Function at 0x404020
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42636c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa0
push esi
push edi
mov eax, dword [0x43400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2c], 0
push str.WmiGetMonitorRawEEdidV1Block
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x68], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
push 0
push 0
mov byte [ebp - 4], 6
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x44]
push eax
push 0x427664
push 1
push 0
push 0x427654
call dword [sym.imp.ole32.dll_CoCreateInstance]
or esi, 0xffffffff
test eax, eax
jne 0x4048b6
mov edi, dword [ebp - 0x44]
push 0xc
call fcn.0040fbab
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x404138
push str.rootwmi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x404a07
jmp 0x40413a
xor esi, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], esi
test esi, esi
je 0x404a11
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
mov eax, dword [edi]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
push edi
call dword [eax + 0xc]
mov edi, eax
mov byte [ebp - 4], 6
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4041ab
mov eax, dword [esi]
test eax, eax
je 0x404189
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4041a0
push eax
call fcn.0040fba6
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0040f97a
add esp, 8
test edi, edi
jne 0x4048b0
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push dword [ebp - 0x2c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x4048b0
mov eax, dword [ebp - 0x2c]
push 0xc
mov dword [ebp - 0x38], eax
call fcn.0040fbab
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 9
test esi, esi
je 0x40420c
push str.Select__from_WmiMonitorDescriptorMethods
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x404a1b
jmp 0x40420e
xor esi, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], esi
test esi, esi
je 0x404a25
push 0xc
mov byte [ebp - 4], 0xa
call fcn.0040fbab
mov edi, eax
add esp, 4
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 0xb
test edi, edi
je 0x404254
push 0x42d22c
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.004104f0
mov dword [edi], eax
jmp 0x404256
xor edi, edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x48], edi
test edi, edi
je 0x404a2f
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x38]
push edx
push 0
push 0x30
push dword [esi]
mov eax, dword [ecx]
push dword [edi]
push ecx
call dword [eax + 0x50]
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4042c1
mov eax, dword [edi]
test eax, eax
je 0x40429f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4042b6
push eax
call fcn.0040fba6
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0040f97a
add esp, 8
mov byte [ebp - 4], 6
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x404305
mov eax, dword [esi]
test eax, eax
je 0x4042e3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4042fa
push eax
call fcn.0040fba6
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0040f97a
add esp, 8
cmp dword [ebp - 0x38], 0
jne 0x4048b0
mov edi, dword [ebp - 0x2c]
push 0xc
call fcn.0040fbab
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0xd
test esi, esi
je 0x40434e
push 0x42d230
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x404a39
jmp 0x404350
xor esi, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], esi
test esi, esi
je 0x404a43
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
mov eax, dword [edi]
push ecx
push 0
push 0
push dword [esi]
push edi
call dword [eax + 0x18]
mov edi, eax
mov byte [ebp - 4], 6
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x4043bb
mov eax, dword [esi]
test eax, eax
je 0x404399
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4043b0
push eax
call fcn.0040fba6
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0040f97a
add esp, 8
test edi, edi
mov edi, dword [ebp - 0x14]
jne 0x4048ab
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push 0
push edx
push 0
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x4c]
test eax, eax
jne 0x4048ab
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x30]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
or esi, 0xffffffff
test eax, eax
jne 0x4048b6
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4048b6
xor edi, edi
test edi, edi
jne 0x404848
mov dword [ebp - 0x1c], edi
lea edx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
push edx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
mov ecx, dword [eax]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x404898
push 0x42cd58
lea ecx, [ebp - 0x18]
call fcn.00402d90
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x10
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
push eax
call esi
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x60]
push edi
push edi
push edx
mov ecx, dword [eax]
push edi
push str.InstanceName
push eax
call dword [ecx + 0x10]
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x98]
push eax
movups xmmword [ebp - 0x98], xmm0
call esi
push 8
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x404a57
mov edx, dword [ebp - 0x90]
test edx, edx
jne 0x4044a9
xor ecx, ecx
jmp 0x4044bf
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4044b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.004031f0
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0x10
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
jne 0x404877
mov eax, dword [ebp - 0x18]
mov esi, dword [eax - 0xc]
test esi, esi
js 0x404a4d
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x404517
push esi
lea ecx, [ebp - 0x18]
call fcn.004033f0
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004166cc
mov eax, dword [ebp - 0x18]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x404a4d
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x18]
push ecx
mov word [eax + esi*2], cx
lea ecx, [ebp - 0x18]
push dword [ebx + 8]
call fcn.00402d30
cmp eax, 0xffffffff
je 0x4047f0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0x13
mov edi, dword [ebp - 0x1c]
push 0xc
call fcn.0040fbab
mov esi, eax
add esp, 4
mov dword [ebp - 0x9c], esi
mov byte [ebp - 4], 0x14
test esi, esi
je 0x4045b3
push str.__PATH
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x404a07
jmp 0x4045b5
xor esi, esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x404a07
push 0
push 0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
mov eax, dword [edi]
push ecx
push 0
push dword [esi]
push edi
call dword [eax + 0x10]
mov edi, eax
mov byte [ebp - 4], 0x13
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x404623
mov eax, dword [esi]
test eax, eax
je 0x404601
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x404618
push eax
call fcn.0040fba6
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0040f97a
add esp, 8
test edi, edi
jne 0x404855
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x60]
push eax
call edi
mov eax, 0x11
lea edx, [ebp - 0x60]
mov word [ebp - 0x60], ax
xor eax, eax
push 0
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x30]
push edx
push 0
push str.BlockId
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jne 0x404855
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push esi
push edx
push dword [ebp - 0x30]
mov ecx, dword [eax]
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0xa8]
push eax
call dword [ecx + 0x60]
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jne 0x404855
lea eax, [ebp - 0x78]
push eax
call edi
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x78]
push esi
push esi
push edx
mov ecx, dword [eax]
push esi
push str.BlockContent
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x404855
lea eax, [ebp - 0x60]
push eax
call edi
mov eax, 0x11
lea edx, [ebp - 0x60]
mov word [ebp - 0x60], ax
mov eax, 1
push esi
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x30]
push edx
push esi
push str.BlockId
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jne 0x404855
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x24]
push esi
push edx
push dword [ebp - 0x30]
mov ecx, dword [eax]
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0xa8]
push eax
call dword [ecx + 0x60]
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jne 0x404855
lea eax, [ebp - 0x88]
push eax
call edi
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x88]
push esi
push esi
push edx
mov ecx, dword [eax]
push esi
push str.BlockContent
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x404855
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x70]
call esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x80]
call esi
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x40479d
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x40479d
mov edx, dword [ebp - 0x64]
mov ecx, 0x20
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x80]
mov ecx, 0x20
mov esi, eax
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x70]
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
call esi
push dword [ebp - 0x80]
call esi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0x12
mov edi, 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], edi
test eax, eax
je 0x4047dd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4047f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4047f3
mov edi, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x404807
mov dword [ebp - 0x1c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xf
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404828
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404839
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x404407
test edi, edi
je 0x4048b3
mov ecx, dword [ebp - 0x64]
call fcn.00403c30
mov dword [ebp - 0x68], eax
jmp 0x4048b3
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x404866
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x404877
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xf
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404898
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4048b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4048b3
or esi, 0xffffffff
jmp 0x4048b6
or esi, 0xffffffff
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4048f8
mov dword [ebp - 0x2c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x40490c
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x404920
mov dword [ebp - 0x34], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x404934
mov dword [ebp - 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x404948
mov dword [ebp - 0x3c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40495c
mov dword [ebp - 0x30], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x40497a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40498b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x40499c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4049ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4049be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4049cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebx + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4049ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x8007000e
call fcn.004104d0
push 0x80070057
call fcn.00401510
push eax
call fcn.00401510
int3