Function at 0x421bd0
Capabilities:
Connect to wmi namespace via wbemlocator
Get hostname
Query or enumerate registry value
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ee31
mov eax, dword fs:[0]
push eax
sub esp, 0x750
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x6f0], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x421c3b
cmp eax, 0x80010119
jne 0x422311
mov dword [ebp - 0x6ec], 0
lea eax, [ebp - 0x6ec]
mov dword [ebp - 4], 0
push eax
push 0x584300
push 1
push 0
push 0x5843d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4222fa
mov dword [ebp - 0x6f8], 0
mov edi, dword [ebp - 0x6ec]
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x704], esi
lea ecx, [ebp - 0x6f8]
mov byte [ebp - 4], 2
mov eax, dword [edi]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [eax + 0xc]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x4222e6
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x6f8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4222e6
mov ecx, 0x1b
mov dword [ebp - 0x6ac], 0x593e90
mov dword [ebp - 0x6a8], str.SoftwareElementID
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], str.SELECT__FROM_Win32_Processor_WHERE__ProcessorId_IS_NOT_NULL_
mov dword [ebp - 0x69c], str.ProcessorId
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], str.SELECT__FROM_Win32_DiskDrive_WHERE__PNPDeviceID_IS_NOT_NULL__AND__NOT__InterfaceType__USB__
mov dword [ebp - 0x690], str.Signature
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], str.SELECT__FROM_Win32_NetworkAdapter_WHERE__MACAddress_IS_NOT_NULL__AND__NOT__PNPDeviceID_LIKE_ROOT___
mov dword [ebp - 0x684], str.MACAddress
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x67c], str.SELECT__FROM_Win32_BaseBoard_WHERE__SerialNumber_IS_NOT_NULL_
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], str.SELECT__FROM_Win32_OperatingSystem
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x664], str.SELECT__FROM_Win32_PhysicalMemory
mov dword [ebp - 0x660], str.PartNumber
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], str.SELECT__FROM_Win32_UserAccount
mov dword [ebp - 0x654], 0x5942e8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], str.SELECT__FROM_Win32_SoundDevice_WHERE__PNPDeviceID_IS_NOT_NULL_
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x6fc], eax
cmp eax, ecx
jge 0x4222e6
mov dword [ebp - 0x6e8], 0
mov eax, dword [ebp + eax*4 - 0x6ac]
mov ebx, dword [ebp - 0x6f8]
test eax, eax
jne 0x421e2b
xor edi, edi
jmp 0x421e34
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x6e4], edi
push 3
push 0x594370
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 5
mov eax, dword [ebx]
push ecx
push 0
push 0x30
push edi
push esi
push ebx
call dword [eax + 0x50]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
push edi
call esi
mov eax, dword [ebp - 0x6e8]
test ebx, ebx
js 0x4222be
test eax, eax
je 0x4222be
xor ecx, ecx
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
mov word [ebp - 0x6c4], cx
mov byte [ebp - 4], 6
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x421ec0
test eax, eax
je 0x42223e
mov dword [ebp - 0x6e4], 0
lea edx, [ebp - 0x700]
mov dword [ebp - 0x700], 0
push edx
lea edx, [ebp - 0x6e4]
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov dword [ebp - 4], 7
test eax, eax
mov eax, dword [ebp - 0x6e4]
js 0x422230
test eax, eax
je 0x422230
cmp dword [ebp - 0x700], 0
je 0x422230
push 2
push 0x594374
lea ecx, [ebp - 0x6c4]
call fcn.0041c1c0
lea eax, [ebp - 0x71c]
mov byte [ebp - 0x6dd], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.SerialNumber
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xb
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x421fb3
cmp word [ebp - 0x71c], 8
jne 0x421fb3
mov eax, dword [ebp - 0x714]
test eax, eax
je 0x421fb3
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xb
push str.PNPDeviceID
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0xd
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xc
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x42202b
cmp word [ebp - 0x72c], 8
jne 0x42202b
mov eax, dword [ebp - 0x724]
test eax, eax
je 0x42202b
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
mov byte [ebp - 0x6dd], 1
mov esi, dword [ebp - 0x6fc]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [ebp + esi*4 - 0x6a8]
test esi, esi
je 0x42209d
lea eax, [ebp - 0x75c]
push eax
call edi
push 0
push 0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x75c]
mov eax, dword [ebp - 0x6e4]
push edx
push 0
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x422094
cmp word [ebp - 0x75c], 8
jne 0x422094
mov eax, dword [ebp - 0x754]
test eax, eax
je 0x422094
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x75c]
push eax
call ebx
cmp byte [ebp - 0x6dd], 0
je 0x4221ba
lea eax, [ebp - 0x73c]
push eax
call edi
mov edi, dword [ebp - 0x6e4]
push 4
push 0x594398
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0x10
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x422127
cmp word [ebp - 0x73c], 8
jne 0x422127
mov eax, dword [ebp - 0x734]
test eax, eax
je 0x422127
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
push 0x5943a0
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.Manufacturer
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 0x12
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0x11
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x4221a8
cmp word [ebp - 0x74c], 8
jne 0x4221a8
mov eax, dword [ebp - 0x744]
test eax, eax
je 0x4221a8
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
push 0x5943a0
lea ecx, [ebp - 0x6c4]
call fcn.0041b9f0
lea eax, [ebp - 0x74c]
push eax
call ebx
lea eax, [ebp - 0x73c]
push eax
call ebx
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp + eax*4 - 0x6a4], 0
lea eax, [ebp - 0x72c]
push eax
jne 0x4221e8
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
jmp 0x422234
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
test eax, eax
jne 0x42220c
mov eax, dword [ebp - 0x6e8]
jmp 0x421ec0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6e8]
jmp 0x421ec0
mov byte [ebp - 4], 6
test eax, eax
je 0x42223e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov ecx, ebx
push 0x5943b4
call fcn.0041b9f0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c4]
mov ecx, ebx
push eax
call fcn.0041c8f0
cmp dword [ebp - 0x6b0], 8
jb 0x422279
push dword [ebp - 0x6c4]
call fcn.005385cc
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x6c4], ax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
test eax, eax
je 0x4222d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421dfe
mov byte [ebp - 4], 1
test eax, eax
je 0x4222cc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421dfe
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6f8]
test eax, eax
je 0x4222fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6ec]
test eax, eax
je 0x422311
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebx + 0x10], 0
jne 0x42253e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push eax
call fcn.005392b0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x6e8]
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0x5943b8
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4223b3
cmp word [ebp - 0x224], ax
je 0x4223b3
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422390
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004204e0
jmp 0x4224ac
push str.IsWow64Process
push 0x5918a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x6ec], 0
test esi, esi
je 0x4224ac
lea eax, [ebp - 0x6ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4224ac
cmp dword [ebp - 0x6ec], 0
je 0x4224ac
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4224ac
mov esi, dword [ebp - 0x6ec]
test esi, esi
je 0x4224ac
push 0x208
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.005392b0
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0x5943b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4224a0
cmp word [ebp - 0x224], ax
je 0x4224a0
lea eax, [ebp - 0x224]
mov ecx, ebx
push eax
call fcn.0041b980
push dword [ebp - 0x6ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x63c], ax
lea eax, [ebp - 0x63a]
push eax
call fcn.005392b0
add esp, 0xc
mov dword [ebp - 0x6e4], 1
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], 0x206
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x6e4]
push eax
push str.Default_User_ID
push str.Identities
push SysReAllocString
call edi
test eax, eax
jne 0x42253e
cmp word [ebp - 0x63c], ax
je 0x42253e
lea ecx, [ebp - 0x63c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422520
sub ecx, edx
lea eax, [ebp - 0x63c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.004204e0
mov dword [ebp - 0x6c8], 0xf
mov dword [ebp - 0x6cc], 0
mov byte [ebp - 0x6dc], 0
lea eax, [ebp - 0x6dc]
mov dword [ebp - 4], 0x13
push eax
mov byte [ebp - 4], 0x14
call fcn.004218e0
jmp 0x42257e
mov dword [ebp - 4], 0x13
lea edx, [ebp - 0x6dc]
cmp dword [ebp - 0x6c8], 0x10
lea ecx, [ebp - 0x6c4]
cmovae edx, dword [ebp - 0x6dc]
call fcn.004145d0
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x16
call fcn.0041c8f0
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x6b0], 8
jb 0x4225cf
push dword [ebp - 0x6c4]
call fcn.005385cc
add esp, 4
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x434], ax
lea eax, [ebp - 0x432]
push eax
call fcn.005392b0
add esp, 0xc
mov dword [ebp - 0x708], 0x104
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x434]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp word [ebp - 0x434], 0
jne 0x42261b
xor ecx, ecx
jmp 0x422633
lea ecx, [ebp - 0x434]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422624
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x434]
mov ecx, ebx
push eax
call fcn.0041c1c0
cmp dword [ebp - 0x6c8], 0x10
jb 0x422659
push dword [ebp - 0x6dc]
call fcn.005385cc
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4