Function at 0x402920
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414230
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x469090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x24], esp
lea eax, [ebp + 8]
push eax
call fcn.004042f0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
push str.Name
push 0x41a532
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.00402c70
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 2
jl 0x4029bd
mov dword [ebp - 0x2c], str.BeUx2Hkc5HS0rwyo246SUfFyKg8xNBixXdLJl92TmUywa7CikURYDTBXGYJGwzyNxbY1uXPp5hakLR1MyoRRVBJYjXGxBXezK6NtkpnIy8WmsAfpOC8Kc9l7jwMWuTiAMLBTfiahlbKMqcgETySwiSFeDetTDz8zAPUOa3AXis6YUFnXo1sMFMOIu3MDwhtdSKpqvCW8ti6w85hJEBmRelJpnfszFmt7aMTDcBrygoxblA4jMMcLrFly0pOlyfHQE4k4G79vhKRVPoeYFOKefsoTpsSMJr3WnxL3XT0GpI7WRNC2WOVD9WyBQEgTJyRT7XtzveSfPWYDKcyE4JL860nkSyfW8gQ8pXNpiYwNWqPzO2E0ajuxDYi8j7Jntg62AVgWRBzptuDynPXccaooMVEzcviOnq7VGavkfazAlM2zMeWiRFWV4oEDSm77pDM9AHkoYeUiMigOpTpkF8N5yvrLXv1jeRnTStEG80UYhkfGCCzgPzFtM20RlduGtczoVezqhfMuzuwOOf42mUtsSfeh70EEKJoNTwizviBbHLhYpFRv1Ue5r2UOGKfUMIjdFKaLq6mNVslcOUowm675yRJKKFGjeq9GV9Fmb8UBP9cGu5oRERrVSLfLdi0TLe9f6Ktpot3icOURSi4h1rGLynV3huRXazUPnskEeMoY6JilsOXrfRqtfQ8dpqBX60soKXaAlivhUuFWIX31X1oz714jkDbAl7cMUO2lVOPee17Ha7EAwzulSaRS3WcHDzTPqn8MIKFkVAiPjJwH34HLLhATNzSoNaKjuPMvT4gwaLuNHpMSrSdvsO6N9X7UAIkXacvKdhGfluGcRJWznbkUeTesPYrNO9zsekSwTxXl70sSpqUcgYs6ObEdWL0IjsRrgUHtKyY7rQ2TRg06j8dPwTXROOByUHWuArQ01AulvXjuR8SBshiz6SED1WHqu4VbignbwwcfOyM71WDYrWzxSv3eoinBTKmXewrNyLDt5bCoVJJsLs3BFLqN4kmB258k1domXlgciIBchA2dFWRmOeUWqQ09MqyE4aG25QqWKpbAHHNmapk690zI8Yj75gljv0VJLslLXKqORjF04EOO4NjD6bWCQ8zBgdR4pV8bKE3mvKEaTjWfqUWEueb12EIM26nkRzP49hqRhqcO0RoKDddcLeXLCwE5gMuwAikQvbxeVP7WqA0sB8F6DCQDzvCEafnmsApnpb2udxAp4CLbLIPI5c3wSuiCIflfVvLVJubWQbf4wUOq4x4Ol2qzznH4FpPiXHYhABU4Cu3I9eqpXNEBVxr7Fcg1ycrl1nwBomNykfm78b03rgKMCugEd2OsDPSU4lIzLU2gKlYYld4YYepusWDXf3zjWs3dCWQiFMriIJ3WuzmxBDzhJkYWRu7tk0VaHb2lgMwW3t7E1mFIOY4e3nnMaGsLkbHqQyjI13pHBD7F7vYhFjCNd8tOe2Y1iCDj5bzSE4PhfrnuLJqEIiQXl1Dyc1sVlHaRYJFM9DfyQ9CBHDeY2ag6NIONcb2flFROCvhMLTEEj6XqsCM6bGf4ejFtnbiBVCtDBjYH1kLQxIUmgTEyhh5awapKTIbAvpNr1ziPFGUHrwlHbxuAWSXaQYX0XA0MfMR7vjxUN72S06xL1r7aj4WhDMQKLFvG5iOac617I3Lk84bMkjtV2T09BWgOwTOLIjUSK5S6Yhl9PdjWrGGgg7WUFa18rjrsD4zel09WsSEF5kpptXXbFXy97rySN0h72ymQF9LdgjfpSikfhjHutjqQo70tPaA4VGW7TrzSJjg7g7gwuMpCnz7vhS5rQ36z68d5NlhqyYxHfOSfveKMAL14MIcA70QT3o7xzStJCJwkTxanukwPStpSeXlUVrjc5RMXXHEc7jijhtxNnBFkuQwO9idAERlCgGswg0fAsLAbrVOpPohzcEqamE51BPbhpRy7extdmxNHxf90lQxyhc5DXpTM81ra7gCibHyKMkUPDS9m80QVynmrkagHC9bkJwknTqwo0cCHSlLcaDH7mF1f2SoLr0NFp8vlJdkLtwbFqemcdrIbu8H80T9b1u681p7RxaNXY2xiqeHYNSIVkoXElO3mKziycugoEVHuyKik24U9ehCSIEcPwAeT5iVKoncXXMDkv4DKtBwdwKsd4IJ7bvuDsL2tLQiqQy7WpDrIVJtGvhtPfWMqhbfAmdWrix5heDyd3xdAEr4YLFYmHhs92xAWeRqkFUeHv1etz54XQN1wFvv6kfI4UQcbA8DKogyDDglxiYNBMXoDjhD3BWttGJrSWp6iGGYH4uWDSdPtJ9HDygaWt4s6l5iSPdKtB8CcLs2uc9dMXCOL6w0cpPn89aqeM8ULSnGaeqqfpqFTNO0fj3cWp8KbEx4anPjC61zjqhUwW3wpy9UdozU0Xk1lG997952pytK4Tu6mvlK7xaAOgGvT8rxahceIIGzuk1UyF3wj1W008tu6EOsRr2wCNguPGyO8eHPDhBCjIQwgEMr52dmQUf4bQeMvEE3BUtrPOkFN7lejwQDKDWXtaOdJhkz0i3U6I4NoOYTET5EK7wI1tUb6f3OCf6XJeRtLN19fpUnc910nQIFLjR2KMOGF7qJp9lcI4KP3c26d8r5d9rSOGlGdRzv7AvhRHKS0btk9iQUVmXmsrM8YUKtSanOGARCbDuMDzgiBlsC3HyXxcUB03iQWMP6wjorBCXvArXvavtQGcsC5T3RwV1ohq9Hhdf4CqJ5LKkRira9sdiKT0vRf9MRpg5Q02WtSKoR4gQr9mkXpm0l13GWI5j8BXYFdKmejpCGhrUqAWmA2vO6Ew3QxR8cQLMdSCDAW9bIdzI9dqdhiMlkg0bGanzfNn0ltcjr5KUwzFh7gws7ACuXsYFY6iQyP4HTQgaid3J54xrUHvc6LGvB65eDI2XA3yyzkQok2REHkISlg797aUXveQEXpMLTb9OUJjskq1IbUz6hhEAWxwLw4SODsxUfKCjrh
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004043e0
mov al, byte [ebp - 0xd]
jmp 0x4029f2
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004043e0
mov al, byte [ebp - 0xe]
jmp 0x4029f2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18