Function at 0x41b7f3
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx], 0x48e485
push ebx
add ebx, 4
push ebx
push 8
call fcn.0047911e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.0047911e
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x20], 0
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 0x24], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.0047911e
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
push 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], 0
push 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x41b9c0
push ebx
call fcn.00479124
add esp, 4
cmp dword [ebp - 0x50], 0
jne 0x41b9d4
mov eax, 0x48e230
jmp 0x41c570
mov dword [ebp - 0x3c], esp
push 0
xor eax, eax
call dword [sym.imp.ole32.dll_CoInitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41ba02
push 0xa8
push 0x402dba4
push 6
call fcn.0047912a
add esp, 0xc
push 0
push 0
push 0
push VariantClear
push 0
push str.WbemScripting.SWbemLocator
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x91c
call fcn.0047dce0
add esp, 0x28
push 0x10030
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x928
call fcn.0047dee0
add esp, 0x10
test eax, eax
je 0x41ba87
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41ba7d
push 0x161
push 0x402dba4
push 6
call fcn.0047912a
add esp, 0xc
mov eax, 0x48e230
jmp 0x41c570
push VariantClear
push 0
push str.rootCIMV2
push VariantClear
push 0
push 0x48e6f4
push VariantClear
push 0
push str.ConnectServer
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x964
call fcn.0047e450
add esp, 0x34
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0xc]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x10030
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x928
call fcn.0047dee0
add esp, 0x10
test eax, eax
je 0x41bb4c
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41bb42
push 0x275
push 0x402dba4
push 6
call fcn.0047912a
add esp, 0xc
mov eax, 0x48e230
jmp 0x41c570
push VariantClear
push 0
push str.SELECT__FROM_Win32_Process
push VariantClear
push 0
push str.ExecQuery
push 0x10030
push 0
push dword [ebp - 0xc]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push 0x10030
push 0
push dword [ebp - 0x10]
push 1
mov ebx, 0x928
call fcn.0047dee0
add esp, 0x10
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x41c4b5
push 0
push 0
push 0
push VariantClear
push 0
push str._NewEnum
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x940
call fcn.0047e0f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x14]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Count
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x934
call fcn.0047def0
add esp, 0x28
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
fld qword [ebp - 0x40]
fsub qword [0x48e965]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
call fcn.004019ad
push eax
lea eax, [ebp - 0x18]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x41c45e
lea eax, [ebp - 0x14]
push eax
call fcn.0041c69b
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041c6f0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x3c]
call fcn.0041c73e
push 0x80000301
push 0
push dword [ebp - 0x18]
push 0x10031
push 0
push dword [ebp - 0x1c]
push 2
mov ebx, 0x9a0
call fcn.0047ed10
add esp, 0x1c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x24]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x24], eax
push 0x10030
push 0
push dword [ebp - 0x24]
push 1
mov ebx, 0x928
call fcn.0047dee0
add esp, 0x10
test eax, eax
je 0x41bd3d
jmp 0x41c455
push 0
push 0
push 0
push VariantClear
push 0
push str.Properties_
push 0x10030
push 0
push dword [ebp - 0x24]
push 3
mov ebx, 0x940
call fcn.0047e0f0
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x28]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
push 0x10030
push 0
push dword [ebp - 0x28]
push 1
mov ebx, 0x928
call fcn.0047dee0
add esp, 0x10
test eax, eax
je 0x41bdc2
jmp 0x41c455
push VariantClear
push 0
push str.ProcessId
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e230
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x994
call fcn.0047ec90
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
fld qword [ebp - 0x48]
call fcn.004019ad
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x41c41d
push VariantClear
push 0
push str.ExecutablePath
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e230
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x990
call fcn.0047ebb0
add esp, 0x1c
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
lea eax, [ebp - 0x44]
push eax
call fcn.00403f69
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x41bf9c
push ebx
call fcn.00479124
add esp, 4
mov eax, dword [ebp - 0x48]
push eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41bfb0
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x30], eax
push 0x48e230
push dword [ebp - 0x30]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x41bff0
push dword [ebp - 0x2c]
call fcn.0041c776
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41bfec
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x30], eax
push 0x80000301
push 0
push dword [ebp - 0x38]
push 1
mov ebx, 0x168
call fcn.0047af10
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x41c023
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 0x34], eax
push str._.pid
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401504
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
cdq
push edx
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x108]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41c071
push ebx
call fcn.00479124
add esp, 4
push str._.name
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401504
add esp, 0xc
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
push str.Name
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x40]
push 3
mov ebx, 0x944
call fcn.0047e230
add esp, 0x28
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x44]
push 2
mov ebx, 0x990
call fcn.0047ebb0
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
lea eax, [ebp - 0x48]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41c18c
push ebx
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41c19c
push ebx
call fcn.00479124
add esp, 4
push str._.path
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401504
add esp, 0xc
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41c1e4
push ebx
call fcn.00479124
add esp, 4
push str._.cmd
push dword [ebp - 0x34]
push 0x48e478
mov ecx, 3
call fcn.00401504
add esp, 0xc
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
push str.CommandLine
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x40], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x40]
push 3
mov ebx, 0x944
call fcn.0047e230
add esp, 0x28
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x44]
push 2
mov ebx, 0x990
call fcn.0047ebb0
add esp, 0x1c
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
lea eax, [ebp - 0x48]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe4]
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x41c2ff
push ebx
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41c30f
push ebx
call fcn.00479124
add esp, 4
push VariantClear
push 0
push str.Name
push VariantClear
push 0
push str.Item
push 0x10030
push 0
push dword [ebp - 0x28]
push 3
mov ebx, 0x964
call fcn.0047e450
add esp, 0x28
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push VariantClear
push 0
push str.Value
push 0x10030
push 0
push dword [ebp - 0x3c]
push 3
mov ebx, 0x944
call fcn.0047e230
add esp, 0x28
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0x40]
push 2
mov ebx, 0x990
call fcn.0047ebb0
add esp, 0x1c
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
push str.Battle.net.exe
push dword [ebp - 0x44]
call fcn.00401560
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x41c410
push ebx
call fcn.00479124
add esp, 4
cmp dword [ebp - 0x48], 0
je 0x41c41a
inc dword [ebp - 0x38]
push 0x10030
push 0
push dword [ebp - 0x28]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x24]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x41bc87
add esp, 0xc
push 0x10031
push 0
push dword [ebp - 0x1c]
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x14]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0x10]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
push 0x10030
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
mov dword [ebp - 0x3c], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x3c], esp
je 0x41c516
push 0xec8
push 0x402dba4
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x50]
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x41c568
push ebx
call fcn.00479124
add esp, 4
mov eax, dword [ebp - 0x4c]
jmp 0x41c570
push eax
mov ebx, dword [ebp - 4]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x984
call fcn.0047eb90
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x24]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x28]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.0047dec0
add esp, 0x10
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41c686
push ebx
call fcn.00479124
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x41c696
push ebx
call fcn.00479124
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret