Function at 0x4057c0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416140
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x478010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], str.ROgBeffqeXy1xGPuHQdvO5OHk46BLYPM73vpVIHxrKhPcjvpXtV3m486EzBIjEVeetAFfM28Vw1dmttCy73TMKfSOy27T70r3xwKSoH69WU4Bg31Uv7tQgDRGLSsRo40cMYy8lIDSihmxbvjnytDTBg7swNsBV7b9UosPmtcevC2R43W3g8MNHvWEQEQCw56cMQnt1OuD9F6mcP9TPKR4leX9nxmsoSAsobK2P7tSpmxRe1SIxNjKcG25oHKL7mhSQSw9a6q4bMlkbDT7Pn4uQFg0NDMiFixgqb9Yh2OzUjzLnIrMaKzO59Nyso4OKGLo3RMsY0eH0kJ8mb6hjgX5HaiIG3eqbQqByJ46xd0t9hFqtR9JuT1DY10bEUP8MxxvUN3BNw5w4CBXM3eiIGf1RlxVICn0h9zkGDU07vEFpgs48N8Mxg4by8aagQD39V81SoOH64A0KctX73NJ3LOyyFMgCnQfCXXc6LJDAqkILrlQ7wjoM1F1BCXRf3EwIaXeq7z8J71j7b6TgMQIRkITJVRLuM1Lcfb9rh80W1opqAbcteOkTCXYeTkXOBkMAMLHiI4vSlPUoYsOq6EA0ohuD8OGDzope94lAvWluCqRJI8Kxq3yNJo8KzslrQmk9yvetefHVIOx9gPY16JYuiY1FwXyGGOgc5HdD6jbGOkpn7yrOOEkHjAKJyK9RoHPYyoRfRmRuqV8aUIXH8QKEAEpyBP8tlmFQHrr0TxglpdAfj6o8pw82vus1WTK22xjW3RT67QmuUpSr5RwoO2144jRgafr51lfaWPVg3fAstqhv5C3vpOFtMe2GbPPaTjWaAETKKuO2SLhhcjGh1x7vNfPXdgKQpkPnYKSkThphlBxzrh3gjWYWOfy3PJfJjIfYXHEfKd8wiJYdRhKLNUF561Y8Yazot9wWdfGj6KelzBH5FrjUPwhGwckGQ2asQHU1efcNmgoBki012ifxyVz4vnhs0vGxsQEEkF3zu0Np1xmViK0hXt3550VqkoYintU7EHQV471arHuIP7XvSBT3QoSS276nNMPrdCSKdD7uIMkj64voWV2PWNbmFKjsXruoNPaoCuCkkrWBEIVQCc2OalhD625fduUy3TnICusQ1WGA7xvzeicSN27Nvi5rWl6dryVa2m4vVg4daprYSfyrLK7aqyaLFNXtgCVBlGj1uUMrAyTkydOpzk5kIrpWV6sbD6cuxXuls8MigE1A2vneerlayf6KoMnWw7eLfzpJWLcL5JQuUzmRqDDLrSHVKSx9FVgTCLhHmkkT5eryE1zLlpRQHAyEgHclCLnpc4vsFMF8V4gYVLuUlIGSg0CNtJxVMuEjqU4JEHuC4ClueiXevfX7mU3fqVX7f46dd86Xl7yuTkqUSaYcWQfCiesDlB3ehD8bGWLnI4yTyg7BodD1QTcYQcCmySj7bX8oPJvosUXiAF8mHmJ7aw5b1ii2p9V63V2zapM3RHUXSG4e0MnBH33PUjXrJR9KI0VxN59phsvHgX9Eu105pwlE27NSWoEVkd7d0h5mQluPc52oJcgbjsdaHIIb1YBKlk5q3U4vzInbGtQrC82xvGOA6giFtNAByHy7lkufh2n4jvb3mflOasiXb1OdtRG96mqclbHJARlnhn4LtBsHyqI5KpjaJ7ohrUOAAy1S01UtieYoRXRRYC9ts2spvmEckF3fHW
push 0x42d232
lea eax, [ebp + 8]
push eax
call fcn.00403280
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x405834
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401770
mov al, byte [ebp - 0x11]
jmp 0x4058f3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call fcn.00403900
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
push str.Name
push 0x42d233
push str.SELECT__FROM_Win32_Process
push str.ROOTcimv2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 2
jl 0x4058a7
mov byte [ebp - 0x12], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401770
mov al, byte [ebp - 0x12]
jmp 0x4058f3
mov dword [ebp - 0x38], str.OAKeR1zigloku6WRjQV6tmeOB8xUKOjUvvpN3DBRR4wvBAn61c9rRrBnIKEuh0wcjc9u5fD3JiuHgSlnM4WVua7xjVoBb2anzn3wzAQHBHPwQQsDClhUpRBFvdUJ64hAsBkQA0mavfJMMoIJiM8peoSzItWxGijVQil8Lq8dIc2uuwvwlVHc4eCuBVSRE06vpEzGel15NbbQqlCL4biHzpp866MMGARiBKEAAQOsx9ii1XefyKm6SyFGoQkyvuegBsoA2Aau3n7qLFTABFveEQKKXmOEPedkptF9dMBLEs258KzuQPtF44VpxadLppcmImzrkhzlXl5hEBAxDV8FPzjb658L1IYc3shj5qoHRhWfOIHh6uvd9hU2TjMIpUJBEX8kFdhOvPUqbC3c8RJWKGEpul5VpP3kyUBMRcl5hWWqhW7Mpg9gRUkbE1xRMpS3A9lDStAmQRE7GpOrlEaehADHqtkeoCzngl5zvLSXb9fwYNsv8UnCeY9J9deT4xRVV0IX1m2EtHBTLWIkJHvWwSmyp3GYDkTfGrjTd6FFcKeGDPGaSwomsICO36OM1ddOnR3bopoE5QjxgsPf4G4LRrbIcRjN4vG6DeeholCK8SBifU1JwmFL5CcOf8yJGAEtPmloysHxB4z2gotLiwtDWoGcO1yuNUNk9TXqKWS23Vi008Rq9YToPrBmR0Wcl3eWtlRYkygKgmtF8tdJEnwIC5KgxP29hBoCvXVldBRAixtGmOWH8a31HbPjiEIRxgbxITbwL0BYu0iWqERgDEkq1asoRRB58OORi7KfXegJrAzv4xcj4WlIX46NchSI280Jep0Ucmwa0vAE19vGY2drwt9lyXpTg7JehnmDr1X1jegR4aOdNEdM7ASerlEWQMtmWsofar4vKBaN0qsBFqKGJar8DbMqPf18vVQgmo9hYOtnAMeBuMoLSwTcbxx2iDzr2TCTuiuqWl4FGchRV0Nmyzc0nQmIgfLdiiF6B3dxN1pX7H90raPthP9AMOhERmAgTQcteemD1XCKHqMzfbrQ6mtsgx09copnabrnpTOakGsKkyw6jOJVyMOxUnRLnO1keFSOHNr4G0mPRl44mCYQImFf64PgxdyOVz5zb9THn0l8e9xRT2zscRpqrEwAPbBtVWJ5sOMTTa6VinqVeg3i5HmnRwdTrt6TCGHsCdBX3jWL1zCynm4BXOERwmLzxQmGbx0AjlGAQvSkjhq27frl1Lo6QdK9kd9kx2J1EMl0EfuwabvA3B8aRDvKxrkq0uyhpydYkGGP1i1vwYUru0gqFaRVzIklOH7XfjOstNMaLJnzox6JyM2b8Add95c61YGLhl86Opyx404gKJVx6bPdqLaBLR24QtA1vvPhwqPYfRhiEwCVKdcXh8fBcKBNBtvXHvM4ljlVXqPB7XNTTIKCTHQ8tIg8yjvQoRWeu6Fi849kbcvqJpl422jzR8403n2SRUsfIrkqVylOVp7oaMRQWkMLVCCCmdWacQyhivGaLWaArSrFRbqhpio0wbinRmvNcFEe073JoEVoO1F5kLejHg51G7YSUtlPsciG8AzSJoIbadnoLzEEE9I0O5iURisgl7aUuSjM4e97B1xkancGyo5Cu3su7Ch2XS5Uqwd3Ryxxi0vyhQvug5MXCjkN4lC3eQ0oLz8LT4M0nQ3JDulS8PnAmtpg7qFaM92ISJMsdNvh3khpvAFl0Rhv7xQvJU1c3Kq2EeO869UkugK9Yiw6hWObyJrjlUCTcsz6rTHc7MQjUyopPz71QtdvDICIpDS0cTYqbaSx7JOBxcuDFdNI8mxSAprVqnx9KxlghYDxanWLAfLgQP3x39M7R4DoRsKXlFrtFU9YDm3AlRkBtTvt4VQteiwJhj33foeHO8t6aIw34gDWqFVe8puGF17LatnTrENgGkBBDLqj2JzAlgffHNmVut3w4w22IdoaLNpEdctMxFpHECuDOX2Qdgzgx8JPCHm93qARjY03UxNtwuQeVkVwDhCpb1BJtweD4EOiCr0TuPN0TtEy7QpuQLKBy384lVDKOwCr6f5jBdPlu0oPR8FJch8Hh6b641nmRDpjXlvvCkKxLiE2giPIfICJY926fGnWhcujI5cRVYKxYqdKR5TlTiGYhgmfgGJNDW4i63G1U0ri8lWnMMMWhyrSPydIgADP2edC7fbJ0jPFYITTAiflNoD6ki2C8LsI4YW34Vt3AUkv5ae7p4YM60GtqIF0ytGMRH7PuJ4b9UHAI3hsR9yY8UC7OdkQXJW64stDdC3w7r7DYzu599q6507fffEbzs2pPTHDiQaIXK8mGNrPRgUKqqumqkERjkPaPhko61OAcaIprBTjegj2SIH873HOWSrxhoMXe428i3emBFJJVuHrrJmq38BPXu2pODoQzftBNTmMkxW5bT7WnDHl2iyGDmWlI0o1g9srffhatyI3GYt1dVC9Qp68XuFAHYQQHHWfaKtYJVlYIOAuIrBkimdPMKP81KNdz8wS85RDvDgX268JXlQAdbfrCNbEpY7rO1qoJ3Kv2y2MS1Gxh69OqUVxO9BxbXzhDfv1yvOSdkpU4rJ8fwW6NJqFs8aS8zPWu4jcep93OteySJDdILkJdRekqU3rzdt881YAnKcdjiwzaSEUNj1fxBhXityIjUVVy0j3DDPzWXpzfsVSUVnkGlQ0uEaVIiyX2cJCFfkgLsbRXzu8FLpRyyFKa4tWDtze5clzaPhlyzgpHVgb0hM17LOyedfnrg6dwOPnMJKQQXdWkQ505eL3hBLGmnlv2VaRphzGhmaMX6KRgbD0nKjv2Mnk2HOnNpEA47zokbk51gHgolx3AgW7l3UFr9NGGcmc6arxGLrEOA5XaphrGyULeh2OztDO7k00mCup7L7j001uwVd0UH4DFoLQckJU3s6KYXDunUiTWjJ2U8DUN8R1IqyOM9INVNaEl5qtf0p8N6GwlJHS7BtsprcFEbjYMawn855dxTbKtOpBh6t2
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401770
mov al, byte [ebp - 0x13]
jmp 0x4058f3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18