Function at 0x10052ed0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
xor edi, edi
push str.Win32_Process
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xec], edi
mov dword [ebp - 0x108], edi
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0x10c], edi
lea ebx, [edi + 2]
call esi
push str.GetOwner
mov dword [ebp - 0xe4], eax
call esi
push str.ROOTCIMV2
mov dword [ebp - 0xdc], eax
call esi
push 0x10079d90
mov dword [ebp - 0xe0], eax
call esi
mov ecx, dword [ebp + 8]
push ecx
push str.Select__from_Win32_Process_Where_ProcessID___d
lea edx, [ebp - 0xcc]
push 0x64
push edx
mov dword [ebp - 0xd8], eax
call sym.vmtools.dll_Str_Swprintf
add esp, 0x10
lea eax, [ebp - 0xcc]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x120], esi
cmp dword [ebp - 0xe4], edi
je 0x1005338f
cmp dword [ebp - 0xdc], edi
je 0x1005338f
cmp dword [ebp - 0xe0], edi
je 0x1005338f
cmp dword [ebp - 0xd8], edi
je 0x1005338f
cmp esi, edi
je 0x1005338f
lea ecx, [ebp - 0xf0]
push ecx
push 0x1007a620
push 1
push edi
push 0x1007a6f0
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x10052fec
push eax
push str.CoCreateInstance_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x1005339c
mov eax, dword [ebp - 0xf0]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0xd0]
push ecx
mov ecx, dword [ebp - 0xe0]
push edi
push edi
push 0x80
push edi
push edi
push edi
push ecx
push eax
call edx
cmp eax, edi
jge 0x10053029
push eax
push str.IWbemLocator_ConnectServer_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x1005339c
mov eax, dword [ebp - 0xd0]
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, edi
jge 0x10053057
push eax
push str.CoSetProxyBlanket_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x1005339c
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
lea edx, [ebp - 0xec]
push edx
mov edx, dword [ebp - 0xd8]
push edi
push 0x30
push esi
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
cmp eax, edi
jge 0x1005308e
push eax
push str.IWbemServices_ExecQuery_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
mov eax, dword [ebp - 0xec]
mov ecx, dword [eax]
lea edx, [ebp - 0x10c]
push edx
lea edx, [ebp - 0xe8]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jge 0x100530c5
push eax
push str.IEnumWbemClassObject_Next_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
cmp dword [ebp - 0x10c], edi
jne 0x100530df
push str.Process_not_found._n
call sym.vmtools.dll_Debug
add esp, 4
jmp 0x100533a1
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0xe4]
push edi
push edi
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
cmp eax, edi
jge 0x10053115
push eax
push str.IWbemServices_GetObject_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
push edi
push edi
lea edx, [ebp - 0x104]
push edx
push edi
push str.__PATH
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jge 0x10053149
push eax
push str.IWbemServices_Get_Path_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
mov ecx, 8
cmp cx, word [ebp - 0x104]
je 0x10053176
push str.Unexpected_variant_type_for_Path._n
call sym.vmtools.dll_Debug
add esp, 4
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x100533a1
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0xd4]
push edx
mov edx, dword [ebp - 0xdc]
push edi
push edi
push edi
push edx
mov edx, dword [ebp - 0xfc]
push edx
push eax
mov eax, dword [ecx + 0x60]
call eax
cmp eax, edi
jge 0x100531c1
push eax
push str.WbemServices_ExecMethod_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x100533a1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x104]
push edx
call esi
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
push edi
push edi
lea edx, [ebp - 0x104]
push edx
push edi
push str.ReturnValue
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jge 0x10053204
push eax
push str.IWbemClassObject_Get_RetVal_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
mov ecx, 3
cmp cx, word [ebp - 0x104]
jne 0x10053377
mov eax, dword [ebp - 0xfc]
cmp eax, edi
je 0x1005323c
push eax
push str.GetOwner_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
lea edx, [ebp - 0x104]
push edx
call esi
jmp 0x100533a1
lea eax, [ebp - 0x104]
push eax
call esi
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
push edi
push edi
lea edx, [ebp - 0x11c]
push edx
push edi
push str.User
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jge 0x10053279
push eax
push str.IWbemClassObject_Get_User_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
jmp 0x100533a1
mov ecx, 8
cmp cx, word [ebp - 0x11c]
je 0x100532a2
push str.Unexpected_variant_type_for_User._n
call sym.vmtools.dll_Debug
add esp, 4
lea edx, [ebp - 0x11c]
push edx
call esi
jmp 0x100533a1
mov eax, dword [ebp - 0xd4]
mov ecx, dword [eax]
push edi
push edi
lea edx, [ebp - 0x130]
push edx
push edi
push str.Domain
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, edi
jge 0x100532df
push eax
push str.IWbemClassObject_Get_Domain_failed__err_u._n
call sym.vmtools.dll_Debug
add esp, 8
lea ecx, [ebp - 0x11c]
push ecx
call esi
jmp 0x100533a1
mov edx, 8
cmp dx, word [ebp - 0x130]
je 0x10053311
push str.Unexpected_variant_type_for_Domain._n
call sym.vmtools.dll_Debug
add esp, 4
lea eax, [ebp - 0x11c]
push eax
call esi
lea ecx, [ebp - 0x130]
push ecx
call esi
jmp 0x100533a1
mov edx, dword [ebp - 0x128]
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10053320
sub eax, ebx
sar eax, 1
je 0x10053349
mov eax, dword [ebp - 0x114]
push eax
push edx
push str._ls_ls
push edi
call sym.vmtools.dll_Str_Aswprintf
add esp, 0x10
jmp 0x10053359
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.MSVCR90.dll__wcsdup]
add esp, 4
mov ecx, dword [ebp - 0xf4]
lea edx, [ebp - 0x11c]
push edx
mov dword [ecx], eax
call esi
lea eax, [ebp - 0x130]
push eax
call esi
xor ebx, ebx
jmp 0x100533a1
push str.Unexpected_variant_type_for_RetVal._n
call sym.vmtools.dll_Debug
add esp, 4
lea ecx, [ebp - 0x104]
push ecx
call esi
jmp 0x100533a1
push str.SysAllocString_failed._n
call sym.vmtools.dll_Debug
add esp, 4
mov ebx, 1
mov eax, dword [ebp - 0xe8]
cmp eax, edi
je 0x100533b3
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x108]
cmp eax, edi
je 0x100533c5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xd4]
cmp eax, edi
je 0x100533d7
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xec]
cmp eax, edi
je 0x100533e9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xd0]
cmp eax, edi
je 0x100533fb
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xf0]
cmp eax, edi
je 0x1005340d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0xe4]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call esi
mov ecx, dword [ebp - 0xdc]
push ecx
call esi
mov edx, dword [ebp - 0xe0]
push edx
call esi
mov eax, dword [ebp - 0xd8]
push eax
call esi
mov ecx, dword [ebp - 0x120]
push ecx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret