Function at 0x41b544
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx], 0x48e485
push ebx
add ebx, 4
push ebx
push 8
call fcn.004790b3
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.004790b3
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x20], 0
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 0x24], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.004790b3
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
push 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], 0
push 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x41b711
push ebx
call fcn.004790b9
add esp, 4
cmp dword [ebp - 0x50], 0
jne 0x41b725
mov eax, 0x48e230
jmp 0x41c2c1
mov dword [ebp - 0x3c], esp
push 0
xor eax, eax
call dword [sym.imp.ole32.dll_CoInitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41b753
push 0xa8
push 0x402dba4
push 6
call fcn.004790bf
add esp, 0xc
push 0
push 0
push 0
push VariantClear
push 0
push str.WbemScripting.SWbemLocator
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x91c
call fcn.0047dc80
add esp, 0x28
push 0x10030
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x928
call fcn.0047de80
add esp, 0x10
test eax, eax
je 0x41b7d8
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41b7ce
push 0x161
push 0x402dba4
push 6
call fcn.004790bf
add esp, 0xc
mov eax, 0x48e230
jmp 0x41c2c1
push VariantClear
push 0
push str.rootCIMV2
push VariantClear
push 0
push 0x48e6f4
push VariantClear
push 0
push str.ConnectServer
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x34
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0xc]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x10030
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x928
call fcn.0047de80
add esp, 0x10
test eax, eax
je 0x41b89d
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41b893
push 0x275
push 0x402dba4
push 6
call fcn.004790bf
add esp, 0xc
mov eax, 0x48e230
jmp 0x41c2c1
push VariantClear
push 0
push str.SELECT__FROM_Win32_Process
push VariantClear
push 0
push str.ExecQuery
push 0x10030
push 0
push dword [ebp - 0xc]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push 0x10030
push 0
push dword [ebp - 0x10]
push 1
mov ebx, 0x928
call fcn.0047de80
add esp, 0x10
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x41c206
push 0
push 0
push 0
push VariantClear
push 0
push str._NewEnum
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x940
call fcn.0047e090
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x14]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Count
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x934
call fcn.0047de90
add esp, 0x28
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
fld qword [ebp - 0x40]
fsub qword [0x48e965]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
call fcn.004016fe
push eax
lea eax, [ebp - 0x18]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x41c1af
lea eax, [ebp - 0x14]
push eax
call fcn.0041c3ec
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041c441
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x3c]
call fcn.0041c48f
push 0x80000301
push 0
push dword [ebp - 0x18]
push 0x10031
push 0
push dword [ebp - 0x1c]
push 2
mov ebx, 0x9a0
call fcn.0047ecb0
add esp, 0x1c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x24]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x24], eax
push 0x10030
push 0
push dword [ebp - 0x24]
push 1
mov ebx, 0x928
call fcn.0047de80
add esp, 0x10
test eax, eax
je 0x41ba8e
jmp 0x41c1a6
push 0
push 0
push 0
push VariantClear
push 0
push str.Properties_
push 0x10030
push 0
push dword [ebp - 0x24]
push 3
mov ebx, 0x940
call fcn.0047e090
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x28]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
push 0x10030
push 0
push dword [ebp - 0x28]
push 1
mov ebx, 0x928
call fcn.0047de80
add esp, 0x10
test eax, eax
je 0x41bb13
jmp 0x41c1a6
push VariantClear
push 0
push str.ProcessId
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e1d0
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x994
call fcn.0047ec30
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
fld qword [ebp - 0x48]
call fcn.004016fe
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x41c16e
push VariantClear
push 0
push str.ExecutablePath
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e1d0
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x990
call fcn.0047eb50
add esp, 0x1c
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
lea eax, [ebp - 0x44]
push eax
call fcn.00403cba
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x41bced
push ebx
call fcn.004790b9
add esp, 4
mov eax, dword [ebp - 0x48]
push eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41bd01
push ebx
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x30], eax
push 0x48e230
push dword [ebp - 0x30]
call fcn.004012b1
add esp, 8
cmp eax, 0
jne 0x41bd41
push dword [ebp - 0x2c]
call fcn.0041c4c7
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41bd3d
push ebx
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x30], eax
push 0x80000301
push 0
push dword [ebp - 0x38]
push 1
mov ebx, 0x168
call fcn.0047aeb0
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x41bd74
push ebx
call fcn.004790b9
add esp, 4
pop eax
mov dword [ebp - 0x34], eax
push str._.pid
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401255
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
cdq
push edx
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x108]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41bdc2
push ebx
call fcn.004790b9
add esp, 4
push str._.name
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401255
add esp, 0xc
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
push str.Name
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x40]
push 3
mov ebx, 0x944
call fcn.0047e1d0
add esp, 0x28
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x44]
push 2
mov ebx, 0x990
call fcn.0047eb50
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
lea eax, [ebp - 0x48]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41bedd
push ebx
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41beed
push ebx
call fcn.004790b9
add esp, 4
push str._.path
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401255
add esp, 0xc
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41bf35
push ebx
call fcn.004790b9
add esp, 4
push str._.cmd
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401255
add esp, 0xc
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
push str.CommandLine
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x40]
push 3
mov ebx, 0x944
call fcn.0047e1d0
add esp, 0x28
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x44]
push 2
mov ebx, 0x990
call fcn.0047eb50
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
lea eax, [ebp - 0x48]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41c050
push ebx
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41c060
push ebx
call fcn.004790b9
add esp, 4
push VariantClear
push 0
push str.Name
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e3f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e1d0
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x990
call fcn.0047eb50
add esp, 0x1c
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
push str.Battle.net.exe
push dword [ebp - 0x44]
call fcn.004012b1
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x41c161
push ebx
call fcn.004790b9
add esp, 4
cmp dword [ebp - 0x48], 0
je 0x41c16b
inc dword [ebp - 0x38]
push 0x10030
push 0
push dword [ebp - 0x28]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x24]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x41b9d8
add esp, 0xc
push 0x10031
push 0
push dword [ebp - 0x1c]
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x14]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x10]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41c267
push 0xec8
push 0x402dba4
push 6
call fcn.004790bf
add esp, 0xc
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x50]
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41c2b9
push ebx
call fcn.004790b9
add esp, 4
mov eax, dword [ebp - 0x4c]
jmp 0x41c2c1
push eax
mov ebx, dword [ebp - 4]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb30
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x24]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x28]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047de60
add esp, 0x10
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41c3d7
push ebx
call fcn.004790b9
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x41c3e7
push ebx
call fcn.004790b9
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret