Function at 0x401a10
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42efb8
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x493224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], str.G1wCXMtHns0Elzsk3p9oHW1zwrvA7911uPADJdPvho9X0RMqVRhw5Vn0EXloLopzsSGmuWN4en9BN8kq2tsv5589JInnEHXT5WFm4Bs6OASrQmUImHYisBa3EmHuxp7rqIPxEt5nGFd48G3hwVC9ilDFjTov3WWa8LVYLu9ExyWSomWyHsCz2NR5IMuVDTivoza6eckIcFO2gNwwFpEkp6oi0PY4y0Fu2tbydNwnwKxpayqFJQQuw0VnhgLUT7jApI6gcaOruWMImkW1OJNkKWspPELjCg9Pusup2JvK7PanWV94qSxrRX5tX3OOtAMKNImsPF49wleCQlJSC1zDTLbG6L11d8YfSMM8pnjctUhEUWf9eXQfuktgg1x4sAbdq6ajOGWBOiAaSHHW3AQ4uNKGRuyhH7SGzwgFfkv5MxPYi7SdSM0fXroc1QUEmzStDkMD415Xyruhmb3hIip5TPHsl8c2WysVKfGUhJMHILL3rz11qjpeQO6dRlL4bmqY0rezyCJOfgE73F6TJuDE3lVg1rIfRX79kwTYb26TuzV9PB91jUXDmFDtziXTX5nvyAsS5v1Ecm7By9uXFayQiaBPKNa9A5yLrbWhRPFMvbsOaM1YgfNc1shn7JI0X4x9BgFzJWfaXA3UHJ5PoAq0hm6dFSPfvRItxhcqx3XGu4HQpTCTh9kPwSxyMWruIWYaE7kSMt2lo2YrAT180gKFPg5GcBgehzMdg7cjBOHboUfiK1d2yLbKTUeW3sMI0B29w68nNPenx4CRwhEIOVkG6ttMU7g6NGb9whM4LwQ8nKYrGpiQAueooKlGH4HiO8dTeo2Kz4TJJfX77OCHuB98qNpgJOR5eWCIvA26VPDATL0OTDC75UCtsQcaJMk4rRnt5sd4bqp9wsflcGNuOwskqki9MnnEWl1BB5h1hCwVFqEfmvbN2WKUSTj3oU78ptybAYayTrlyKLVWPjjEWdOP0pNJrHlyB6yLt65Hg3eIBtyJh4ebFIgWCSrdWEe7IvbS10rB1Cqq09TgHp1897l1b5mD7MG74p0SKon11kxJgGkbwN9j85tDG6zijpPo9cKUrJ6w4I1QYGVk74MNDUE1EPT4H3zpLApLsOTmA06YFze3vdmCe3sWwvN9FxtQHpmdWfbrAVWP66kQIkFJ9LCYiUEdR2ICLvnUOruoxPDxjlYuPzW7ra2ktrGld2cMJRBALFvwsD5FCIEUVcNCVbFT3238TmlDuuBNe35RRN9gAWmf5wc6cxGmzeKzoajGPwi9psbbNrwO47NPoXxlyQp267J9oVPCF918hGTROaPi8zjfYYB79weWaoNLUsmlQCufAgv50dA5b5Rd09y5PWluUKuaRT6Umh47MIj87MRlWNywXYaVn1awTx0FhCJP2NpOpxtrA2cVmRQp9O9aVM1xBQXGwIyKx4BIHN8qqWmqIJiqXikJ9PeXxfvKxwKkDzyde1amomWz5qmObYM3q5JrhkajXeCVzo4cJ26KkcU3dOEz31xWsMaNnONLeRzF5cO0iX6g2sBtGyWnj4tKauI6qvLtxfdisepqekWNlbMsPa9BgrmfK8hz1eILP4gitjiH8V8t8yyyKXhkHYRDHTmFKXJUQNzQrPQwQUGygNteh7ymV9yBKn82hHi95MaRb
push 0x433af6
lea eax, [ebp + 8]
push eax
call fcn.00402c60
add esp, 8
mov byte [ebp - 0x3d], al
movzx ecx, byte [ebp - 0x3d]
test ecx, ecx
je 0x401a88
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403fd0
mov al, byte [ebp - 0x2d]
jmp 0x401b4e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
lea edx, [ebp + 8]
push edx
call fcn.00403f90
mov dword [ebp - 0x44], eax
push str.Name
push 0x433af7
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 2
jl 0x401aed
mov byte [ebp - 0x35], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403fd0
mov al, byte [ebp - 0x35]
jmp 0x401b4e
mov dword [ebp - 0x28], str.n29StR74wz4cLjtlTeWxD7bA5dYaPEKIFLumRT7RXtxfRD3HsAH09vTg6xjTJkLonkWFwjPIjdeupn3c5gTDbEedBYhAaQkgUe2FJQ5bgPbrHh4VaCsqm6NW5f4utst8afyT0nNdw7dHIycSzlDUxpjpWIF4KUTHssGv0FXbJC12719YBoYmJbyQxBXTLtQxBbTiCAENhFjxDTyKBldfjhTHmss0U9DzGqKJFr8n3TL1l9Y6dDCR8ogsPfuQql1TvKpxKRGVvUTcE4BLTqORNyGiuNhKWFYm5gvSckriojT53OHSA64hSoSxiFU81CxPe5UYmyDik5i2CNvCxXkX4i153SLJOUHicegQM2WnRJNI8zjfsjnCbiPmuQuF9wvOCJVl8UBxnau9UWo50MuwDnYsFaqFzUrmHeVpCXI2WsSiiwasIAj3MHvJmdTMz6cEzBEE2pX5BxX9GVTAd52QmiCYqBtX79R4bIk81SudHrpXFBzpL9PeFVVNIX4lIX5WhO3FFodviSLeluMt9Ue6bldc2FtbA30B8odLlW8mqpxwy3KhxL20ymdv8RjSEmoandBzzCmB5iWyNhj9AnraIJQvj7eBtqqp2sxlOIWTcHd1qq9m3IQk2Xu82Wdn52wNt8qhARJi8VnhNKYDwHttHB766jF2ntV0gWO47gs75bp2jpxyTOvBkHHiP65iW6o8SGAqPAum4XWOFg9WafJ3deUdu1L45MfdiqWGpzes5EsngGDuHpfGS8rJgvPnOYp9QtoSJU9e5ievcDtNp2v73n36mMfoOykINq16GlWDIG0AHPRbnCOP676O9MuPtDQ9OejNL1HABd4c7dwEjm0K2h7lTtHxPBCmnNG7pPWHXYQMkdI6ysHPcDgxBuwUrcnT8K7oeeKIctzRS2qPH7NGv5SglDNvTO413mM0U386AjcwWO6tDbkVURc73R4opM7arw8kev54bekjfxDRy7xdvGoupez9Iio8VMJJ1duEf48s6YLrjBFD2wjdFJkVu5SzTAAb1TQIMx1cE7u8JzEYN2zMB5khs5RkMnG2AbnnwxfT6MoRH8YXNxprQ8VlTjLXtJz0JTcVFwRuQn9e8gpRiRQCoh1EoUlCqnvLEtd7wi0C6n5mwObgUt6Ljikvke3UGPcgRUsBs7BJUpfTXAYVBuykMlCYUI31RBNFfWc8UAE3bgq1xoRxU2epFSMjhkOK9eBwiwjT0QydKlco5UUwXsvcQvbtPN7qap3TdqRSGxcmBPzRpLR47XHRxtk4MF0uKA2fcPOjF8GDo0lPJs7y8xAxjYVWpug2bqUOoMh4iIszvclRRowB1O7nMzDLJ0jChyz7eXy3XPTqc085cQo7b2ryGc3WG2iotqfUxIadckmfu3W5F0thi6TeUohKxnnM9uGb4zNxxw0SoJUWqn5pocSvegdS4FUvX9J7G6ojAr4uNvfa6zVg0WxCqKXxtwAskIzHwo9cQDbsHV6cHVLvRTkixjCC4H1XRJBuaIb8UAtRkDtsgKMBjTuihTTTzc72oHmo85pc6eGHowJ1VjkrAB9w51119i7iWcqLUhDEr56M3Kxz6SJiSqe43CPxrxC1a4lGz89kpt0FMVPO7bbJTrazbmuidfSIHEGbz8xl5mdsRkbIh4uaK8R2vRc1DbYQcd8pajlSeb1gLTcAytc4OSU05TUUHcCBRlBFGSvbErY6CJ5PJKJ8nv9W1qobeFClyzByQHdqj6yNo2Jlc53j3rykwNlLP9v0FjXRFhNP9qdXR8MwRytNMJoBRNsnYhs0cO5IwKREto5KobAiLK7l2JlmBFtlHTBThBskVGeo11AvStypciIWT5ImPoeMvtRAp2HlDQbm5qKzbtET4wnmL1MDsVhX7pXlhi2ymiLuViQJX3XvPbvbJmuevTEhnn5oSLlY6pL6TF8wL9frzQ1kdxXc9lhTXb4sNN4Vadctp2LfVTYtR3iXWFwByD6KpKvNcx0VendWWeSVDAmR
mov dword [ebp - 0x24], str.7dWxfwoivCqezK51hh7YIWgloHage7F8joA3Krd8Ew7hqoaxLVrX6RT3bSHIohHyI4lYuV7fwIgHTfotVAeIP8t229Kwvu3YaQ2IkE8h6lt3FVPzcOkPJisVgrIbY2WXbP2AxtFrvytgkQnDIJ8L68C8mF7y8Vta3DiJSBqF8z4FrcKHkYDVEF7y4MwXfYupHomfBqpuxz71wSvSAFsyAfmPgKA4yLJDNJm4lF15tKyp2C2tKuHNyq9d6w5UgBKXGPY2dhUgVnqmnSwRNA9ID4zAS5MXvCSBrotUMv7t6FQLWS1DmE6fng3t9sB5oEmWOzIk6OYQjUXV4DouPUpcMpn3C9JyqF9durniACp0YrQTdVib2dh8MupUBDfCmDX4Dwe7RCgkkYzdRvCmsa5g1c4GOf3MQRplDMYQuMVnbmPgtfIeexKvA4oOQatyR8zs5QitytMHE2oM8z2NS25LwUMcADgpbXHA1XCmrqM4TzruJH8QwSNp3RjVU3uMhNdy2VooLFwp3Bv2UHIMIXtiGpDlJNF3pRDTe8SQsAiTiQy14vFKBFBFfj6UYoHxEeDSewguEUXUO7U0nNWDM1xiJHEoBqQyMK2raDByOD6YNfktK9IWpAzmv1VFxyOinbMfFASFB9QTtcSWUVgY8wOt73aRLuD0L2YDV6UY184C307NlmXF8ymLpSeki6ML3HQHCii8L3qx4f7UNCI6NoF4nhdGFSDpADNwrq6NImnFmuqkrpS9j1WGnP4VgJqvW29c50kPBEiuwbWxd8O0IIi10zfTTDOExrgOhD0KKpvWqc9XjoBWNGjDtJn9bMoA8cox3m2HDhxsWB64sipAUFPb62rPmOA9kW1odaB5JXeQmYnmBGtkqx0a4pXHQyhUExXRj7AR0xQ6ohEH4DXrDa4ftNmdSDBbkzhtTvrRchsEjl7iwQieVOfPhfLnkEfsXkbMF6DDVvLy1VlvXF20M9G8dU0Fz2fAsJ7onXwsDKcjXHq5I5Y6Hdw2Sbz9C6bC2lJQOBtqxGTVa9RWqH8QjqNiIuKk241ThlRMUTKmL4GXeICk4OFEiExmWssiX5e23yzOD8CTcP7vmH9HWi1Rq5JuFQjz97GRBt7z3Wgoz5p6kjiPHILRyliFKxGiR6KztdUIiqR0s0wQrCoJjfI6kVLPUKkEvevaIc3RTYEIxlx2Aoqi1hj2gii9IvUw4FNYdfKukmzBVS2maIR2Pq5EHkf8016epPCYRz16TNEColMIQHrtXL11xRrkg6MKewPLEoWFtY9kKiy27M85u3LN5W2SazXrai87guf6mOCX5i5yh8NqbzAB9SvCCiJ2MuYU49bajyXqBWg1FH6ew6hSXiGXJ5dEFbKd9aDxzCqdLS1tyfxlGVg1e0H1MQEPheAciP3LMMxufInoafqNAVuf592uhsmv6gub00pk62c2Q6qEGWVIOoxI96tKVNHWuFhCs0kw5CBiGGludn3nDaxutvaOEObSQBz9zGYBL7kmX9o
mov dword [ebp - 0x2c], str.gNNb2UIdmnwlCYsfxYlXe4CsLxc60eXdAO5VYsx8aeH7KtwjO90dd0QmIIq1NICI4g0aUGqQpkfAPklEocVgK4QOJWBLboxiDfU6MEARnqNtld6Ifoseaoc3SX7FLJ2QPKEcP4tFpE1fxWIpWWosaLFjkPkS1n7PJEueGiHKWzr9ytPdDVYzJBgSf4vgc5td3Jacej5ECMdpEgQBPXpcqeq2UhJjkhevc4JiC5DkI9ni5GVriSgKBLOcfb2MN5eD7KbVbPAt5f5Dhfjrdztez4tmuf5tfa8HLLGCEiwKr6qaIN1hVbt16r1NYy1h7fprR0rHzqbhfg1uostj1MJRV3PYLDv2kjRhhkJTpY7iCO88EynudzNWMHasAAOqgDDf9CTjAsLcplwsnKMrXWixRWaLgUUtrfbcQaAihBfGsstTNJEIr0t8MX9CpaiO3ieWJmpSuMUygli3SebB2PrsX7Te1nL6rYmeYvH29XijonLneMAqnuMflXsDNUzj2nb3fHfo56tmhH6CTDjmCyXD7mu8rfkq3lucEBG8msdkpyNuLOXfqgkgLujbHR2nrBc8UsyPkES2fgRCpchEYm7d0SSrlVILuii9IwNleu9YesYDnOQJSY16rAkPzlLuRbyVwNQsTAwPanqs5QiPFn3Wglam4OxVjGMOOC1JaHuU5zReE4ydqcQeHGzScliji8S4lFfQNB69XRNs1WFLfJqEHksM35lVFKtM3n33rrAMuiNIw1oim2evaqYHjqXaJKYUWRobEQwoS7pGQFho9OgFMzyDlXtt9jAeJKu3vihKgM6NMWmo4aUlBS2CtEkRxDFG8bgmnl9mEOVFbDGPwg6vzimtjQpElbwJ8bm4lWWbzjc9LfUrLry5JrWmSdUd5Yt9RDVozhhwAqvCn8L6b1GtVN0DL7rMYuByuN8o3BreOcTJ7j9IfGQNNXpbaL0WAMaEgi1OzlpHYxTpsr9ftyn1OHMkOi5sKAB8vaCgN4UN8PLLE2nB9o8MSch7iuIm51jsAUO8bt4dGABKLFTpVkORHS3oXDCuwzNqpyN9EydHdthovbY0NfY4evGUa4XXsIoyBHSbKrqXoxKTSbEUfP2TVOSpu30scdKHe6yWWJLPcN6VV5KOpmXNJRCiHS53WAqP4XP58oEKJjptB2Ytbxo32VfxNSBcU9K4z3l2FxPNm9VXMYQRwEw3F2mcFEpfrEuw8cF5k6vlbz8Thwp3fp6CgPvP3kT4YVdokwix11R331aPIoz5iP6wwr9mzVatP27qRVEOy6LI4JW99Jkd5PoYak3nuBhFvmymHdSt735AKtz6eUTBEwRoiVIgbbOtqKbesh88exrIRGBvyKOHGcs9qCpgceTgPwRookzvRag0fwaOCyRiwm5KrIbrROBcSIFm6AUwsGeG45v3hqwxrXRvsbqrXgctX7I1bCV8psDaOGFDGIyYdBiXqMadfrsldjKaoJslGXYjmchnsTVlFk3THeoT1eL4MuuJllnXrhIBWm8A5U9vbad1y73G2OOw2PJ6BDp3w3PrlgjehGMLYUF6UAFEuDFhxylWGw8FuqU4IcjUWbvMma88rioK6nEu5RgrdXGl7qXxvxqMtHYQ0Yl2eLxIHmC7DPqPG7ijFoUciTYcQY3UjR3JnqgTmdp58bKkc2OaTblWcwKdySQbQrTVmI6WiV9EhJszWD98oEV7d5thndSQdwmG3LeqARQVSkcLp8LELKKV351BDmvEeeujjP8O7aJGhqwCj5SpEvhEbPl69jWI343j1cLytN6rg2TeEnfeH0mrzX7yJL7UY9jEhWWDnhJnkX9K8S9jhG7XOsAFLBkvpxxPHhkNJT4jXvDbKfaYviJ5d1UDfJex0L0PiB0RWv49QNnPkKevKCr2KtEclNmwLPaO9rNWWFUKYCqPyTcWG1kcOD9Wk8JzDdJe2rBe4UBTsnkM4D9HF2x4bfvjDLWorOITmyhY0HSbxe9VmmuuEpbc1YBvPq4e
mov byte [ebp - 0x36], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403fd0
mov al, byte [ebp - 0x36]
jmp 0x401b4e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c