Function at 0x48b7a0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
test edi, edi
js 0x48bb49
cmp edi, 7
jae 0x48bb49
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
push eax
push 0x569f10
push 1
push ebx
push 0x569fe0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x48b80b
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
lea eax, [ebx - 2]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
push 0x55b2d4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], ebx
call fcn.0048b270
mov eax, dword [eax]
test eax, eax
je 0x48b825
mov edx, dword [eax]
jmp 0x48b827
xor edx, edx
mov eax, dword [ebp - 0x28]
push esi
lea esi, [ebp - 0x24]
push esi
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
test esi, esi
je 0x48b88b
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48b88b
test esi, esi
je 0x48b88b
mov eax, dword [esi]
test eax, eax
je 0x48b86d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x48b880
push eax
call fcn.005238b4
add esp, 4
mov dword [esi + 4], ebx
push 0xc
push esi
call fcn.0052389d
add esp, 8
cmp dword [ebp - 0x20], ebx
jl 0x48b8b4
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x24]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x48b8d9
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
push dword [edi*8 + 0x55b020]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
call fcn.0048b1e0
mov eax, dword [eax]
test eax, eax
je 0x48b8f5
mov esi, dword [eax]
jmp 0x48b8f7
xor esi, esi
push 0x55b2ec
lea ecx, [ebp - 0x20]
call fcn.0048b1e0
mov eax, dword [eax]
test eax, eax
je 0x48b90e
mov edx, dword [eax]
jmp 0x48b910
xor edx, edx
mov eax, dword [ebp - 0x24]
lea edi, [ebp - 0x30]
push edi
push 0
push 0x30
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x50]
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp - 0x40], eax
test esi, esi
je 0x48b971
lea ecx, [esi + 8]
push ecx
call edi
test eax, eax
jne 0x48b96e
test esi, esi
je 0x48b96e
mov eax, dword [esi]
test eax, eax
je 0x48b950
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x48b963
push eax
call fcn.005238b4
add esp, 4
mov dword [esi + 4], ebx
push 0xc
push esi
call fcn.0052389d
add esp, 8
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x48b9b3
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x48b9b3
test esi, esi
je 0x48b9b3
mov eax, dword [esi]
test eax, eax
je 0x48b995
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x48b9a8
push eax
call fcn.005238b4
add esp, 4
mov dword [esi + 4], ebx
push 0xc
push esi
call fcn.0052389d
add esp, 8
cmp dword [ebp - 0x40], ebx
jge 0x48b9e6
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x48bb18
mov edx, dword [ebp - 0x3c]
mov edi, edx
cmp byte [edx], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
jne 0x48bb18
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x2c], 0
je 0x48bb15
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x50]
push 0
push 0
push edx
mov edx, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0
push dword [edx*8 + 0x55b024]
push eax
call dword [ecx + 0x10]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x48]
mov dword [ebp - 8], 0xf
push 0
push 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
jle 0x48bab1
push ebx
call fcn.005238ab
add esp, 4
mov esi, eax
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push dword [ebp - 0x48]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea ecx, [ebp - 0x1c]
call fcn.0043c9b0
push esi
call fcn.005238b4
add esp, 4
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0x80
push edi
call fcn.00431ee0
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x80
push edi
push dword [ebp - 0x38]
call fcn.0048b660
mov ebx, dword [ebp - 0x34]
add esp, 0xc
test eax, eax
je 0x48baf4
inc ebx
sub edi, 0xffffff80
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x1c]
call fcn.00403240
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x3c]
test ecx, ecx
jne 0x48b9f6
jmp 0x48bb18
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop ebx
call fcn.0052388c
mov esp, ebp
pop ebp
ret