Function at 0x45ae20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a976b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x244
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b40
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0xd8]
call fcn.004123d0
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1b0]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x54]
call fcn.00401fb0
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1b8]
call fcn.00401c20
push eax
lea ecx, [ebp - 0x1c]
call fcn.00426bd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x54]
call fcn.00401c00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd8]
call fcn.00412410
lea ecx, [ebp + 0xc]
call fcn.0043b8b0
push eax
lea ecx, [ebp + 0xc]
call fcn.00413340
push 0x4afe70
lea edx, [ebp + 0xc]
push edx
call fcn.00411fc0
add esp, 8
movzx eax, al
test eax, eax
je 0x45b143
lea ecx, [ebp - 0x38]
call fcn.0040d890
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov ecx, 0x4d72a0
call fcn.00412030
movzx ecx, al
test ecx, ecx
je 0x45af80
push 0
lea edx, [ebp - 0xdc]
push edx
call fcn.0045b9c0
add esp, 8
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1c0]
push ecx
mov ecx, 0x4d72a0
call fcn.00413340
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xdc]
call fcn.0043bb20
mov ecx, 0x4d72a0
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b005
push str.Version
push 0x4adb78
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
lea eax, [ebp - 0xf8]
push eax
call fcn.0045bc60
add esp, 0x14
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1c8]
push edx
lea ecx, [ebp - 0x38]
call fcn.0040c780
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xf8]
call fcn.00401c00
lea ecx, [ebp - 0x38]
call fcn.00401c20
push eax
push 0x4ae534
push 0x4d72a0
call fcn.00402a00
add esp, 0xc
jmp 0x45b04d
push 0x4d72a0
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00401c00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
jmp 0x45b0b4
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.00401c20
push eax
push 0x4ae534
push 0x4d72a0
call fcn.00402a00
add esp, 0xc
mov ecx, 0x4d72a0
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b0f6
push 0x4b3a28
mov ecx, 0x4d72a0
call fcn.00405a40
push 0x4d72a0
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00401c00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push str.osname
lea ecx, [ebp + 0xc]
push ecx
call fcn.00411fc0
add esp, 8
movzx edx, al
test edx, edx
je 0x45b236
mov ecx, 0x4d72a4
call fcn.00412030
movzx eax, al
test eax, eax
je 0x45b1f5
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0045c490
add esp, 4
mov dword [ebp - 0x1d4], eax
mov edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d8], edx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1d8]
call fcn.00401c20
push eax
lea ecx, [ebp - 0x100]
call fcn.004132d0
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x1e0]
push ecx
mov ecx, 0x4d72a4
call fcn.00413340
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x100]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x11c]
call fcn.00401c00
push 0x4d72a4
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4b3990
lea eax, [ebp + 0xc]
push eax
call fcn.00411fc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b307
mov ecx, 0x4d72a8
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b2aa
push 1
lea eax, [ebp - 0x120]
push eax
call fcn.0045b9c0
add esp, 8
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1e8]
push edx
mov ecx, 0x4d72a8
call fcn.00413340
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call fcn.0043bb20
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.0045b9c0
add esp, 8
lea ecx, [ebp - 0x124]
call fcn.0043bb20
push 0x4d72a8
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov ecx, dword [ebp - 0x1a4]
or ecx, 1
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4afe34
lea edx, [ebp + 0xc]
push edx
call fcn.00411fc0
add esp, 8
movzx eax, al
test eax, eax
je 0x45b3da
mov ecx, 0x4d72ac
call fcn.00412030
movzx ecx, al
test ecx, ecx
jne 0x45b370
push 0x4d72ac
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
call fcn.0045b970
test eax, eax
je 0x45b38a
push 0x4b3a24
mov ecx, 0x4d72ac
call fcn.004133f0
jmp 0x45b399
push 0x4b3a20
mov ecx, 0x4d72ac
call fcn.004133f0
push 0x4d72ac
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4b3964
lea ecx, [ebp + 0xc]
push ecx
call fcn.00411fc0
add esp, 8
movzx edx, al
test edx, edx
je 0x45b510
mov ecx, 0x4d72b0
call fcn.00412030
movzx eax, al
test eax, eax
je 0x45b4cf
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x128], esp
push str.nothing
call fcn.00401fb0
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f0], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
call fcn.00401fb0
mov dword [ebp - 0x1f4], eax
mov edx, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f8], edx
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x130], esp
push str.HKEY_LOCAL_MACHINE
call fcn.004132d0
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x200], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xf
mov ecx, 0x4d7298
call fcn.004563f0
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
push ecx
mov byte [ebp - 4], 2
mov ecx, 0x4d7298
call fcn.00456170
push 0x4b2660
mov ecx, 0x4d729c
call fcn.0045c710
push eax
mov ecx, 0x4d72b0
call fcn.00413340
push 0x4d72b0
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4afe1c
lea eax, [ebp + 0xc]
push eax
call fcn.00411fc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b632
mov ecx, 0x4d72b4
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b5f1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.AntivirusProduct
call fcn.00401fb0
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x154]
push ecx
mov byte [ebp - 4], 2
call fcn.0045c210
add esp, 0x20
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x214], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x214]
call fcn.00401c20
push eax
lea ecx, [ebp - 0x134]
call fcn.004132d0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x21c]
push ecx
mov ecx, 0x4d72b4
call fcn.00413340
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x134]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.00401c00
push 0x4d72b4
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4afe04
lea eax, [ebp + 0xc]
push eax
call fcn.00411fc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b754
mov ecx, 0x4d72b8
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b713
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x15c], esp
push str.FirewallProduct
call fcn.00401fb0
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x178]
push ecx
mov byte [ebp - 4], 2
call fcn.0045c210
add esp, 0x20
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x22c]
call fcn.00401c20
push eax
lea ecx, [ebp - 0x158]
call fcn.004132d0
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x234]
push ecx
mov ecx, 0x4d72b8
call fcn.00413340
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x158]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x178]
call fcn.00401c00
push 0x4d72b8
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4afdec
lea eax, [ebp + 0xc]
push eax
call fcn.00411fc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b876
mov ecx, 0x4d72bc
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b835
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x180], esp
push str.AntiSpywareProduct
call fcn.00401fb0
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x19c]
push ecx
mov byte [ebp - 4], 2
call fcn.0045c210
add esp, 0x20
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x244], edx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x244]
call fcn.00401c20
push eax
lea ecx, [ebp - 0x17c]
call fcn.004132d0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x24c]
push ecx
mov ecx, 0x4d72bc
call fcn.00413340
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x17c]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x19c]
call fcn.00401c00
push 0x4d72bc
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x1a4]
or edx, 1
mov dword [ebp - 0x1a4], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4b394c
lea eax, [ebp + 0xc]
push eax
call fcn.00411fc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45b924
mov ecx, 0x4d72c0
call fcn.00412030
movzx edx, al
test edx, edx
je 0x45b8eb
lea eax, [ebp - 0x1a0]
push eax
mov ecx, dword [ebp - 0x1a8]
call fcn.0045c5f0
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x254], ecx
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x254]
push edx
mov ecx, 0x4d72c0
call fcn.00413340
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a0]
call fcn.0043bb20
push 0x4d72c0
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x45b95b
push 0x4adb78
mov ecx, dword [ebp + 8]
call fcn.004132d0
mov ecx, dword [ebp - 0x1a4]
or ecx, 1
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00423b90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8