242e
lea ecx, [ebp - 0x63c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422410
sub ecx, edx
lea eax, [ebp - 0x63c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004203d0
mov dword [ebp - 0x6c8], 0xf
mov dword [ebp - 0x6cc], 0
mov byte [ebp - 0x6dc], 0
lea eax, [ebp - 0x6dc]
mov dword [ebp - 4], 0x13
push eax
mov byte [ebp - 4], 0x14
call fcn.004217d0
jmp 0x42246e
mov dword [ebp - 4], 0x13
lea edx, [ebp - 0x6dc]
cmp dword [ebp - 0x6c8], 0x10
lea ecx, [ebp - 0x6c4]
cmovae edx, dword [ebp - 0x6dc]
call fcn.004145d0
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x16
call fcn.0041c7e0
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x6b0], 8
jb 0x4224bf
push dword [ebp - 0x6c4]
call fcn.0053ba8c
add esp, 4
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x434], ax
lea eax, [ebp - 0x432]
push eax
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x708], 0x104
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x434]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp word [ebp - 0x434], 0
jne 0x42250b
xor ecx, ecx
jmp 0x422523
lea ecx, [ebp - 0x434]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422514
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x434]
mov ecx, ebx
push eax
call fcn.0041c0b0
cmp dword [ebp - 0x6c8], 0x10
jb 0x422549
push dword [ebp - 0x6dc]
call fcn.0053ba8c
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4