Function at 0x402b60
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 0x24
movaps xmm0, xmmword [0x4451a0]
movups xmmword [esp + 0x10], xmm0
movaps xmm0, xmmword [0x4451b0]
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [esp + 0xc]
push eax
push 0x4453f8
push 1
push 0
push 0x445408
call dword [sym.imp.ole32.dll_CoCreateInstance]
push str.rootSecurityCenter2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
sub esp, 0x24
lea esi, [esp + 0x28]
mov dword [esp + 0x20], esi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call dword [edx + 0xc]
test eax, eax
js 0x402f09
mov eax, dword [esp + 4]
sub esp, 0x20
movaps xmm0, xmmword [0x4451c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 3
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x44d812
call edi
mov esi, eax
push str.SELECT__FROM_AntiVirusProduct
call edi
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
lea edi, [esp + 8]
push edi
push 0
push 0x20
push eax
push esi
push ecx
call dword [edx + 0x50]
test eax, eax
js 0x402ef5
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call fcn.00405ee0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
test eax, eax
je 0x402db4
mov ecx, dword [0x4575b8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
lea ebx, [ecx + 0xac]
lea edi, [esp + 0x20]
jmp 0x402ce7
push edi
push ebx
push dword [esp + 0x18]
call fcn.00406060
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, esi
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 8]
test eax, eax
je 0x402db4
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [esp + 0x14], 0
je 0x402db4
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push 0
push 0
mov esi, edi
push edi
push 0
push str.displayName
push eax
call dword [ecx + 0x10]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push dword [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00401000
add esp, 0xc
mov edi, eax
mov eax, dword [0x4575b8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
cmp byte [eax + 0xb4], 0
je 0x402d73
cmp byte [ebx + 5], 0
je 0x402cc0
xor dword [ebx], 0x73b1746a
xor byte [ebx + 4], 0x33
mov byte [ebx + 5], 0
jmp 0x402cc0
mov eax, dword [0x4575b8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov byte [eax + 0xb4], 1
mov dword [eax + 0xac], 0x16dc1504
mov word [eax + 0xb0], 0x133
push 0x4052e0
call fcn.00405999
add esp, 4
cmp byte [ebx + 5], 0
jne 0x402d60
jmp 0x402cc0
mov esi, dword [esp + 0x10]
push esi
call fcn.00405e20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call ebx
mov edi, eax
push esi
call fcn.00405e20
lea ecx, [esp + 0x1c]
push eax
push edi
push ecx
call fcn.00401000
add esp, 0xc
mov esi, eax
push eax
call ebx
test eax, eax
je 0x402e9d
xor ecx, ecx
cmp eax, 1
jne 0x402e1d
test al, 1
je 0x402e9d
movzx eax, byte [esi + ecx]
cmp eax, 0x2b
je 0x402e94
cmp eax, 0x2f
je 0x402e98
cmp eax, 0x3d
jne 0x402e9d
mov al, 0x2d
jmp 0x402e9a
mov edx, eax
and edx, 0xfffffffe
xor ecx, ecx
jmp 0x402e3d
mov bl, 0x5f
mov byte [esi + ecx + 1], bl
add ecx, 2
cmp edx, ecx
je 0x402df2
movzx edi, byte [esi + ecx]
cmp edi, 0x2b
je 0x402e70
cmp edi, 0x3d
je 0x402e60
cmp edi, 0x2f
jne 0x402e75
mov bl, 0x5f
jmp 0x402e72
mov bl, 0x2d
jmp 0x402e72
mov bl, 0x2e
mov byte [esi + ecx], bl
movzx edi, byte [esi + ecx + 1]
cmp edi, 0x2b
je 0x402e90
cmp edi, 0x2f
je 0x402e30
cmp edi, 0x3d
jne 0x402e36
mov bl, 0x2d
jmp 0x402e32
mov bl, 0x2e
jmp 0x402e32
mov al, 0x2e
jmp 0x402e9a
mov al, 0x5f
mov byte [esi + ecx], al
mov eax, dword [0x4575b8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
cmp byte [eax + 0xc0], 0
je 0x402f19
mov eax, dword [ebp + 8]
mov ecx, dword [0x4575b8]
mov edx, dword fs:[0x2c]
mov edx, dword [edx + ecx*4]
lea ecx, [edx + 0xb8]
cmp byte [edx + 0xbd], 0
je 0x402ee5
xor dword [ecx], 0x73b1746a
xor byte [ecx + 4], 0x33
mov byte [ecx + 5], 0
push esi
push ecx
push dword [eax]
call fcn.00406060
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x4575b8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov byte [eax + 0xc0], 1
mov dword [eax + 0xb8], 0xc61104
mov word [eax + 0xbc], 0x133
push 0x405310
call fcn.00405999
add esp, 4
jmp 0x402eb5