Function at 0x403d20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414310
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x465148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 0x4158a6
lea eax, [ebp + 8]
push eax
call fcn.00401060
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x403d8d
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d20
mov al, byte [ebp - 0x11]
jmp 0x403e53
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp + 8]
push edx
call fcn.00401910
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
push str.Name
push 0x4158a7
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], str.5M1pHD8LOma5YP3eDsfgAwymdbA8UCuXeHrOH4aynwz0qm01uLJoCrYoJ9n7lRtfHQ9EEkFUP8PSboDDDQYKIESncBRO0btwxYjAlcMpgjMIveGD3vlXxlrdnrQWMX4rbqXLNKhKGdDtsW1de75a11vW7BtbovUkF55MmozSd4X0PuDjbCkUjszVd9j7fTScvtuFyPHXUdM9eBIyry5dTQJByagky3VNJDSUfbokS4uHYRwh32jxvENHYRFkiG9yUfTtxNWwh5PqcHvwAIMP7F96ougAeqOC7v3INqnjcOY0Jmf28UeqX3OUEq9yOEjPUfIxE5fDNVv6fRqfgreczfvrG3OAnBbJqObe0bRFh8lj9aUi6IfoJ4xdqUb2Vk6zgdDw2o6KNcOdzWI3fKFKvASVNyvahIQiyV9E9Kuty0FiuMX4R8Ltbi9uMFseXuqyX8Ei4EeALv22A2VACYGclWA3kY7pncUICu1xIK74FIoQlV2zE3s1QE5TqiVQycyQfhXXn5C5vLE7XuPGFF2tOQaA6vJFpGII0l9BwYQ1xO79tB1jSHezBh1PlBMSxIULB75VS7xs38rdDVqu0CLKQ3qydDHxn9ObjBaRwv5bj4HzW141fugWtxRUJIty3DePOpHNIttaE0ooKc1lnUbvExpe04yRuH5iqFSA2FpBotkO4EyFE7VeP6O35WHkqHsQR9Oug5aTR2KUJo6QSQNoGBr85K7KgNzut9rfw2GDrklLlfavkuWIeNjo6ToUg0MS1zD5a9zCt74lgSrTOXqnEJ40gUtxp6CqOTaCNp3RmbnABML2GObYuN1kJoJisLHdJbEYj7Yyup4qgg6AL65DuI5TF2VOUvP363EHQTR6iLkGStwXqvOQHvQuexcH5AUpMIANPGR8cjLdSojhwi3Bpxx4CM4s1c2vbXMKWNKrE9kJtOPjsghmcw1M3FsAwfngbbqr8OW49tpYznCz9QT0RtK1JbGxbzjgchCgBHye7zKDUwli01dQxKUlUmtGmMiO9Nm1PGgk5Nwi0yNmXkoJy2hxPoSoakYWvQxYApp1yAfx2AVotVwSykfALtqXtu8nd6TTQL074rQT4yQIwxz1rXTE1UWEVmEwJN8VT1FE9XEQQeMmzsoglCV8R5KEXSBu6NKIiJGRnNoQWd52DyIgHiGBCrt8JPa8MwfmPPXdiI9gEVgbehd4diaRDwbdcNEXOUUmzy3jwwqq4DXUnFocOgWVgVhW3czeJAYKSs91D86D1q16CkFBJdlXPoCmMgvQBGzWkp5oiwra6cke3qmJtpeoKDprB4et0UHRNFlF7J8aIGXzdLFrKvaNowh5yxCrYAfRrL2kJVcPYt95cEG4Ctk0cYdcopIMbA0JDzU0Pj7gNWfnE3nolAy1y1BBEdHhGoCI3ioy6bHuQlIOFpCEttj3VGf5DmSm90IzCuu4eSdyyHftTPcwO4HvMbinp3IbI4HqyYSMWSep9Tz5uYJatEt2zJjbOlNA3LXTiXUdXHMYyEC786MaLQ2qMEh8s6RbkSI5zYw02Xg8xusI0WNykynIVkvPG1NbeK6tpRj2UktGzNhLMY5Q14c9xeKPDDCA0j742MwnpzzqWJpPJ7Q0YUO98U9Edkt3l5HhXf3khw95FmlczVeqD5alg1bI4fFWv8D124pnl6akxuHNwxcXDLPzufMtCpEmf7DAgpKdpjWO8OfmoDDVWy5Spmfg6F04PigOYLTHmdh9KPQfqvm7LlLvCffpqHrx3u0TMWhY1XgPuTAwr10HympUIPRakYOYe5dzw7YlfNrne9D0KB7o3b9Jl9BMkQ8ga49XjHJgW2IfzAjabgcigEMP9hhqEty0cYXGxwUs22oPU15c4Cx0s1LhLqbdkNmtbXGMRHvPphcvo7x0hOow9NbiTNUe9FWFtIfLbIbw0iayXjrcbCSnaRHneLxwEHUjYyrCGjcOLHOfhWF3El1syqJbsIs5anWN5j1IOCvfGe0NN8gA8TGcE1gzk9uPMXTfGsxWi5GxICXnKPnxwMIq3rUCyDQFlCLrf0wD7sUARKo77Pjhg3LqBVXCTN8tthFUGxkytQ4y8xi5CJwVjkqXsYm28nj1wHRRugeVVFCKy17iN1Al8P9fYqEy2aK3FxMfBUnqeFIIbfFJVTg0HoiTQq24q2fiObXFxQQcqV8b3pbl3wo9xl75YsmD6XWoDU5rjYzOOSh6gKe1XN0IDFJjyo6zSXn0AO0BpMok0ebBSAOzgtfkxScD3lonDavDQPETTk1eL3z22llPhaoji5pvbMYJfJEPqGcKlh3sgJLWOtzv8eTIsYbQTxiyxXw53WPjMQ2qP0J7oxEkFWki7Pe3vJnWscfNd30oPQkX7T7sTcaWyoosRt8UuPTcSPjmccdzAEeo2N99v83WcqVnNlnKDDcOKqC63s96DeUsIqIxp9CTINYSxpjh1fey1vriyJCT96toCMoeM8Dj73EyghfFT7BhBLschIzEKpPPrglWR1dE3zdCA6hBU1A9vVI0zX8GCPQU8wnGROOl1y64HBu9S34sHOHPwRv6rDgdUBWB4FpLd3Qxh6NQTFyKekfO1A5DnHIJjQb6GIedEUaoxt3InBfJ3pyXEboKbqIY3UNJ1gY07QTJcdVdVWVnf9ikPu5D2PFQbNcjmCJk7n1iul4eu84MQDsPKdWaIvSKYRnM1dWoWOEz9vW8dSKiU7toiQVTtBzv1J1ojxukFo3JtSXIxiHtyP7ScK874RLq6qqtAaze75CFdgohbJj2Qbz7R5KONCudjewFcJQ9SIUXF1pw6WBWTAsRzQ9FtLA62MVKw1k3jXATE54Cx0cmQzGPiQQ5pLOIQ4PIVLsUwjuswWjc0gqCQJFILMt8qGObFo8NPU0Dq5zl5JYkfsch3K89w6OCTa82DmjpEoc4EqVXI6OyjB67CneGR6N3GochaVw7OhA1EiPpiirQv6m4LqsTPWuBbainVpzLLEcfzvEsc9mEnBOk5oMzccdfBVGNQjJ8gblfUXi6MRGyl4lbC8xUixIJdPHXFFJO8cvdjfB9SfA24Y6HMv2iFTAOoDKsuNpMQfijXLsd8BPbXOcFVCzOqxH2uBvu7wAd6wo9HmNLdr2oPOm3quvRfIdFOlS0MrADbDLQwWgnE6J3jqyVG9wICoeicbWwFv6CdbQLTNxFHfEvJAMaKgNPHOYo2y28K98GCKsm2nP3bqrxTGMTffgbfa9K5DEP8aG6H47BJ2NbeR0WGth2zEygBtQqqczGXNGTx022n1yYnpqy38Uf2a03FHHGtCIMvD2U3z9CTtFDqwYc2bk0HBB7WEI8XYed6FxI0U5VRp8BwlbHIz3tvX7sw5pAWYs37i2EYlbYlKqCaDIXlDCFblXE1AHbPVWs3geOohtm3kuE8MvP86wii0iLEG1flPsyrLP5uiI9fOFWAQDds3bThkXnfKbrvhVtWlw6k6lTKPN2Xxp1J1WIlQuBc6wEHxxqiVSgMyuL1PcH59latRcNyg83rSM4EwDyfTtKCE2m2cyY2DaBgTbWNmPQvbc5nJN4FWNumwuOmb4dhELiJL8IM7hExVoqfnMcxcmbps9MbWoWzqhcEyht5BNCe1w3VgyaRawiWQWsdyC34P1jPIJi25srP98bsRjdLKH42hyvLThC8pwD95C3RU1idXgkbgoApeduvrl8JQo3zlvcASXmADWUNYneLdqB4jjk6an4A5pWsrU0cLMD4TrvACpUd5aw42f7irqxneehc8S96J22YukObbKFQTAFORc8snYhHMcaxwJEvcDtQme6JQe5klUmQGjsLecAN8a4zm2DHWqF0Ao9YI9VEHvVIHETepWerxnFF1ub3bg4CpNefJel8UYJ4zi5FtQuXbxYzt5o0tRSHaaaqNGDoz9aDkekK5bck8PelqXp3N075mRg0E9spUYAeloLX4UF3jTSm8snOwkwnEYm2VJGuMGqJtGiDoLLcANJkz9rWnsC6OjO8b0sgHH47SXyT97PtG5OiiMNfv0GyLmuxOVdFNBXpa40JB4J6eIqCvlDusuNSAkL1a2B0SfyKiILW8qSUJ9816X9C9oL3u7xVqaA
cmp dword [ebp - 0x24], 2
jl 0x403e00
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d20
mov al, byte [ebp - 0x12]
jmp 0x403e53
mov dword [ebp - 0x34], str.GB5ILvHLKgbigrJH7UeafAyVVWpkIUqdEKuxjTky3edlxSv5fKw9ufNPnSFrH2UQouW3r7o7asssd2mFW1v7FdjPdAXXKVpjGdjSdMPyJwyfmBL55iYyh9oORxGa8brHUdSU08O6tn78SsSo45fh5pxJOE94RqfE4Epmv5ITclHhtAwgTJ1jcWtuEcDtRvMgDC7BK959JaPCI8hO9xtX6o854QpXQmHcL4Fm8wG55WWRYnnHYCiPwWAsKFDRm6nC9PbAj2vUecuutHM792xLBycBx7uiKWQd4Edwi8HUiOOHYp3eK8bVkUiLD3RqF5bn2VpKShtW36fnQQir9EdGCodW9IoCSj8voQk5aDvHOMVlogk7dyR4kotBuUze9nPn2YKQ5LMO6jxw4Pnehb8Ovf3k1i2k56QzfHQLDojfY7DG7yNt7oQ6wyuU5yNS1aQmOWF03yK8CHdyvf7e3GNBYk3m5yiR63FL7eccPEqQ8HBM1yWBV8DpNPzSq8jbc5gsWDepJoeVGMA39Y7n6kQ46JASwh4FXnJQHPxbOPL9sFhSdOu3qvUBiWeXO279QWk2f6HumjftEdeQedbPjs8t6LiXJvtn1zrNWehNUxw4sklq38nDBxGAqOcSLUt5pSAGJEDXlx6h70X4enq3LGHju21WowTUKmrR2k6mIG7HQiL99xNoIrasNFsA5FSuxgNhLPOKpCm7UkQ2S7aGSTWk4kSqmPXp0HCwpkSq3nfuAmH2mlgCfKPCkVgiLt6c9EYVTuh3viO09GdmblYEhetxOIfdPdAjMR8vJDPNX2N3SFDhM4qSWbpG8j6q7H8crVq0UEjiQAxd8LCTlgJ9N17b2zJocHQfqinOXXkzPh0hewemNvhXPISxBJIIE1fNNdE7TCrbRJOguxTIRfuAASXLcpdi7zb8rJ1Ghe34cYfkjvs10I1U9Dsjpr58bkVwVOp7aYtDhhdT3d7cs0AD2Io465Nvulb9EbUB7CUNSheA7utdfY73mqDnoQtQGLXaJnK7gvrR2WwbUhzU8pCeJDY4IEQQsNJF5Ofiaz4DYASHRyLaEPhUgO7nJFlluKkKnJUu0iDkjMNlqpQI7Epxz0B1ns0psYYo3bpLnKVCPwny211lz5siPNT9OQtj6Vjyi1sQrBAFB2mVaBMHS920Grlpx35w88jc5W1eT6a4YW8ijt9tCKSfjEbRgzOIico99x94U35QAdJGY3qeazQhqOy2YhfLnNlfY81ccOGxh3QkGMnwD9Y4dQtSXjDK8HlhRVYdXnb5d4KDXe6RWPqiqfPQlBtKjUnhD4sL9XocjmCzb5ALuEx3notR24BpLiheIEbSaRteVB03BaG7liYFEHO4mxk9wXzslRRqWUh0KSOCUEWiUDK8f8JUQ90dvLlMerBgOI1BLREs46LRAjNVwMw4KCDccJ35VthLh8V8bffxIhRmuPGTjSfPaxUjN99e23esL2xXrt52cBQ54qtX1kOszbNmnCCK1RTQJdvQ8OrAMPsRoOEP8LkITAmYVxmj3bgm8GP92zDjHwaGfgg6y7d7hNHdq63IYHUikIRU846E8WlG5tUgEwcG3U4pJcbTpH3PaTfMCAksdba65JQIdsmdLYIpLx6VCXm4V2W4TvTY32Cl9PNKwB62971okzY3ALdXndjIxarQF6zXP5awiW9bappVbxOCYUsoGNWj
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d20
mov al, byte [ebp - 0x13]
jmp 0x403e53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18