Function at 0x40a860
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b888
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x48d870]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], str.UsI05nyvFUMeIASNsWR73E40OnwYABLzOxRMdsIkI689Be6u1slQtw215b9yh56dvbuSo5VGMDCH4hSGILVTG0GDkx3jNMl1lUL2C3QBfgk35saY
mov dword [ebp - 0x2c], str.azQGlqlkeTxDLWr8CBl9RpteeYWkUaqz5pPy5RbhKSVds0Q4GT2jfxCxEEA1WaalfufOFwB0sKNCs27HgPOFGRVMlFKbxja9NrBRxmRk0Dhi9JXzprjXn8yyBlmhzNO09c3i8pv5Lxziom2Fq5Havb1ntNtxppsmY4nWSOx0Ye6sAIPrRtQqhTeKN3jSXxi9gE1PgKjPAmmhDfLKyDg8Thw68PdSE6qIbS1aJwzdhn3WXT7WAU5PDpAPPOFRoDPUe27mPsuMyzXpvf5Qm05lJpwi2qjRCfo08HE420B8E43g
mov byte [ebp - 4], 1
push 0x43498f
lea eax, [ebp + 8]
push eax
call fcn.0040fd10
add esp, 8
mov byte [ebp - 0x11], al
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x40a8df
mov byte [ebp - 0x12], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407d30
mov al, byte [ebp - 0x12]
jmp 0x40a9ac
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30], esp
lea edx, [ebp + 8]
push edx
call fcn.0040b2f0
mov dword [ebp - 0x34], eax
push str.Name
push 0x434a4d
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x40a944
mov dword [ebp - 0x38], str.Ki8g4ssztOegdkhEj8WkWw4fzC9LTRIMRAmFYuEzPw74pNXyQlkGvFREvSkjmvsuUfWEevOYJj1LQVocaldatsLTDy6eKxyLkOEyoWQVyqTsKdPiVR3o5jJjhKOEFe5hvG7QNJjn8k1Px9E2Lo9cdam3gO9lSNb9NWLbtjhdJKYfPegVf9AwutKcNo7Kmx5QvuTj7Crc5IGGsYbVSblsgdDIDn3UjJ5gRXD99b30lwpMtX1mcebfvRltUTBy6GyE7MSKGWVbaFIO5IpTzRHeXqHdeoN0jGXFo7qiAsxbDYxHKQ7GrpjW4obzEzWeJ6PnOTP7lHOjiw5Y7UWd7Th2WPO4HQuqhioWbwSSOMqFRnwQisCaEJtFs5ziH1qO1ETTjHU8MrcSAVGoxJ9ILYW8cwJd1zYPPVnBWVuu6tfVwMdid6BJDXAOw7fad4mqHRQ9PHo3qdGd5IsaBR2md95edxVjA2wkKSTazWKa8cDe0uwn94Yfgsr9GGIXSVe6e7yTE4WAacfvtMhdqrxGwgTIXFssccYawpr9vUBl99EH3gmI9sjuyoYpKN6c3d2JakEhoNBOle2xFxbMaen6R8u1mAxHjirSP5Mhut9IDNyMFbT9tDovOdrDLJJygK0ulFYESaC5AprjMEtlddtjFObIAaDqANhiEISyvvLgmQS58tALDeiDyAg430d1mDCNRAGEeWeEyh1rxgW7r1ww4SVs6EF5reGbFKLeOoNMRYnjUFLPNO3Os2cdz9eAdjRKlF6lDgSaV3zt2mYf4WjhgyQw5PQj3ErYmAHfPFpoQAeMmgpVvcDzoSWFkAInKAjL3bTdOpFgQ4bH04xfrhcAktQfvTafbMbtlzCmrUxgTyTAVG7ycrxh7xHoPnpmaP9v3SG6lBm2XaFaGYjb94nwVbNXxwUyTVXcDFKa6DLc3mIVyY2UhoRqe6DSVfbunnam7mXxyNCnfYd9JMS79ACoNEU2oRAvoFSk4kTvVyXgKigOaI8CSFE2MSzlo5uNBn40ENABMW6uMWYJFbMNbzviDpGIsXchtghHERvCYIrMHXosTKyym78m8xA9e1XBkdQmnAABIdGQULuij7PgfYWEobMyp41ghfMnIOfUvqGoTbdlc9JPkONUPU1WKpwsixLEboj9d0wadorsGN5HB536HodYywDf3abqc1nvkA47AUD5re9b4q1RvCrDM3P0eMCcRxyyTYgx2Nu7whxjjRJzosYAn1xGNPOSQOOdl8lPgobr7pViVC9uJc16ErD3bwEl9fVCo3hgjmLyGlKFpqSo77MRT4OSpyCgctXCWM8rc559qj2PFjYCjtDXkrBbgaKgTolDbo0mRIOYb2k55AKfkBYQ8Qk5e7FPDbOMqU7sfcu1xMOBuMQSkPkosmcOsEAndhsNcsJvcdrlLlfvcJhSIufNnNbNQzgaToE2g7gIwfQaSYVJVxk96WoJWJ9A0a5lou9wyY7F0uGQxwLbTwFigytdayJPbgX0SNXTfdNjlVN
mov byte [ebp - 0x13], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407d30
mov al, byte [ebp - 0x13]
jmp 0x40a9ac
mov dword [ebp - 0x3c], str.cJkQB2bkz8OoBKs6uUqPBl9jXcXVHv2jtppeOX6DreyTf08mge8SU3JPlS4NAjB3VokiJz2zAKI0mPT0KNn3tjP3Qke8BdJ7nhYcSMCuMWpz4hJ22nNLp76wcFWPfYavErcbs41Ffj25HlCT9tQEwUIJBi4tboGAv4xFopXhFDlFN6Ep3nLplHw2IRKfigc7C2tdjiPmaXq67z1MH7GV5XQFFjuYFoCgF1fuwJxRlAGNyQVCYuvdHJFL0M7bCD0ziuXl5fxBf5SPh2IUI70pNxwnJMMYCOsX1DwJIRUkli2QCcN3IjINIpvpl1W7nNcNnqGMQakDAjzfavEMIb8QvUjEJsh6hNrjPJyx5mqCBG7TLrXyEQWTI2q0WveKE36r8gkh43RC9hpIxgfaTBzwfS5OYWwKuOMJxKOtgy6lawLQVrvbHwL9Xj5vqLflDl1GUleTYjGrmXlXA2dQAWvEFiEdpt950VHLT3S43j54KvVS97fkM3XFHnWxjOyCsXalQGe9NbALClXHhRPLjMosVH2yNWwTWT5NVSS483uBt3wDDwDeXXf3IYNKLkD2oiyr58AonHR38rkcVsGLjf46Vv55oHfkKK4wXIfrrsL3DKJ0S3omD5z3Y8AY9efiX0sg3MQdIe4YlvJXbMzV3MB0MjUkJkcE3L0PwhAratyHPxY8zeqqnraKK3xo8KlmYXmlp0LvchWuY3KMO3yDg2mPQXQ0zCvuMuySqyOyKgM7SwXpGWXp4ksrwf8mzlbqsm1s5omnkFyLXObFXIYsWUSwLCw9UFvE4FA5GM6wShC8Q6BtsgqwNgcG3s5uDFgWFAsEgOUcVschvQ4SXvpfkC3fpEKY3MPekle6CqNkubsM6T4elwvfW5igkGnFHIjD9iUdlmWx5XpG4oHXpoE6TyUrSDF3sxmxeNSOLdBcLUXqaOMN3kbj8M1eBbf3pEksGmUE1nej6JXVlXFE9zMmnnPKAuB4VMcaExarV8nC9F5ASYrCzuBFaHLSop9XbTVIMVjBJKIXlPkAnYcniWQa5DM9GBnonYG4AGwVT16Nwz0A9okgaEjXC6CVkvi7duSrnxqm16a0Mb70kK319Jug0AEMqJndaiIbzNIJd5fqnb9F3g8WHM5MMixi0MR9zn549LxcXHOXBvxdle5TPebyQX988uVbASzsDyt84kBxPrI2Y86d8poOq5uV07Hmc6ucceBaEXv3yH1hEy4KMzJ82GRpQigrdsNDxGrdagCqimKROhzSwOGhywJd25EYfwfGUKUuoviCFScuK9WuGbcjbVK5WRQjMYdJe9spsB2BpayACdbYaxEzrUMI5tOw8INHUsWHLaymfs0nnC0isHTFbjUzNpuErOuL8G9VqTMEIWTxppC5pjvC2WjkUE3XNMLD6XIMJbA3zjuQqkB2BcsqhVCvhL6v7cHB5hiUaxqFHmbAhKPmbHPTrMhClnH0G24XCEWhijQz7svPbdXDYlX6M8qI82ondVO6jxMyxY5hmNsVHTPuSXaSpNRkg98QCadmQLOgaa3PzwusJEuwTRFPdHbwU1lVfBC70x0BfAoOwCuivXco4IFlVUzRRQTmIPDLCuhBEatkt0PAzVoJwyly9E0ssJ79016JCCw2aVkWkriINjKduPLnfg7UBFNznYYr2
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407d30
mov al, byte [ebp - 0x14]
jmp 0x40a9ac
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18