Function at 0x413bd0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
mov dword [esp + 0x14], ecx
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [esp + 0x118], eax
push str.Opera_Browser_Assistant_Main_Window
push str.Opera_Browser_Assistant_Main_Window_Class
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
setne bl
je 0x413c42
xor ecx, ecx
push ecx
push ecx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, 0x14
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push str.Opera_Browser_Assistant_Main_Window
push str.Opera_Browser_Assistant_Main_Window_Class
call edi
test eax, eax
je 0x413c42
push 0
push 0x186a0
call fcn.0043c8d0
add esp, 8
dec esi
jne 0x413c20
sub esp, 0x24
movsd xmm0, qword [0x59fd20]
movups xmmword [esp + 0x10], xmm0
movq xmm0, qword [0x59fd30]
movdqu xmmword [esp], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x413e30
mov byte [esp + 0xf], bl
xor ebx, ebx
lea eax, [esp + 0x6c]
mov dword [eax], ebx
push eax
push 0x590020
push 1
push ebx
push 0x590030
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x413f1d
mov dword [esp + 0x68], ebx
mov edi, dword [esp + 0x6c]
push 0xc
call fcn.004f507e
add esp, 4
mov esi, eax
mov dword [eax + 4], ebx
mov dword [eax + 8], 1
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x4145cc
test esi, esi
je 0x4145cc
mov ebx, eax
lea eax, [esi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [0x5c0d2c]
sub esp, 0x24
lea eax, [esp + 0x8c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
pxor xmm0, xmm0
movdqu xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], edi
call ecx
mov ebx, eax
mov eax, dword [esp + 0x10]
lock dec dword [eax]
jne 0x413d4e
mov eax, dword [esi]
test eax, eax
je 0x413d35
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x413d45
push eax
call fcn.004f50ec
add esp, 4
push esi
call fcn.004f50ae
add esp, 4
test ebx, ebx
js 0x413e83
mov eax, dword [esp + 0x68]
sub esp, 0x20
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
movdqa xmm0, xmmword [0x59fd40]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 3
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x413f7c
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
pxor xmm0, xmm0
movq qword [esp + 0x58], xmm0
mov edx, dword [esp + 0x14]
lea esi, [edx + 4]
movsx eax, byte [edx + 0xf]
mov ecx, esi
test eax, eax
jns 0x413dbf
mov eax, dword [edx + 8]
test eax, eax
js 0x4145bd
mov ecx, dword [edx + 4]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4145b6
lea ebx, [esp + 0x58]
push ebx
push 2
push 0x5a037a
push 1
push 0x5a0380
push eax
push ecx
call fcn.0043d8a0
add esp, 0x1c
test al, al
jne 0x413fca
cmp byte [esp + 0x63], 0
jns 0x413e09
push dword [esp + 0x58]
call fcn.004f50ae
add esp, 4
mov esi, dword [esp + 0x64]
test esi, esi
je 0x413ecb
mov dword [esp + 0x64], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x5c0d2c]
push esi
call ecx
jmp 0x413ecb
mov esi, eax
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x413f07
lea edi, [esp + 0x70]
mov ecx, edi
push 2
push 0x1fb
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x2e
push str.Failed_to_initialize_security._Error_code__0x
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, eax
push esi
call fcn.00411fc0
mov ecx, edi
call fcn.0044e910
jmp 0x413f07
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x413ecb
lea esi, [esp + 0x70]
mov ecx, esi
push 2
push 0x20c
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x22
push str.Could_not_connect._Error_code__0x
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, eax
push ebx
call fcn.00411fc0
mov ecx, esi
call fcn.0044e910
mov esi, dword [esp + 0x68]
test esi, esi
je 0x413ee9
mov dword [esp + 0x68], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x5c0d2c]
push esi
call ecx
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x413f07
mov dword [esp + 0x6c], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x5c0d2c]
push esi
call ecx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.004f5620
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, eax
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x413ee9
lea edi, [esp + 0x70]
mov ecx, edi
push 2
push 0x203
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x26
push str.Failed_to_create_IWbemLocator_object.
push eax
call fcn.00493c00
add esp, 0xc
push 0xd
push str.Err_code__0x
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, eax
push esi
call fcn.00411fc0
mov ecx, edi
call fcn.0044e910
jmp 0x413ee9
mov esi, eax
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x413ecb
lea edi, [esp + 0x70]
mov ecx, edi
push 2
push 0x214
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x2c
push str.Could_not_set_proxy_blanket._Error_code__0x
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, eax
push esi
call fcn.00411fc0
mov ecx, edi
jmp 0x413ec6
mov dword [esp + 0x1c], esi
push 0x70
call fcn.004f507e
add esp, 4
mov edi, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], 0x80000038
mov dword [esp + 0x50], 0x34
add eax, 0x68
mov ecx, 0x5a0384
cmp edi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4145af
push 0x68
push 0x5a0384
push edi
call fcn.004f8b10
add esp, 0xc
mov word [edi + 0x68], 0
movsx edx, byte [esp + 0x63]
mov esi, edx
test edx, edx
jns 0x41402d
mov esi, dword [esp + 0x5c]
xor eax, eax
dec eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea edi, [esi + 2]
cmp edi, 0x7ffffff8
jae 0x4145db
cmp edi, 4
jbe 0x414549
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
or edi, 3
inc edi
js 0x4145d6
lea eax, [edi + edi]
push eax
call fcn.004f507e
add esp, 4
or edi, 0x80000000
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test dl, dl
jns 0x41409c
mov ebx, dword [esp + 0x58]
lea edi, [eax + esi*2]
cmp ebx, eax
jb 0x4140ab
cmp edi, ebx
ja 0x4145af
test esi, esi
je 0x4140bc
add esi, esi
push esi
push ebx
push eax
call fcn.004f8b10
add esp, 0xc
lea eax, [edi + 4]
mov ecx, 0x5a037a
cmp edi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4145af
mov dword [edi], 0x5c005c
mov word [edi + 4], 0
lea ecx, [esp + 0x30]
push 0x15
push 0x59feec
call fcn.004a57f0
movsd xmm0, qword [eax]
lea ecx, [esp + 0x40]
movsd qword [ecx], xmm0
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
xor edi, edi
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
push 1
push 0x5a03ee
call fcn.004a57f0
movq xmm0, qword [eax]
lea ebx, [esp + 0x70]
movq qword [ebx], xmm0
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov dword [eax + 8], edi
pxor xmm0, xmm0
movq qword [eax], xmm0
movsx eax, byte [ebx + 0xb]
test eax, eax
cmovs eax, dword [ebx + 4]
mov edx, dword [ebx]
cmovns edx, ebx
lea edi, [esp + 0x4c]
mov ecx, edi
push eax
push edx
call fcn.004a57f0
cmp byte [ebx + 0xb], 0
jns 0x414167
push dword [esp + 0x70]
call fcn.004f50ae
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x41417a
push dword [esp + 0x40]
call fcn.004f50ae
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x41418d
push dword [esp + 0x30]
call fcn.004f50ae
add esp, 4
cmp byte [esp + 0x57], 0
jns 0x414198
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], eax
push 0xc
call fcn.004f507e
add esp, 4
mov ebx, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 1
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx], eax
test eax, eax
setne dl
test edi, edi
sete cl
or cl, dl
je 0x4145cc
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x4145cc
push 0xc
call fcn.004f507e
add esp, 4
mov edi, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 1
push 0x5a03f2
call fcn.004f4ed0
mov dword [esp + 0x28], eax
mov dword [edi], eax
test edi, edi
je 0x4145cc
mov eax, dword [esp + 0x14]
add eax, 8
mov dword [esp + 0x24], eax
lea eax, [edi + 8]
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x50]
call dword [0x5c0d2c]
lea eax, [esp + 0x64]
push eax
push 0
push 0x30
push dword [esp + 0x24]
push dword [esp + 0x38]
push ebx
call ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
lock dec dword [eax]
mov bl, byte [esp + 0xf]
jne 0x414289
mov eax, dword [edi]
test eax, eax
je 0x414270
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x414280
push eax
call fcn.004f50ec
add esp, 4
push edi
call fcn.004f50ae
add esp, 4
mov eax, dword [esp + 0x24]
lock dec dword [eax]
jne 0x4142c2
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x4142a9
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4142b9
push eax
call fcn.004f50ec
add esp, 4
push edi
call fcn.004f50ae
add esp, 4
mov edi, dword [esp + 0x10]
test edi, edi
js 0x414424
xor eax, eax
mov dword [esp + 0x30], eax
lea esi, [esp + 0x2c]
mov dword [esi], eax
mov edi, dword [esp + 0x64]
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
call dword [0x5c0d2c]
push esi
lea eax, [esp + 0x34]
push eax
push 1
push 0xffffffffffffffff
push edi
call ecx
test eax, eax
je 0x41446e
test bl, 1
je 0x4143ea
xor ebx, ebx
dec ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov ecx, dword [esp + 0x1c]
push 0x15
push 0x59feec
lea eax, [esp + 0x48]
push eax
call fcn.004bb900
lea eax, [esp + 0x70]
push eax
call fcn.004ac430
add esp, 4
mov esi, 0x4c4b40
add esi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
adc eax, 0
mov edi, SysReAllocString
cmovno edi, eax
cmovo esi, ebx
lea ebx, [esp + 0x70]
lea eax, [esp + 0x40]
push eax
call fcn.0053f270
add esp, 4
test al, al
jne 0x4143a1
push 0
push 0xc350
call fcn.0043c8d0
add esp, 8
push ebx
call fcn.004ac430
add esp, 4
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x70], esi
sbb eax, edi
jl 0x414357
lea eax, [esp + 0x40]
push eax
call fcn.0053f270
add esp, 4
test al, al
je 0x414566
push 0
call fcn.004b90d0
add esp, 4
test al, al
je 0x4143e1
lea esi, [esp + 0x70]
mov ecx, esi
push 0
push 0x24e
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x2d
push str.browser_assistant.exe_should_be_writable_now.
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, esi
call fcn.0044e910
lea ecx, [esp + 0x40]
call fcn.004ba510
mov esi, dword [esp + 0x30]
test esi, esi
je 0x414408
mov dword [esp + 0x30], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x5c0d2c]
push esi
call ecx
cmp byte [esp + 0x57], 0
jns 0x413df6
push dword [esp + 0x4c]
call fcn.004f50ae
add esp, 4
jmp 0x413df6
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x414408
lea esi, [esp + 0x70]
mov ecx, esi
push 2
push 0x229
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x1e
push str.ExecQuery_failed_with_error_
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, eax
push edi
call fcn.00411fc0
mov ecx, esi
call fcn.0044e910
jmp 0x414408
lea ecx, [esp + 0x70]
jmp 0x4144bb
mov dword [esp + 0x30], 0
mov eax, dword [edi]
mov ecx, dword [eax + 8]
call dword [0x5c0d2c]
push edi
call ecx
mov ecx, esi
call fcn.0043b4a0
mov edi, dword [esp + 0x64]
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
call dword [0x5c0d2c]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 1
push 0xffffffffffffffff
push edi
call ecx
mov ecx, esi
test eax, eax
jne 0x4142fe
mov byte [esp + 0xf], bl
mov dword [esp + 0x40], 0xffffffff
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x70], xmm0
mov word [esp + 0x70], 0
mov ebx, dword [esp + 0x30]
mov esi, ecx
call fcn.00419ad0
mov edi, eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
call dword [0x5c0d2c]
xor edx, edx
push edx
lea eax, [esp + 0x44]
push eax
push edi
push edx
push str.ProcessId
push ebx
mov bl, byte [esp + 0x27]
call ecx
cmp word [esp + 0x70], 1
je 0x41448a
push dword [esp + 0x78]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x414536
mov edi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x30]
mov bl, 1
test edi, edi
jne 0x414474
jmp 0x41448a
pxor xmm0, xmm0
mov ecx, edi
lea eax, [esp + 0x30]
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov byte [eax + 0xb], cl
jmp 0x414094
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x4143e1
lea esi, [esp + 0x70]
mov ecx, esi
push 2
push 0x24b
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044e430
lea eax, [esp + 0x78]
push 0x33
push str.After_closing_assistant_its_executable_is_still_not
push eax
call fcn.00493c00
add esp, 0xc
push 8
push str.writable
jmp 0x4143d1
push str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
jmp 0x4145c2
push str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x4145c2
push str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
push 0x59f83f
call fcn.00526860
push 0x8007000e
call fcn.004f5060
call fcn.00525870
lea ecx, [esp + 0x30]
call fcn.00525850
int3