Function at 0x4b4110
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x754
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x750], eax
mov eax, edi
mov dword [ebp - 0x748], edx
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x74c], edi
lea edx, [eax + 2]
xor ebx, ebx
jmp 0x4b4150
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b4150
sub eax, edx
sar eax, 1
je 0x4b4285
mov eax, edi
xor esi, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b4170
sub eax, edx
sar eax, 1
je 0x4b41b3
movzx eax, word [edi + esi*2]
push eax
call fcn.004e6ab9
mov word [edi + esi*2], ax
mov eax, edi
add esp, 4
inc esi
lea edx, [eax + 2]
jmp 0x4b41a0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b41a0
sub eax, edx
sar eax, 1
cmp esi, eax
jb 0x4b4181
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x568461], bl
je 0x4b4285
lea ecx, [ebp - 0x710]
push ecx
push 0x5020f8
mov esi, 1
push esi
push ebx
push 0x5021c8
mov dword [ebp - 0x710], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4b427f
mov eax, dword [ebp - 0x710]
lea ecx, [ebp - 0x70c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x70c], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push str.ROOTCIMV2
push eax
call edx
test eax, eax
js 0x4b4271
mov eax, dword [ebp - 0x70c]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x70c]
js 0x4b4269
lea edx, [ebp - 0x718]
push edx
push ebx
push 0x30
push str.SELECT_LogonId_StartTime_FROM_Win32_LogonSession_WHERE_LogonType__2
mov dword [ebp - 0x718], ebx
mov ecx, dword [eax]
push 0x52550c
push eax
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jns 0x4b4298
mov eax, dword [ebp - 0x70c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x710]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push 0x400
mov dword [ebp - 0x720], ebx
mov dword [ebp - 0x738], ebx
call fcn.004e5420
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x718]
add esp, 4
cmp eax, ebx
je 0x4b47ea
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4b42d0
cmp dword [ebp - 0x720], ebx
jne 0x4b47ea
mov ecx, dword [eax]
lea edx, [ebp - 0x738]
push edx
lea edx, [ebp - 0x73c]
push edx
push esi
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x738], ebx
je 0x4b47ea
push 0x3e
lea edx, [ebp - 0x86]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x88], cx
call fcn.004e8ba0
push 0x3e
lea ecx, [ebp - 0x46]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x48], ax
call fcn.004e8ba0
mov eax, dword [ebp - 0x73c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
add esp, 0x18
push ebx
push ebx
lea ecx, [ebp - 0x730]
push ecx
push ebx
push str.LogonId
push eax
call edx
test eax, eax
jne 0x4b4397
cmp word [ebp - 0x730], si
je 0x4b4397
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x88]
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x4b4366
lea eax, [ebp - 0x730]
push eax
call edi
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x48]
push 0x526afc
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x7e
lea ecx, [ebp - 0x106]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x108], ax
call fcn.004e8ba0
mov eax, dword [ebp - 0x73c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
add esp, 0xc
push ebx
push ebx
lea ecx, [ebp - 0x730]
push ecx
push ebx
push str.StartTime
push eax
call edx
test eax, eax
jne 0x4b43fd
cmp word [ebp - 0x730], si
je 0x4b43fd
mov eax, dword [ebp - 0x728]
push 0xe
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e5481
add esp, 0xc
lea edx, [ebp - 0x730]
push edx
call edi
mov eax, dword [ebp - 0x714]
push 0x400
push ebx
push eax
call fcn.004e8ba0
mov eax, dword [ebp - 0x70c]
add esp, 0xc
lea edx, [ebp - 0x71c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_LoggedOnUser
mov dword [ebp - 0x71c], ebx
mov ecx, dword [eax]
push 0x52550c
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x734], ebx
cmp eax, ebx
je 0x4b47d4
jmp 0x4b445b
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, 1
cmp dword [ebp - 0x720], ebx
jne 0x4b47d4
mov ecx, dword [eax]
lea edx, [ebp - 0x734]
push edx
lea edx, [ebp - 0x740]
push edx
push esi
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x734], ebx
je 0x4b483c
push 0xfe
lea edx, [ebp - 0x706]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x708], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x740]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x730]
push edx
push ebx
push str.Dependent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b44fa
cmp word [ebp - 0x730], si
je 0x4b44fa
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x708]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b44e2
lea ecx, [ebp - 0x730]
push ecx
call edi
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x708]
push eax
call fcn.004e571a
add esp, 8
test eax, eax
je 0x4b47bb
push 0xfe
lea edx, [ebp - 0x406]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x408], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x740]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x730]
push edx
push ebx
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b458c
cmp word [ebp - 0x730], 1
je 0x4b458c
mov eax, dword [ebp - 0x728]
lea edx, [ebp - 0x408]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b4570
lea ecx, [ebp - 0x730]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x408]
push 0x3d
push edx
call fcn.004e53f9
mov esi, eax
lea eax, [ebp - 0x408]
push 0x2c
push eax
call fcn.004e53f9
push 0xfe
lea edx, [ebp - 0x306]
xor ecx, ecx
push ebx
push edx
mov edi, eax
mov word [ebp - 0x308], cx
call fcn.004e8ba0
push 0xfe
lea ecx, [ebp - 0x206]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x208], ax
call fcn.004e8ba0
push 0xfe
lea eax, [ebp - 0x506]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x508], dx
call fcn.004e8ba0
push 0xfe
lea edx, [ebp - 0x606]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x608], cx
call fcn.004e8ba0
mov eax, edi
sub eax, esi
sar eax, 1
add esp, 0x40
sub eax, 3
push eax
add esi, 4
lea ecx, [ebp - 0x308]
push esi
push ecx
call fcn.004e5481
lea eax, [edi + 0xe]
lea edx, [ebp - 0x208]
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x4b4643
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
jmp 0x4b4660
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b4660
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x20a], dx
lea eax, [ebp - 0x308]
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b4684
sub eax, edx
sar eax, 1
je 0x4b46d6
jmp 0x4b46a0
movzx eax, word [ebp + esi*2 - 0x308]
push eax
call fcn.004e6ab9
mov word [ebp + esi*2 - 0x508], ax
lea eax, [ebp - 0x308]
add esp, 4
inc esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b46c3
sub eax, edx
sar eax, 1
cmp esi, eax
jb 0x4b46a0
lea eax, [ebp - 0x208]
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b46e1
sub eax, edx
sar eax, 1
mov edi, eax
je 0x4b471e
jmp 0x4b4700
movzx ecx, word [ebp + esi*2 - 0x208]
push ecx
call fcn.004e6ab9
mov word [ebp + esi*2 - 0x608], ax
inc esi
add esp, 4
cmp esi, edi
jb 0x4b4700
mov esi, dword [ebp - 0x74c]
lea edx, [ebp - 0x508]
push edx
push esi
call fcn.004e571a
add esp, 8
test eax, eax
je 0x4b47bb
lea eax, [ebp - 0x608]
push eax
push esi
call fcn.004e571a
add esp, 8
test eax, eax
je 0x4b47bb
mov edx, dword [ebp - 0x750]
lea eax, [ebp - 0x308]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b4764
mov edx, dword [ebp - 0x744]
lea eax, [ebp - 0x208]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b4783
mov edx, dword [ebp - 0x748]
lea eax, [ebp - 0x108]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b47a2
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x71c]
cmp eax, ebx
jne 0x4b4450
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, 1
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x718]
cmp eax, ebx
jne 0x4b42d0
mov ecx, dword [ebp - 0x714]
push ecx
call fcn.004e577a
mov eax, dword [ebp - 0x718]
mov edx, dword [eax]
add esp, 4
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x70c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x710]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x71c]
jmp 0x4b47d4