Function at 0x410b89
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x350
mov eax, 0x49c220
call fcn.0045201c
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x340], eax
xor edi, edi
mov dword [ebp - 0x35c], eax
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x358], edi
push edi
push eax
call fcn.0046a220
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push str._______invalid_file_path
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x4114f8
lea eax, [ebp - 0x21c]
push eax
call fcn.0046eca3
pop ecx
test eax, eax
je 0x411553
push 2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x314]
call fcn.00406c4c
mov dword [ebp - 4], 3
test ebx, ebx
je 0x410c7d
lea ecx, [ebp - 0x314]
call fcn.00401ffa
cmp dword [eax + 0x14], 8
jb 0x410c31
mov eax, dword [eax]
mov ax, word [eax]
lea ecx, [ebx + 0x60]
mov word [ebp - 0x318], ax
call fcn.00401ffa
mov esi, eax
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 1
jb 0x410c54
mov esi, dword [esi]
lea eax, [ebp - 0x318]
push eax
push esi
call fcn.00402039
xor eax, eax
mov word [ebp - 0x316], ax
lea eax, [ebp - 0x316]
push eax
lea eax, [esi + 2]
push eax
call fcn.00402039
add esp, 0x10
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 4
test eax, eax
jns 0x410cc1
push str.COM_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 5
push ecx
push 0x8e8
push str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
lea ecx, [ebp - 0x340]
call fcn.0040d4f0
jmp 0x41152f
push edi
push edi
push edi
push 3
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, eax
test esi, esi
jns 0x410d47
cmp esi, 0x80010119
jne 0x410d8d
lea ecx, [ebp - 0x2fc]
call fcn.00402a5a
mov esi, eax
mov byte [ebp - 4], 6
push str.It_is_too_late_for_CoInitializeSecurity__trying_to_proceed_anyway.
push esi
call fcn.0040508d
pop ecx
pop ecx
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.00402a43
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x234]
call fcn.00402109
push eax
push 2
call fcn.00401235
pop ecx
pop ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x234]
call fcn.004020b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.00402479
mov dword [ebp - 0x334], edi
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x334]
push eax
push 0x4b36b4
push 1
push edi
push 0x4b36a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x410db2
push str.CoCreateInstance___failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0xb
push ecx
push 0x913
jmp 0x410da7
push str.COM_security_initialization_failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 8
push ecx
push 0x905
push str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
push esi
jmp 0x411530
mov dword [ebp - 0x320], edi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x31c]
mov edi, dword [ebp - 0x334]
push str.ROOTCIMV2
call fcn.0040d550
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
test eax, eax
je 0x410de0
mov eax, dword [eax]
jmp 0x410de2
xor eax, eax
mov esi, dword [edi]
lea ecx, [ebp - 0x320]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov ecx, dword [esi + 0xc]
push eax
push edi
call dword [0x4a4360]
call dword [esi + 0xc]
mov esi, eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
je 0x410e20
call fcn.0040d5e5
xor edi, edi
mov dword [ebp - 0x31c], edi
jmp 0x410e22
xor edi, edi
test esi, esi
jns 0x410e45
push str.ConnectServer___failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0xf
push ecx
push 0x924
jmp 0x410da7
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push dword [ebp - 0x320]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x410e80
push str.CoSetProxyBlanket___failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x10
push ecx
push 0x935
jmp 0x410da7
push str.ASSOCIATORS_OF_Win32_LogicalDisk.DeviceID
lea ecx, [ebp - 0x264]
call fcn.00401688
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x314]
call fcn.00401ffa
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x410ea9
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x264]
call fcn.004016d4
push str._WHERE_AssocClass__Win32_LogicalDiskToPartition
lea ecx, [ebp - 0x264]
call fcn.00401638
mov dword [ebp - 0x330], edi
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x264]
mov edi, dword [ebp - 0x320]
call fcn.00402109
push eax
lea ecx, [ebp - 0x318]
call fcn.0040d550
mov esi, eax
mov byte [ebp - 4], 0x14
push ecx
lea ecx, [ebp - 0x31c]
call fcn.0040d4f3
mov byte [ebp - 4], 0x15
mov ecx, dword [esi]
test ecx, ecx
je 0x410f0f
mov ecx, dword [ecx]
jmp 0x410f11
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
je 0x410f1b
mov eax, dword [eax]
jmp 0x410f1d
xor eax, eax
mov esi, dword [edi]
lea edx, [ebp - 0x330]
push edx
push 0
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push eax
push edi
call dword [0x4a4360]
call dword [esi + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
je 0x410f58
call fcn.0040d5e5
xor edi, edi
mov dword [ebp - 0x31c], edi
jmp 0x410f5a
xor edi, edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x410f73
call fcn.0040d5e5
mov dword [ebp - 0x318], edi
test esi, esi
jns 0x410f96
push 0x4b9a0c
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x16
push ecx
push 0x947
jmp 0x410da7
mov dword [ebp - 0x32c], edi
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], edi
test eax, eax
je 0x4114bc
mov esi, dword [eax]
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x32c]
push ecx
mov ecx, dword [esi + 0x10]
push 1
push 0xffffffffffffffff
push eax
call dword [0x4a4360]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
jns 0x410ffa
push str.Enumeration_failed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x19
push ecx
push 0x953
jmp 0x410da7
cmp dword [ebp - 0x338], 0
jne 0x411021
push str.Empty_response_for_DiskToPartition_mapping
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x1a
push 0x958
jmp 0x41156f
push 0x10
lea eax, [ebp - 0x350]
push edi
push eax
call fcn.0046a220
add esp, 0xc
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x324]
mov edi, dword [ebp - 0x32c]
push str.DeviceID
call fcn.0040d550
mov byte [ebp - 4], 0x1c
mov eax, dword [eax]
test eax, eax
je 0x411068
mov eax, dword [eax]
jmp 0x41106a
xor eax, eax
mov esi, dword [edi]
lea ecx, [ebp - 0x350]
push 0
push 0
push ecx
mov ecx, dword [esi + 0x10]
push 0
push eax
push edi
call dword [0x4a4360]
call dword [esi + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x4110a3
call fcn.0040d5e5
and dword [ebp - 0x324], 0
test esi, esi
jns 0x4110c6
push str.Cant_get_DeviceID
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x1d
push ecx
push 0x95f
jmp 0x410da7
push 8
pop eax
cmp word [ebp - 0x350], ax
jne 0x4114da
cmp dword [ebp - 0x348], 0
je 0x4114da
push str.Associators_of_Win32_DiskPartition.DeviceID
lea ecx, [ebp - 0x264]
call fcn.004016ad
push dword [ebp - 0x348]
lea ecx, [ebp - 0x264]
call fcn.00401638
push str._where_ResultClassWin32_DiskDrive
lea ecx, [ebp - 0x264]
call fcn.00401638
test ebx, ebx
je 0x411126
push dword [ebp - 0x348]
lea ecx, [ebx + 0x78]
call fcn.004016ad
xor ebx, ebx
mov dword [ebp - 0x31c], ebx
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x264]
mov edi, dword [ebp - 0x320]
call fcn.00402109
push eax
lea ecx, [ebp - 0x328]
call fcn.0040d550
mov esi, eax
mov byte [ebp - 4], 0x21
push ecx
lea ecx, [ebp - 0x324]
call fcn.0040d4f3
mov byte [ebp - 4], 0x22
mov ecx, dword [esi]
test ecx, ecx
je 0x41116f
mov ecx, dword [ecx]
jmp 0x411171
mov ecx, ebx
mov eax, dword [eax]
test eax, eax
je 0x41117b
mov eax, dword [eax]
jmp 0x41117d
mov eax, ebx
mov esi, dword [edi]
lea edx, [ebp - 0x31c]
push edx
push ebx
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push eax
push edi
call dword [0x4a4360]
call dword [esi + 0x50]
mov esi, eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x324]
test ecx, ecx
je 0x4111b3
call fcn.0040d5e5
mov dword [ebp - 0x324], ebx
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x4111cc
call fcn.0040d5e5
mov dword [ebp - 0x328], ebx
test esi, esi
jns 0x4111ef
push 0x4b9a0c
lea ecx, [ebp - 0x234]
call fcn.00401688
mov byte [ebp - 4], 0x23
push ecx
push 0x97a
jmp 0x410da7
mov dword [ebp - 0x318], ebx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x33c], ebx
test eax, eax
je 0x41148f
mov esi, dword [eax]
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x318]
push ecx
mov ecx, dword [esi + 0x10]
push 1
push 0xffffffffffffffff
push eax
call dword [0x4a4360]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
jns 0x41125f
push str.Enumeration_failed
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x26
push ecx
push 0x985
push str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
push esi
lea eax, [ebp - 0x24c]
jmp 0x411536
cmp dword [ebp - 0x33c], 0
jne 0x411291
push str.Empty_response_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x27
push 0x98a
mov edx, str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
lea ecx, [ebp - 0x24c]
jmp 0x41157a
push 0x10
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.0046a220
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x328]
mov edi, dword [ebp - 0x318]
push str.SerialNumber
call fcn.0040d550
mov byte [ebp - 4], 0x29
mov eax, dword [eax]
test eax, eax
je 0x4112d8
mov eax, dword [eax]
jmp 0x4112da
mov eax, ebx
mov esi, dword [edi]
lea ecx, [ebp - 0x22c]
push ebx
push ebx
push ecx
mov ecx, dword [esi + 0x10]
push ebx
push eax
push edi
call dword [0x4a4360]
call dword [esi + 0x10]
mov esi, eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x328]
test ecx, ecx
je 0x41130f
call fcn.0040d5e5
mov dword [ebp - 0x328], ebx
test esi, esi
jns 0x411332
push str.Cant_get_SerialNumber
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x2a
push ecx
push 0x991
jmp 0x41124e
push 8
pop eax
cmp word [ebp - 0x22c], ax
jne 0x411471
cmp dword [ebp - 0x224], 0
je 0x411471
push dword [ebp - 0x224]
mov edi, dword [ebp - 0x354]
mov ecx, edi
call fcn.00401688
mov dword [ebp - 0x358], 1
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x41139b
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x4113b9
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x4113e8
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x330]
test eax, eax
je 0x411406
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x264]
call fcn.004020b0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x411433
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x411451
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a4360]
call esi
mov byte [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x314]
call fcn.004020b0
mov eax, edi
call fcn.00451fc5
ret
push str.No_SerialNumber_found_in_DiskPartitionToDiskDrive_mapping
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x2b
push 0x996
jmp 0x411281
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x318]
call fcn.00411580
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x31c]
call fcn.00411580
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x350]
call fcn.0040d652
push str.WMI_query_failed
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x32
push 0x99d
jmp 0x411281
push str.No_DeviceID_found_in_DiskToPartition_mapping
lea ecx, [ebp - 0x24c]
call fcn.00401688
mov byte [ebp - 4], 0x1e
push 0x964
jmp 0x411281
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.GetVolumePathName___failed
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.00401688
mov dword [ebp - 4], 1
movzx eax, si
push ecx
or eax, 0x80070000
test esi, esi
push 0x8d6
push str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
cmovle eax, esi
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0040bc87
push 0x4d95fc
lea eax, [ebp - 0x2e4]
push eax
call fcn.0046a3fc
push str.GetVolumePathName___returned_empty_drive_letter._Unable_to_proceed
lea ecx, [ebp - 0x234]
call fcn.00401688
mov dword [ebp - 4], 2
push 0x8db
mov edx, str.c:dvsp4_build_sw_relgfclient_rel_03_16_backend_shim_srcupdtshimenum.cpp
lea ecx, [ebp - 0x234]
call fcn.0040c3d8
int3