Function at 0x47b4b0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529539
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x260
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c4], ecx
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435820
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.00459cf0
push eax
lea ecx, [ebp - 0xe0]
call fcn.0041f550
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1cc]
call fcn.00459cf0
push eax
lea ecx, [ebp - 0x5c]
call fcn.004025c0
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d4], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1d4]
call fcn.00419640
push eax
lea ecx, [ebp - 0x1c]
call fcn.004389a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00401ef0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe0]
call fcn.0041f590
lea ecx, [ebp + 0xc]
call fcn.00456060
push eax
lea ecx, [ebp + 0xc]
call fcn.00421ab0
push 0x53cd08
lea edx, [ebp + 0xc]
push edx
call fcn.0041ef70
add esp, 8
movzx eax, al
test eax, eax
je 0x47b7d3
lea ecx, [ebp - 0x3c]
call fcn.00419530
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov ecx, 0x5835a0
call fcn.0041f0a0
movzx ecx, al
test ecx, ecx
je 0x47b610
push 0
lea edx, [ebp - 0xe4]
push edx
call fcn.0047c050
add esp, 8
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1dc]
push ecx
mov ecx, 0x5835a0
call fcn.00421ab0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe4]
call fcn.00401640
mov ecx, 0x5835a0
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47b695
push str.Version
push 0x530754
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
lea eax, [ebp - 0x104]
push eax
call fcn.0047c300
add esp, 0x14
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e4], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1e4]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00417ca0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x104]
call fcn.00401ef0
lea ecx, [ebp - 0x3c]
call fcn.00419640
push eax
push 0x538714
push 0x5835a0
call fcn.004030e0
add esp, 0xc
jmp 0x47b6dd
push 0x5835a0
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov eax, dword [ebp - 0x1c0]
or eax, 1
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.00401ef0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
jmp 0x47b744
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.00419640
push eax
push 0x538714
push 0x5835a0
call fcn.004030e0
add esp, 0xc
mov ecx, 0x5835a0
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47b786
push 0x544b94
mov ecx, 0x5835a0
call fcn.00410130
push 0x5835a0
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov eax, dword [ebp - 0x1c0]
or eax, 1
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.00401ef0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push str.osname
lea ecx, [ebp + 0xc]
push ecx
call fcn.0041ef70
add esp, 8
movzx edx, al
test edx, edx
je 0x47b8c6
mov ecx, 0x5835a4
call fcn.0041f0a0
movzx eax, al
test eax, eax
je 0x47b885
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0047cba0
add esp, 4
mov dword [ebp - 0x1f0], eax
mov edx, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], edx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1f4]
call fcn.00419640
push eax
lea ecx, [ebp - 0x10c]
call fcn.004218e0
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x1fc]
push ecx
mov ecx, 0x5835a4
call fcn.00421ab0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x10c]
call fcn.00401640
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.00401ef0
push 0x5835a4
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x544ac8
lea eax, [ebp + 0xc]
push eax
call fcn.0041ef70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x47b997
mov ecx, 0x5835a8
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47b93a
push 1
lea eax, [ebp - 0x130]
push eax
call fcn.0047c050
add esp, 8
mov dword [ebp - 0x200], eax
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x204], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x204]
push edx
mov ecx, 0x5835a8
call fcn.00421ab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00401640
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.0047c050
add esp, 8
lea ecx, [ebp - 0x134]
call fcn.00401640
push 0x5835a8
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov ecx, dword [ebp - 0x1c0]
or ecx, 1
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x53cccc
lea edx, [ebp + 0xc]
push edx
call fcn.0041ef70
add esp, 8
movzx eax, al
test eax, eax
je 0x47ba6a
mov ecx, 0x5835ac
call fcn.0041f0a0
movzx ecx, al
test ecx, ecx
jne 0x47ba00
push 0x5835ac
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
call fcn.0047c000
test eax, eax
je 0x47ba1a
push 0x544b90
mov ecx, 0x5835ac
call fcn.004219e0
jmp 0x47ba29
push 0x544b8c
mov ecx, 0x5835ac
call fcn.004219e0
push 0x5835ac
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov eax, dword [ebp - 0x1c0]
or eax, 1
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x544a9c
lea ecx, [ebp + 0xc]
push ecx
call fcn.0041ef70
add esp, 8
movzx edx, al
test edx, edx
je 0x47bba0
mov ecx, 0x5835b0
call fcn.0041f0a0
movzx eax, al
test eax, eax
je 0x47bb5f
push 0
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.nothing
call fcn.004025c0
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
call fcn.004025c0
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x214], edx
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.HKEY_LOCAL_MACHINE
call fcn.004218e0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xf
mov ecx, 0x583598
call fcn.00473dc0
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
push ecx
mov byte [ebp - 4], 2
mov ecx, 0x583598
call fcn.00473b30
push 0x53d064
mov ecx, 0x58359c
call fcn.0044f720
push eax
mov ecx, 0x5835b0
call fcn.00421ab0
push 0x5835b0
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x53ccb4
lea eax, [ebp + 0xc]
push eax
call fcn.0041ef70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x47bcc2
mov ecx, 0x5835b4
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47bc81
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x148], esp
push str.AntivirusProduct
call fcn.004025c0
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x168]
push ecx
mov byte [ebp - 4], 2
call fcn.0047c8b0
add esp, 0x24
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x230]
call fcn.00419640
push eax
lea ecx, [ebp - 0x144]
call fcn.004218e0
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, 0x5835b4
call fcn.00421ab0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x144]
call fcn.00401640
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
call fcn.00401ef0
push 0x5835b4
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x53cc9c
lea eax, [ebp + 0xc]
push eax
call fcn.0041ef70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x47bde4
mov ecx, 0x5835b8
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47bda3
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x170], esp
push str.FirewallProduct
call fcn.004025c0
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x190]
push ecx
mov byte [ebp - 4], 2
call fcn.0047c8b0
add esp, 0x24
mov dword [ebp - 0x244], eax
mov edx, dword [ebp - 0x244]
mov dword [ebp - 0x248], edx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x248]
call fcn.00419640
push eax
lea ecx, [ebp - 0x16c]
call fcn.004218e0
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x250]
push ecx
mov ecx, 0x5835b8
call fcn.00421ab0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x16c]
call fcn.00401640
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x190]
call fcn.00401ef0
push 0x5835b8
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x53cc84
lea eax, [ebp + 0xc]
push eax
call fcn.0041ef70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x47bf06
mov ecx, 0x5835bc
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47bec5
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x198], esp
push str.AntiSpywareProduct
call fcn.004025c0
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1b8]
push ecx
mov byte [ebp - 4], 2
call fcn.0047c8b0
add esp, 0x24
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x260], edx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x260]
call fcn.00419640
push eax
lea ecx, [ebp - 0x194]
call fcn.004218e0
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x268]
push ecx
mov ecx, 0x5835bc
call fcn.00421ab0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x194]
call fcn.00401640
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b8]
call fcn.00401ef0
push 0x5835bc
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov edx, dword [ebp - 0x1c0]
or edx, 1
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x544a84
lea eax, [ebp + 0xc]
push eax
call fcn.0041ef70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x47bfb4
mov ecx, 0x5835c0
call fcn.0041f0a0
movzx edx, al
test edx, edx
je 0x47bf7b
lea eax, [ebp - 0x1bc]
push eax
mov ecx, dword [ebp - 0x1c4]
call fcn.0047cd00
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x270]
push edx
mov ecx, 0x5835c0
call fcn.00421ab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1bc]
call fcn.00401640
push 0x5835c0
mov ecx, dword [ebp + 8]
call fcn.004100e0
mov eax, dword [ebp - 0x1c0]
or eax, 1
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
jmp 0x47bfeb
push 0x530754
mov ecx, dword [ebp + 8]
call fcn.004218e0
mov ecx, dword [ebp - 0x1c0]
or ecx, 1
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00435870
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401640
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8