Function at 0x42bebc
Capabilities:
Reference wmi statements

Disassembly:
push 0x2e8
mov eax, 0x58078d
call fcn.00550e3c
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2e4], edi
xor ebx, ebx
mov dword [ebp - 0x2d4], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2c8], eax
push 3
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c8]
call fcn.004029c2
mov byte [ebp - 4], 3
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x22c]
call fcn.004016bb
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 0x10
jb 0x42bf23
mov eax, dword [eax]
push eax
call fcn.0041cd88
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x22c]
call fcn.00401d18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c4]
cmp dword [ebp - 0x2c8], eax
je 0x42bf57
push dword [ebp - 0x2c8]
call fcn.00550ad6
pop ecx
lea ecx, [ebp - 0x2d0]
call fcn.00401515
mov byte [ebp - 4], 5
lea ecx, [ebp + 0xc]
call fcn.0040cc31
push eax
lea ecx, [ebp + 0xc]
call fcn.004070db
push 0x595374
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c0f0
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 0x22c], bl
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
push 0x597998
push 0x592ec4
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
lea eax, [ebp - 0x244]
push eax
call fcn.0042a910
add esp, 0x14
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040712b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x244]
call fcn.00401d18
mov dword [ebp - 4], 6
jmp 0x42c05c
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
cmovae eax, dword [ebp - 0x22c]
push eax
push 0x5931c4
push 0x5ff62c
call fcn.00402933
add esp, 0xc
mov eax, dword [0x5ff62c]
cmp dword [eax - 0xc], 0
jne 0x42c09d
push 0x597a08
mov ecx, 0x5ff62c
call fcn.0040332b
push 0x5ff62c
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x22c]
call fcn.00401d18
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004032e4
mov eax, edi
jmp 0x42c7ba
push str.osname
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c1a9
mov eax, dword [0x5ff630]
cmp dword [eax - 0xc], 0
jne 0x42c16c
lea eax, [ebp - 0x244]
push eax
call fcn.0042b4ce
pop ecx
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 0x10
jb 0x42c12c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00401485
mov byte [ebp - 4], 0xf
push eax
mov ecx, 0x5ff630
call fcn.004070db
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2cc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x244]
call fcn.00401d18
push 0x5ff630
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x12
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
jmp 0x42c0e4
push 0x597950
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c1ee
push 0x592ec4
mov ecx, edi
call fcn.00401485
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x14
jmp 0x42c19b
push 0x59664c
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c298
mov eax, dword [0x5ff638]
cmp dword [eax - 0xc], 0
je 0x42c245
push 0x5ff638
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x16
jmp 0x42c19b
call fcn.0042ba8c
mov ecx, 0x5ff638
test eax, eax
je 0x42c25a
push 0x597a24
jmp 0x42c25f
push 0x597a28
call fcn.00402082
push 0x5ff638
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x18
jmp 0x42c19b
push 0x59797c
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c36a
mov eax, dword [0x5ff63c]
cmp dword [eax - 0xc], 0
jne 0x42c336
push ebx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2cc], esp
push str.nothing
call fcn.004016bb
mov byte [ebp - 4], 0x19
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2dc], esp
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
call fcn.004016bb
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str.HKEY_LOCAL_MACHINE
call fcn.00401485
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1a
call fcn.00429d9b
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00428438
add esp, 0x38
push 0x597734
mov ecx, 0x5ff610
call fcn.0042be22
push eax
mov ecx, 0x5ff63c
call fcn.004070db
push 0x5ff63c
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x1d
jmp 0x42c19b
push 0x596664
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c439
mov eax, dword [0x5ff640]
cmp dword [eax - 0xc], 0
jne 0x42c405
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str.AntivirusProduct
call fcn.004016bb
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x244]
push eax
mov byte [ebp - 4], 5
call fcn.0042b52d
add esp, 0x1c
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0x14], 0x10
jb 0x42c3c5
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00401485
mov byte [ebp - 4], 0x20
push eax
mov ecx, 0x5ff640
call fcn.004070db
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x2cc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x244]
call fcn.00401d18
push 0x5ff640
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x23
jmp 0x42c19b
push 0x59667c
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c508
mov eax, dword [0x5ff644]
cmp dword [eax - 0xc], 0
jne 0x42c4d4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str.FirewallProduct
call fcn.004016bb
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x244]
push eax
mov byte [ebp - 4], 5
call fcn.0042b52d
add esp, 0x1c
mov byte [ebp - 4], 0x25
cmp dword [eax + 0x14], 0x10
jb 0x42c494
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00401485
mov byte [ebp - 4], 0x26
push eax
mov ecx, 0x5ff644
call fcn.004070db
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x2cc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x244]
call fcn.00401d18
push 0x5ff644
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x29
jmp 0x42c19b
push 0x596694
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c5d7
mov eax, dword [0x5ff648]
cmp dword [eax - 0xc], 0
jne 0x42c5a3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
push str.AntiSpywareProduct
call fcn.004016bb
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x244]
push eax
mov byte [ebp - 4], 5
call fcn.0042b52d
add esp, 0x1c
mov byte [ebp - 4], 0x2b
cmp dword [eax + 0x14], 0x10
jb 0x42c563
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00401485
mov byte [ebp - 4], 0x2c
push eax
mov ecx, 0x5ff648
call fcn.004070db
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x2cc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x244]
call fcn.00401d18
push 0x5ff648
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x2f
jmp 0x42c19b
push 0x597994
lea eax, [ebp + 0xc]
push eax
call fcn.00418797
pop ecx
pop ecx
test al, al
je 0x42c65c
mov eax, dword [0x5ff64c]
cmp dword [eax - 0xc], 0
jne 0x42c628
lea eax, [ebp - 0x2cc]
push eax
call fcn.0042b03d
pop ecx
mov byte [ebp - 4], 0x30
push eax
mov ecx, 0x5ff64c
call fcn.004070db
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2cc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
push 0x5ff64c
mov ecx, edi
call fcn.00401452
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x33
jmp 0x42c19b
push 0x592ec4
mov ecx, edi
call fcn.00401485
mov dword [ebp - 0x2d4], esi
mov byte [ebp - 4], 0x34
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2d0]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x35
jmp 0x42c19b
call fcn.00550d8e
ret