Function at 0x4ae580
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x5ac]
xor edi, edi
push ecx
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5d0], edi
mov dword [ebp - 0x604], 0x63
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0xc], edi
lea esp, [esp]
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x568461], 0
je 0x4aee27
lea edx, [ebp - 0x5b8]
push edx
push 0x5020f8
push 1
push edi
push 0x5021c8
mov dword [ebp - 0x5b8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4aee25
mov eax, dword [ebp - 0x5b8]
lea edx, [ebp - 0x5b4]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
mov dword [ebp - 0x5b4], edi
mov ecx, dword [eax]
push str.ROOTCIMV2
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x4aee17
mov ecx, dword [ebp - 0x5b4]
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x5b4]
js 0x4aee0f
lea ecx, [ebp - 0x5d8]
push ecx
push edi
push 0x30
push 0x526080
mov dword [ebp - 0x5d8], edi
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x52550c
push eax
call edx
test eax, eax
js 0x4aee09
push 0x400
mov dword [ebp - 0x5e0], edi
call fcn.004e5420
mov esi, eax
mov eax, dword [ebp - 0x5d8]
add esp, 4
mov dword [ebp - 0x5f8], esi
cmp eax, edi
je 0x4aedbe
jmp 0x4ae6c0
mov ecx, dword [eax]
lea edx, [ebp - 0x5e0]
push edx
lea edx, [ebp - 0x600]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x5e0], edi
je 0x4aedbe
push 0x3e
lea edx, [ebp - 0xa2]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0xa4], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x600]
mov ecx, dword [eax]
add esp, 0xc
push edi
push edi
lea edx, [ebp - 0x5cc]
push edx
push edi
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4ae792
cmp word [ebp - 0x5cc], 1
je 0x4ae792
mov ecx, dword [ebp - 0x5c4]
push 0x22
push ecx
call fcn.004e53f9
add eax, 2
lea edx, [ebp - 0xa4]
add esp, 8
sub edx, eax
jmp 0x4ae750
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4ae750
lea eax, [ebp - 0xa4]
lea edx, [eax + 2]
jmp 0x4ae770
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4ae770
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0xa6], dx
lea eax, [ebp - 0x5cc]
push eax
call ebx
push 0xfe
lea edx, [ebp - 0x1a2]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1a4], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x600]
mov ecx, dword [eax]
add esp, 0xc
push edi
push edi
lea edx, [ebp - 0x5cc]
push edx
push edi
push str.Dependent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4ae842
cmp word [ebp - 0x5cc], 1
je 0x4ae842
mov ecx, dword [ebp - 0x5c4]
push 0x22
push ecx
call fcn.004e53f9
add eax, 2
lea edx, [ebp - 0x1a4]
add esp, 8
sub edx, eax
jmp 0x4ae800
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4ae800
lea eax, [ebp - 0x1a4]
lea edx, [eax + 2]
jmp 0x4ae820
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4ae820
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x1a6], dx
lea eax, [ebp - 0x5cc]
push eax
call ebx
push 0x400
push edi
push esi
call fcn.004e8ba0
lea ecx, [ebp - 0xa4]
push ecx
push str.SELECT__FROM_Win32_DiskDrive_WHERE_DeviceID___s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x5b4]
add esp, 0x18
lea ecx, [ebp - 0x5ec]
push ecx
push edi
push 0x30
push esi
mov dword [ebp - 0x5ec], edi
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x52550c
push eax
call edx
mov eax, dword [ebp - 0x5ec]
cmp eax, edi
je 0x4aeda8
mov ecx, dword [eax]
lea edx, [ebp - 0x5e0]
push edx
lea edx, [ebp - 0x5f0]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x5e0], edi
je 0x4aedbe
push 0x3e
lea edx, [ebp - 0x62]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x64], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x5f0]
mov ecx, dword [eax]
add esp, 0xc
push edi
push edi
lea edx, [ebp - 0x5cc]
push edx
push edi
push str.InterfaceType
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4ae928
cmp word [ebp - 0x5cc], 1
je 0x4ae928
mov eax, dword [ebp - 0x5c4]
lea edx, [ebp - 0x64]
sub edx, eax
jmp 0x4ae910
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4ae910
lea ecx, [ebp - 0x5cc]
push ecx
call ebx
mov eax, dword [ebp - 0x5f0]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push edi
push edi
lea ecx, [ebp - 0x5cc]
push ecx
push edi
push str.Index
push eax
mov dword [ebp - 0x5e8], edi
call edx
test eax, eax
jne 0x4ae96f
cmp word [ebp - 0x5cc], 1
je 0x4ae96f
movsx eax, word [ebp - 0x5c4]
lea ecx, [ebp - 0x5cc]
push ecx
mov dword [ebp - 0x5e8], eax
call ebx
push 0x400
push edi
push esi
call fcn.004e8ba0
mov eax, dword [ebp - 0x5b4]
add esp, 0xc
lea ecx, [ebp - 0x5d4]
push ecx
push edi
push 0x30
push str.SELECT__FROM_Win32_LogicalDiskToPartition
mov dword [ebp - 0x5d4], edi
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x52550c
push eax
call edx
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5dc], edi
cmp eax, edi
je 0x4aed9a
lea ebx, [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 0x5dc]
push edx
lea edx, [ebp - 0x5fc]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x5dc], edi
je 0x4aed94
push 0xfe
lea edx, [ebp - 0x2a2]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x2a4], cx
call fcn.004e8ba0
mov eax, dword [ebp - 0x5fc]
mov ecx, dword [eax]
add esp, 0xc
push edi
push edi
lea edx, [ebp - 0x5cc]
push edx
push edi
push str.Antecedent
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jne 0x4aea92
cmp word [ebp - 0x5cc], 1
je 0x4aea92
mov ecx, dword [ebp - 0x5c4]
push 0x22
push ecx
call fcn.004e53f9
add eax, 2
lea edx, [ebp - 0x2a4]
add esp, 8
sub edx, eax
jmp 0x4aea50
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4aea50
lea eax, [ebp - 0x2a4]
lea edx, [eax + 2]
jmp 0x4aea70
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4aea70
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x2a6], dx
lea eax, [ebp - 0x5cc]
push eax
call ebx
lea ecx, [ebp - 0x1a4]
lea eax, [ebp - 0x2a4]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aeac6
cmp dx, di
je 0x4aeac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aeac6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4aeaa0
xor eax, eax
jmp 0x4aeacb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4aed78
push edi
xor ecx, ecx
xor eax, eax
push edi
mov word [ebp - 0x20], cx
lea ecx, [ebp - 0x5cc]
push ecx
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x5fc]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push edi
push str.Dependent
push eax
call edx
test eax, eax
jne 0x4aeb64
cmp word [ebp - 0x5cc], 1
je 0x4aeb64
mov eax, dword [ebp - 0x5c4]
push 0x22
push eax
call fcn.004e53f9
add eax, 2
lea edx, [ebp - 0x20]
add esp, 8
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4aeb30
lea eax, [ebp - 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4aeb45
sub eax, edx
lea edx, [ebp - 0x5cc]
sar eax, 1
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x22], cx
call ebx
push 0x400
push edi
push esi
call fcn.004e8ba0
lea eax, [ebp - 0x20]
push eax
push str.SELECT__FROM_Win32_LogicalDisk_WHERE_DeviceID___s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x5b4]
add esp, 0x18
lea edx, [ebp - 0x5e4]
push edx
push edi
push 0x30
push esi
mov dword [ebp - 0x5e4], edi
mov ecx, dword [eax]
push 0x52550c
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 0x5e4]
cmp eax, edi
je 0x4aed5e
mov ecx, dword [eax]
lea edx, [ebp - 0x5dc]
push edx
lea edx, [ebp - 0x5f4]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x5dc], edi
je 0x4aed88
mov eax, dword [ebp - 0x5f4]
mov ecx, dword [eax]
push edi
push edi
lea edx, [ebp - 0x5cc]
push edx
push edi
push str.DriveType
push eax
mov eax, dword [ecx + 0x10]
xor esi, esi
call eax
test eax, eax
jne 0x4aec1c
cmp word [ebp - 0x5cc], 1
je 0x4aec1c
movsx esi, word [ebp - 0x5c4]
lea ecx, [ebp - 0x5cc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ax, word [ebp - 0x20]
movzx ebx, ax
cmp ax, word [ebp - 0x5ac]
jne 0x4aec4c
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp - 0x5d0], 1
mov edx, 0x33
mov dword [ebp - 0x604], ecx
jmp 0x4aed50
mov eax, esi
sub eax, 2
je 0x4aed4b
sub eax, 4
je 0x4aec6a
mov edx, dword [ebp - 0x5e8]
cmp dword [ebp - 0x604], edx
jne 0x4aec82
mov ecx, dword [ebp - 0x5b0]
mov eax, 0x33
mov word [ecx + ebx*2 - 0x82], ax
jmp 0x4aed5e
mov ecx, 0x52620c
lea eax, [ebp - 0x64]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aecb6
cmp dx, di
je 0x4aecb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aecb6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4aec90
xor eax, eax
jmp 0x4aecbb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aed36
mov ecx, str.SCSI
lea eax, [ebp - 0x64]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aeced
cmp dx, di
je 0x4aece9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aeced
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4aecc7
xor eax, eax
jmp 0x4aecf2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aed36
mov ecx, str.SATA
lea eax, [ebp - 0x64]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aed26
cmp dx, di
je 0x4aed22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aed26
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4aed00
xor eax, eax
jmp 0x4aed2b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aed36
mov edx, 0x35
jmp 0x4aed50
mov edx, dword [ebp - 0x5b0]
mov ecx, 0x34
mov word [edx + ebx*2 - 0x82], cx
jmp 0x4aed5e
mov edx, 0x37
mov eax, dword [ebp - 0x5b0]
mov word [eax + ebx*2 - 0x82], dx
mov eax, dword [ebp - 0x5e4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x5f8]
mov eax, dword [ebp - 0x5d4]
cmp eax, edi
jne 0x4ae9c0
jmp 0x4aed9a
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x5f8]
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x5d8]
cmp eax, edi
jne 0x4ae6c0
push esi
call fcn.004e577a
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 4
push eax
call edx
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x5b8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 1
jl 0x4ae5d0
jmp 0x4aee27
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x5b8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call esi
cmp dword [ebp - 0x5d0], edi
jne 0x4aef60
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
xor esi, esi
mov eax, 1
mov ecx, esi
shl eax, cl
test ebx, eax
je 0x4aef3e
lea ecx, [esi + 0x41]
mov word [ebp - 0x10], cx
lea edx, [ebp - 0x10]
xor ecx, ecx
push edx
mov dword [ebp - 0xe], 0x5c003a
mov word [ebp - 0xa], cx
call edi
cmp eax, 3
je 0x4aee81
cmp eax, 6
je 0x4aee81
cmp eax, 2
jne 0x4aef3e
cmp esi, 1
jle 0x4aef3e
mov cx, word [ebp - 0x10]
cmp cx, word [ebp - 0x5ac]
jne 0x4aeeb5
mov eax, dword [ebp - 0x5b0]
mov edx, 0x33
mov word [eax + esi*2], dx
mov dword [ebp - 0x5d0], 1
jmp 0x4aef3e
sub eax, 2
je 0x4aef2f
sub eax, 4
je 0x4aef1e
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x3a2]
push edx
mov word [ebp - 0x3a4], cx
call fcn.004e8ba0
lea eax, [ebp - 0x3a4]
push eax
lea edx, [ebp - 0x10]
call fcn.004add40
lea eax, [ebp - 0x3a4]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aeef5
sub eax, edx
sar eax, 1
je 0x4aef0d
mov ecx, 0x35
jmp 0x4aef34
mov ecx, dword [ebp - 0x5b0]
mov eax, 0x34
mov word [ecx + esi*2], ax
jmp 0x4aef3e
mov eax, dword [ebp - 0x5b0]
mov edx, 0x33
mov word [eax + esi*2], dx
jmp 0x4aef3e
mov ecx, 0x37
mov edx, dword [ebp - 0x5b0]
mov word [edx + esi*2], cx
inc esi
cmp esi, 0x1a
jl 0x4aee43
cmp dword [ebp - 0x5d0], 0
jne 0x4aef60
mov ecx, dword [ebp - 0x5b0]
mov eax, 0x33
mov word [ecx + 4], ax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret