Function at 0x404890
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415b50
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4473c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 0x417b4e
lea eax, [ebp + 8]
push eax
call fcn.00402940
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4048fd
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401540
mov al, byte [ebp - 0x11]
jmp 0x4049e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp + 8]
push edx
call fcn.00402eb0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
push str.Name
push 0x417b4f
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x404969
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401540
mov al, byte [ebp - 0x12]
jmp 0x4049e4
mov dword [ebp - 0x30], str.YM6J8NC69eD0WvI3f7SUDst8nVuUuzzki3AQJ9bpTNkgzbo92z8WaeSux2OnhTYRGesh1QRuP8ahUnmOuDzxquFYDmgyEHTjnOOWkflWRbUjgUBuDI2e0qzH8D48NoblECJvUQWSuQQVfilAxAjjhm3j4pW2g0TESSdpOgJXMRDWNA1zmp8QsKgV384sSekXwcdQVitkpUprdAeUmLcHAb3fha4SSmV06BENXQCFBwMK5DM8OB9syoYqxJY1KnnwcuqYrYk9a8MukNKG9gAt2glaaYmQlRyhwDkSJSstu3VxdIj7Pt4SAO4F5VaFP5x3Qe9N2UASxwa2lJVWon5AxdPGNtsPC6C5hLoaRzteXOTl2Ex7W1RGqv5JsxYDrlQInSEDghVNJWmJt5YQUbgCo9LxEI3ejsVrUDj0rygOyh0BPI0RPEihR4JCAOPKQKqnuqbB8jOzOcAohUavfHb8TTahpSjvl6sybSnvdr6MRRNJIxD0eQrfJlk7bFhTMQIUsWliOSCx1c6mKVbteTYlP4wbVJovSTxhjMTjgB1jxSNaG18VcVYLSNbSFq723DKlaR8r3xXWCm19vbnhwgWxKfN3kMIjnYNIQRthTHhItRHvWlpj4tKhu9USMHmlHnJRHNG1K5MibmFxqXhI6sAgogcYUKXgvJ8dwSTwJFqGPBwG2YE5ojVrVmmjvmkk1xbYuDvhavdlt7HxAQIQ8rDlMechkD2WaLDmkQhpzDe43atPDAin0vSbQFAB4vxFzUPo9xgHI7E6vNVroFKV5q9OduvuoD7byXG1x1Tzw1I1KP1mL72CVpfH9wXtUuOk9sG5xRU38qKOBQuKqsGvBRlYbC5ucgA56rUiDVmQTsaSRaUUFJNuxzTqXD3QMVbwNs0gMiEjmdp1hTHgxw4nFtKprt9i7f9WrzawokuohR5lyV7nNTKRmP01H0HUDGUIPofriFVHBxNqkTdXSsHysa8T38afIyHox0AjNelwupheddRTVilVegUpYN19uWEizh7uM15ztjBdW4E5r0vKEXBVa9ykMNhqUJx2fNnjgN6JQNQYyM6XhUfnK7vp0uCGd2Vopp95qRC4VI5T2z4tbAvYJsepevrBkte0UPHlOxBidG7ExqhsE8vmpKRUSD6RarHh9SvjKoq1VUpjIwY2HxyMC7r1B1zoDp5zfecQ8BhgEX28g9Pi8A5gLgTci6yhHUrd9ktBiVjv9FHzQBQgsWCvIu3p9EiQizgqwtfQ9GxIvgMjcjsV25TUQFA6CNJCm6orQOwB6MPf3fgd2KtgVhLB7e86pYskTg7rkjvz4H2XmtNl4u670EdmUcaKuXDRUT5xUItatwMaj8EY5bVnQA9WjMcC7O5J84o0r2sy3W5B9OO8CkQ8fVDILA9LL8dp3ic0LW9UPMhV5K03fVlhVEewRUTIlCzCo3b9pyAbWEI3dwCdg69PQX3eLNnvT3NQjg0Y40heRj9TmwsUUhs6eptjMeBztWkEApS0YE3EgzlSgU9y7r2eJJiUrhFH2zqNLuDxNc5E2ddLCz6Gu5cgx0zNu0J9vYc74YBPCwR4f3GH6dz0ldRacuIoRs3uOYzEpUK42RdneVPekgGjJmwJKNsJIKVIKaiwqOBd1DhHrHIiQUkBnygJGLSwnYMfaPW3s
mov dword [ebp - 0x34], str.IHwEbtWFCNml4I5fYgIdi07MtbqptfJ6IuS8jyov5pCC5OOKYwom7IvSklibLqMbovzCHMSd1wk8o3LWU2VtXfISCGmdt1Qgryi9h9gmV70SVvdOxN3ueDV4H7TaGVlN7hfXihzrpt7EspdO8DSxxBxJUR7qmcqMfd3Djs239j70B8sWyk53Su8dKCace2RJePNWfA5KQKndKbpKhvGICitOIp9pSKfG6s2Yken8nigncebfjFcumBATqF9MLPM9ojJ48zKMCM3l02BXigBA7IEPAfbL8SobgvmPxshmxwYH4xe0oAkuaw5YWleD1FJnq3O7MmbtebgPaPiTnQfX9zuKnAcml4aNdOq4pnVMMM3TO8IMA8F223EyMXYJR7G3uD15iibXrOrLtLceWppX6LBNbSpi7Y5gI9QPCtMFv5v7kf2oXzFiYdyWE6glt0M4WVCgW0PDkPfoqciTHn9RDuTrlNhVcCWALrvw8vzzlFCNFoKTPt0KjmiLuz9Uiqswp278mltc7BziKMQ5zpNhBbxoqkxSEaQ2CWwM8sdfe3WBdoKCJBB5t1EQxq1dXIoNKjgtjrFvmMzfpqkdIpU2bvSDiBa0K634J8it5yVJhYfsye96u1GfhYEif0sbptvx5l3jUFhJPeGiEgt0BxjbHpBm28no587sSIqLEjcjUtAwybiaaYFsHlyqlRj5MvXAMXKTsDmiy5yJWHimSe43Q2z4XyDqncPd3GO3OsGvNMdfkLOS34ga2nSRLQEowUd6tkQLxdgONI681oYuv8tfuQWrHPFHIxhyugzVLYn6OqGgcLzxH1o3LCpqL0RPi3Uq2J7EXvxf7MsgQe4PEa7zKv7t4bs5oAI1GU5kW8t878MvNdFIVTf5EU9eLDxq0sYcyOxAPS4Hga3bGmg4JtN72WJn92dEV5IjonYn4oqS6VyaYnseO1htJjlBvmvmO0ChrpnPrXRBfWxbYaz7tvBcWlFBi4pO8W5tAC8s4wVRq5fDPKz7DRbEf5y8WWQ8aKeNiB8UnCkCnzPNujdbMSPpq95T5eL93qRIyRFd8uXRY5qCI9SIXgRkGNwFjvXuH4u9YLyArXYDbD5QaHGGPy3yy0ndmJgwWWlzKBYxJxIVWGQ0gyszBeytRhij2kpomvlWCvEQJmHNp2HmgtJl4E4JKQaKd262ng6LVxGzybEkHTAXhhHvB5GgJy6oQ026hUV3BEF0zpxx6SmDf1k4bCXgDRn1YMM39iSj6FEHy8uzTYTWTOdyikVaBVtvJkV5TnHAwk8wx1PvwAXePYI3563H7v8HgW1bigNrvd2zUoatssjBtWQ5dLfRXYduRnt4SekWgQLcqgbBeKEV2hoIX1SUipOLSJKg6D7FCDb46dS3u3DQBGJAbrNlzuisJuf393JJWQA3kwoYXiQL434MhwiWzx7sVzfr68oKdFJjN56zrNSR9keVfC4Mrv0J3e5gQG5PWaQjzqy3Mje5oFKaF2k9B3ReK9W37FrFgiAIYIxAVVl5cnU9ISIDPmQUMo5aqdOnRT3wIO1rVcFmLOG36dk5fngMVqAH9vhF2JPVN99RSYy98BHy9XGBgACQ85BwwXAJApWrAPk6XAlr9olRKYOzDcF7jA9gx5eg0sROKA7rrGj0w2FImWbDt0kCyzej4wmveix5hPkaDmFmMvsk2uEIbrJqY5OPM6PcTckxvxVAY4COgWcro6CXvDezNuPKdJgBan5I6q72YEip9B2lEaSOvimbhA6LHwTtLV5s1KhPcnMYqRSNzXI0BNQjNBtlpGK71N5QBt0miQ89Wij7wEPtubG6M5HGkztlORgfuc7XX7ldnyA6rkpsg5XFL1wNiHurDShfE7A44zllctJ5QS3uiM6alJBrWHRhxveLn7D2r24pI2rTOdRjheAJc1z8MnpcafGVhHGi6Hl47k6T31mXg1fz30197CB4HyDal1kh2aYIkAN0LVxJCl0QLdtx4wFgWJyaPQorpnLAadmytoUcQgcMv86JXx0AMUPzI5ubH9qNbLlio7DavdzLKxya8VdY7dEDAWq0OFcQf5JfvY4eKyKImvJzsB5P1KE0o8CInr0bml89civqBBa6vkW5qjdDRKCJuGhJjmkI8OHeiCDpfHiJl4oWdiNNsDAAqGGQs9xxOiby7Lru4bITVx5zHnEz46XUVfcfFgNRp4S7mOfCFo6dWSnCFyRN8Hbn4rFfwqS2gTRMD5iIbf2ALUy4MfyrSfGwew8emMCDU7RlW0N8GmRSI6lE7duE56NwNK30UfqaG5epFS1nzqSYCvpwyKxD86ljEsnh2T9EmvRzVqI5lVPGOLgbgvdOsgvJsKfs4swEXsoyWm1PjcGvc4kFCpELuARADEQCU8aaNiYmTxs9vlsC8eWslJElFfpFlVCAWKzAqHw7XQXxLkoXwAjqm8DytnuEzf5Q5KbQFHvepjQrEXN7M7vXTvFBnjSe01RDJ5hhDF4eqWPgxRdpQjyTq9tUSmJ08yOPPk1FGhYVjVXjwudQ9hjtGCp9uYAzdYR6QCvirxGijtMVu6B9EIysGSq6IGmsge6HKFHONLfvHS8l5OhJPRV0IacO94n734KH0MrrUEkWNxhMIziIGz2Jj3YxiLm176cNCPvJdajdVSSoz8OWJffKgrGHKxowLJVr7hvMnE95pt1iA5dVXRWCEARV7eY07gDJw806nKuyAT5yuQVUW1liP3H7YI1HWJ4xn1mDpsAQPQVbIFBPJPxeoI4gX0LTU4boK7VQY3mkv8LaxCWkS4zkcNpEI8SNn22vecTAPakC2xdqXCTIuYiVnQQITerxt9QQSAnbYMHxN2hPJos59uwRmK989wSf6QY4lejqIbi5eBkeptO9X3UoMIGKaj2WVlVuJCAxBYAsMlapiiimAH4bAgwDDV8FpGkdFPYeq8F5TpW5r3kTb3prYfk5jSMoJKVVlw9ChUjA41gXHLxBnhiLpRpwRE01QgGapUBjuUSNLv2HFlD3ncXfBDKE6RcpwJD23ONlH5pIugCSHtwtR7ynzpWlJcapey0qXE4eLEABLLL3VGcR305azldFzp3MfT4TomBUQfIR9yAJgkPTFkr16XtVplshANmJ3uxOkJK9agBmlAIWXcsOY5dB2Tkz36uTbbQLTphinAInCvj4FhOUgQBnh72idtd5z8r7vOwkole7gSa36N76gLs9X1j2nqqDuA5BkQnvMmOTgp2n0BNByDe1YMhlEjbGKsqsQKmhaAA0jzKeH3f82BYgcDtHSgE0Da4mO4Aib3YDUHlv29HPL9rptSOAHhb30HqpdGTptPR1kXVNirkib4Y9IUBnvbc4bFQdkPIFH8vezkOpn39ATtCpRcxrqBkT1gzMF27lwbxnrBqjBH6eQOYhPgH5o3kcUdIC39NTEkYttrieTGY9dUn5zJzy6M3fJPjDxo90MXhxYiayEQvMrPIl4k16YXy3U4egshavEAdv5rRoLEiYe3zLhMhRhxYilmhipEsuYL1gA3ozF7O6zjaic03XWjEruM94fIkfx9hE91RBjPsSIIl3PRkvKR2yh0pk6XHe5rXt6ayG90uyaGzlfrytcEFucdwglf89ostvD5RKbm4OGX2JsLzSzXkKedQwFIORh4zrDdmrRfeMkErXv3zETRQARnDf0RCtyepUMNI3eAW3o9gWvv9F1khS7E1Yux0h4XwAxWLCMQ3EsavPvukMu4JjwA2JCQ5KDqR06AuSA8e6mNTYEmsMFFwc9hA06jDB9LLFrrYhc48jcrLV2DkpDz5ywpuFUH5JtgV5i6wWERgGlM5rNR6mi0Y9Jgs9largvhuEbXuIym07rSrs6Flif2UpoE4eRbps9dVKmhpa1VCQn9887LYOVxLtA2NeivkRlA9JS5XvDwkGkf3Q0XnuvgweXn2REh9c1YqSwgYHzFbPIdHaY8eOUKjcDh1khWtl83qqSyoqrv8VfqiPgcGhPopEiRVgIizrFweyhuj0rI27RzEQ5cehKnfx4UMKRojOAfgqNsYvdzCXPEdmEfLcTKmwFIxlNHfYV5p7lDKIYVxtB25LiwAlgotYj914TYxFH1SHv4b6reh9Yn1D
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401540
mov al, byte [ebp - 0x13]
jmp 0x4049e4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18