Function at 0x4044a1
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413ca0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4ab1c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x24], str.TnM78vO5vUn7IhdSMK5ERqn7jmSXHnWffQ3aKcFK6TSNPe3WjNEFMY8xKuXn8SPDNFksnepkwY4Ve9hUsjDzAzaDg05EqsBSdlYfkLD9uUA90R0rj8jhuDobJMxLiWkPxEKvbY10CeVdWKN2pslgTzLn3tvO7IGdkBFMG2jYtcp5AEV9MEDFpNlO0vV31DVFyw6jP7lEBS9N6Xa6SswjRNdtl5DPL6TGFXJWKp1Uv68zoAR4DLAAg1BIO7fIU1YFxKCbPbl7Bq8L5VYboPLBOVMj4mcnDNaVxY5aDEmUjdMQyQrDgXyhnMoceinrHqPMWmyJrzwuwhtBbOBgAkR5MrhXmWBDhT8sTbg15PrBLIs9wM9CUF63DcLcVEkVojXPDzqh4n9hR0lV2uDSK0epS5P87CC7PR8ekTBImmAEppxug3yVstVS20UjpKNYr7kC1C45wVb7jUHoR0npenzJaKSvCyjk71gPwmOBF5MlN7EawfuL5bfGU26NWdRXQVzqzSv5vFGitdrq24hcPrH2zqjuQwmLKCPHC6wLkvGae6jKfa4EbSsxUpNb9TRzVbBM22XtXg0qhiHL7B6QBnFymkfI0tIfDamwWRAwSshNbWi7DRBjqUfQTsMePWpGbtAwnVUH5AEjORTpWPMfOFMN4W35uGCMWpEc8H8o9XHdpsBjcIJHKSyeYO4V4HhsoGUFQK7sgPt2vPEwDbzs20zwnYmH2DuE4nIS1RueajrAWGvIBfi5jAwyxiSAbMziAXhwUTyDcpwUXoQBvlUS2mQJkr30A43nEjQ2HSi5g29n4VyTPhmVv9BWc1JGJ4DR2FzCj0stPX9y5WFm9hx6QWEE9wgBmXgLBIzixxpgYUNjeJtI6TjY2RtMNko0yE35hsWL0XjnmrRL0dtLoarXNdiNlImoLAjP4mGA9QWj90yjfVkhRqHdMm2GvPQyIUC44dO1eVQ3bXwC76U2mrOCpRkUDKYvwpGQsee6n5f5NASB6ylSQpqRWrtwEnmAztrfs2PDti5p0Ybr2LSDmP9otSx13A0mAa4mpBtfkKWAgcsC3T3a0FypVceqS4pDDcRhHkVdtIdFJ9aPEGxiYg9T3sYkOsxy8Rp8PYWGlDTb5Cd5CxeVyjqBoXWL4fMtMbr3mJfvb5LeAm0A7ufX5UN1o4XlqPY1DKUdS7sl3Lep4UmUzgTjXBEpgkzbjws54O1Ja7cAQysOXMxON9GRJgkO4p1QDsXQLi5QX21piqh5hljlU8jCWa54H8hvYJHKNIFKaBqJWvgkzQQOmNIuhXbGRrXOCped7ngJhnlrX20R7FQLHEmnoGIoQ06sTLrBeLw06q22dR2xXfMQwFPxnGcxDOzSVI5SK5cWycvegSJCs7Y5RFfYLBDadaL1GOrslvfwcyEuqPX0sRsnXJXJJBaWrhKOnShPtcyyvP0HGkbyI1z2CcjHOReGJ3BVvECrwa4JiIW5xrdCqVuuGlFgLyMwn9ntUpqCTsp7ehgjM8bC1LmvdpsxKiiAwpKIkxijOXlpraBxvFP9XLKL2qjoph7wF249tCesfnN8CBum2Fy2LeCULhVpViuoxxfp6fEUTeQpXqoN03njVzjyKDeO2FwI6LTpW5lwiTF790Boh5XcXgze95cCSmgsDThdOTt2FACOokm5YlD9pPvrOU0sfQA5Fqh6vyCd6i9MsULfzJlL
mov dword [ebp - 0x28], str.YlhYXbtq54RJMGia74YOqw6hLOwSLwziROYcyhHnGfIhbSqVEaaPJ7OafjKwjjkKhwOXMMDwyz3GHGvfCGYdECgw9DfcPEbCjeyA40KvGBxSS8DOoTtpfGtXzxGKiExm68VaAnbuIPm4zT3mqozAn4eGaGeeV32qSKDvpvM8Pz9IXifAecdKLGYkaBr0neui05ldpa8BO4XxAiRhpFgDWBT5oKnFxeVvPsBEhctB2sjyhvPaEEyHi2PFdry8GJzyQB1XyBNmnLc1c9b2IiQfYhmiBSUuq1RYAF32AALznT2qR7dGsbTi3QKG8bQbD4qlH9bwyrJu6EIA7UqUMfmCllY7TlgRAt6bSVNQtzNSfJzz5JuzFSTNwyJkCgqvQrV7VmjfcAJ11HoGgnjseN697loBzH7hkRbIG6YCod2Ff4pvtgYsA9tMqM1KBkyEdggB6e7JxiRal9lUQtNqXsyxE2q5aIpo7MQpceU4YP8khek2RLhgHDM2Kr6pgjOuReMM4VzRRYpsBrXdku6RaYzFzrd6urlcI18nSCdab20rrPj7mEc9NcfBJFG02m24bf9QTUTJIoTCwkRFpUE2bm8KIQ7tCamS9CjVsRH98DPU7KB3fxOuUXuMPRNrAShIOvgiWSAIStbG6MVG0scuHSxbdKJhPq9TGSSGSLvvhJ3QT3Ik7guYkls8MGEURzQ1DqfPNKloprgRz2iVl8EYD2lCnWWOJ0EVOoDtnqWYgFkDG6qJMWMvyWhqA1JT4jjNMHvpjK9DAJsFrwkgRbez6yj2QsQD5W3XkVzpp8Ex12AUAuHikXwenFoIs1N2Bhu8DgGgxiczX6kQt2FPh5pwwusxtxOzXxLbdxXNGrrqHC0wY5Of5WOxOCqjQ4PgaRslQgGQQ6YwksEqCub3vASny47AmIsEGjx3Iylgadp7Jy1BtXg6AJX79djJxO3NFLv1iaDTO6e8H3vCb90vKHBS5NMQPMDeN4hfnvtD5uUlNahwWvNEHsyPT3dNtcX3kSdX7CWmhuUeqjaVBsv9uDL7gsffxKsQ6OaIWcm0RBz5M1IUviqSutqSQ1vyTjiIynpiGyftlIeWYXc8Ebj4pTRku3yViSijFSEHrGhIg7cASXwExbo5gpED2gTiiA2J2D8jEbqHjtFCdXnbkgkFqdy3rNYlfHKGMMsD7iKneQSlv57RFgdLB8zMIagymEqiGnIATTDKOHXR8xMnQVDBMBP5Yf49HYGh2ktesxyOXR04iIaTJTDFkJKcqlK87pWOIsIWyogAFB4y28HbKFEKTiTqi9AgiLeEdvUphgG7Wv9KcrApSGEQvC33WHO5L1l1y5Xv1AXsXBcMtsGmKd0guLcnLtARSiJDnEdoxurDTj9Cm6zgutxxtnwJil5GNRANSDvxUGDM2qQVesxTQwxvuLrt4wlnx7NhPi5DxxjYK87aeLxz9mLgNSvVJFsvWAVmCNFF85pku0Izlni4iPp96izt4MpsFYiS9drQKX4XK0o7qMbIKH7LjfBvOj8kb7R9Wu1GNtF29vMz8EgmzCY3LANrU1w2PVl17stWYyKGlgzsUJnkp6A65PBEk8tcJy8QjQmGkM577pi4600vrATmc8BC3eLhTejvNiDbcoBvguvqPslguppvqhCLfiaq6kGnoiK0jcw3HoGn4mjvTJ2ulFFy6FoBXoMovhBXGJb0rthvB3uFCH7vUqYuS97xY6NV8vxcF99ywqG94YdDbiu4odX2XQWHpdDYNcl2Wcc17jgqTNuTFnrRnogJLlulnIVXGoh6xilBpEhdni3oLIGXNXG5OxetOG0Ru52jKwIDJj2aClhAKYoBSyhEFLFRvnQ9v6LNhAKpsyGGz1kurJdkfrhY1Jg637dPCe606N0e23rXXu1BfpeXLx8EBxlrQrvph45Bxbgq0PnVp7SWakXyHotggGjYc0TWvafzglxmXlzikl95LJrtBc9oR3qz9zbXUVx7dw2oCp4xWMJ2cJ5imMdGpTVOC7TwHGoIJF9TJfNUndjnbkMTcDUMXU26nGkdDCH9risgatIpuvdd2pUqERHjE9TwWun82PLoiBNUO6HM2Ht8CLhgCefXG2C2KTGRPioLApagHvAByXQgp575j9ppmqfg0oDywSMNVcMKUs89sDMerUaOeBfm3wOFLCgQdmEji44QBa7uW9rakJyEfl2vdYhsTlkTvo9oVKC21acu57FKhSV5yCeBlMxz9vhmGuPmsFhLrp2HHf3b3BmNGrvn5luL08irx8MQMP4yifdxyrO7Y1mOspLB5rXxRreOsBtJcUeW4qi58IXM28To3I548gH9TKEKq9Saheasg4NhNf9UGTq2YiIx4ntBazPVXQpwUIwCxFaJKiKK35Ny4DaPLJWItvLDdITvn0a3A9NV0kP3Loo1sV8MhHK4vj7CRDG3fh6hdO52nTb55pXIFWveD2tWMSfadovlorzUhmj0xLiCPALgtan22PGsDih56ECR403BHPLz1Mk0okvu3E22EDQteGXEYXFmN7bVvJFd7Vd2KRjxQ809PnrBxpOJRMMPvAOANUcd0nu2slNMFXXgWkRfoV2ElsyxoP0cLCuyDouREM1RDbQjsdrxqPtiAd01XV1qDuB3QpdT39tHdpKcV7wp8RMYlaC49Dj0KyBfgYl2Tf8vbV0UWvlxMVfEVkkJ5gxCwgstmOiD7KpGDG7off7ox3RHhCxnkOBYro7MqMaD8iaX3fNCAA2blnm3RO5zJXyQ4at4zPMsWmIk9OYAOdcSYe88JCgctXFX2amTL8E3bkR13gNkR9Gf54iSxAPm4Jq76oBGMUYS1sNxb3zQLNxL5rGNucYtkQv41eXzeCHUcUfFhkQcB1ILe7NRoNnbrvOCGp7twLrE5KisrQmrw0agEWTyCE8oSypA57J3X4v6xUxc332DMlL4hWRU8RNlvsBOdTrKBlWL7e2tRX1TI4nJPhnrqvprrlSacGNMozvHPrh7VjFjIwLEVdIdWJaruCD37hvlilY4z1R1lgdzLAC44M9XjPB9m3vaG92JaKCFbrjTnEJygEw55FkH8PT51r2PGMU0rvBVMfpei2xpGGhAC8vw5AetD0QGb9cBd5Kj0XdVYFqBelriE2SV8sECuLvAecNKhGDHg8i1TxchLusmnAjFgM0CET9hTovcHzFDJK5YpFyKBCXFS13NpYempL37cIClUU8uzimq0pFLO63qzd2OwADYYeMJNmtFNQ5p1Wnz5x0oarMUe3V4GUYfqx981JpMztlquBUcUne20ogt4meH8VysIsgBLqKkSNvmvOgDFBkqmUCzDS8KbkbxJcsOEeT2KRWRLTfRpoxBR9WIVnE1nu8WenlIU8fGBBKs5Obn6onXQsqwjuwalwiJP7PConbceUQqriUgxFAeencDvRhEScYy6X49Al7vOERVUIOdvKdpAGqOG5cOT25ArVrgFEtFYCeWLbJrBDyT8mkUmFkNteXDbuFeq7JOFB8hnt6OkJbpIx6Or7vxMFy5xwFEhKm9hiwyh8MH6YTURAXxhRjQd0fPArFviMNUxn7d9me8dFPOH797yl6meuWsl2a2bDzvDsnzK3mCQDkL1RUHnQWutb91EzQPiVck58AI5ODl671NdPyxcHMyGMLdkNMOCwcSNTJCd02YSNMemcjTVbeDOIki0TdgNp5N8gB2mC1R7RNJakwbPrGFR6L7evGI6QsHMEKyUoAQuUtiXPtOxHmr5LD3sF28qhRnQstCnJhpG1vfKuwm82cwJfW82YhGlkUCP0QtoN7ycFQe8j0q1wRllKeS9oN03QckCAIdLpDStRIeothH3bR8ugxvVnbUmUlvttHJq7UCN0CxpoJWq0rYWnsGoNiGKKYc5QaNr8wupYhOKEL2LRBNBr4Kq4hQnOMxsQeW1qyRm7I0B6LQ5H6iuwWzOUxiWMoK5COBwDCEDbeoMHbqKju3LmgBeFJdSuu7McBXs7Pm7qmBLHrOzv4sMoATg0M7e2N0Mz16rUR3zxVAFu0eH0SHXM74l4UTDD2SHKfSgMPoDD0DeIlQHuNQVpujOwyKsOSfyDh2OcrCSlVjObW2xCpMoNTnWpsa
mov dword [ebp - 0x2c], str.ppDEnKo869QvslYSlFtcedH52tJbcBG6u60PfzjKPYg8Hf6Yes3MdWX1QLtYmDM7HbMI8bfWh64yfS1rWilbhRfeif1fsKnH8nu1udgylwjr7EzVFqnOl1w8bbE1IvYPwT9lgzN1bk8LfJtghzIYNF9HsTQMlbXCnwobLrAq7zIXx3dmk1yStnLDlH4osPtkRupVQfHvGknOShai8vBAFYnfdXT49ixlRBYRLHxDFHsv6TsjDlc58yirG10ss9YeXataeLPPYNoDV77Lxkfd3t8Pwe5AoLtErWPRpHCKLLIajX6uVFThFhrit7xtszWsNbKaapDN8Cc3wpExzbRbsWaAeCDMGaXarrzYiJ5gv78yTb4cBS7PXy4l44rFwXPOY3No6tuc4I0R3C1uTxfHcrJTq78hKcoTNrwauxhewwcjofXUULlrtzXzQOOzVbbtUVgpHs7UI13UcI3wF8T2rBLHWBygwmo3SL2qjrPRy6PywO4QM1SG4MkFpknNJo1FQ4hQdktIY1PQjuzXrJKSG22Q0afrF0DWxNRxBAj66sd8hMOrovloTRvCzK6ce6EVgTcD3kME1u9z0WKn1p0cGuxp36NO7G4eT92xpjy3XwJ4Rj0mcquClIaDqzcRUYDYUcESTWuYdq3g7oUysq5bt2zJNY4D2gOMlCLE4gDa9o5DMMyyQbqH2xcbkt9bD1LOMSy0KVige5NmKjGy4kGhj0EqfC9mOOlJtlBpahT3Wt8pJQKdjqsfRLKXQoGJpp6H9e0BMh9gWYWvhuUIpTLdFTwjy7nI9FjraEgAuuUETn4bJp4KK683Y4cXPwLpwBV9tFnBrdh0yRgEjXJzicuTmzdueKnIVpDxybKb9hv7K0hY0BeSAkhcKmdqnjCixlNRvXi8qe7MqJMWFYvWLukzn31jX7XzlSwS0KltreMPysq70QfxxyX0NQELNsIKezxRg5FyF5o7dSNOu6PUajWFXDpmJ2fMOamC7swXWe3ty9r8tLlSvqv43VHJITMoDuaqWfAypK3LOLQV73zL0tiUDTcuKxz40AP7LF3rvnTVjGtPog0nFRsdBkJhWPM44zY17Ut03tiOpcHe8RP47YyebDnLt0xpNKS060USb39mAYUgYuXHu3DuRUnDAHVS3wypsPU1kKzvn8pQqQ0DyabOzTdzCX03ptG8sgoAhRTbp8rGKQeMDl8gtUyhYdIdniFz0YN1akCnnQee5uFwDwR96Yft9f2teQDDuAY3oHt33xWHoX1O2se5iJnTHiQF67oMXygDKcmciRI3sAH4TQwVGNiLLz2P7rktU2v9mTv91drmMSDvYou9mex3b0sjNv8mgbPTK06jby232U36fr7AWUj08g3AE2g56lBBzPdzc0KNXQNbvSEOqu88Ex3D3UbiG95NzCODOd23eaWMazUz8S1kfxh8BAuYqgqs6rnlTKOYLEV3nJpNB5ga3o952u50qRxDePy5AvaWR9bvU6potjFJAK8PoJ0ruFrxbJpVIHzmKICFDKLiVfWhAWfiCVxH2Denx2KPji49yVsm2YiyuvwTRY1Wx6iv5U0ujx9ywR9RkO7IchQi6DBvnBtSTJ5WmOPiS5VFENTAXQleVliF6baRgfbKiM1oaVSf1pez86R2hW6HB5vYcBWxJ3cKfFszvYgTScUwvw7sYsEgiBnzvksWfQ8H8c2x0V8U
mov byte [ebp - 4], 1
push 0x41bba3
lea eax, [ebp + 8]
push eax
call fcn.00402606
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40451c
mov byte [ebp - 0x11], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013fc
mov al, byte [ebp - 0x11]
jmp 0x4045ce
mov dword [ebp - 0x30], str.6Q6qFXWejq4UC7MIQ516lQwAaU2DiOVeVHX9ClQ3kBctIfUGjq1338m3xy1mkghBoj6s620BmXqrq07uMe9a4poePtVTQopPUhl4xB7RdKU2Hy52Khf3fmIQBQH6Ydckv62XGg7OIEOgkcdLheDyMeBFui9yFP74M9WoDR9uPFbPVoCD1H2NbXwteM5FGxntVFjQQTwTxg2jVJ97a8Fdh7a2AHgAEIVyGRM82vM6VemVCVicwScpfSo9tOod0WoMoLxgiqG8cM7K6SimsdIky7kEPh8eYS5aXk8y2784zy9Ahz5CWeMa3ifmIC54Ho2fTnAzYAi2nvk1Uahxv0rmSwC7dNPW5qX2hCrbdzu513qnBWe9fq8EvBcMvaTPP6l7HGCr6ninXUdLKlWYQiM2KUPgToJuAEhws5vKo0s3Mjn5AWdaAlMIKwErICMoHvCSidYK72Ue7MyVcsrfi9XgW5XdolqPqbUhDlkjDJQ6EgoKtJLnpbAr9WgvprYQPlpjqEjCG2CPd6pG8M59TOohs5hgndJeMO48cd97irLEF08GIITInkz7l6UsWkWx1zxo40utN95JV72rDOvJYRLwydj3QQN84FafJOsFTWwm5Vvq5wPnss4ldmK1Tdq6jn2ousDVDkhIbmXR5mzk642HK3No0iViW4SY9w3KkoH8qFGKv34MNuDWUrba7jmm0fbLaw9SDQpO5z0S3pou2snKNmNojSJHkz8XxSSmB797t75KfrkEQA71OfO6G30sCRzjRUCtwcVi3L9Eqgk2RleTIdzntb4zo354iNeM5LVIholGL7ASi9xQzYAiV7NJXdX1yCX6e7yGJdIDhqY0UfjALUBXs11oxzcp1lAvjboA5Rm6NH7G4Pf334BttttN6ur6wPinXzeM3ofs0FfJHXwvs2HYurVUrt6nzRIj8u6EqbkOl7nulAMroahB7j1vhah6d4Yd9PbC84v4a1cL4x6CymRw2Mp72lKA6XCdC4S46eDQBu7XyxY5YdgTX3DY4V2Ip1EJvnPrngwBEKdV3er73VnUMChct1kTWwyt6wPd68Ww5dj5n8TjsoqOnqOzfLw15FdmYVTOsdBxxoTiXBftd5JMILFGayesLB0B7HhKIhamuWd0L0QHH8U6TmgSQRLcugKGLwmvgrgudH98mstnzlJX3hUiMl9DozJnwKMBuhsbNBjaT4o6Q79Gp2VMdI5L8gFEjnpyVHiqfI234MjLRwmxfuB0fU03X1KNn2dTb3f0hikgbumyigKOXU6nP01uKoBmjYueT0ItvHVO7UbR7GTP1XA3I8XzROj819D5OG99mrgekHOpELCWVGb0vFnlkCpdI4j3MAQ56bswPnM8z8StkwWVC5slG3TT0XmLGB79NGlggm4fQ2TNSjVijXcB7bePJEQOvYcUoUttLW4fLo3inf4mC5bHk4hRaB0RiphMAV4L9mFSYKXlEWj7ukMJByq9NWhzcVxTXW5eJFdarjrnEqwkDJ2jRts3zrmzq059UkatrSsorRuNm4xxCtGwysDgDs6yhrVcGxEBLPE6CTk4QE94PRc2I7GHx5xf8u8tifChOku7SxmCjm6XumHWXSKz9VXkpLEdEdOEdY6vxudXWJ44Cy6Xt6slEnQyEhomrmGodm5BbcHy6KGX7cTg32RJzmRFsqeEeKpGBTu4JDRT9KA3Fapw2MxKJtTqwYYAlyPfMUNItvVwztjqOsyWkopDlY1ABarq19xhKCYJX8kYU2l1Tf3itKUURJuYxvkce0Ow18sw8rGMOVas8OfMxGWo9gPof0lGQHBeHq4Je2PxY7bbuDdbcRR7lKIEHX6tz4Baxq7lO8PNbQJoPhJKGSppWY3A1bcSRWbBMSovNDVbiPa2PsiiOeRRLpU5jJbY6pqljs6Jo2yhfaJQY1670eTlW7CYPdxEpC9HxJUKbvnI4hFjB001dbGVWOFbStJvNUNwvaXz1OebP39GRwClYcN3ATKzPQbW5LB7N4Oq7rbhKJh0JRfWtkkkXlN6b2c7TKsmzGwS3quI4Ya22tRdnuKGyOTFr77UIDVDA8zJEuCc6NQknTb00v2j8Boffzc4RjmObrR281fogCidgQCHc6BEODLMigE0sMJjfuO72Xe32gsLWbggoPkp2tLhmrFVsfL4g5hzb1CT0VfQARW5EfvzykjHiLlQDYRtiUxhKqJGNet582a8xFVnt3w52iKuCrax0xllh82d97YOkX8PgpOle9IsArVoQdsGzrUaBFceP0udO3MdyBReyItQ31ROB3hVOYSpRg7xLBIc1RJIKjc6xzukAftNXMQK8nm0zJRXS8lrc5koNtoeA5HWrIEbSs6bqNV8xAKmd6XnrwyJ9VueqliPVrfv6dFJgfBeUWhxRs9dFbcNTo0T81y4tN38ckSsJFP2cz6n4xoVDaE8FuQn5s6LxyNazgLVxQyxbQaK33dhUH4MIIr01DC5GSctvy5eVu9YYQyza71KTeioPsDqXa6axlTH1WhVLcqT5fzJQebCPfS1o2JykiGaPRvg3itassG3hnJaBh2ULq4hmAuwMVLhmNAihyxw0BEvFcLN1yRsBBNjhc7NnCSIXRDLiU1bXWvyHkzBIIUN4JJMgOh4swNFCb9mtCaMxBUNb0gyuQniETfP1j6iJtvolgvy06WvqDW5a7bD7oo2MloaMp8GdVa7f17yVT21WY9v7dPQub4QDsUWrJqKfYa6vHgp8ILx1sxrMrWdBtrqfJiUpNrgun4Co2gPhpfM3LzyhDuKuSw8tQHhH37eXvEYe3knTVeY8x8JXeyxhqh70B1MSKOWYnVurfDklqbTSgBaCjvDcvAkkVNH97oYdE5twrlKN8hMvkMhkDR7vVmsOUmMee98DDvf3UwugtqqL0VLszo4zSnXCLDkq3NvyiMcFhe6zYb72sMDK72CPVq4KRm9EryrEcIF7ysXnkQEfKv6hWVTP4dK1ISyna4zQyk5da9cbmppUQJEolr3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
lea eax, [ebp + 8]
push eax
call fcn.00402ad0
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
push str.Name
push 0x41bba6
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
call dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jl 0x404584
mov byte [ebp - 0x12], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013fc
mov al, byte [ebp - 0x12]
jmp 0x4045ce
mov dword [ebp - 0x3c], str.nUMwO3BFFyw9ELt63KIWkjh91o58HRWfXeuNBN6oEsQcMSaPi51cBlCYb9Eb9EdCUFpaXheuazSfr7WaVbTovJ1awMBvdzXyYONRBLLD2WlKkSt8MXqAFwRzIu98lzg4wr0fztfngmsN27DbiADU6CkRx92DN2muyxhJlBW2XiXX59B2zmAAcXkAXjvcNKQtLiXOKiXMoU8uQNQMkQnTLpz32hmwr5x0s6o54B5EX7K8Cm2OWN6b0Mvr01RXFHwnyzWaTCUtct8gyxaRs8QTtPmKddPqmR8gEtYNhjNSMi4NIus0u2Ly9j7NbhAlgb0CYPRMCDToywSh3QqzmO1LpRxgwiXN2L2KpR22Kv4ktTqMpHOjY5JcX99A42jrbalhqWSuPKXNDN40vzGgXy6A0Je8H1urbpmacIQctd1OilF90rjNudjM29PYvsTBiVMFuXnhECpaPiC5lKiBrezHXTL8FepjLFxqKJWVIH6tLcQc0ppHjX6k9pEnzXttHXQn3e2qr9MdLfKteJNsfY8Hf5NkGWYE3FcL5S79YyXEFlgtdxOx05V0nglsCepVJ3jcdkJuRuRVn8Rl344X2eLq2ga1auHYuNdBpnoY2vxX1TvNG1s5mAVi4kT7dbk409ael5DdM5JxMGE8Yy9wIAHXKEXHPpj2OGIEgE3PRC0f5dleHiyjsLpTLqxyd07hmxGM4yaClxEwoU5wshnKwXnD8JzeFuNNYd8RlqBoJbKBoTS4M3zvz8XNiFKaF7SaTIorf7X1UObBQ2js7ykxQuw46eAAQMrwfu4qEERvaHupHPpSJebbgrrcJohBWb2B0q321jVU836L3xL6RVP3nA74P6Q7RBII4TrNrxPnTY8f57usA1l6lIWzod5PC89IdHEBH0e5SDtf9baTSfYC2RmINzvkpuo6a5mFcxNmV3OYK7VSDRhfSeNCQXqYw97SrKuvWfgyigBwwVqwAy4U0fJoG8S1rfsGvTfYEnj9yc0IgqNrpsqU9vCjTJKtJE5HJ75iDoGCJO1jQ2JUDaGOHQWErtCebU9ImuIWOX8BfWlOnVqIHJtAIieQETPYBjo4uxaNP0pLRsvB1YxfVEFtP5Xmgzxg4NYGaeF1UyiTL6LR7JkuySp3nDIIo1DpH4G5h0K6WUzOxC9C9uwXEP6fjA2zzFLDPsHlDKeRsz4r9FrJKdmOfmpjdMsCHXoWS4P7XM9vAeBLUVdQFzBKdLhMjgzE5fFbrFjFNUOtaJ0SBXLvOWy2kPUBug0wpOA0dLWNDnPBBf8Umkf2dr0wgMNYgelbJYQU5v3UPR3121R6Fusz4PfFzgFtMPeDyWXe2Oq0ExAd8y6KuW37GB8tHqvWQUi0JSa8dgqAeYOWiAHg74pvyXYx1OAETwcruUuyUaSPBgpow1C6ddFmfNF2Jvr60VDcv9ImzubqIShXtVLMTGMawHzHXXSaSBhCLBoaIWcFmNAupF7WELpeg0zSJ7X3ScQ7KhRq6XjqgsM2hJCikE1FuF5uWn1h2z4ae6crwDt81GB3DRfAcxNror1XoyCHWPEkpXek0L5O7O1kHY1GSwLmgIOqKYFuUengTIA4DS66UCgVkcUxsFE0xCrsBpgaQg0GGcEpJcX7IlQi1P09k2XPPXlkq0Ozkzjo97zXGCGFEEybRtiAlA08QhxMxsXQx68h2bfa2LK4NGpEFNQ3FgMYuMufeRDwkSehv5nit08e61J7PLKLWW8jJoeDCM3obfur7popQkoDnG6krx63atDRJLivJfBCdFIRNJus6tyoldll8sXkHDCfOdIWuI5FdQNLTAFcnSa7Cvyxi3v4kccRnM5EH7qmyGBo8rEaTHj2I08ER5POcPfW0drT5NTNij35AHWM5LzW3vFItu8eSeozpWovcC2v8Y0iLLPisC3gRm78otw0lX3Dr84UxRAdnfquAXlJGvlUmkAAumeWSAoQ6C47ufC40Ofikzg2AoBsAAy7kJrUfElMwXxGiXsvCAqlDPcQ8Uu1xOG45lmRyABNYq9M7EFjtGUmAWrLpr9f29X9ybePjOE8UW39Yq7ztsJcE48aE2gsO9BmephTpJHMQcW5RNRJ7oSIEg6des2uvO74bpMh9DMDuy3tyNlyAfmTPBYWGb9MEEfVaJ1cdOCoG53NMRb8IVdNO5cfEmRjEA2Wyeh1FvMypxc79UgQVBuyDFTMWRUHN0KtoORaXRwuMqe1aiLtkAgmFh04vjy5iIW8kI76X5Vm5SrIbPa4DqAuJKdqoVxdd2uUElmqUcPbFPz1wL82gQBk1UX3RJcqwHqakfWMshOL8PXgkRE7bPpi6ywVgpiA7T7uVfgTBjdN7bonEgWl4w7VVnQT5lbcIibRHmGBKfbLsQdStzx7cgSOT4IBXBEi0YvBuLCKJYBY8zfSCUb8xBQCJfCwI17vtvfkNTtkKp7AeHQ3ONTsDke8AvSXg4o5zSO0MlHmmi9y0mVCGc1qJnc9Ymw5DWSLCATRfWJ0ypSHOmQqJz5LGUWAQknO5zuWOwqAAG2oIthEebwRoNVuYlHqwP1YTyCzh2D4TO6RAa3QT3nWVeDWLcILFhOcDcd9XYYARLpKj6FBCSkdxEBPNhfIo0RURwGMMBeJR8utrQp1liQNhlq9xxxvcj4pof2auFnrSKQzUVf1aAUr9XYd2cTrVr2M6LHxKjHWyG4B2Q0pjM0qXHtIXBBUSDdY4fIK7cJQ89Egv1bKaD6Cv9jDGn0lH3KLruyd1oj2wzdhsP7wcyIupoajchpjrLDIA1gTNssKkBktnDSV7EU3bUYn6kanwRwgY4noHmyyG7AL8Hj5ENeUfI2NFIDhNoVEdAVQNycmt8E80j1RMwHiUdKUNPdLth4W3dvY8Wem8T8BFDn4z3VUpgUl4iiFauX4nhc6ATN7OTFlaQwdek1aMcx3CSgWRRnJePB5VckufLWyW2mH70yU4OTkjEyAXhPwMDPpQ6sHPnExQgyLHqFH5lyLBMCFguEO
mov byte [ebp - 0x13], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013fc
mov al, byte [ebp - 0x13]
jmp 0x4045ce
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18