Function at 0x421b80
Capabilities:
Connect to wmi namespace via wbemlocator
Get hostname
Query or enumerate registry value
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5736b1
mov eax, dword fs:[0]
push eax
sub esp, 0x750
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x6f0], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x421beb
cmp eax, 0x80010119
jne 0x4222c1
mov dword [ebp - 0x6ec], 0
lea eax, [ebp - 0x6ec]
mov dword [ebp - 4], 0
push eax
push 0x589140
push 1
push 0
push 0x589210
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4222aa
mov dword [ebp - 0x6f8], 0
mov edi, dword [ebp - 0x6ec]
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x704], esi
lea ecx, [ebp - 0x6f8]
mov byte [ebp - 4], 2
mov eax, dword [edi]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push edi
call dword [eax + 0xc]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x422296
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x6f8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x422296
mov ecx, 0x1b
mov dword [ebp - 0x6ac], 0x598c90
mov dword [ebp - 0x6a8], str.SoftwareElementID
xor eax, eax
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], str.SELECT__FROM_Win32_Processor_WHERE__ProcessorId_IS_NOT_NULL_
mov dword [ebp - 0x69c], str.ProcessorId
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], str.SELECT__FROM_Win32_DiskDrive_WHERE__PNPDeviceID_IS_NOT_NULL__AND__NOT__InterfaceType__USB__
mov dword [ebp - 0x690], str.Signature
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], str.SELECT__FROM_Win32_NetworkAdapter_WHERE__MACAddress_IS_NOT_NULL__AND__NOT__PNPDeviceID_LIKE_ROOT___
mov dword [ebp - 0x684], str.MACAddress
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x67c], str.SELECT__FROM_Win32_BaseBoard_WHERE__SerialNumber_IS_NOT_NULL_
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], str.SELECT__FROM_Win32_OperatingSystem
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x664], str.SELECT__FROM_Win32_PhysicalMemory
mov dword [ebp - 0x660], str.PartNumber
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], str.SELECT__FROM_Win32_UserAccount
mov dword [ebp - 0x654], 0x5990e8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], str.SELECT__FROM_Win32_SoundDevice_WHERE__PNPDeviceID_IS_NOT_NULL_
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x6fc], eax
cmp eax, ecx
jge 0x422296
mov dword [ebp - 0x6e8], 0
mov eax, dword [ebp + eax*4 - 0x6ac]
mov ebx, dword [ebp - 0x6f8]
test eax, eax
jne 0x421ddb
xor edi, edi
jmp 0x421de4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x6e4], edi
push 3
push 0x599170
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 5
mov eax, dword [ebx]
push ecx
push 0
push 0x30
push edi
push esi
push ebx
call dword [eax + 0x50]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
push edi
call esi
mov eax, dword [ebp - 0x6e8]
test ebx, ebx
js 0x42226e
test eax, eax
je 0x42226e
xor ecx, ecx
mov dword [ebp - 0x700], 0
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
mov word [ebp - 0x6c4], cx
mov byte [ebp - 4], 6
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x421e70
test eax, eax
je 0x4221ee
mov dword [ebp - 0x6e4], 0
lea edx, [ebp - 0x700]
mov dword [ebp - 0x700], 0
push edx
lea edx, [ebp - 0x6e4]
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov dword [ebp - 4], 7
test eax, eax
mov eax, dword [ebp - 0x6e4]
js 0x4221e0
test eax, eax
je 0x4221e0
cmp dword [ebp - 0x700], 0
je 0x4221e0
push 2
push 0x599174
lea ecx, [ebp - 0x6c4]
call fcn.0041c100
lea eax, [ebp - 0x71c]
mov byte [ebp - 0x6dd], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.SerialNumber
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xb
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x421f63
cmp word [ebp - 0x71c], 8
jne 0x421f63
mov eax, dword [ebp - 0x714]
test eax, eax
je 0x421f63
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xb
push str.PNPDeviceID
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0xd
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xc
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x421fdb
cmp word [ebp - 0x72c], 8
jne 0x421fdb
mov eax, dword [ebp - 0x724]
test eax, eax
je 0x421fdb
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
mov byte [ebp - 0x6dd], 1
mov esi, dword [ebp - 0x6fc]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [ebp + esi*4 - 0x6a8]
test esi, esi
je 0x42204d
lea eax, [ebp - 0x75c]
push eax
call edi
push 0
push 0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x75c]
mov eax, dword [ebp - 0x6e4]
push edx
push 0
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x422044
cmp word [ebp - 0x75c], 8
jne 0x422044
mov eax, dword [ebp - 0x754]
test eax, eax
je 0x422044
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
mov byte [ebp - 0x6dd], 1
lea eax, [ebp - 0x75c]
push eax
call ebx
cmp byte [ebp - 0x6dd], 0
je 0x42216a
lea eax, [ebp - 0x73c]
push eax
call edi
mov edi, dword [ebp - 0x6e4]
push 4
push 0x599198
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x73c]
mov byte [ebp - 4], 0x10
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0xf
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x4220d7
cmp word [ebp - 0x73c], 8
jne 0x4220d7
mov eax, dword [ebp - 0x734]
test eax, eax
je 0x4220d7
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
push 0x5991a0
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x6e4]
push 0xc
push str.Manufacturer
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
mov dword [ebp - 0x6f4], esi
push 0
push 0
lea ecx, [ebp - 0x74c]
mov byte [ebp - 4], 0x12
mov eax, dword [edi]
push ecx
push 0
push esi
push edi
call dword [eax + 0x10]
push esi
mov edi, eax
mov byte [ebp - 4], 0x11
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x422158
cmp word [ebp - 0x74c], 8
jne 0x422158
mov eax, dword [ebp - 0x744]
test eax, eax
je 0x422158
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
push 0x5991a0
lea ecx, [ebp - 0x6c4]
call fcn.0041b930
lea eax, [ebp - 0x74c]
push eax
call ebx
lea eax, [ebp - 0x73c]
push eax
call ebx
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp + eax*4 - 0x6a4], 0
lea eax, [ebp - 0x72c]
push eax
jne 0x422198
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
jmp 0x4221e4
call ebx
lea eax, [ebp - 0x71c]
push eax
call ebx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6e4]
test eax, eax
jne 0x4221bc
mov eax, dword [ebp - 0x6e8]
jmp 0x421e70
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6e8]
jmp 0x421e70
mov byte [ebp - 4], 6
test eax, eax
je 0x4221ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov ecx, ebx
push 0x5991b4
call fcn.0041b930
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c4]
mov ecx, ebx
push eax
call fcn.0041c830
cmp dword [ebp - 0x6b0], 8
jb 0x422229
push dword [ebp - 0x6c4]
call fcn.0053ce3a
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x6c4], ax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6b0], 7
mov dword [ebp - 0x6b4], 0
test eax, eax
je 0x422282
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421dae
mov byte [ebp - 4], 1
test eax, eax
je 0x42227c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [ebp - 0x704]
add eax, 3
jmp 0x421dae
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x6f8]
test eax, eax
je 0x4222aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6ec]
test eax, eax
je 0x4222c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebx + 0x10], 0
jne 0x4224ee
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push eax
call fcn.0053e230
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x6e8]
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0x5991b8
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x422363
cmp word [ebp - 0x224], ax
je 0x422363
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422340
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00420490
jmp 0x42245c
push str.IsWow64Process
push 0x5966e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x6ec], 0
test esi, esi
je 0x42245c
lea eax, [ebp - 0x6ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x42245c
cmp dword [ebp - 0x6ec], 0
je 0x42245c
lea eax, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42245c
mov esi, dword [ebp - 0x6ec]
test esi, esi
je 0x42245c
push 0x208
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0053e230
add esp, 0xc
mov dword [ebp - 0x6e8], 0x206
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e4], 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0x5991b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422450
cmp word [ebp - 0x224], ax
je 0x422450
lea eax, [ebp - 0x224]
mov ecx, ebx
push eax
call fcn.0041b8c0
push dword [ebp - 0x6ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x63c], ax
lea eax, [ebp - 0x63a]
push eax
call fcn.0053e230
add esp, 0xc
mov dword [ebp - 0x6e4], 1
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x6e8], 0x206
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x6e4]
push eax
push str.Default_User_ID
push str.Identities
push SysReAllocString
call edi
test eax, eax
jne 0x4224ee
cmp word [ebp - 0x63c], ax
je 0x4224ee
lea ecx, [ebp - 0x63c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4224d0
sub ecx, edx
lea eax, [ebp - 0x63c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00420490
mov dword [ebp - 0x6c8], 0xf
mov dword [ebp - 0x6cc], 0
mov byte [ebp - 0x6dc], 0
lea eax, [ebp - 0x6dc]
mov dword [ebp - 4], 0x13
push eax
mov byte [ebp - 4], 0x14
call fcn.00421890
jmp 0x42252e
mov dword [ebp - 4], 0x13
lea edx, [ebp - 0x6dc]
cmp dword [ebp - 0x6c8], 0x10
lea ecx, [ebp - 0x6c4]
cmovae edx, dword [ebp - 0x6dc]
call fcn.004145d0
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x16
call fcn.0041c830
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x6b0], 8
jb 0x42257f
push dword [ebp - 0x6c4]
call fcn.0053ce3a
add esp, 4
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x434], ax
lea eax, [ebp - 0x432]
push eax
call fcn.0053e230
add esp, 0xc
mov dword [ebp - 0x708], 0x104
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x434]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp word [ebp - 0x434], 0
jne 0x4225cb
xor ecx, ecx
jmp 0x4225e3
lea ecx, [ebp - 0x434]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4225d4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x434]
mov ecx, ebx
push eax
call fcn.0041c100
cmp dword [ebp - 0x6c8], 0x10
jb 0x422609
push dword [ebp - 0x6dc]
call fcn.0053ce3a
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4