Function at 0x1001ea20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x10066040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
push 0
push 1
push 0x1006ac48
call fcn.10006fb0
add esp, 0xc
test eax, eax
je 0x1001ea72
mov eax, 1
jmp 0x1001ed90
cmp dword [ebp + 8], 0
je 0x1001ed8e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.ROOTCIMV2
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x1001eac0
push str.HookOle32Interface:_Failed_to_ConnectServer_ROOTCIMV2_object._n
call fcn.100267f0
add esp, 4
xor eax, eax
jmp 0x1001ed90
cmp dword [ebp - 8], 0
je 0x1001eb79
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x50]
mov dword [0x10068504], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x18]
mov dword [0x100684f8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x30]
mov dword [0x1006850c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x48]
mov dword [0x10068508], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x58]
mov dword [0x10068518], ecx
mov edx, dword [0x10068504]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], str.SELECT__FROM_Win32_Process
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x30], edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x1005c200
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1001eb79
cmp dword [ebp - 0x14], 0
je 0x1001eb79
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
mov dword [0x10068514], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.ROOTSUBSCRIPTION
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x1001ebb6
push str.HookOle32Interface:_Failed_to_ConnectServer_ROOTSUBSCRIPTION_object._n
call fcn.100267f0
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x1001ec54
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3c], edx
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.__EventFilter
mov ecx, dword [ebp - 0x10]
push ecx
call dword [ebp - 0x3c]
cmp dword [ebp - 0xc], 0
je 0x1001ec42
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x40], ecx
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], 0
je 0x1001ec30
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
mov dword [0x100684fc], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [0x10068510], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [ebp - 0x44]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x48]
call fcn.100015a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001dd0
cmp dword [0x10068564], 0
jne 0x1001ed2a
push 0x1005c294
push 0x1001e990
push 0x10068504
call fcn.10026920
add esp, 0xc
push 0x1005c2ac
push 0x1001e910
push 0x100684f8
call fcn.10026920
add esp, 0xc
push 0x1005c2c4
push 0x1001e3f0
push 0x1006850c
call fcn.10026920
add esp, 0xc
push 0x1005c2e4
push 0x1001e370
push 0x10068508
call fcn.10026920
add esp, 0xc
push 0x1005c308
push 0x1001e470
push 0x10068518
call fcn.10026920
add esp, 0xc
push 0x1005c32c
push 0x1001e7c0
push 0x100684fc
call fcn.10026920
add esp, 0xc
push 0x1005c344
push 0x1001e4f0
push 0x10068510
call fcn.10026920
add esp, 0xc
push 0x1005c35c
push 0x1001e880
push 0x10068514
call fcn.10026920
add esp, 0xc
call fcn.10001810
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
push str.SaturnMon32.dll_HookOle32Interface__x_n
call fcn.100267f0
add esp, 8
cmp dword [ebp - 8], 0
je 0x1001ed7b
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x4c]
cmp dword [ebp - 0x20], 0
je 0x1001ed7b
cmp dword [0x10068500], 0
jne 0x1001ed7b
push 0x10068500
mov edx, dword [ebp - 0x20]
push edx
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp dword [ebp - 0x24], 0
jne 0x1001ed8a
mov eax, 1
jmp 0x1001ed90
xor eax, eax
jmp 0x1001ed90
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029475
mov esp, ebp
pop ebp
ret