Function at 0x4b0590
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x4a4]
push ecx
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4ec], 0x63
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x53b5fd], bl
je 0x4b069b
lea edx, [ebp - 0x4b0]
push edx
push 0x502118
push 1
push ebx
push 0x5021e8
mov dword [ebp - 0x4b0], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4b0695
mov eax, dword [ebp - 0x4b0]
lea edx, [ebp - 0x4a8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x4a8], ebx
mov ecx, dword [eax]
push 0x52619c
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x4b0687
mov eax, dword [ebp - 0x4a8]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x4a8]
js 0x4b067f
lea edx, [ebp - 0x4c8]
push edx
push ebx
push 0x30
push 0x526728
mov dword [ebp - 0x4c8], ebx
mov ecx, dword [eax]
push 0x526208
push eax
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jns 0x4b06ae
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
push 0x400
mov dword [ebp - 0x4cc], ebx
call fcn.004e4240
mov edi, eax
mov eax, dword [ebp - 0x4c8]
add esp, 4
mov dword [ebp - 0x4e8], edi
cmp eax, ebx
je 0x4b0d3e
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ecx]
mov ecx, dword [eax]
lea edx, [ebp - 0x4cc]
push edx
lea edx, [ebp - 0x4f4]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x4cc], ebx
je 0x4b0d3e
push 0x3e
lea edx, [ebp - 0x5a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x5c], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x4c4]
push edx
push ebx
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b0794
cmp word [ebp - 0x4c4], 1
je 0x4b0794
mov ecx, dword [ebp - 0x4bc]
push 0x22
push ecx
call fcn.004e46a9
add eax, 2
lea edx, [ebp - 0x5c]
add esp, 8
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b0760
lea eax, [ebp - 0x5c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b0775
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x5e], dx
lea eax, [ebp - 0x4c4]
push eax
call esi
push 0xfe
lea edx, [ebp - 0x19a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x19c], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x4c4]
push edx
push ebx
push str.Dependent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b0842
cmp word [ebp - 0x4c4], 1
je 0x4b0842
mov ecx, dword [ebp - 0x4bc]
push 0x22
push ecx
call fcn.004e46a9
add eax, 2
lea edx, [ebp - 0x19c]
add esp, 8
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b0800
lea eax, [ebp - 0x19c]
lea edx, [eax + 2]
jmp 0x4b0820
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b0820
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x19e], dx
lea eax, [ebp - 0x4c4]
push eax
call esi
push 0x400
push ebx
push edi
call fcn.004e7d90
lea ecx, [ebp - 0x5c]
push ecx
push str.SELECT__FROM_Win32_DiskDrive_WHERE_DeviceID___s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x4a8]
add esp, 0x18
lea ecx, [ebp - 0x4dc]
push ecx
push ebx
push 0x30
push edi
mov dword [ebp - 0x4dc], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x526208
push eax
call edx
mov eax, dword [ebp - 0x4dc]
cmp eax, ebx
je 0x4b0d28
mov ecx, dword [eax]
lea edx, [ebp - 0x4cc]
push edx
lea edx, [ebp - 0x4e4]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x4cc], ebx
je 0x4b0d3e
push 0x3e
lea edx, [ebp - 0x9a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x9c], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x4c4]
push edx
push ebx
push str.InterfaceType
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b0928
cmp word [ebp - 0x4c4], 1
je 0x4b0928
mov eax, dword [ebp - 0x4bc]
lea edx, [ebp - 0x9c]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b0910
lea ecx, [ebp - 0x4c4]
push ecx
call esi
mov eax, dword [ebp - 0x4e4]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push ebx
lea ecx, [ebp - 0x4c4]
push ecx
push ebx
push str.Index
push eax
mov dword [ebp - 0x4e0], ebx
call edx
test eax, eax
jne 0x4b096f
cmp word [ebp - 0x4c4], 1
je 0x4b096f
movsx eax, word [ebp - 0x4bc]
lea ecx, [ebp - 0x4c4]
push ecx
mov dword [ebp - 0x4e0], eax
call esi
push 0x400
push ebx
push edi
call fcn.004e7d90
mov eax, dword [ebp - 0x4a8]
add esp, 0xc
lea ecx, [ebp - 0x4d0]
push ecx
push ebx
push 0x30
push str.SELECT__FROM_Win32_LogicalDiskToPartition
mov dword [ebp - 0x4d0], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x526208
push eax
call edx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], ebx
cmp eax, ebx
je 0x4b0d1a
lea ebx, [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 0x4d4]
push edx
lea edx, [ebp - 0x4f0]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x4d4], ebx
je 0x4b0d14
push 0xfe
lea edx, [ebp - 0x29a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x29c], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
lea edx, [ebp - 0x4c4]
push edx
push ebx
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4b0a92
cmp word [ebp - 0x4c4], 1
je 0x4b0a92
mov ecx, dword [ebp - 0x4bc]
push 0x22
push ecx
call fcn.004e46a9
add eax, 2
lea edx, [ebp - 0x29c]
add esp, 8
sub edx, eax
jmp 0x4b0a50
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b0a50
lea eax, [ebp - 0x29c]
lea edx, [eax + 2]
jmp 0x4b0a70
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b0a70
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x29e], dx
lea eax, [ebp - 0x4c4]
push eax
call esi
lea ecx, [ebp - 0x19c]
lea eax, [ebp - 0x29c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0ac6
cmp dx, bx
je 0x4b0ac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0ac6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4b0aa0
xor eax, eax
jmp 0x4b0acb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4b0cf8
push ebx
xor ecx, ecx
xor eax, eax
push ebx
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x4c4]
push ecx
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x4f0]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push str.Dependent
push eax
call edx
test eax, eax
jne 0x4b0b64
cmp word [ebp - 0x4c4], 1
je 0x4b0b64
mov eax, dword [ebp - 0x4bc]
push 0x22
push eax
call fcn.004e46a9
add eax, 2
lea edx, [ebp - 0x18]
add esp, 8
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4b0b30
lea eax, [ebp - 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b0b45
sub eax, edx
lea edx, [ebp - 0x4c4]
sar eax, 1
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x1a], cx
call esi
push 0x400
push ebx
push edi
call fcn.004e7d90
lea eax, [ebp - 0x18]
push eax
push str.SELECT__FROM_Win32_LogicalDisk_WHERE_DeviceID___s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x4a8]
add esp, 0x18
lea edx, [ebp - 0x4d8]
push edx
push ebx
push 0x30
push edi
mov dword [ebp - 0x4d8], ebx
mov ecx, dword [eax]
push 0x526208
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 0x4d8]
cmp eax, ebx
je 0x4b0cde
mov ecx, dword [eax]
lea edx, [ebp - 0x4d4]
push edx
lea edx, [ebp - 0x4f8]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x4d4], ebx
je 0x4b0d08
mov eax, dword [ebp - 0x4f8]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0x4c4]
push edx
push ebx
push str.DriveType
push eax
mov eax, dword [ecx + 0x10]
xor edi, edi
call eax
test eax, eax
jne 0x4b0c1c
cmp word [ebp - 0x4c4], 1
je 0x4b0c1c
movsx edi, word [ebp - 0x4bc]
lea ecx, [ebp - 0x4c4]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ax, word [ebp - 0x18]
movzx esi, ax
cmp ax, word [ebp - 0x4a4]
jne 0x4b0c42
mov ecx, dword [ebp - 0x4e0]
mov edx, 0x33
mov dword [ebp - 0x4ec], ecx
jmp 0x4b0cd0
mov eax, edi
sub eax, 2
je 0x4b0ccb
sub eax, 4
je 0x4b0c60
mov edx, dword [ebp - 0x4e0]
cmp dword [ebp - 0x4ec], edx
jne 0x4b0c75
mov ecx, dword [ebp - 0x4ac]
mov eax, 0x33
mov word [ecx + esi*2 - 0x82], ax
jmp 0x4b0cde
mov ecx, 0x5268ac
lea eax, [ebp - 0x9c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0ca6
cmp dx, bx
je 0x4b0ca2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0ca6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4b0c80
xor eax, eax
jmp 0x4b0cab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4b0cb6
mov edx, 0x34
jmp 0x4b0cd0
mov edx, dword [ebp - 0x4ac]
mov ecx, 0x35
mov word [edx + esi*2 - 0x82], cx
jmp 0x4b0cde
mov edx, 0x37
mov eax, dword [ebp - 0x4ac]
mov word [eax + esi*2 - 0x82], dx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [ebp - 0x4e8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x4d0]
cmp eax, ebx
jne 0x4b09c0
jmp 0x4b0d1a
mov edi, dword [ebp - 0x4e8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x4c8]
cmp eax, ebx
jne 0x4b06e0
push edi
call fcn.004e424b
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 4
push eax
call edx
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret