Function at 0x41c66f
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d5bb
push dword [ebp + 0x10]
call fcn.004024be
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x41c6c7
push 0x80000004
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x41c6b4
mov eax, 0x45c309
push eax
push 1
mov ebx, 0x234
call fcn.00428290
add esp, 0x10
push 0
mov ebx, 0x104
call fcn.004280f0
add esp, 4
mov dword [ebp - 8], eax
push 0
mov ebx, 0x108
call fcn.004281e0
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x45c348
push dword [ebp - 8]
mov ecx, 3
call fcn.0040106b
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41c71c
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41c72c
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.0040106b
add esp, 8
mov dword [ebp - 0x14], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41c759
mov eax, 0x45c309
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x41c76d
mov eax, 0x45c309
push eax
push 2
mov ebx, 0x23c
call fcn.00428270
add esp, 0x1c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41c790
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41c7a0
push ebx
call fcn.00427715
add esp, 4
push closesocket
push 0
push 1
mov ebx, 6
call fcn.0040d5b3
push 0x80000004
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x41c7cb
mov eax, 0x45c309
push eax
push 0x80000004
push 0
push str.AAAAAA
push 0x80000004
push 0
push str.cmd__c_wmic__NAMESPACE:__root_subscription__PATH___EventFilter_CREATE_Name_AAAAAA___EventNameSpace_rootcimv2__QueryLanguage_WQL___Query_SELECT__FROM___InstanceModificationEvent_WITHIN_30_WHERE_TargetInstance_ISA_Win32_PerfFormattedData_PerfOS_System___wmic__NAMESPACE:__root_subscription__PATH_CommandLineEventConsumer_CREATE_Name_BBBBBB__CommandLineTemplate_CCCCCC___wmic__NAMESPACE:__root_subscription__PATH___FilterToConsumerBinding_CREATE_Filter___EventFilter.Name_AAAAAA____Consumer_CommandLineEventConsumer.Name_BBBBBB___r_n
push 6
mov ebx, 0x180
call fcn.00429040
add esp, 0x4c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c80d
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 4], eax
push closesocket
push 0
push 1
mov ebx, 6
call fcn.0040d5b3
push 0x80000004
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x41c83c
mov eax, 0x45c309
push eax
push 0x80000004
push 0
push str.BBBBBB
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41c85c
mov eax, 0x45c309
push eax
push 6
mov ebx, 0x180
call fcn.00429040
add esp, 0x4c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c886
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.0040106b
add esp, 8
mov dword [ebp - 8], eax
push closesocket
push 0
push 1
mov ebx, 6
call fcn.0040d5b3
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41c8cd
mov eax, 0x45c309
push eax
push 0x80000004
push 0
push str.CCCCCC
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41c8ed
mov eax, 0x45c309
push eax
push 6
mov ebx, 0x180
call fcn.00429040
add esp, 0x4c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41c913
push ebx
call fcn.00427715
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c927
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 1
push closesocket
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41c956
mov eax, 0x45c309
push eax
push 3
mov ebx, 0x2c0
call fcn.00427ea0
add esp, 0x28
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41c979
push ebx
call fcn.00427715
add esp, 4
mov esp, ebp
pop ebp
ret 0x10