Function at 0x404c20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414f40
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x44a1d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 0x419a2f
lea eax, [ebp + 8]
push eax
call fcn.00402a70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x404c8d
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401550
mov al, byte [ebp - 0x11]
jmp 0x404d76
mov dword [ebp - 0x28], str.JK4dudhw76WuVuRfiV0vuI5e5EExkzTmOemjOm4UOLKad9lW5yv2C7opNeDgSe84durbxgEiiS0vY1MDC5cyx3a9jmkmBtODVripXltDAGip44cfVtcEomPKr4gqWoM6vzI2Ekz3NtDG10KoygwkFbyJ3so37U1bXWsxshDT2FpbbrHqwx73415KYI2J6MBkRd8RtB1JqKnAGMwnp1LKzFPK89TXCzNFiBer50Fj5hIDngKYhVbNsfPNn57abF24NV95TxezbRXYUW8HJaW2deMdEVbH5kN2vyb7PAWGSg6dHKuES6yIDq1vQdYUkBMQ2sui3PH0meqTSoQImJnAMUupWclxOJcUW52K87czYmbP54lovTMyEre8LHmIkzYrfE3msUeIzqTBnCltqnE3lk0a1BDIiRbLyY6zqceNuhPAAdvTtj7oqMb0lgTtrKk6BWrVK1rw5b6OOHdM5ew0Loy1zkcCJm5W1b9bTXJsbDaYo1QDCo9nUgww1FTqmS9ip47a1bv65sPqN5WkpQ2e601FsuHLDvkslO3RVgMNvEc6KP5bLo5niJBx5cEdapubklwsdl7REzJBbeUOTBYJ87o6zu7TGOzyOkUa77FpaMcddeal1NjrYk4b1lLFbWB7fhprAHbu78HN8QEcg5pHT2Tw1YDYP5GJYp5PiPX35IFTv4idIkuUFqKLAT3V1r1JlCOfxWAQFEFlDotirVDhK2antI0T89WnVY3dPdMBcy1BT8goNSJ9XYrc6i327nsMOTbV0h1pnWKvrwA65SK29Nv0VOgVOfROEHX1CQ93iPkgy2fb8qHiDP1Bnit7d8M8NT5rBhCwtaG9lwItLb6acd5a1IHd6fAn5Y6QPAj8GkEavKaYA6G7UmNJxqLgFQ2Q7god5dfnfk1zXHpmGajreIf1fhPvdHKbJkSER61CVmOcQpqFb7yBeg3zSqpTbxslKAntqGN8XYxxuScj4uQcJqqSDel0hbXHUbt3GYm63WTHqaO7lyvVheaidnN0op92V1BVfr2yhiYvoksiVmAG69D3FMhIB3XvsL2Pq7IrgkckkqmsIH2t5dOiBDzGcUrD8RQziuVA3DhfmzQByaAqTWe41nR0FSHpuyX7xCIJ72iVRQk6e5RRRoYgmKCqJNV74M9zD3KtoDDInohIGJiqsRvJgrLwCa1atlHDKcYhgwHTt9u32bogjNRB4bVI0UQh8OWtN2Wc7WcGTkHVDpFgS7eKVJglgnzSvi5z6Npn6xgkA0r0CLlwQ5jK77dwED6lPLFBjPjmmHqkx2zlPvNNpyKC6FTGrRGY79pTF2s9hdQqKrk1TByzgY5QC43mSm26678zRPzbtamxhfj1dWhYDlGlKj4niqcTkaOm9ihoSWoPbAzjXdKUheSvKJVGYuEz6FBKg438Dk3CvEuO3UVXsORabYlvf3ggsOIUsjicem4slKRnbpSoVPHCR4AcsGg4fABKyPhRksO5MfTONPQb0BoBShCoW2g03OLOOYa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call fcn.00403010
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push str.Name
push 0x41a8a9
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x404d15
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401550
mov al, byte [ebp - 0x12]
jmp 0x404d76
mov dword [ebp - 0x40], str.MAJ3VS1wL0jl3kKMynYSX5Fy2t3GND7sJJItmoTtjKXObTpBAHqI7VOHgxopuhjN3XNuVpnCvilpu1frg2DgGdfi2mpMLIlrXoMQOIJaGdG8ezpTTM85OpPFwBMmwpKPlhsqB405lMHut1iRsAsM2Xf22ELcyekQJ8C7f7Xh5XDCfbABvib6ejUnYy9Xyu7BiB5T6vboFshfqoeFiVSNHN2xY8aU80rCNCISTPYV2CTCLqqYGKbK9LzdIOBQI0TGJhmcMDsfbyiCYtDKcdFSDseR6PNbHclXaQR4hqsui3LFBfBy0WYeD6wQ54yRlHSTORaOjDCEIzaN5OlfSOKS2SGiP6cuMaTj317O9FkxTkNAKO64gSE13UKdDeA93B3kSdFywSJOsezdRfpx
mov dword [ebp - 0x44], str.sIl1fKHQGfCuhaqoeMdXMKCfpeHUecx8qygbkbEkMgwdDCtwDKM35NCdSOvH7JcKYg2fQqwNNsNiVl9x76JedOdeTQWPiE0yyiSDLE3kRGzCsjhSMUpKgtE22z4MWc5svUQTLyxPv3hJKwKrL62XWWPfkrcCsCAJb5MKckTaIUDMx0wp6fBqMX9ofg08pdN5OAn18GA1XVMBKMFqLL1MULCRH1tEAf4yGWbGlSE0927CwVjuLOVOe4P161YeX3NCWtvRiDIBDmmWduE30lRui8XYhO9vJUt8KdxObfYfenAjkzYRj2bRnJIRvfXOieGlbYjWRsfacLf5DeE9wk1btbsEynojQWf9Yab3S8Ea8sta4UfqBK5KjfDn8CIucsFX6kIkBmVE2M32mIV53TYz2UOuoelgG5C8XXmJOp3n79TIhQXDdhuEd8d8ufN5bYgsTuBVgObYYytshFk0SRSaWmxNkY0ri8UqHVW3Vt6ji7DqChbLrehGDpbdNOfHpn4dJTHF7AeqH0FJlHMdHtJjWo8fOdfgHliJQw6PiHGzRsbveJBm3lawLL33lJ4o5vlzqAh0kHafvPdJN1aSm6nihjdTjXcnea83mpf8eK25jwbqp1cd2B62WaylFDuqBtEa3TTAmohX11Uw81xr0kUBtID6qveHpm5Cpw2fjuxXlSCVO9boEikkQMG5yr4lECJPSmloWc6n4LRt5mfyX4HYirxq5n1p4S4Ur2oLn3TDVoEXiq0bpRjMl6Gr1jwU9zDHwMDA0RtsJymaBXQaVqkrKwgGqkpScXcH8osvuO2Ih9KLVpm825M4zN3TlBRcgbC8Lf6DKppvn6YrW0eqJKEe7jr0RpxM87TVrhFwYs77RsBN7Rf3xVJ0VOv941ntpwcJG2ecD6f2BlypCTqKvHMRSnVF4RM3p1NRxBG8rOAXqV9MrQQYaGnK4m48Xqxgg09nzHQfnqxOev8pjjMRC735PwRiUgNNOGO0QApTG38FTpAHKFDeqNcGQSX5JbnAp7gfors2HqD7CVwcV6eDc2kVJkysrYyb2j1OgCgP5P7VUptbr35SAmfKIaJ6TaTVbnKr0hHY4J7LF7KHQ6Y9dgdBcbQv3QUGNDY3cUbM1fd0AMYrh5Y5aBvmpLLvMVToDWOuVjmauy6lhXEbvlHe0zLwKnshY4093FTtLtkGfPvYlU6O3Km1JyVfOoXqrEceaEuEFJrAfgipiIpr5HKKOfjksjpUVTiYLjqx4CnIF3mzDbAgx5fEaAubEyY79JUXmy6wR0bARpFLORqB0iKN9MpREDYMMTwPbLvSoVckqBkId9wXMiQdAll7R2J4rRon7VcPtN6H7Sswb9mXUvAKLdLPcF6TEmofFS9lRGbmLvHxU1ae3QXMRl7VcNVo96SR8MVvzfKzvrh9TaMEOaVL3ijb2viSHGuhUhV8CkQ8JwyItd1hFoS2dnj6HADB1xGN9XDwPOpBBAVVpW5fGQV0YAyN6lIcrjYTnsiN8mR8eR1M7lhLoSXX8G1XXuxyYNU5wfTTCgdpy4GCFBR9CID2y49QYcoVg42VVPgAxxTJrl76L5aMEzl9kPWhH6NVxjS7iDTsfVX1DjJeKnu69Ah4CQVFzhzqK12nI48WfQUGL1ejBiaE9UmmLC71TjMFrN6xG
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401550
mov al, byte [ebp - 0x13]
jmp 0x404d76
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18