Function at 0x412f32
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x350
mov eax, 0x479402
call fcn.00450819
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x338], eax
xor edi, edi
mov dword [ebp - 0x358], eax
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x354], edi
push edi
push eax
call fcn.00452e20
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push str._______invalid_file_path
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x412fea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.GetVolumePathName___failed
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.0040724b
mov dword [ebp - 4], 1
push ecx
movzx eax, si
or eax, 0x80070000
test esi, esi
push 0x8d5
push str.srcupdtSHIMEnum.cpp
cmovle eax, esi
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0040e55c
push 0x4b4724
lea eax, [ebp - 0x2e4]
push eax
call fcn.00452ffc
lea eax, [ebp - 0x21c]
push eax
call fcn.00459e88
pop ecx
test eax, eax
jne 0x41303d
push str.GetVolumePathName___returned_empty_drive_letter._Unable_to_proceed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov dword [ebp - 4], 2
push 1
push 0x8da
push str.srcupdtSHIMEnum.cpp
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0040e6dc
push 0x4b47f0
lea eax, [ebp - 0x2e0]
jmp 0x412fe4
push 2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x314]
call fcn.00408da5
mov dword [ebp - 4], 3
test ebx, ebx
je 0x41307d
lea ecx, [ebp - 0x314]
call fcn.0040732b
cmp dword [eax + 0x14], 8
jb 0x41306f
mov eax, dword [eax]
movzx eax, word [eax]
lea ecx, [ebx + 0x60]
push eax
push 1
call fcn.0040acb2
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [ebp - 0x35c], esi
mov byte [ebp - 4], 4
test esi, esi
jns 0x4130b9
push str.COM_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 5
push ecx
push 0x8e7
push str.srcupdtSHIMEnum.cpp
push esi
jmp 0x412fc7
push edi
push edi
push edi
push 3
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jns 0x41313a
cmp esi, 0x80010119
jne 0x413183
lea ecx, [ebp - 0x2fc]
call fcn.00408d76
mov esi, eax
mov byte [ebp - 4], 6
push str.It_is_too_late_for_CoInitializeSecurity__trying_to_proceed_anyway.
push esi
call fcn.0040b812
pop ecx
pop ecx
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.00408d5d
mov byte [ebp - 4], 7
lea eax, [ebp - 0x234]
push eax
push 2
call fcn.00406d81
pop ecx
pop ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x234]
call fcn.00407241
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.0040878b
mov dword [ebp - 0x334], edi
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x334]
push eax
push 0x48e194
push 1
push edi
push 0x48e264
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x4131a2
push str.CoCreateInstance___failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0xb
push ecx
push 0x912
jmp 0x4130ae
push str.COM_security_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 8
push ecx
push 0x904
jmp 0x4130ae
mov dword [ebp - 0x320], edi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x318]
mov esi, dword [ebp - 0x334]
push str.ROOTCIMV2
call fcn.0040f9ec
mov byte [ebp - 4], 0xe
mov ecx, dword [eax]
test ecx, ecx
je 0x4131d0
mov ecx, dword [ecx]
jmp 0x4131d2
mov ecx, edi
mov eax, dword [esi]
lea edx, [ebp - 0x320]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
push esi
call dword [eax + 0xc]
mov esi, eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x413201
call fcn.0040fa80
mov dword [ebp - 0x318], edi
test esi, esi
jns 0x413224
push str.ConnectServer___failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0xf
push ecx
push 0x923
jmp 0x4130ae
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push dword [ebp - 0x320]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x41325f
push str.CoSetProxyBlanket___failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x10
push ecx
push 0x934
jmp 0x4130ae
push str.ASSOCIATORS_OF_Win32_LogicalDisk.DeviceID
lea ecx, [ebp - 0x264]
call fcn.0040724b
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x314]
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x264]
call fcn.00407889
mov esi, str._WHERE_AssocClass__Win32_LogicalDiskToPartition
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.0040751f
mov dword [ebp - 0x330], edi
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x264]
mov edi, dword [ebp - 0x320]
call fcn.004071ba
push eax
lea ecx, [ebp - 0x31c]
call fcn.0040f9ec
mov esi, eax
mov byte [ebp - 4], 0x14
push ecx
lea ecx, [ebp - 0x318]
call fcn.0040f990
mov byte [ebp - 4], 0x15
mov edx, dword [esi]
test edx, edx
je 0x4132e8
mov edx, dword [edx]
jmp 0x4132ea
xor edx, edx
mov eax, dword [eax]
test eax, eax
je 0x4132f4
mov ecx, dword [eax]
jmp 0x4132f6
xor ecx, ecx
mov eax, dword [edi]
lea esi, [ebp - 0x330]
push esi
push 0
push 0x30
push edx
push ecx
push edi
call dword [eax + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x413328
call fcn.0040fa80
xor edi, edi
mov dword [ebp - 0x318], edi
jmp 0x41332a
xor edi, edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
je 0x413343
call fcn.0040fa80
mov dword [ebp - 0x31c], edi
test esi, esi
jns 0x413366
push 0x495504
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x16
push ecx
push 0x946
jmp 0x4130ae
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x33c], edi
test eax, eax
je 0x413853
mov ecx, dword [eax]
lea edx, [ebp - 0x33c]
push edx
lea edx, [ebp - 0x32c]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jns 0x4133c1
push str.Enumeration_failed
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x19
push ecx
push 0x952
jmp 0x4130ae
cmp dword [ebp - 0x33c], 0
jne 0x4133ea
push str.Empty_response_for_DiskToPartition_mapping
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x1a
push 1
push 0x957
jmp 0x413019
push 0x10
lea eax, [ebp - 0x34c]
push edi
push eax
call fcn.00452e20
add esp, 0xc
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x324]
mov esi, dword [ebp - 0x32c]
push str.DeviceID
call fcn.0040f9ec
mov byte [ebp - 4], 0x1c
mov ecx, dword [eax]
test ecx, ecx
je 0x413431
mov ecx, dword [ecx]
jmp 0x413433
mov ecx, edi
mov eax, dword [esi]
lea edx, [ebp - 0x34c]
push edi
push edi
push edx
push edi
push ecx
push esi
call dword [eax + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x41345f
call fcn.0040fa80
mov dword [ebp - 0x324], edi
test esi, esi
jns 0x413482
push str.Cant_get_DeviceID
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x1d
push ecx
push 0x95e
jmp 0x4130ae
push 8
pop eax
cmp word [ebp - 0x34c], ax
jne 0x413873
cmp dword [ebp - 0x344], 0
je 0x413873
mov esi, str.Associators_of_Win32_DiskPartition.DeviceID
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.00407411
mov esi, dword [ebp - 0x344]
cmp word [esi], di
jne 0x4134c7
mov eax, edi
jmp 0x4134ce
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.0040751f
mov esi, str._where_ResultClassWin32_DiskDrive
push esi
call fcn.00459e88
pop ecx
push eax
push esi
lea ecx, [ebp - 0x264]
call fcn.0040751f
test ebx, ebx
je 0x413506
push dword [ebp - 0x344]
lea ecx, [ebx + 0x78]
call fcn.004073ea
xor ebx, ebx
mov dword [ebp - 0x318], ebx
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x264]
mov edi, dword [ebp - 0x320]
call fcn.004071ba
push eax
lea ecx, [ebp - 0x328]
call fcn.0040f9ec
mov esi, eax
mov byte [ebp - 4], 0x21
push ecx
lea ecx, [ebp - 0x324]
call fcn.0040f990
mov byte [ebp - 4], 0x22
mov edx, dword [esi]
test edx, edx
je 0x41354f
mov edx, dword [edx]
jmp 0x413551
mov edx, ebx
mov eax, dword [eax]
test eax, eax
je 0x41355b
mov ecx, dword [eax]
jmp 0x41355d
mov ecx, ebx
mov eax, dword [edi]
lea esi, [ebp - 0x318]
push esi
push ebx
push 0x30
push edx
push ecx
push edi
call dword [eax + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x41358a
call fcn.0040fa80
mov dword [ebp - 0x324], ebx
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x4135a3
call fcn.0040fa80
mov dword [ebp - 0x328], ebx
test esi, esi
jns 0x4135c6
push 0x495504
lea ecx, [ebp - 0x234]
call fcn.0040724b
mov byte [ebp - 4], 0x23
push ecx
push 0x979
jmp 0x4130ae
mov dword [ebp - 0x31c], ebx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x338], ebx
test eax, eax
je 0x41381a
mov ecx, dword [eax]
lea edx, [ebp - 0x338]
push edx
lea edx, [ebp - 0x31c]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jns 0x41362d
push str.Enumeration_failed
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x26
push ecx
push 0x984
push str.srcupdtSHIMEnum.cpp
push esi
lea eax, [ebp - 0x24c]
jmp 0x412fcd
cmp dword [ebp - 0x338], 0
jne 0x413661
push str.Empty_response_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x27
push 1
push 0x989
push str.srcupdtSHIMEnum.cpp
lea eax, [ebp - 0x24c]
jmp 0x413024
push 0x10
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.00452e20
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x328]
mov esi, dword [ebp - 0x31c]
push str.SerialNumber
call fcn.0040f9ec
mov byte [ebp - 4], 0x29
mov ecx, dword [eax]
test ecx, ecx
je 0x4136a8
mov ecx, dword [ecx]
jmp 0x4136aa
mov ecx, ebx
mov eax, dword [esi]
lea edx, [ebp - 0x22c]
push ebx
push ebx
push edx
push ebx
push ecx
push esi
call dword [eax + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x4136d6
call fcn.0040fa80
mov dword [ebp - 0x328], ebx
test esi, esi
jns 0x4136f9
push str.Cant_get_SerialNumber
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x2a
push ecx
push 0x990
jmp 0x41361c
push 8
pop eax
cmp word [ebp - 0x22c], ax
jne 0x4137fa
cmp dword [ebp - 0x224], 0
je 0x4137fa
push dword [ebp - 0x224]
mov edi, dword [ebp - 0x350]
mov ecx, edi
call fcn.0040724b
mov dword [ebp - 0x354], 1
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x22c]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call esi
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x41375a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x41376e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x34c]
push eax
call esi
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x41378f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x330]
test eax, eax
je 0x4137a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x264]
call fcn.00407241
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x4137c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x4137da
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov byte [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x314]
call fcn.00407241
mov eax, edi
call fcn.004507c3
ret
push str.No_SerialNumber_found_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x2b
push 1
push 0x995
jmp 0x413651
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x41382e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x413842
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str.WMI_query_failed
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x34
push 1
push 0x99c
jmp 0x413651
push str.No_DeviceID_found_in_DiskToPartition_mapping
lea ecx, [ebp - 0x24c]
call fcn.0040724b
mov byte [ebp - 4], 0x1e
push 1
push 0x963
jmp 0x413651