GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2009-08-21 10:19:46
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

INT 0x06  \??\C:\WINDOWS\system32\drivers\Haspnt.sys                                                                                 B104616D
INT 0x0E  \??\C:\WINDOWS\system32\drivers\Haspnt.sys                                                                                 B1045FC2

Code      8A13B798                                                                                                                   ZwEnumerateKey
Code      8A140CE8                                                                                                                   ZwFlushInstructionCache
Code      00000000                                                                                                                   pIofCallDriver
Code      8A13AE76                                                                                                                   IofCallDriver
Code      8A1395F6                                                                                                                   IofCompleteRequest
Code      8A1648C5                                                                                                                   ZwSaveKey
Code      8A168955                                                                                                                   ZwSaveKeyEx

---- Kernel code sections - GMER 1.0.12 ----

.text     ntoskrnl.exe!ZwSaveKey                                                                                                     804DD6E8 5 Bytes  JMP 8A1648CA 
.text     ntoskrnl.exe!ZwSaveKeyEx                                                                                                   804DD6FC 5 Bytes  JMP 8A16895A 
.text     ntoskrnl.exe!IofCallDriver                                                                                                 804E37C5 5 Bytes  JMP 8A13AE7B 
.text     ntoskrnl.exe!IofCompleteRequest                                                                                            804E3BF6 5 Bytes  JMP 8A1395FB 
PAGE      ntoskrnl.exe!ZwEnumerateKey                                                                                                8056EF30 5 Bytes  JMP 8A13B79C 
PAGE      ntoskrnl.exe!ZwFlushInstructionCache                                                                                       80576A6A 5 Bytes  JMP 8A140CEC 

---- User code sections - GMER 1.0.12 ----

.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnterCriticalSection                                               7C901000 94 Bytes  [ CA, D8, 46, 8C, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnterCriticalSection + 60                                          7C901060 30 Bytes  [ 00, D9, CA, D8, 86, 70, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnterCriticalSection + 80                                          7C901080 6 Bytes  [ 00, D9, CA, D8, 86, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnterCriticalSection + 88                                          7C901088 39 Bytes  [ FF, D9, C9, D8, 8F, 98, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnterCriticalSection + B0                                          7C9010B0 46 Bytes  [ 00, D9, CA, D8, 86, 60, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLeaveCriticalSection                                               7C9010E0 6 Bytes  [ 00, D9, CA, D8, 86, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLeaveCriticalSection + 7                                           7C9010E7 39 Bytes  [ FF, FF, D9, C9, D8, 8F, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLeaveCriticalSection + 30                                          7C901110 32 Bytes  [ 00, D9, CA, D8, 86, 48, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTryEnterCriticalSection + 19                                       7C901131 14 Bytes  [ D9, CA, D8, 86, 38, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTryEnterCriticalSection + 29                                       7C901141 23 Bytes  [ D9, CA, D8, 86, 3C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTryEnterCriticalSection + 41                                       7C901159 7 Bytes  [ D9, C9, D8, 8F, C4, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTryEnterCriticalSection + 49                                       7C901161 38 Bytes  [ D9, CA, D8, 86, 2C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitializeThunk + 22                                               7C901188 52 Bytes  [ FF, D9, C9, D8, 8F, D0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextUnsafeFast + 26                           7C9011BE 164 Bytes  [ 00, 03, C3, 0F, 88, 24, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitAnsiString + 6                                                 7C901263 520 Bytes  CALL CA1BE36B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldiv + 32                                                          7C90146D 35 Bytes  [ C1, E2, 0C, 03, C2, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldiv + 56                                                          7C901491 31 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldiv + 76                                                          7C9014B1 36 Bytes  [ 75, 08, 8B, 46, 0C, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldiv + 9B                                                          7C9014D6 14 Bytes  [ 38, 8B, D3, 0F, AF, 55, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldvrm                                                              7C9014E5 7 Bytes  [ 00, 00, 2B, F0, 89, 45, E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldvrm + 8                                                          7C9014ED 20 Bytes  [ 45, FC, 89, 4D, F8, 8D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldvrm + 1D                                                         7C901502 45 Bytes  CALL 087C5A90 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldvrm + 4B                                                         7C901530 39 Bytes  [ 08, 73, 52, 3B, 74, 24, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_alldvrm + 73                                                         7C901558 39 Bytes  [ 5E, 04, 2B, CB, 83, C7, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allmul + 18                                                          7C9015DC 121 Bytes  [ 5F, 5E, 5B, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allrem + 21                                                          7C901656 28 Bytes  [ 06, 8B, 2F, 03, C5, 8B, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allrem + 3E                                                          7C901673 13 Bytes  [ FC, 89, 5D, F8, 8B, 75, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allrem + 4C                                                          7C901681 44 Bytes  [ 4D, FC, 7C, 25, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allrem + 79                                                          7C9016AE 120 Bytes  [ 40, 08, 8B, 11, 83, E8, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_allshr + 1F                                                          7C901727 103 Bytes  [ 5D, F8, 8B, 55, F4, 55, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldiv + 66                                                         7C90178F 11 Bytes  [ 74, 09, 83, C1, 08, 81, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldvrm + A                                                         7C90179B 21 Bytes  [ 45, 08, 8B, 40, 08, 8B, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldvrm + 20                                                        7C9017B1 53 Bytes  [ 45, 10, 5F, 89, 72, 08, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldvrm + 56                                                        7C9017E7 48 Bytes  CALL 05985977 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldvrm + 87                                                        7C901818 8 Bytes  [ 89, 45, EC, EB, 03, 8D, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aulldvrm + 90                                                        7C901821 4 Bytes  [ 75, FC, B8, A0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aullrem                                                              7C901826 5 Bytes  [ 00, 00, 3B, F0, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aullrem + 6                                                          7C90182C 48 Bytes  [ 83, C3, 08, 2B, F0, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aullrem + 37                                                         7C90185D 26 Bytes  [ 46, EC, D9, CB, D8, 4F, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aullrem + 52                                                         7C901878 27 Bytes  [ D9, C9, D8, 46, E0, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_aullrem + 6E                                                         7C901894 83 Bytes  [ 4F, 10, D9, C9, D8, 46, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_memccpy + 7                                                          7C9018E8 171 Bytes  [ D8, 46, B4, D9, CB, D8, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!atan + 60                                                             7C901994 156 Bytes  [ D9, CB, D8, 4F, 40, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!ceil + 5A                                                             7C901A31 30 Bytes  [ 85, EA, FD, FF, FF, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!ceil + 79                                                             7C901A50 14 Bytes  [ 8B, 55, 0C, D1, F8, 2B, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!ceil + 88                                                             7C901A5F 60 Bytes  [ 2D, A0, 00, 00, 00, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!ceil + C5                                                             7C901A9C 93 Bytes  [ 3B, D6, 72, F0, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!ceil + 124                                                            7C901AFB 38 Bytes  [ 8B, 43, 08, 8B, 53, 30, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!floor + B                                                             7C901B23 148 Bytes  [ 89, 7D, EC, 8B, 75, FC, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!floor + A0                                                            7C901BB8 42 Bytes  [ 4F, 14, D9, C9, D8, 46, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!floor + CB                                                            7C901BE3 220 Bytes  [ C9, D8, 46, B8, D9, CA, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memchr + 60                                                           7C901CC0 157 Bytes  [ FF, D9, CA, D8, 4F, 48, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcmp + 57                                                           7C901D5E 32 Bytes  [ C2, 74, 0E, 8B, 45, FC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcmp + 7A                                                           7C901D81 8 Bytes  [ 2B, FA, 2B, F2, 03, CF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcmp + 84                                                           7C901D8B 2 Bytes  [ 76, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcmp + 87                                                           7C901D8E 119 Bytes  [ C6, 2B, CE, 8B, 34, 01, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcpy + 53                                                           7C901E06 146 Bytes  [ 8B, 45, 10, 83, EB, 04, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcpy + E6                                                           7C901E99 170 Bytes  [ 46, D4, D9, CB, D8, 4F, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcpy + 191                                                          7C901F44 51 Bytes  [ 90, D9, CA, D8, 4F, 34, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcpy + 1C5                                                          7C901F78 78 Bytes  [ FF, FF, D9, CB, D8, 4F, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memcpy + 214                                                          7C901FC7 91 Bytes  [ FF, D9, CB, D8, 4F, 48, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memmove + 106                                                         7C9021FB 15 Bytes  [ 98, 00, 00, 00, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memmove + 116                                                         7C90220B 15 Bytes  [ 9C, 00, 00, 00, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memmove + 126                                                         7C90221B 15 Bytes  [ 9C, 00, 00, 00, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memmove + 136                                                         7C90222B 113 Bytes  [ A0, 00, 00, 00, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!memmove + 1A9                                                         7C90229E 55 Bytes  [ 00, D9, C9, D8, 86, 98, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcpy + E                                                            7C90249B 30 Bytes  [ D9, C9, DE, C2, DE, C2, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcat + 1E                                                           7C9024BB 34 Bytes  [ 89, 45, F8, 8B, 45, E8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcat + 42                                                           7C9024DF 12 Bytes  [ 00, 72, 25, 8B, 56, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcat + 4F                                                           7C9024EC 73 Bytes  [ 40, 99, 2B, C2, 8B, 55, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcat + 99                                                           7C902536 71 Bytes  [ 71, 0C, 42, 83, C0, 04, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcat + E1                                                           7C90257E 5 Bytes  [ 75, 08, 8B, 5E, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strcmp + 1                                                            7C902584 644 Bytes  [ 43, 18, 8B, 4E, 0C, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strncmp + 24                                                          7C902809 32 Bytes  [ FF, D9, CB, D8, 4F, 60, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strncpy + D                                                           7C90282A 135 Bytes  [ C9, D8, 86, 28, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strncpy + 95                                                          7C9028B2 34 Bytes  [ FF, D9, CA, D8, 4F, 7C, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strncpy + B8                                                          7C9028D5 30 Bytes  [ D9, C9, D8, 86, F4, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strncpy + D8                                                          7C9028F5 206 Bytes  [ D9, C9, D8, 86, EC, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strspn + 48                                                           7C9029C5 61 Bytes  [ D9, C9, D8, 86, B8, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tan + 35                                                              7C902A03 15 Bytes  [ 00, 00, D9, C9, D8, 86, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tan + 45                                                              7C902A13 18 Bytes  [ 00, 00, D9, C9, D8, 86, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tan + 58                                                              7C902A26 45 Bytes  [ C9, D8, 86, A0, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tan + 86                                                              7C902A54 72 Bytes  [ 00, D9, C9, D8, 86, 94, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tan + CF                                                              7C902A9D 6 Bytes  [ D9, CB, D8, 8F, B8, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedPushListSList + 15                                      7C902AE5 30 Bytes  [ D9, C9, D8, 86, 70, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFirstEntrySList + C                                                7C902B04 191 Bytes  [ 00, D9, C9, D8, 86, 68, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareMemoryUlong + 21                                            7C902BC4 29 Bytes  [ 00, D9, C9, D8, 86, 38, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFillMemory + F                                                     7C902BE2 33 Bytes  [ 00, 00, 00, D9, C9, D8, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFillMemory + 31                                                    7C902C04 58 Bytes  [ 00, D9, C9, D8, 86, 28, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFillMemory + 6E                                                    7C902C41 85 Bytes  [ D9, C9, DE, C2, DE, C2, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMoveMemory + 3                                                     7C902C97 34 Bytes  [ D0, 8B, 45, 0C, D1, FA, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMoveMemory + 26                                                    7C902CBA 6 Bytes  [ 00, 00, BF, 04, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMoveMemory + 2D                                                    7C902CC1 32 Bytes  [ 2B, FA, 2B, F2, 03, CF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMoveMemory + 4E                                                    7C902CE2 2 Bytes  [ 45, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMoveMemory + 51                                                    7C902CE5 10 Bytes  [ 13, 89, 43, 08, 8B, 45, F8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerAdd + 4                                                7C903006 148 Bytes  [ 01, 59, 08, 0F, BF, 5A, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedLargeIntegerDivide + 4E                                    7C90309C 27 Bytes  [ 33, C0, 49, 8B, 7D, F8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedMagicDivide + F                                            7C9030B9 68 Bytes  [ 8B, 1C, CF, 03, D3, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedMagicDivide + 54                                           7C9030FE 10 Bytes  [ 8B, 1C, CF, 03, D3, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedMagicDivide + 60                                           7C90310A 74 Bytes  [ 5C, 4E, 01, 03, D0, 8A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedIntegerMultiply + 1B                                       7C903155 1 Byte  [ 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedIntegerMultiply + 1D                                       7C903157 12 Bytes  [ 00, 89, 45, 08, EB, 03, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedIntegerMultiply + 2A                                       7C903164 1 Byte  [ 87 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendedIntegerMultiply + 2C                                       7C903166 71 Bytes  [ 01, 00, 00, 8B, 40, 04, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerShiftLeft + 1C                                         7C9031AE 3 Bytes  [ 00, 8B, 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerShiftLeft + 20                                         7C9031B2 24 Bytes  [ 0F, AF, C2, 99, 81, E2, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerShiftRight + 11                                        7C9031CB 10 Bytes  [ 00, 0F, AF, C2, 99, 81, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerShiftRight + 1C                                        7C9031D6 198 Bytes  [ 03, C2, 8B, 51, 08, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUlongToLargeInteger + 5F                                    7C90329D 14 Bytes  [ 01, 00, 00, 8B, 00, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUlongToLargeInteger + 6E                                    7C9032AC 10 Bytes  [ 03, C2, 8B, 51, 20, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUlongToLargeInteger + 79                                    7C9032B7 23 Bytes  [ 41, 24, 89, 51, 20, C1, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUlongToLargeInteger + 91                                    7C9032CF 20 Bytes  [ 40, 04, 0F, AF, C2, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUlongToLargeInteger + A6                                    7C9032E4 49 Bytes  [ 87, 10, 01, 00, 00, 8B, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureContext + A                                                 7C903324 12 Bytes  [ 03, C2, 0F, BF, 56, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureContext + 17                                                7C903331 12 Bytes  [ 00, 8B, 00, 0F, AF, C2, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureContext + 24                                                7C90333E 10 Bytes  [ 03, C2, 8B, 51, 30, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureContext + 2F                                                7C903349 21 Bytes  [ 41, 34, C1, FB, 0F, 03, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureContext + 46                                                7C903360 11 Bytes  [ 8B, 40, 04, 0F, AF, C2, 99, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtAdjustGroupsToken + C                                               7C90CF0A 757 Bytes  CALL 6369E5C8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtDebugContinue + 2                                                   7C90D200 78 Bytes  [ 6B, DE, 11, 3A, E0, 98, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtDeleteKey + 1                                                       7C90D24F 212 Bytes  [ 39, 84, A3, B1, 39, CC, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFindAtom + 6                                                        7C90D324 15 Bytes  [ 6D, DF, 0B, BA, 47, 73, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFlushBuffersFile + 6                                                7C90D334 15 Bytes  [ CE, 12, 1E, BA, D1, 91, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFlushInstructionCache + 6                                           7C90D344 15 Bytes  CALL C89F8D78 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFlushKey + 6                                                        7C90D354 15 Bytes  [ C5, 45, 41, BA, B4, 86, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFlushVirtualMemory + 6                                              7C90D364 15 Bytes  [ BE, 0E, 52, BA, 5D, 26, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFlushWriteBuffer + 6                                                7C90D374 15 Bytes  [ 20, 28, 62, BA, 91, 0F, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFreeUserPhysicalPages + 6                                           7C90D384 15 Bytes  [ 91, 76, 71, BA, 04, 27, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFreeVirtualMemory + 6                                               7C90D394 15 Bytes  [ EA, DE, 7F, BA, D5, A8, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtFsControlFile + 6                                                   7C90D3A4 15 Bytes  [ 37, A3, 86, BA, 6E, 3A, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtGetContextThread + 6                                                7C90D3B4 15 Bytes  [ 63, C9, 8C, BA, 28, 3B, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtGetDevicePowerState + 6                                             7C90D3C4 15 Bytes  [ 1B, 55, 92, BA, 47, 9E, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtGetPlugPlayEvent + 6                                                7C90D3D4 15 Bytes  [ D4, 39, 97, BA, 58, 57, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtGetWriteWatch + 6                                                   7C90D3E4 15 Bytes  [ 78, 6B, 9B, BA, 69, 5A, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtImpersonateAnonymousToken + 6                                       7C90D3F4 15 Bytes  [ 6C, DE, 9E, BA, F8, 9B, 9F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtImpersonateClientOfPort + 6                                         7C90D404 15 Bytes  [ AD, 87, A1, BA, 15, 11, A2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtImpersonateThread + 6                                               7C90D414 15 Bytes  [ AB, 5C, A3, BA, 7B, AF, A3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtInitializeRegistry + 6                                              7C90D424 15 Bytes  [ 98, 53, A4, BA, 6E, 6D, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtInitiatePowerAction + 6                                             7C90D434 15 Bytes  [ 55, 63, A4, BA, 0C, 42, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtIsProcessInJob + 6                                                  7C90D444 15 Bytes  [ 8E, 83, A3, BA, 2B, 25, A3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtIsSystemResumeAutomatic + 6                                         7C90D454 15 Bytes  [ B0, AC, A1, BA, 73, 0F, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtListenPort + 6                                                      7C90D464 15 Bytes  [ 03, D8, 9E, BA, 63, FA, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLoadDriver + 6                                                      7C90D474 15 Bytes  [ BA, FF, 9A, BA, 66, E0, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLoadKey + 6                                                         7C90D484 15 Bytes  [ F7, 1E, 96, BA, DD, BC, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLoadKey2 + 6                                                        7C90D494 15 Bytes  [ C4, 31, 90, BA, 17, 8C, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLockFile + 6                                                        7C90D4A4 15 Bytes  [ 48, 35, 89, BA, 6C, 4B, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLockProductActivationKeys + 6                                       7C90D4B4 15 Bytes  [ 97, 27, 81, BA, 8A, F2, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLockRegistryKey + 6                                                 7C90D4C4 15 Bytes  [ B2, 0F, 70, BA, 03, 2A, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtLockVirtualMemory + 6                                               7C90D4D4 15 Bytes  [ 94, AC, 5B, BA, 4F, 3E, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtMakePermanentObject + 6                                             7C90D4E4 15 Bytes  [ 70, 28, 45, BA, 95, 32, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtMakeTemporaryObject + 6                                             7C90D4F4 15 Bytes  [ 1C, 88, 2C, BA, 39, 0C, 26, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtMapUserPhysicalPages + 6                                            7C90D504 244 Bytes  [ 96, D2, 11, BA, C1, D2, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtOpenObjectAuditAlarm + B                                            7C90D5F9 152 Bytes  [ A1, EC, 3A, 70, D7, F2, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtOpenTimer + 4                                                       7C90D692 279 Bytes  [ 6D, 3B, 16, FF, 6F, 3B, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtQueryEvent + C                                                      7C90D7AA 48 Bytes  [ BF, 3B, FC, 74, BF, 3B, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtQueryInformationFile + D                                            7C90D7DB 15 Bytes  [ 3B, 5D, 4F, C2, 3B, A9, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtQueryInformationJobObject + D                                       7C90D7EB 674 Bytes  [ 3B, 9D, 89, C2, 3B, 95, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtReplyWaitReceivePort                                                7C90DA8E 44 Bytes  [ 8D, B3, A2, CB, 94, B3, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtReplyWaitReplyPort + D                                              7C90DABB 55 Bytes  [ B3, 7E, 66, C4, B3, 59, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtRequestWakeupLatency + 5                                            7C90DAF3 583 Bytes  [ B4, 0F, C7, 00, B4, A3, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtSetSecurityObject + D                                               7C90DD3B 23 Bytes  [ 33, 9D, AC, CF, 33, 9A, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtSetSystemEnvironmentValueEx + 5                                     7C90DD53 515 Bytes  [ 34, DA, AB, 06, 34, 7D, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!NtWaitForSingleObject + 9                                             7C90DF57 285 Bytes  [ 33, C8, B3, EC, 33, F2, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_CIpow + 55                                                           7C90E075 236 Bytes  [ B1, 02, B5, 2A, D0, 04, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_CIpow + 142                                                          7C90E162 535 Bytes  [ 19, B5, 76, AA, 17, B5, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_CIpow + 35A                                                          7C90E37A 68 Bytes  [ 8D, 35, 1E, 8F, 8E, 35, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_CIpow + 39F                                                          7C90E3BF 349 Bytes  JMP 6CC67412 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!KiFastSystemCallRet + 9                                               7C90E51D 531 Bytes  CALL 55BA9A28 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_CIlog + 8F                                                           7C90E731 400 Bytes  [ 59, 27, B5, 30, 6F, 1D, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strchr + B5                                                           7C90E8C2 63 Bytes  [ 36, 36, 5D, D7, 36, 36, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strchr + F5                                                           7C90E902 246 Bytes  [ 35, 36, 99, 66, 34, 36, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strchr + 1EC                                                          7C90E9F9 869 Bytes  [ DA, A7, 34, AD, 53, 87, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiByteToUnicodeN + A5                                           7C90ED5F 739 Bytes  [ 36, AC, 29, 8E, 36, BE, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiByteToUnicodeN + 389                                          7C90F043 191 Bytes  [ B7, 3C, AE, 01, B7, 9C, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiByteToUnicodeN + 449                                          7C90F103 518 Bytes  [ B7, E6, AA, FE, B6, 8E, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiByteToUnicodeN + 650                                          7C90F30A 922 Bytes  [ 42, 37, 48, D1, 42, 37, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 2C                                       7C90F6A5 72 Bytes  [ E2, 05, B7, C6, FF, 00, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 75                                       7C90F6EE 112 Bytes  [ 15, B6, 0D, F3, FC, B5, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtStatusToDosErrorNoTeb + E6                                       7C90F75F 242 Bytes  [ 37, 72, A9, 07, 37, 5D, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 1D9                                      7C90F852 264 Bytes  [ B5, 37, 62, 4B, B5, 37, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtStatusToDosErrorNoTeb + 2E2                                      7C90F95B 26 Bytes  [ 37, 78, F0, F2, 36, B1, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddRefActivationContext + 24                                       7C90FBF6 536 Bytes  [ 1B, B7, 9A, 1A, 12, B7, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInformationActivationContext + 13D                            7C90FE0F 715 Bytes  [ 38, D5, B9, FC, 37, A8, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateHeap + 17                                                  7C9100DB 362 Bytes  [ B7, 83, B5, F9, B7, 62, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateHeap + 182                                                 7C910246 201 Bytes  [ 59, 38, 0E, 19, 5C, 38, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateHeap + 24C                                                 7C910310 117 Bytes  [ CD, 15, 69, 38, 43, 04, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageDirectoryEntryToData + 40                                     7C910386 347 Bytes  [ 0B, 38, 68, 05, 07, 38, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSizeHeap + 6                                                       7C9104E3 443 Bytes  [ B8, 4A, 60, 8D, B8, E9, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncpy + 120                                                         7C91069F 393 Bytes  [ 37, 05, 54, 1C, 37, 9A, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncpy + 2AA                                                         7C910829 181 Bytes  [ A5, BE, 38, 82, 55, BD, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncpy + 360                                                         7C9108DF 71 Bytes  [ 38, 78, D8, 00, 38, 0C, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncpy + 3A8                                                         7C910927 703 Bytes  [ B6, C4, 90, A2, B6, B1, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncpy + 668                                                         7C910BE7 135 Bytes  [ 38, 26, 62, 0C, 38, E3, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteCriticalSection + 129                                        7C9114A3 18 Bytes  [ B9, 82, EF, 97, B9, 59, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteCriticalSection + 13C                                        7C9114B6 203 Bytes  [ 99, B9, 2E, 16, 9A, B9, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSectionAndSpinCount + 68                         7C911582 87 Bytes  [ 47, B9, 64, 33, 42, B9, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLogStackBackTrace + 6                                              7C9115DA 54 Bytes  [ 98, B8, 8B, D8, 8B, B8, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLogStackBackTrace + 3D                                             7C911611 133 Bytes  [ 66, 70, 37, 1C, DC, AD, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSection + 7A                                     7C911697 211 Bytes  [ 39, 03, DE, 6B, 39, F5, A6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSection + 14E                                    7C91176B 68 Bytes  [ 39, FA, 8A, C8, 39, DA, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSection + 193                                    7C9117B0 269 Bytes  [ 7D, 4E, BB, 39, A6, DD, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSection + 2A1                                    7C9118BE 19 Bytes  [ 8F, B8, 89, 20, A1, B8, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeCriticalSection + 2B5                                    7C9118D2 352 Bytes  CALL 76E7FE8F 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToTimeFields + 50                                              7C911F4D 900 Bytes  [ 0D, AA, BA, 86, CE, A9, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToTimeFields + 3D5                                             7C9122D2 33 Bytes  [ C5, 3B, 24, EB, C5, 3B, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToTimeFields + 3F7                                             7C9122F4 69 Bytes  [ 00, 5E, 01, 00, 80, 60, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToTimeFields + 43D                                             7C91233A 98 Bytes  [ 80, C0, 00, 00, 80, 40, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToTimeFields + 4A1                                             7C91239E 37 Bytes  [ 00, 00, 00, 00, 80, 40, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResource_U + 1C                                                7C91278C 28 Bytes  [ CD, 5C, 00, 00, 66, 5E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAccessResource + 18                                                7C9127A9 9 Bytes  [ 68, 00, 00, 9A, 69, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAccessResource + 22                                                7C9127B3 20 Bytes  [ 00, CD, 6C, 00, 00, 66, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadAlternateResourceModule + 4                                    7C9127C8 66 Bytes  [ CD, 74, 00, 00, 66, 76, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadAlternateResourceModule + 48                                   7C91280C 7 Bytes  [ 00, 90, 00, 00, 9A, 91, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadAlternateResourceModule + 51                                   7C912815 25 Bytes  [ 93, 00, 00, CD, 94, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadAlternateResourceModule + 6C                                   7C912830 4 Bytes  [ 66, 9E, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadAlternateResourceModule + 71                                   7C912835 1 Byte  [ A0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAlternateResourcesEnabled + E                                      7C912853 3 Bytes  [ 00, CD, AC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAlternateResourcesEnabled + 13                                     7C912858 6 Bytes  [ 66, AE, 00, 00, 00, B0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAlternateResourcesEnabled + 1B                                     7C912860 18 Bytes  [ 9A, B1, 00, 00, 33, B3, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAlternateResourcesEnabled + 2F                                     7C912874 34 Bytes  [ 9A, B9, 00, 00, 33, BB, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAlternateResourcesEnabled + 53                                     7C912898 26 Bytes  [ 00, C8, 00, 00, 9A, C9, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddressInSectionTable + 12                                         7C9128B4 22 Bytes  [ 33, D3, 00, 00, CD, D4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddressInSectionTable + 29                                         7C9128CB 773 Bytes  [ 00, CD, DC, 00, 00, 66, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToAnsiString + 1B                                     7C912BD1 37 Bytes  CALL FD286A77 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToAnsiString + 41                                     7C912BF7 80 Bytes  CALL 722B6B03 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToAnsiString + 92                                     7C912C48 35 Bytes  [ 8C, 0A, E4, FF, 73, 10, E5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLockLoaderLock + B                                                 7C912C6C 35 Bytes  [ A0, 96, EA, FF, B9, 15, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLockLoaderLock + 2F                                                7C912C90 59 Bytes  [ 64, 47, EE, FF, 4F, 9B, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLockLoaderLock + 6B                                                7C912CCC 27 Bytes  [ 2E, 3C, F2, FF, C3, 71, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLockLoaderLock + 87                                                7C912CE8 35 Bytes  [ AE, 9A, F3, FF, 88, C8, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLockLoaderLock + AB                                                7C912D0C 23 Bytes  [ CE, 18, F5, FF, 7A, 3F, F5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnlockLoaderLock + B                                               7C912D24 7 Bytes  [ 5A, F7, F5, FF, 5E, 1A, F6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnlockLoaderLock + 13                                              7C912D2C 75 Bytes  [ D8, 3C, F6, FF, CB, 5E, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnlockLoaderLock + 5F                                              7C912D78 11 Bytes  [ 09, 77, F8, FF, 5A, 91, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnlockLoaderLock + 6B                                              7C912D84 83 Bytes  [ 11, C5, F8, FF, 7A, DE, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrClientCallServer + 47                                              7C912DD8 15 Bytes  [ DB, A5, FA, FF, 5A, BA, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrClientCallServer + 57                                              7C912DE8 147 Bytes  [ B9, F6, FA, FF, 7D, 0A, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strcmpi + 18                                                         7C912E7C 503 Bytes  [ 71, 71, FD, FF, 50, 80, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSid + F0                                                      7C913074 46 Bytes  [ C8, 57, 01, 00, 1F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUnicodeStringFromAsciiz + 2A                                 7C9130A3 31 Bytes  [ 00, 98, 57, 01, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsDosDeviceName_U + 1B                                             7C9130C3 7 Bytes  [ 00, 80, 57, 01, 00, 20, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsDosDeviceName_U + 24                                             7C9130CC 3 Bytes  [ 7C, 57, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsDosDeviceName_U + 28                                             7C9130D0 19 Bytes  [ 0C, 00, 00, 00, 74, 57, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsDosDeviceName_U + 3C                                             7C9130E4 7 Bytes  [ 64, 57, 01, 00, 1C, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsDosDeviceName_U + 44                                             7C9130EC 11 Bytes  [ 5C, 57, 01, 00, 19, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyLuid + 19                                                      7C913165 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopySid + 13                                                       7C91317D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopySid + 1C                                                       7C913186 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopySid + 2F                                                       7C913199 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSid + 13                                                     7C9131B1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSid + 17                                                     7C9131B5 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToMultiByteSize + 14                                        7C9131CE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToMultiByteSize + 1A                                        7C9131D4 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToMultiByteSize + 26                                        7C9131E0 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToMultiByteSize + 44                                        7C9131FE 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToMultiByteSize + 4C                                        7C913206 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockHeap + 15                                                      7C913220 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockHeap + 30                                                      7C91323B 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockHeap + 3C                                                      7C913247 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockHeap + 49                                                      7C913254 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockHeap + 50                                                      7C91325B 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockHeap + 15                                                    7C913288 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockHeap + 30                                                    7C9132A3 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockHeap + 37                                                    7C9132AA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockHeap + 49                                                    7C9132BC 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockHeap + 50                                                    7C9132C3 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidHandle + 23                                                 7C913300 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidHandle + 2C                                                 7C913309 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidHandle + 47                                                 7C913324 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidHandle + 52                                                 7C91332F 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidHandle + 5D                                                 7C91333A 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeHandle + 34                                                    7C913373 130 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsValidIndexHandle + 28                                            7C9133F6 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEncodePointer + 8                                                  7C913407 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEncodePointer + 21                                                 7C913420 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUnicodeString + 14                                           7C913446 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUnicodeString + 4C                                           7C91347E 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDetermineDosPathNameType_U + 17                                    7C91349E 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDetermineDosPathNameType_U + 21                                    7C9134A8 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDetermineDosPathNameType_U + 2A                                    7C9134B1 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDetermineDosPathNameType_U + 35                                    7C9134BC 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDetermineDosPathNameType_U + 42                                    7C9134C9 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosPathNameToNtPathName_U + 23                                     7C913C10 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosPathNameToNtPathName_U + 29                                     7C913C16 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosPathNameToNtPathName_U + 4E                                     7C913C3B 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosPathNameToNtPathName_U + 78                                     7C913C65 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosPathNameToNtPathName_U + 8A                                     7C913C77 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFullPathName_U + 1B                                             7C913CBC 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFullPathName_U + 21                                             7C913CC2 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFullPathName_U + 37                                             7C913CD8 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixUnicodeString + 21                                           7C913D21 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixUnicodeString + 27                                           7C913D27 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixUnicodeString + 31                                           7C913D31 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixUnicodeString + 5D                                           7C913D5D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixUnicodeString + 67                                           7C913D67 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetCurrentDirectory_U + 12                                         7C913E10 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetCurrentDirectory_U + 37                                         7C913E35 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetCurrentDirectory_U + 40                                         7C913E3E 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetCurrentDirectory_U + 5F                                         7C913E5D 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetCurrentDirectory_U + 7C                                         7C913E7A 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryEnvironmentVariable_U + 10                                    7C913EA1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryEnvironmentVariable_U + 14                                    7C913EA5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryEnvironmentVariable_U + 16                                    7C913EA7 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryEnvironmentVariable_U + 1D                                    7C913EAE 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryEnvironmentVariable_U + 33                                    7C913EC4 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExpandEnvironmentStrings_U + 3B                                    7C913FFD 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExpandEnvironmentStrings_U + 47                                    7C914009 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExpandEnvironmentStrings_U + 76                                    7C914038 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExpandEnvironmentStrings_U + A0                                    7C914062 110 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExpandEnvironmentStrings_U + 10F                                   7C9140D1 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcschr + 2E                                                           7C9142A8 19 Bytes  [ 74, 31, 83, C3, 03, 8A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcschr + 42                                                           7C9142BC 222 Bytes  [ 4C, DF, 04, 03, D0, 03, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLongestNtPathLength + CA                                        7C91439B 24 Bytes  [ E5, 5D, C2, 0C, 00, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLongestNtPathLength + E3                                        7C9143B4 11 Bytes  [ 00, 83, EB, 03, 0F, EF, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLongestNtPathLength + F0                                        7C9143C1 28 Bytes  CALL 087EA5D5 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLongestNtPathLength + 10F                                       7C9143E0 11 Bytes  [ 74, 45, 83, C3, 03, 8A, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLongestNtPathLength + 11D                                       7C9143EE 233 Bytes  [ 8B, CA, 0F, AF, 55, F8, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertSidToUnicodeString + 48                                     7C914595 27 Bytes  [ FF, 83, FB, 0E, 8B, 7D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertSidToUnicodeString + 64                                     7C9145B1 13 Bytes  [ 74, 27, 83, C3, 06, 0B, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertSidToUnicodeString + 72                                     7C9145BF 129 Bytes  [ BF, 0C, 1E, 01, 0C, 9F, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertSidToUnicodeString + F4                                     7C914641 79 Bytes  [ 64, 9F, 38, 0F, 7F, 54, 9F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertSidToUnicodeString + 145                                    7C914692 295 Bytes  [ 83, FB, 0E, 8B, 7D, 08, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyUnicodeString + 6                                              7C9147D7 21 Bytes  [ 75, 08, 8B, 7D, 0C, 8B, CB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyUnicodeString + 1C                                             7C9147ED 180 Bytes  [ 5F, A9, 07, 00, 00, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAppendUnicodeToString + 70                                         7C9148A2 29 Bytes  [ 00, 00, 2B, CE, 89, 4D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAppendUnicodeStringToString + 19                                   7C9148C0 140 Bytes  CALL C21C98CD 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatCurrentUserKeyPath + 3D                                      7C91494E 113 Bytes  [ 2B, C1, 8B, 4D, 0C, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatCurrentUserKeyPath + AF                                      7C9149C0 63 Bytes  [ 8B, 75, 08, 8B, 46, 0C, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatCurrentUserKeyPath + EF                                      7C914A00 18 Bytes  [ 55, 0C, 83, C2, 02, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatCurrentUserKeyPath + 102                                     7C914A13 89 Bytes  [ EC, 8B, 75, F4, 8B, 7D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatCurrentUserKeyPath + 15C                                     7C914A6D 134 Bytes  [ 6C, 24, 0C, 03, C5, 0F, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!bsearch + 9                                                           7C914AF4 202 Bytes  [ 55, F0, 5F, 5E, 89, 42, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!bsearch + D4                                                          7C914BBF 14 Bytes  [ 55, F8, 8B, 7D, F4, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!bsearch + E4                                                          7C914BCF 10 Bytes  [ 8D, 34, 9D, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!bsearch + EF                                                          7C914BDA 30 Bytes  [ 4D, D4, 8D, 64, 24, 00, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!bsearch + 10E                                                         7C914BF9 7 Bytes  [ DB, 89, 55, F8, 76, 12, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionString + 80                            7C914E89 210 Bytes  [ 76, 17, 2B, D1, 8D, 49, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlHashUnicodeString + 8                                              7C914F5D 32 Bytes  [ 0C, 85, C0, 74, 32, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlHashUnicodeString + 29                                             7C914F7E 64 Bytes  [ 6F, 4C, 8E, 08, 0F, 6B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlHashUnicodeString + 6A                                             7C914FBF 36 Bytes  [ E4, 8B, 45, F8, 8D, 0C, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlHashUnicodeString + 8F                                             7C914FE4 35 Bytes  [ 45, FC, 2B, 45, F4, 8D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlHashUnicodeString + B4                                             7C915009 11 Bytes  [ 0C, 00, 00, 00, 81, 02, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosApplyFileIsolationRedirection_Ustr + 4                          7C915297 39 Bytes  [ 46, 68, 8B, 4E, 60, 8B, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosApplyFileIsolationRedirection_Ustr + 2C                         7C9152BF 34 Bytes  [ CF, FF, 15, 88, 3C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosApplyFileIsolationRedirection_Ustr + 4F                         7C9152E2 8 Bytes  [ 55, 8B, EC, 8B, 45, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosApplyFileIsolationRedirection_Ustr + 58                         7C9152EB 22 Bytes  [ C0, 75, 1F, 8B, 4D, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosApplyFileIsolationRedirection_Ustr + 6F                         7C915302 74 Bytes  [ 5F, 5E, 79, 07, 85, D2, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindCharInUnicodeString + 4C                                       7C9156A5 191 Bytes  [ 00, 33, C0, 5E, 8B, E5, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateUnicodeString + 3                                          7C915765 33 Bytes  [ 10, 89, 02, 8B, 56, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateUnicodeString + 25                                         7C915787 4 Bytes  [ C0, 5B, 75, 23 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateUnicodeString + 2A                                         7C91578C 80 Bytes  [ 46, 18, 85, C0, 74, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateUnicodeString + 7B                                         7C9157DD 2 Bytes  [ 46, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateUnicodeString + 7F                                         7C9157E1 10 Bytes  [ FC, 5F, C7, 46, 14, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadDll + 87                                                       7C915D42 30 Bytes  [ F6, 7C, 2B, 8B, 83, 84, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadDll + A6                                                       7C915D61 43 Bytes  JMP 7C915CCA C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadDll + D2                                                       7C915D8D 19 Bytes  [ E5, 5D, C2, 04, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadDll + E6                                                       7C915DA1 14 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrLoadDll + F5                                                       7C915DB0 97 Bytes  [ 10, 00, 00, C0, 5D, C2, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetDllHandleEx + 16                                                7C915FCF 6 Bytes  [ 83, EC, 10, 53, 56, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetDllHandleEx + 1D                                                7C915FD6 129 Bytes  CALL 0799A566 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetDllHandleEx + 9F                                                7C916058 35 Bytes  [ 0C, 8B, 56, 18, 57, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetDllHandleEx + C3                                                7C91607C 51 Bytes  [ 00, 8B, 51, 08, 85, D2, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetDllHandleEx + F7                                                7C9160B0 1 Byte  [ 91 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiAppendUnicodeStringBuffer + 52                                7C91625F 42 Bytes  [ 00, 00, 8B, 45, FC, 5B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiAppendUnicodeStringBuffer + 7D                                7C91628A 74 Bytes  [ 4D, 10, 8B, 09, 39, 88, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiAppendUnicodeStringBuffer + C9                                7C9162D6 86 Bytes  [ FF, 89, 11, 8B, 80, 48, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiAppendUnicodeStringBuffer + 120                               7C91632D 87 Bytes  [ 89, 11, 8B, 80, 48, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiAppendUnicodeStringBuffer + 178                               7C916385 92 Bytes  [ 8B, 81, 48, 01, 00, 00, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_U + 58                                               7C916949 125 Bytes  [ 00, C0, EB, 16, 8B, 76, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_U + D6                                               7C9169C7 45 Bytes  [ C0, 75, 69, 8B, 4A, 18, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_U + 104                                              7C9169F5 161 Bytes  [ 53, 8B, 5A, 04, 57, 8D, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_U + 1A6                                              7C916A97 4 Bytes  [ 8B, 47, 18, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_U + 1AB                                              7C916A9C 10 Bytes  [ 0C, 0F, B7, 46, 7A, 0F, AF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadDll + 1A                                                     7C916C9D 18 Bytes  [ 00, 00, 85, C0, 0F, 85, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadDll + 2E                                                     7C916CB1 2 Bytes  [ 40, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadDll + 32                                                     7C916CB5 12 Bytes  [ 53, 6A, 00, 6A, 00, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadDll + 3F                                                     7C916CC2 24 Bytes  [ 6A, 00, 50, 89, 45, 0C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadDll + 58                                                     7C916CDB 73 Bytes  [ 83, 39, 00, 74, 6C, 8B, BE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextEx + 3E                                   7C916FB3 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextEx + 40                                   7C916FB5 34 Bytes  [ 15, 08, 3E, 01, 00, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextEx + 64                                   7C916FD9 6 Bytes  [ 8B, 45, EC, 89, 88, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextEx + 6B                                   7C916FE0 13 Bytes  [ 00, 00, 8B, 93, 48, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContextEx + 79                                   7C916FEE 26 Bytes  [ 3B, 77, 04, 74, 5F, 8B, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContext + 36                                     7C917131 1 Byte  [ 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContext + 3A                                     7C917135 22 Bytes  [ 0F, 85, AB, 00, 00, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContext + 51                                     7C91714C 12 Bytes  [ D2, 0F, 84, 99, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContext + 5E                                     7C917159 22 Bytes  [ 85, D2, 0F, 84, 8B, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlActivateActivationContext + 76                                     7C917171 20 Bytes  [ 57, 85, C0, 8B, 45, 10, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeactivateActivationContext + 20                                   7C9171F7 50 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeactivateActivationContext + 54                                   7C91722B 21 Bytes  [ 00, 85, C0, 74, 33, 8B, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeactivateActivationContext + 6A                                   7C917241 84 Bytes  [ 45, 10, 89, 30, 8B, 89, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeactivateActivationContext + BF                                   7C917296 23 Bytes  [ 6A, 01, 8D, 70, 38, 56, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareUnicodeString + E                                           7C9172AE 76 Bytes  [ 3D, 01, 00, 56, 57, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareUnicodeString + 5B                                          7C9172FB 12 Bytes  [ 08, B8, 10, 00, 00, C0, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareUnicodeString + 68                                          7C917308 83 Bytes  [ 5D, C2, 0C, 00, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareUnicodeString + BC                                          7C91735C 30 Bytes  [ 48, 60, 53, 56, 8B, 75, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareUnicodeString + DB                                          7C91737B 10 Bytes  [ C1, 08, 41, 8B, 57, 30, 3B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReAllocateHeap + 1F                                                7C917508 135 Bytes  [ 46, 58, 89, 46, 5C, 89, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReAllocateHeap + A7                                                7C917590 72 Bytes  [ 85, C0, 0F, 84, 3E, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReAllocateHeap + F0                                                7C9175D9 54 Bytes  [ 40, EB, 1C, B9, 04, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReAllocateHeap + 127                                               7C917610 59 Bytes  [ 00, 66, 81, 3E, FE, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReAllocateHeap + 163                                               7C91764C 45 Bytes  [ 00, 00, 8B, F8, F3, A5, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeFieldsToTime + 7                                               7C918417 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeFieldsToTime + 9                                               7C918419 102 Bytes  [ 4D, 0C, 8A, 41, 20, 84, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeFieldsToTime + 70                                              7C918480 22 Bytes  [ 6A, 00, 6A, 00, 6A, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeFieldsToTime + 87                                              7C918497 93 Bytes  [ 4E, 10, 89, 01, 89, 48, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeFieldsToTime + E6                                              7C9184F6 108 Bytes  CALL 09918637 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToChar + 25                                                 7C918604 8 Bytes  [ 8B, 40, 0C, 85, C0, 74, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToChar + 2E                                                 7C91860D 6 Bytes  [ 50, FF, D7, 8B, 8E, A4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToChar + 37                                                 7C918616 5 Bytes  [ C7, 41, 0C, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToChar + 3E                                                 7C91861D 6 Bytes  [ 8B, 86, A4, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToChar + 45                                                 7C918624 13 Bytes  [ C0, 74, 0F, 6A, 00, 50, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToUnicodeString + 1B                                        7C918721 10 Bytes  [ 33, C0, 8D, 8B, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIntegerToUnicodeString + 27                                        7C91872D 67 Bytes  [ 74, 07, 50, FF, 15, F8, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToInteger + 8                                         7C918771 86 Bytes  [ 3D, 01, 00, 8B, 46, 48, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToInteger + 5F                                        7C9187C8 8 Bytes  [ 50, FF, D7, 8B, 83, 00, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToInteger + 68                                        7C9187D1 5 Bytes  [ 85, C0, 74, 05, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToInteger + 6E                                        7C9187D7 86 Bytes  [ 50, FF, D7, 8B, 83, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToInteger + C5                                        7C91882E 20 Bytes  [ 51, FF, D7, 8B, 5D, F8, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrNewThread + 28                                                     7C9189AA 8 Bytes  [ 02, 61, 00, 00, 8B, 96, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrNewThread + 33                                                     7C9189B5 11 Bytes  [ 4D, C8, 33, C0, 3B, CA, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrNewThread + 40                                                     7C9189C2 10 Bytes  [ 95, C0, 0B, C8, 89, 8F, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrNewThread + 4B                                                     7C9189CD 63 Bytes  [ 96, 48, 01, 00, 00, C7, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrNewThread + 8C                                                     7C918A0E 34 Bytes  [ 8B, 8E, 48, 01, 00, 00, C7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpWaitForCriticalSection + 23                                       7C918ABA 18 Bytes  [ 84, B1, 00, 00, 00, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpWaitForCriticalSection + 36                                       7C918ACD 8 Bytes  [ 8D, 49, 00, 8B, 41, F4, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpWaitForCriticalSection + 3F                                       7C918AD6 113 Bytes  [ FE, FF, FF, 8B, 91, 28, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpWaitForCriticalSection + B1                                       7C918B48 4 Bytes  [ 3B, 91, 30, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpWaitForCriticalSection + B7                                       7C918B4E 17 Bytes  [ 75, 0F, 8B, 06, 8B, 4E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpUnWaitCriticalSection + 1                                         7C918B60 2 Bytes  [ 7D, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpUnWaitCriticalSection + 4                                         7C918B63 8 Bytes  [ 4D, CC, 8D, 47, 28, 3B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpUnWaitCriticalSection + D                                         7C918B6C 14 Bytes  [ 60, FF, FF, FF, 8B, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpUnWaitCriticalSection + 1C                                        7C918B7B 52 Bytes  [ 00, 8B, 77, 20, 8B, 5D, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpUnWaitCriticalSection + 51                                        7C918BB0 28 Bytes  [ 8B, 46, F4, 8B, 4D, 08, 81, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeThreadActivationContextStack + A                               7C918C0F 6 Bytes  [ 00, 8B, 81, 54, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeThreadActivationContextStack + 11                              7C918C16 96 Bytes  [ 8B, 8E, 18, 01, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownThread + 4A                                                7C918C78 16 Bytes  CALL 7C916E0C C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownThread + 5B                                                7C918C89 412 Bytes  [ 33, C0, 87, 07, 0F, B7, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckForOrphanedCriticalSections + 9B                              7C918E26 18 Bytes  [ 85, C0, 89, 4D, BC, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckForOrphanedCriticalSections + AE                              7C918E39 64 Bytes  [ 00, 0F, AF, D7, 6A, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReleaseResource + 19                                               7C918E7B 49 Bytes  [ 8B, 15, 88, 58, 01, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceShared + 10                                         7C918EAD 81 Bytes  [ D2, F7, F1, 89, 45, F8, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceExclusive + 24                                      7C918EFF 22 Bytes  [ 00, F7, E1, 8B, 8E, 24, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceExclusive + 3B                                      7C918F16 2 Bytes  [ B8, F6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceExclusive + 3F                                      7C918F1A 20 Bytes  CALL 7C92C2BE C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceExclusive + 54                                      7C918F2F 33 Bytes  [ C0, 74, 55, 8B, 96, 48, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAcquireResourceExclusive + 76                                      7C918F51 33 Bytes  [ 8B, 55, F8, 51, 05, 90, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUserInfoHeap + 1F                                               7C918FC8 103 Bytes  [ 85, FF, 76, 08, 85, DB, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUserInfoHeap + 87                                               7C919030 11 Bytes  [ 51, 05, 90, 00, 00, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUserInfoHeap + 93                                               7C91903C 260 Bytes  [ FC, 8B, 86, 48, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUserInfoHeap + 198                                              7C919141 42 Bytes  [ 85, C0, 74, 13, 8B, 8E, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUserInfoHeap + 1C3                                              7C91916C 2 Bytes  [ 7D, CC ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetProcedureAddress + C8                                           7C9193F0 46 Bytes  [ 00, 85, FF, 0F, 84, 0F, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetProcedureAddress + F7                                           7C91941F 31 Bytes  [ 48, 60, 8B, 56, 08, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetProcedureAddress + 117                                          7C91943F 33 Bytes  [ 00, 00, BF, 00, 80, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrGetProcedureAddress + 139                                          7C919461 133 Bytes  [ BF, F0, 7F, 03, 00, 8B, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetVersion + E                                                     7C9194E7 8 Bytes  [ 00, 6A, 00, FF, 15, F4, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetVersion + 18                                                    7C9194F1 9 Bytes  [ D8, 85, DB, 75, 0C, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetVersion + 23                                                    7C9194FC 13 Bytes  JMP 7C919E8A C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetVersion + 31                                                    7C91950A 13 Bytes  [ FB, F3, AB, 8D, 83, 28, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetVersion + 3F                                                    7C919518 76 Bytes  [ 8B, 45, F8, 66, 81, 38, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtProductType + 2B                                              7C9195F1 27 Bytes  [ 8B, 48, 01, 00, 00, 68, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtProductType + 47                                              7C91960D 11 Bytes  [ 3D, 01, 00, 85, C0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtProductType + 53                                              7C919619 101 Bytes  [ 00, 00, 8B, 45, 0C, 8B, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtProductType + B9                                              7C91967F 16 Bytes  [ 93, 18, 01, 00, 00, 8B, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtProductType + CA                                              7C919690 12 Bytes  [ 89, 40, 04, 89, 00, 8D, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strnicmp + F                                                         7C91971A 69 Bytes  [ 00, 89, 45, F8, EB, 14, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strnicmp + 55                                                        7C919760 29 Bytes  [ D2, F3, A7, 75, 0F, 8B, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strnicmp + 73                                                        7C91977E 59 Bytes  [ 93, 48, 01, 00, 00, A1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strnicmp + B0                                                        7C9197BB 21 Bytes  [ 85, C0, 89, 45, 18, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadAlternateResourceModule + 10                                 7C9197D1 7 Bytes  [ FC, 8B, 4F, 38, 8B, B3, 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadAlternateResourceModule + 18                                 7C9197D9 45 Bytes  CALL 7C90619C C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadAlternateResourceModule + 46                                 7C919807 5 Bytes  [ 00, BF, F0, 7F, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrUnloadAlternateResourceModule + 4C                                 7C91980D 77 Bytes  [ 33, D2, F3, A7, 0F, 85, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDoesFileExists_U + 13                                              7C91985B 30 Bytes  [ 00, 89, 83, D4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDoesFileExists_U + 32                                              7C91987A 49 Bytes  [ 85, C0, 74, 21, B8, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDoesFileExists_U + 65                                              7C9198AD 4 Bytes  [ 00, 89, B3, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDoesFileExists_U + 6B                                              7C9198B3 75 Bytes  CALL 7C92B0FF C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDoesFileExists_U + B7                                              7C9198FF 2 Bytes  [ 08, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPopFrame + 9                                                       7C919959 12 Bytes  [ 75, 0C, C7, 45, 18, 9A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPopFrame + 17                                                      7C919967 26 Bytes  [ 68, 4B, 4D, 49, 58, 6A, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPushFrame + 13                                                     7C919983 42 Bytes  [ 75, 0C, C7, 45, 18, 9A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPushFrame + 3E                                                     7C9199AE 4 Bytes  [ D6, 85, C0, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPushFrame + 43                                                     7C9199B3 15 Bytes  [ B0, 00, 00, 00, 75, 0C, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPushFrame + 54                                                     7C9199C4 41 Bytes  [ 00, 33, D2, 89, 10, 89, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPushFrame + 7E                                                     7C9199EE 5 Bytes  [ 00, 00, 8B, 8B, A4 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcscat + D                                                            7C919AF6 35 Bytes  [ C7, 0F, AF, CA, D1, E8, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcscat + 31                                                           7C919B1A 3 Bytes  [ 8B, 8B, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcscat + 35                                                           7C919B1E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcscat + 37                                                           7C919B20 6 Bytes  [ 85, C9, 89, 83, 4C, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcscat + 3F                                                           7C919B28 5 Bytes  [ 0F, 84, C5, 02, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAnsiCharToUnicodeChar + 2B                                         7C919B7C 31 Bytes  [ 00, 00, 75, 0C, C7, 45, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAnsiCharToUnicodeChar + 4C                                         7C919B9D 165 Bytes  [ 00, 8B, FF, 8B, 93, FC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSubAuthoritySid + 13                                               7C919C43 32 Bytes  [ 8B, 45, 10, 68, 4B, 4D, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSid + 18                                                 7C919C65 5 Bytes  [ C7, 45, 18, 9A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSid + 1E                                                 7C919C6B 3 Bytes  JMP 7C919E8A C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSid + 22                                                 7C919C6F 187 Bytes  [ 00, 00, 8B, 55, 08, 57, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSid + DE                                                 7C919D2B 34 Bytes  [ 00, 00, 8B, 87, 84, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSid + 101                                                7C919D4E 19 Bytes  [ 00, 6A, 00, 52, FF, D6, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!swprintf + 1                                                          7C919E94 32 Bytes  [ 83, A4, 00, 00, 00, 8B, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!swprintf + 22                                                         7C919EB5 17 Bytes  [ 89, 39, 8B, 93, A4, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!swprintf + 34                                                         7C919EC7 10 Bytes  [ D6, 8B, 83, A4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!swprintf + 3F                                                         7C919ED2 3 Bytes  [ 8B, A4, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!swprintf + 44                                                         7C919ED7 28 Bytes  [ 57, 51, FF, D6, 89, BB, A4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidAcl + C                                                       7C919F91 19 Bytes  [ D6, 89, BB, B0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidAcl + 21                                                      7C919FA6 23 Bytes  CALL 7C92B4CF C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidAcl + 39                                                      7C919FBE 15 Bytes  [ 89, 06, 89, 70, 04, 52, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidAcl + 49                                                      7C919FCE 3 Bytes  [ 50, FF, 15 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidAcl + 4D                                                      7C919FD2 18 Bytes  [ 3E, 01, 00, 8B, 4D, 0C, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSecurityDescriptor + 25                                      7C91A02E 14 Bytes  [ 3B, C7, 74, 0A, 57, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetDaclSecurityDescriptor + 6                                      7C91A03D 32 Bytes  [ 83, F4, 00, 00, 00, 3B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetDaclSecurityDescriptor + 27                                     7C91A05E 16 Bytes  [ 3B, C7, 74, 04, 57, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetDaclSecurityDescriptor + 38                                     7C91A06F 2 Bytes  [ 04, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetDaclSecurityDescriptor + 3B                                     7C91A072 6 Bytes  [ FF, D6, 8B, 83, 00, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetDaclSecurityDescriptor + 42                                     7C91A079 12 Bytes  [ 00, 3B, C7, 74, 04, 57, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFirstFreeAce + 90                                                  7C91A122 17 Bytes  [ 83, F8, 01, 74, 09, 83, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFirstFreeAce + A2                                                  7C91A134 112 Bytes  [ 6A, 00, 8D, 86, B8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAcl + 4                                                      7C91A1A5 6 Bytes  [ 56, 2C, 8D, 4E, 28, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAcl + B                                                      7C91A1AC 4 Bytes  [ 89, 50, 04, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAcl + 10                                                     7C91A1B1 46 Bytes  [ 89, 41, 04, FF, 4E, 48, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAcl + 3F                                                     7C91A1E0 33 Bytes  CALL 7C91E2EF C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessAllowedAce + F                                            7C91A202 46 Bytes  [ 00, FF, 24, 85, 2C, 46, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeSid + 1B                                                       7C91A231 12 Bytes  JMP 7C91A338 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeSid + 28                                                       7C91A23E 20 Bytes  [ 85, C0, 74, 47, 8B, 87, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateAndInitializeSid + 11                                      7C91A254 73 Bytes  [ 85, C0, 89, 45, FC, 74, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateAndInitializeSid + 5B                                      7C91A29E 34 Bytes  [ 01, 8D, 57, 58, 89, 02, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateAndInitializeSid + 7E                                      7C91A2C1 2 Bytes  [ 56, 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateAndInitializeSid + 81                                      7C91A2C4 157 Bytes  [ 08, 3B, C8, 74, 08, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAllocateAndInitializeSid + 11F                                     7C91A362 87 Bytes  [ 02, 00, DB, 45, 02, 00, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_Ustr + 1A                                            7C91A3BA 13 Bytes  [ 45, FC, FF, 15, 04, 3E, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_Ustr + 28                                            7C91A3C8 20 Bytes  [ 15, E0, 3C, 01, 00, 8B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_Ustr + 3D                                            7C91A3DD 204 Bytes  [ C7, 86, F0, 00, 00, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_Ustr + 10A                                           7C91A4AA 11 Bytes  [ 8B, 4D, FC, 51, 53, 56, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDosSearchPath_Ustr + 116                                           7C91A4B6 9 Bytes  [ FF, 8B, D8, 85, DB, 7D, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetOwnerSecurityDescriptor + 20                                    7C91A6C9 60 Bytes  [ C7, 45, FC, 9A, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetGroupSecurityDescriptor + 13                                    7C91A706 43 Bytes  [ 55, 0C, 68, AC, 77, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetGroupSecurityDescriptor + 3F                                    7C91A732 5 Bytes  [ 8B, 0D, AC, 58, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetGroupSecurityDescriptor + 45                                    7C91A738 144 Bytes  [ 89, 4B, 50, 8B, 15, A8, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOpenCurrentUser + 2E                                               7C91A7C9 13 Bytes  [ 4B, 68, 89, BB, 90, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOpenCurrentUser + 3C                                               7C91A7D7 31 Bytes  [ 89, B3, FC, 00, 00, 00, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOpenCurrentUser + 5D                                               7C91A7F8 50 Bytes  [ 3B, C8, 89, 15, 88, 79, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncat + 25                                                          7C91A82B 64 Bytes  [ 0C, A3, 78, 77, 03, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncat + 66                                                          7C91A86C 4 Bytes  [ 15, 54, 3D, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncat + 6B                                                          7C91A871 32 Bytes  [ 53, 68, F0, 21, 01, 00, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncat + 8C                                                          7C91A892 41 Bytes  CALL 06821E20 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsncat + B6                                                          7C91A8BC 74 Bytes  [ FC, 74, 12, 8B, 45, F8, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserValueHeap + 1F                                              7C91AF10 43 Bytes  [ 8B, F0, 33, D2, F3, A7, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserValueHeap + 4B                                              7C91AF3C 40 Bytes  [ 00, 00, 8B, 5D, 14, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserValueHeap + 74                                              7C91AF65 124 Bytes  [ FF, 85, C0, 74, 6F, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserValueHeap + F1                                              7C91AFE2 48 Bytes  [ E5, 5D, C2, 14, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserValueHeap + 122                                             7C91B013 7 Bytes  [ 33, F6, 3B, D6, B8, 72, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snwprintf + 2A                                                       7C91BA5C 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snwprintf + 2C                                                       7C91BA5E 23 Bytes  [ 00, 00, 46, 00, 69, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snwprintf + 44                                                       7C91BA76 12 Bytes  [ 6E, 00, 67, 00, 52, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snwprintf + 51                                                       7C91BA83 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snwprintf + 56                                                       7C91BA88 85 Bytes  [ 5C, 00, 52, 00, 65, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceDirectory_U + 4D                                       7C91C102 19 Bytes  [ 55, 8B, EC, 8B, 55, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceDirectory_U + 61                                       7C91C116 196 Bytes  [ 3A, 33, C0, F3, AB, 8B, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceDirectory_U + 126                                      7C91C1DB 195 Bytes  [ DF, E0, F6, C4, 41, 75, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceDirectory_U + 1EA                                      7C91C29F 50 Bytes  [ D9, 05, F0, 53, 01, 00, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceDirectory_U + 21D                                      7C91C2D2 10 Bytes  [ DA, 76, 3C, DD, 1C, 24, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetActiveActivationContext + 4E                                    7C91C461 7 Bytes  [ 38, 5E, 8B, E5, 5D, C2, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetActiveActivationContext + 56                                    7C91C469 118 Bytes  [ C7, 46, 38, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetActiveActivationContext + CD                                    7C91C4E0 21 Bytes  [ DB, 44, 07, F0, D9, 58, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetActiveActivationContext + E3                                    7C91C4F6 5 Bytes  [ 5D, 0C, 8B, 7D, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetActiveActivationContext + EA                                    7C91C4FD 45 Bytes  [ FC, 8B, 55, 08, 3B, D3, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryImageFileExecutionOptions + 35                                7C91CB20 8 Bytes  [ 4D, 08, 8B, 81, B8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryImageFileExecutionOptions + 3E                                7C91CB29 138 Bytes  [ 48, 24, 6A, 00, 53, 51, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryImageFileExecutionOptions + C9                                7C91CBB4 22 Bytes  [ 75, F1, 8D, 4D, D0, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryImageFileExecutionOptions + E0                                7C91CBCB 23 Bytes  [ CC, CC, CC, CC, CC, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryImageFileExecutionOptions + F8                                7C91CBE3 72 Bytes  [ 5D, 0C, 85, DB, 56, 8B, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAppendPathElement + 80                                             7C91D3A5 321 Bytes  [ 41, 8D, 1C, 8D, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAppendPathElement + 1C3                                            7C91D4E8 8 Bytes  [ 00, 00, 89, 57, 14, BB, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAppendPathElement + 1CC                                            7C91D4F1 132 Bytes  [ 00, 89, 5F, 18, DB, 5D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrDisableThreadCalloutsForDll + 33                                   7C91D576 41 Bytes  [ 4B, 01, 23, CF, 2B, D8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrDisableThreadCalloutsForDll + 5D                                   7C91D5A0 262 Bytes  [ 3C, 82, 8B, C3, 2B, D9, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrDisableThreadCalloutsForDll + 164                                  7C91D6A7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrDisableThreadCalloutsForDll + 166                                  7C91D6A9 7 Bytes  [ 89, 56, 14, BB, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrDisableThreadCalloutsForDll + 16E                                  7C91D6B1 12 Bytes  [ DE, C1, 89, 5E, 18, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpEnsureBufferSize + 41                                             7C91E108 57 Bytes  [ 40, 89, 46, 44, 8B, 46, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpEnsureBufferSize + 7B                                             7C91E142 47 Bytes  [ 46, 1C, 3B, 56, 18, 89, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpEnsureBufferSize + AB                                             7C91E172 31 Bytes  [ 7E, 28, 5F, 5E, 5B, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpEnsureBufferSize + CB                                             7C91E192 218 Bytes  [ 55, 8B, EC, 56, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintExWithPrefix + 32                                            7C91E26D 24 Bytes  [ 75, 0B, 8B, 4E, 04, 57, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintExWithPrefix + 4B                                            7C91E286 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintExWithPrefix + 4D                                            7C91E288 12 Bytes  [ 5E, 5D, C2, 0C, 00, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintExWithPrefix + 5A                                            7C91E295 2 Bytes  [ B9, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintExWithPrefix + 5D                                            7C91E298 45 Bytes  [ 00, 00, 89, 4E, 34, 74, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintEx + 11                                                       7C91E2C6 34 Bytes  [ 19, 8B, 4E, 0C, 8B, 7E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrFreeCaptureBuffer + A                                              7C91E2E9 71 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrFreeCaptureBuffer + 52                                             7C91E331 7 Bytes  [ D7, C7, 06, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateCaptureBuffer + 1                                          7C91E339 90 Bytes  [ 46, 14, 3D, A0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateCaptureBuffer + 5C                                         7C91E394 19 Bytes  [ 03, C2, C1, F8, 0F, 05, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateMessagePointer + F                                         7C91E3A8 6 Bytes  [ 04, 00, 3D, BF, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateMessagePointer + 16                                        7C91E3AF 18 Bytes  [ 7E, 0A, D9, 05, 74, 4F, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateMessagePointer + 29                                        7C91E3C2 89 Bytes  [ 5D, C2, 04, 00, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateMessagePointer + 83                                        7C91E41C 5 Bytes  [ 8B, 45, 08, 3D, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrAllocateMessagePointer + 8A                                        7C91E423 17 Bytes  [ 4F, 7D, 06, D9, 45, 08, DB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindCreateProcessManifest + 6D                                     7C91F652 65 Bytes  [ 40, 08, 8D, 14, B5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindCreateProcessManifest + AF                                     7C91F694 139 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindCreateProcessManifest + 13B                                    7C91F720 40 Bytes  [ 8B, 55, FC, 3B, 55, F4, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindCreateProcessManifest + 164                                    7C91F749 136 Bytes  [ 76, 17, EB, 03, 8D, 49, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindCreateProcessManifest + 1ED                                    7C91F7D2 63 Bytes  [ 42, 08, 8B, 55, F8, 2B, C8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrCreateOutOfProcessImage + 5                                        7C91F988 50 Bytes  [ 89, 1C, B0, 8B, 5D, F0, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrCreateOutOfProcessImage + 38                                       7C91F9BB 100 Bytes  [ E4, 8B, 55, 10, 89, 75, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrCreateOutOfProcessImage + 9D                                       7C91FA20 2 Bytes  [ 45, E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrCreateOutOfProcessImage + A0                                       7C91FA23 33 Bytes  [ 55, F4, 8B, 75, DC, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrCreateOutOfProcessImage + C2                                       7C91FA45 46 Bytes  [ 00, 00, 8B, D8, 8B, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintEx + 4                                                       7C91FAE8 26 Bytes  [ 57, 0C, C1, E2, 02, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vDbgPrintEx + 1F                                                      7C91FB03 12 Bytes  [ 8B, 47, 3C, 8B, 4F, 38, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReleaseMemoryStream + 1                                            7C91FB10 8 Bytes  [ 40, 08, 89, 4D, F8, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReleaseMemoryStream + A                                            7C91FB19 148 Bytes  [ 14, F5, 00, 00, 00, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!qsort + 16                                                            7C91FBAE 14 Bytes  [ 55, EC, 89, 1C, 88, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!qsort + 25                                                            7C91FBBD 8 Bytes  [ D8, 03, D0, 3B, CE, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!qsort + 2E                                                            7C91FBC6 15 Bytes  [ 55, EC, 72, BB, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!qsort + 3E                                                            7C91FBD6 48 Bytes  CALL 7C440868 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!qsort + 6F                                                            7C91FC07 15 Bytes  [ 55, DC, 89, 4D, 0C, 39, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpApplyLengthFunction + 2E                                          7C91FCC4 66 Bytes  [ 45, C8, 89, 57, 08, 2B, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReadOutOfProcessMemoryStream + 8                                   7C91FD07 5 Bytes  [ 56, 18, 89, 4D, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReadOutOfProcessMemoryStream + E                                   7C91FD0D 10 Bytes  [ 48, 0C, 8B, 06, 89, 4D, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReadOutOfProcessMemoryStream + 19                                  7C91FD18 66 Bytes  [ 4D, FC, 8B, 0D, F8, 58, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlReadOutOfProcessMemoryStream + 5C                                  7C91FD5B 40 Bytes  [ 85, C0, 89, 75, E4, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInterfaceMemoryStream + 7                                     7C91FD84 554 Bytes  [ 7D, D8, 8B, 45, DC, 03, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutLastFullDosOrNtPathElement + 76                    7C91FFAF 15 Bytes  [ D9, CA, D8, 86, 6C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutLastFullDosOrNtPathElement + 86                    7C91FFBF 210 Bytes  [ D9, CA, D8, 86, 64, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutLastFullDosOrNtPathElement + 159                   7C920092 106 Bytes  [ 86, 2C, FF, FF, FF, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutLastFullDosOrNtPathElement + 1C4                   7C9200FD 99 Bytes  [ 79, 26, D8, 06, D9, C9, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutLastFullDosOrNtPathElement + 228                   7C920161 47 Bytes  [ 8F, 8B, 04, 24, D9, 1C, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAccessOutOfProcessResource + 19                                    7C920191 135 Bytes  [ 75, E4, 03, D1, 8B, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStatMemoryStream + 4                                               7C920219 40 Bytes  [ 45, FC, 2B, 45, F8, FF, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStatMemoryStream + 2D                                              7C920242 8 Bytes  [ D8, 8B, 14, 03, 89, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStatMemoryStream + 36                                              7C92024B 85 Bytes  [ 41, 83, C0, 04, 3B, CA, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateActivationContext + C                                        7C9202A1 41 Bytes  [ 40, 08, 89, 4D, EC, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateActivationContext + 36                                       7C9202CB 57 Bytes  [ 8D, 14, 91, 89, 55, F0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateActivationContext + 70                                       7C920305 57 Bytes  [ 8B, 45, 10, 85, C0, 0F, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateActivationContext + AA                                       7C92033F 94 Bytes  [ 00, 8B, 14, 86, 89, 11, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateActivationContext + 109                                      7C92039E 316 Bytes  [ 4D, E4, 8B, 7D, CC, 50, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFinalReleaseOutOfProcessMemoryStream + 33                          7C920631 70 Bytes  [ D9, CA, D8, 86, 2C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFinalReleaseOutOfProcessMemoryStream + 7B                          7C920679 5 Bytes  [ D9, C9, D8, 8F, E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFinalReleaseOutOfProcessMemoryStream + 82                          7C920680 73 Bytes  [ 00, D9, CA, 81, EE, E4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentDirectory_U + 32                                         7C9206CA 124 Bytes  [ 55, F4, D9, C9, D8, 4F, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentDirectory_U + AF                                         7C920747 22 Bytes  [ 4D, FC, 89, 45, D0, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentDirectory_U + C6                                         7C92075E 21 Bytes  [ 42, 08, 8B, 55, F8, 2B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentDirectory_U + DC                                         7C920774 13 Bytes  [ 0C, 8B, 45, FC, 3B, C1, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentDirectory_U + EA                                         7C920782 165 Bytes  [ 0C, 85, C0, 74, 3B, 03, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsstr + D5                                                           7C920AEF 5 Bytes  [ D9, CA, D8, 86, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsstr + DB                                                           7C920AF5 47 Bytes  [ FF, FF, D9, C9, D8, 8F, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcsstr + 10B                                                          7C920B25 97 Bytes  [ FF, FF, D9, C9, D8, 8F, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyEnvironment + 5D                                            7C920B87 95 Bytes  [ D9, C9, D8, 8F, B8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyEnvironment + BD                                            7C920BE7 23 Bytes  [ D9, C9, D8, 8F, D0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyEnvironment + D5                                            7C920BFF 153 Bytes  [ D9, CA, D8, 86, 24, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDuplicateUnicodeString + 4                                         7C920C99 81 Bytes  [ 7D, CC, 0F, 85, 91, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDuplicateUnicodeString + 57                                        7C920CEC 4 Bytes  [ 45, 08, 2B, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDuplicateUnicodeString + 5C                                        7C920CF1 191 Bytes  [ 8B, 45, 0C, 03, FB, C1, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTable + 28                                     7C920DB1 46 Bytes  [ FF, 55, 8B, EC, 83, EC, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTable + 57                                     7C920DE0 17 Bytes  [ 57, 08, 89, 4D, C8, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTable + 6B                                     7C920DF4 307 Bytes  [ 2B, F1, 89, 4D, DC, 8B, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTable + 19F                                    7C920F28 157 Bytes  [ D9, C9, D8, 4F, 10, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrClientConnectToServer + 65                                         7C920FC6 71 Bytes  [ 46, A4, D9, C9, D8, 4F, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrClientConnectToServer + AD                                         7C92100E 117 Bytes  [ 00, 56, FF, 15, 04, 4E, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrClientConnectToServer + 123                                        7C921084 17 Bytes  [ 00, 00, 85, C0, 74, 29, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtVersionNumbers + D                                            7C921096 2 Bytes  [ 89, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtVersionNumbers + 10                                           7C921099 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtVersionNumbers + 13                                           7C92109C 26 Bytes  [ 48, 04, C7, 40, 08, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtVersionNumbers + 2E                                           7C9210B7 26 Bytes  [ C0, 5E, 5D, C2, 0C, 00, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNtVersionNumbers + 49                                           7C9210D2 48 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumerateLoadedModules + 70                                        7C9211CF 42 Bytes  [ 57, 30, 3B, 8C, D6, DC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumerateLoadedModules + 9B                                        7C9211FA 288 Bytes  [ 15, C8, 4D, 15, B0, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitMemoryStream + 8F                                              7C92131B 19 Bytes  [ 15, D4, 4D, 15, B0, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitMemoryStream + A3                                              7C92132F 59 Bytes  [ 00, 83, C8, FF, F0, 0F, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitMemoryStream + DF                                              7C92136B 14 Bytes  [ C1, E2, 03, 52, 6A, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitMemoryStream + EE                                              7C92137A 31 Bytes  [ FF, 89, 7B, 48, 74, 19, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitMemoryStream + 10E                                             7C92139A 76 Bytes  [ 46, 58, 68, 4B, 4D, 49, 58, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetThreadPoolStartFunc + E                                         7C921FFF 76 Bytes  [ 17, 52, 6A, 00, FF, 15, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetThreadPoolStartFunc + 5B                                        7C92204C 46 Bytes  [ C7, 45, FC, FF, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetThreadPoolStartFunc + 8A                                        7C92207B 10 Bytes  [ 15, CC, 4D, 15, B0, C7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetThreadPoolStartFunc + 95                                        7C922086 13 Bytes  [ 00, EB, 06, C7, 06, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNormalizeProcessParams + 6                                         7C922094 1 Byte  [ 4E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNormalizeProcessParams + 9                                         7C922097 105 Bytes  [ C9, 75, 07, 8B, 47, 04, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNormalizeProcessParams + 73                                        7C922101 35 Bytes  [ 85, F6, 74, 09, 6A, 00, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNormalizeProcessParams + 97                                        7C922125 38 Bytes  [ 4D, F0, 64, 89, 0D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNormalizeProcessParams + BE                                        7C92214C 1 Byte  [ C0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlResetRtlTranslations + 5E                                          7C9222B1 153 Bytes  [ 00, 00, 00, 57, 8B, 3D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlResetRtlTranslations + F8                                          7C92234B 54 Bytes  [ 4C, 15, B0, 8D, 56, 2C, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlResetRtlTranslations + 12F                                         7C922382 54 Bytes  [ D7, 8B, 96, FC, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitNlsTables + 1D                                                 7C9223BA 14 Bytes  [ 85, C0, 74, 05, 6A, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitNlsTables + 2C                                                 7C9223C9 34 Bytes  [ 01, 0F, 85, 3D, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitCodePageTable + 1E                                             7C9223EC 31 Bytes  [ 86, C0, 00, 00, 00, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitCodePageTable + 3E                                             7C92240C 31 Bytes  [ 15, 01, 00, 8B, 86, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitCodePageTable + 5E                                             7C92242C 2 Bytes  JMP 7C92250D C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitCodePageTable + 61                                             7C92242F 24 Bytes  [ 00, 00, 8B, 8E, A4, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitCodePageTable + 7A                                             7C922448 33 Bytes  [ C7, 02, 00, 00, 00, 00, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyProcessParameters + A                                       7C922B26 59 Bytes  [ 00, 74, 1E, 40, EB, 1B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeNormalizeProcessParams + 1F                                      7C922B62 14 Bytes  [ 45, E0, 50, 83, C1, 48, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeNormalizeProcessParams + 2E                                      7C922B71 35 Bytes  [ 86, 48, 01, 00, 00, 8B, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeNormalizeProcessParams + 52                                      7C922B95 2 Bytes  [ 5A, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeNormalizeProcessParams + 55                                      7C922B98 13 Bytes  [ DB, 0F, 84, C0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeNormalizeProcessParams + 63                                      7C922BA6 91 Bytes  [ 00, 00, 8B, 4D, C4, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateProcessParameters + 12                                       7C922C03 4 Bytes  [ 33, FF, 3B, C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateProcessParameters + 17                                       7C922C08 76 Bytes  [ 4E, 8B, 86, 48, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateProcessParameters + 64                                       7C922C55 19 Bytes  [ 00, 00, 89, 5D, FC, E9, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateProcessParameters + 78                                       7C922C69 159 Bytes  [ 00, 8B, 88, 9C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateProcessParameters + 118                                      7C922D09 4 Bytes  [ AF, D1, 81, FA ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberGenericTableElements + 9                                     7C92369F 5 Bytes  [ 55, EC, B8, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberGenericTableElements + F                                     7C9236A5 50 Bytes  [ 00, 89, 83, D0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberGenericTableElements + 42                                    7C9236D8 81 Bytes  [ 00, 89, 83, C0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownProcess + 35                                               7C92372A 3 Bytes  [ 89, BB, BC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownProcess + 3B                                               7C923730 12 Bytes  [ 75, 0C, C7, 45, 18, 9A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownProcess + 48                                               7C92373D 5 Bytes  [ 00, B9, 42, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownProcess + 4E                                               7C923743 39 Bytes  [ 33, C0, F3, AB, 8B, 93, BC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrShutdownProcess + 76                                               7C92376B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteResource + 33                                                7C923846 123 Bytes  CALL 7C925F4F C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!toupper + 78                                                          7C9238C3 75 Bytes  [ C7, 40, 6C, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!toupper + C4                                                          7C92390F 25 Bytes  [ 04, 01, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!toupper + DE                                                          7C923929 142 Bytes  [ 00, 00, FF, 15, F4, 4D, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!toupper + 16D                                                         7C9239B8 59 Bytes  [ 85, 00, 00, 00, 00, 51, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!toupper + 1AA                                                         7C9239F5 49 Bytes  [ 00, C7, 04, 82, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToMultiByteN + 1                                      7C923CF6 116 Bytes  [ 00, 3B, C7, 74, 0C, 57, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToMultiByteN + 77                                     7C923D6C 76 Bytes  [ 00, 57, 52, FF, D6, 89, BB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToMultiByteN + C4                                     7C923DB9 5 Bytes  [ D6, 89, BB, 48, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToMultiByteN + CA                                     7C923DBF 130 Bytes  [ 00, 8B, 83, AC, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToMultiByteN + 14D                                    7C923E42 35 Bytes  [ 48, 18, 8B, 45, EC, 89, 59, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtPathNameToDosPathName + A                                        7C923F3E 71 Bytes  [ F8, 75, 31, 50, 50, 50, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtPathNameToDosPathName + 52                                       7C923F86 100 Bytes  [ 8D, 86, B8, 00, 00, 00, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtPathNameToDosPathName + B7                                       7C923FEB 3 Bytes  [ 28, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtPathNameToDosPathName + BB                                       7C923FEF 11 Bytes  [ 89, 0A, 89, 51, 04, 8B, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNtPathNameToDosPathName + C7                                       7C923FFB 61 Bytes  [ 08, 89, 50, 04, 89, 02, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wcslwr + C                                                           7C92438D 43 Bytes  [ C0, 5B, 8B, E5, 5D, C2, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wcslwr + 38                                                          7C9243B9 92 Bytes  [ 00, 89, 7B, 10, 89, 4B, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!atol + 48                                                             7C924416 144 Bytes  [ 8B, 4D, 18, 89, 01, 74, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!mbstowcs + 63                                                         7C9244A7 14 Bytes  [ 20, 57, 8B, 7D, 0C, 8A, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!mbstowcs + 72                                                         7C9244B6 55 Bytes  [ CF, C7, 47, 1C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!mbstowcs + AA                                                         7C9244EE 31 Bytes  [ 08, 51, FF, 15, B8, 4C, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!mbstowcs + CA                                                         7C92450E 132 Bytes  [ 15, F4, 4D, 15, B0, 8B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTable + 3C                                     7C924593 35 Bytes  [ 54, A1, A4, 68, 15, B0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTable + 60                                     7C9245B7 44 Bytes  [ 00, 8B, CA, 3B, C8, 73, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTable + 8D                                     7C9245E4 60 Bytes  [ 8D, 43, 28, 89, 40, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTable + CB                                     7C924622 90 Bytes  [ BB, 94, 00, 00, 00, 89, B3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTable + 126                                    7C92467D 47 Bytes  [ 78, 87, 17, B0, 8B, 41, 60, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSubtreePredecessor + 1B                                            7C924790 11 Bytes  [ 51, 28, 8B, 02, 50, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteElementGenericTable + 4                                      7C92479C 9 Bytes  [ 5D, FC, B9, 9C, 68, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteElementGenericTable + E                                      7C9247A6 23 Bytes  [ F0, 0F, C1, 11, EB, 31, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteElementGenericTable + 27                                     7C9247BF 10 Bytes  [ BE, BC, 63, 15, B0, F3, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteElementGenericTable + 32                                     7C9247CA 86 Bytes  [ 68, 10, 27, 00, 00, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDelete + 28                                                        7C924821 21 Bytes  [ C0, FF, 15, 0C, 4E, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDelete + 3E                                                        7C924837 32 Bytes  [ 18, 56, 8B, 71, 0C, 8B, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDelete + 5F                                                        7C924858 16 Bytes  [ 00, 52, FF, 15, B0, 4D, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDelete + 70                                                        7C924869 29 Bytes  [ 00, 50, C7, 86, 14, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDelete + 8E                                                        7C924887 1 Byte  [ 6A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConsoleMultiByteToUnicodeN + 1                                     7C9249BE 164 Bytes  [ 55, 10, 57, 8B, BC, C6, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConsoleMultiByteToUnicodeN + A6                                    7C924A63 53 Bytes  [ E2, 07, 03, C2, C1, F8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConsoleMultiByteToUnicodeN + DC                                    7C924A99 38 Bytes  [ 45, 0C, 8B, 4A, 04, 39, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConsoleMultiByteToUnicodeN + 103                                   7C924AC0 197 Bytes  [ 75, 07, 0F, B7, 4A, 02, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConsoleMultiByteToUnicodeN + 1C9                                   7C924B86 96 Bytes  [ 04, 89, 51, 04, 8B, 50, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateHeap + 93                                                    7C924D59 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateHeap + 95                                                    7C924D5B 130 Bytes  [ BF, 00, 90, 17, B0, 8B, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateHeap + 118                                                   7C924DDE 243 Bytes  [ C0, 5E, 8B, E5, 5D, C2, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateHeap + 20C                                                   7C924ED2 62 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateHeap + 24B                                                   7C924F11 42 Bytes  [ FF, 55, 8B, EC, 8B, 0D, A8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBits + 27                                                 7C9253C4 10 Bytes  [ 66, 00, 65, 00, 72, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBits + 32                                                 7C9253CF 62 Bytes  [ 00, 5C, 00, 52, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBits + 71                                                 7C92540E 35 Bytes  [ 6F, 00, 73, 00, 6F, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBits + 95                                                 7C925432 1 Byte  [ 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBits + 97                                                 7C925434 13 Bytes  [ 4D, 00, 41, 00, 75, 00, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBitsAndSet + 25                                           7C92548A 1 Byte  [ 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearBitsAndSet + 27                                           7C92548C 95 Bytes  [ 53, 00, 6F, 00, 66, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetBits + 54                                                       7C9254EC 49 Bytes  [ 78, 00, 4F, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetBits + 86                                                       7C92551E 5 Bytes  [ 61, 00, 63, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetBits + 8C                                                       7C925524 29 Bytes  [ 69, 00, 6E, 00, 65, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyHeap + 14                                                   7C925542 9 Bytes  [ 63, 00, 72, 00, 6F, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyHeap + 1E                                                   7C92554C 5 Bytes  [ 66, 00, 74, 00, 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyHeap + 24                                                   7C925552 7 Bytes  [ 4D, 00, 75, 00, 6C, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyHeap + 2C                                                   7C92555A 3 Bytes  [ 69, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyHeap + 30                                                   7C92555E 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlClearBits + 2D                                                     7C92572E 19 Bytes  [ 4D, 00, 69, 00, 63, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlClearBits + 41                                                     7C925742 67 Bytes  [ 4D, 00, 75, 00, 6C, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsSet + 3F                                                    7C925786 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsSet + 41                                                    7C925788 41 Bytes  [ 61, 00, 6E, 00, 6E, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsSet + 6B                                                    7C9257B2 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsSet + 6D                                                    7C9257B4 79 Bytes  [ 69, 00, 6E, 00, 65, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsSet + BD                                                    7C925804 9 Bytes  [ 69, 00, 6F, 00, 5C, 00, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToOemN + 52                                                 7C9258A6 178 Bytes  [ 69, 00, 78, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToOemN + 105                                                7C925959 10 Bytes  [ 00, 6E, 00, 61, 00, 62, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToOemN + 110                                                7C925964 5 Bytes  [ 53, 00, 68, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToOemN + 116                                                7C92596A 35 Bytes  [ 72, 00, 74, 00, 48, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToOemString + 18                                      7C92598E 11 Bytes  [ 61, 00, 63, 00, 68, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToOemString + 24                                      7C92599A 5 Bytes  [ 5C, 00, 53, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToOemString + 2A                                      7C9259A0 61 Bytes  [ 66, 00, 74, 00, 77, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToOemString + 68                                      7C9259DE 17 Bytes  [ 41, 00, 75, 00, 64, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToOemString + 7A                                      7C9259F0 5 Bytes  [ 78, 00, 65, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemToUnicodeN + 2B                                                 7C925AF3 242 Bytes  [ 00, 77, 00, 61, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemToUnicodeN + 11E                                                7C925BE6 5 Bytes  [ 69, 00, 78, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemToUnicodeN + 124                                                7C925BEC 65 Bytes  [ 72, 00, 00, 00, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemStringToUnicodeString + 3D                                      7C925C2E 86 Bytes  [ EB, 14, B9, 10, 27, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemStringToUnicodeString + 94                                      7C925C85 18 Bytes  [ 16, B0, 68, 50, 68, 16, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemStringToUnicodeString + A7                                      7C925C98 195 Bytes  [ 68, D0, 68, 16, B0, 68, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemStringToUnicodeString + 16B                                     7C925D5C 133 Bytes  [ 68, D8, 6D, 16, B0, 68, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlOemStringToUnicodeString + 1F1                                     7C925DE2 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswctype + 10                                                         7C925E89 136 Bytes  [ 8B, 46, 04, 85, C0, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswctype + 99                                                         7C925F12 36 Bytes  [ 00, 51, 6A, 01, 89, 46, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswdigit + 1A                                                         7C925F37 7 Bytes  [ 5F, 33, C0, 5E, 5D, C2, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswdigit + 22                                                         7C925F3F 18 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswdigit + 35                                                         7C925F52 85 Bytes  [ 55, 8B, EC, 8B, 55, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswdigit + 8B                                                         7C925FA8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswdigit + 8D                                                         7C925FAA 235 Bytes  [ 3B, F1, 5E, 89, 42, 18, 7E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGUIDFromString + 42                                                7C9262E1 148 Bytes  [ DB, 45, 08, D8, 0D, 2C, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGUIDFromString + D7                                                7C926376 100 Bytes  [ 45, 08, 8B, 48, 08, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGUIDFromString + 13C                                               7C9263DB 36 Bytes  [ FF, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGUIDFromString + 161                                               7C926400 4 Bytes  [ 00, 00, 03, C2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGUIDFromString + 166                                               7C926405 48 Bytes  [ F8, 10, 89, 46, 14, 8B, 41, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetEnvironmentVariable + CD                                        7C92671A 30 Bytes  JMP 3EEFC57E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetEnvironmentVariable + EC                                        7C926739 39 Bytes  [ 45, 08, 8B, 48, 08, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetEnvironmentVariable + 114                                       7C926761 5 Bytes  [ 4D, 10, 56, 41, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetEnvironmentVariable + 11A                                       7C926767 181 Bytes  [ 45, 08, 00, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetEnvironmentVariable + 1D0                                       7C92681D 91 Bytes  [ CC, CC, CC, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplaying + 6                           7C926879 32 Bytes  [ 4F, 20, 74, 62, DB, 04, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplaying + 27                          7C92689A 39 Bytes  [ D9, CA, DE, C3, D9, CC, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRealSuccessor + 18                                                 7C9268C2 6 Bytes  [ 75, B9, 8B, 4D, F4, 4A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRealSuccessor + 1F                                                 7C9268C9 86 Bytes  [ 7D, FC, 8B, 5D, 08, 8D, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeHandleTable + B                                          7C926920 12 Bytes  [ 75, BD, EB, 02, DD, D8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeHandleTable + 18                                         7C92692D 362 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeHandleTable + 183                                        7C926A98 16 Bytes  [ AC, 00, 00, 00, 8B, 50, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeHandleTable + 195                                        7C926AAA 132 Bytes  [ 08, 8B, 81, D4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrCaptureMessageBuffer + 2A                                          7C926B2F 121 Bytes  [ FE, DD, 0F, 7F, 58, 08, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeString + 29                                           7C926BA9 35 Bytes  [ 00, 00, 0F, EF, C0, 8B, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeString + 4D                                           7C926BCD 221 Bytes  [ F5, 5C, 17, 18, 74, 22, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeString + 12B                                          7C926CAB 62 Bytes  [ 00, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeString + 16A                                          7C926CEA 121 Bytes  [ 00, 00, 8B, 88, 4C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeString + 1E4                                          7C926D64 116 Bytes  [ 74, 27, 0F, 6F, 16, 8D, 34, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueueWorkItem + 2                                                  7C926E72 158 Bytes  [ FF, 83, C3, 02, 78, 17, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueueWorkItem + A1                                                 7C926F11 95 Bytes  [ 53, 8B, 1D, 80, 66, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueueWorkItem + 103                                                7C926F73 21 Bytes  [ EB, 0B, 8D, A4, 24, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueueWorkItem + 119                                                7C926F89 63 Bytes  [ 8B, 89, F4, 00, 00, 00, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueueWorkItem + 159                                                7C926FC9 105 Bytes  [ 09, 03, CE, DE, C1, D9, 42, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSubAuthorityCountSid + 50                                          7C927708 149 Bytes  [ 34, 00, 00, 00, 76, 30, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSubAuthorityCountSid + E6                                          7C92779E 370 Bytes  [ 00, 00, E4, 31, 55, 32, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetDaclSecurityDescriptor + 78                                     7C927911 96 Bytes  [ 36, F1, 36, 0E, 37, 1A, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMapGenericMask + 16                                                7C927972 264 Bytes  [ 00, 00, E6, 30, 86, 31, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthRequiredSid + 41                                             7C927A7B 339 Bytes  [ 3C, 94, 3C, 98, 3C, 9C, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupAtomInAtomTable + 3F                                         7C927BCF 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupAtomInAtomTable + 60                                         7C927BF0 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupAtomInAtomTable + 8C                                         7C927C1C 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupAtomInAtomTable + C7                                         7C927C57 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupAtomInAtomTable + 10C                                        7C927C9C 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionGuid + F                               7C927DEB 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionGuid + 1A                              7C927DF6 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionGuid + 1F                              7C927DFB 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionGuid + 22                              7C927DFE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindActivationContextSectionGuid + 28                              7C927E04 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStringFromGUID + 10                                                7C927F94 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStringFromGUID + 16                                                7C927F9A 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStringFromGUID + 28                                                7C927FAC 74 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStringFromGUID + 73                                                7C927FF7 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStringFromGUID + 8E                                                7C928012 30 Bytes  [ 89, 45, 08, 8B, 4D, 08, 88, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsTextUnicode + 15                                                 7C9280AF 16 Bytes  [ 53, 51, D9, 1C, 24, E8, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsTextUnicode + 26                                                 7C9280C0 15 Bytes  [ 0D, 34, 55, 01, 00, 53, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsTextUnicode + 36                                                 7C9280D0 43 Bytes  [ 47, 08, D9, 46, 0C, D8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsTextUnicode + 62                                                 7C9280FC 9 Bytes  [ 47, 10, D9, 46, 14, D8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsTextUnicode + 6D                                                 7C928107 31 Bytes  [ 53, 51, D9, 1C, 24, E8, AF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMultiByteToUnicodeSize + 16                                        7C9283DF 62 Bytes  [ 00, 89, 5D, F4, 74, 2A, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatMessage + B                                                  7C92841E 56 Bytes  [ 00, 8B, 88, 20, 52, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatMessage + 44                                                 7C928457 39 Bytes  [ 88, 20, 52, 00, 00, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatMessage + 6C                                                 7C92847F 32 Bytes  [ 00, C1, E1, 05, 89, B4, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatMessage + 8D                                                 7C9284A0 13 Bytes  [ C9, BF, A0, 1E, 03, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFormatMessage + 9B                                                 7C9284AE 17 Bytes  [ 88, 20, 52, 00, 00, 85, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtQueryValueKey + 40                                              7C928816 60 Bytes  [ 00, 00, 89, B9, AC, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtQueryValueKey + 7D                                              7C928853 37 Bytes  [ 00, 83, C2, 05, C1, E2, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtQueryValueKey + A3                                              7C928879 72 Bytes  [ 8B, 90, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtOpenKey + 2B                                                    7C9288C2 5 Bytes  [ 55, 8B, EC, 81, EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtOpenKey + 31                                                    7C9288C8 8 Bytes  [ 00, 00, 00, A1, 30, D2, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtOpenKey + 3A                                                    7C9288D1 39 Bytes  [ 0D, 94, 80, 03, 00, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtOpenKey + 63                                                    7C9288FA 29 Bytes  [ 00, 56, 8D, 73, 4C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtOpenKey + 81                                                    7C928918 17 Bytes  [ 57, 89, 55, 8C, 89, 4D, 80, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMakeSelfRelativeSD + F                                             7C92898E 28 Bytes  [ A0, A1, 34, 80, 03, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMakeSelfRelativeSD + 2C                                            7C9289AB 33 Bytes  [ 80, 03, 00, 89, 45, B0, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMakeSelfRelativeSD + 4E                                            7C9289CD 29 Bytes  [ 00, 00, 8D, 7D, D4, F3, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMakeSelfRelativeSD + 6C                                            7C9289EB 57 Bytes  JMP 06530EF3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMakeSelfRelativeSD + A6                                            7C928A25 16 Bytes  [ C0, 89, 45, 90, 0F, 85, B5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAbsoluteToSelfRelativeSD + 22                                      7C928A6B 184 Bytes  [ 00, 00, 74, 72, EB, 03, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAdjustPrivilege + 87                                               7C928B24 6 Bytes  [ 78, 10, C7, 87, 94, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAdjustPrivilege + 8F                                               7C928B2C 14 Bytes  [ 00, 00, 00, 00, 8B, 33, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAdjustPrivilege + 9F                                               7C928B3C 24 Bytes  CALL 7C92759E C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeString + B                                          7C928B55 4 Bytes  [ 48, 18, 49, EB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeString + 10                                         7C928B5A 24 Bytes  [ 81, C1, 9F, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeString + 29                                         7C928B73 49 Bytes  [ 00, 00, 00, 83, 7E, 3C, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeString + 5B                                         7C928BA5 20 Bytes  [ F3, 75, 8E, 8B, 45, 08, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeString + 70                                         7C928BBA 3 Bytes  [ 00, EB, 03 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSecurityDescriptor + 85                                      7C928F24 21 Bytes  [ C0, 74, 0F, 6A, 00, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSecurityDescriptor + 9D                                      7C928F3C 7 Bytes  [ 85, C0, 74, 0F, 6A, 00, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSecurityDescriptor + A5                                      7C928F44 12 Bytes  [ D7, C7, 86, A0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSecurityDescriptor + B2                                      7C928F51 23 Bytes  [ 56, FF, D7, 5F, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLengthSecurityDescriptor + CA                                      7C928F69 39 Bytes  [ 55, 14, 85, D2, 53, 8B, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetOwnerSecurityDescriptor + 6                                     7C928FBF 24 Bytes  [ 93, 98, 00, 00, 00, C1, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetOwnerSecurityDescriptor + 1F                                    7C928FD8 244 Bytes  [ C2, 99, 81, E2, FF, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeOemString + 36                                                 7C9290CD 43 Bytes  CALL 01A70E5D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeOemString + 62                                                 7C9290F9 37 Bytes  [ AF, D0, 03, F2, 8B, 55, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeOemString + 88                                                 7C92911F 94 Bytes  [ 00, EB, 0C, 3D, 00, 80, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAce + 2A                                                        7C92917E 90 Bytes  [ 00, 53, 89, 4D, F0, 8B, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAce + 85                                                        7C9291D9 164 Bytes  [ 6B, F0, 0F, 7F, F7, 0F, F5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAce + 12A                                                       7C92927E 144 Bytes  [ 00, 00, 8B, B0, 98, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAce + 1BB                                                       7C92930F 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAce + 1BF                                                       7C929313 17 Bytes  [ 86, A0, 00, 00, 00, 85, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIdentifierAuthoritySid + 2D                                        7C929662 7 Bytes  [ 03, C9, 57, 8B, BB, 94, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIdentifierAuthoritySid + 36                                        7C92966B 14 Bytes  [ 83, C6, 04, F3, A5, 8B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIdentifierAuthoritySid + 45                                        7C92967A 139 Bytes  [ BB, 98, 00, 00, 00, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIdentifierAuthoritySid + D1                                        7C929706 164 Bytes  [ 8C, C4, 00, 00, 00, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIdentifierAuthoritySid + 176                                       7C9297AB 4 Bytes  [ 9E, A0, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSystemTimeToLocalTime + A                                          7C9297CE 125 Bytes  [ 00, 5F, 5E, 5D, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressW + 4C                                          7C92984C 112 Bytes  [ 3B, C7, 89, 5E, 20, 89, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressW + BD                                          7C9298BD 9 Bytes  [ 00, 00, 00, 8B, 06, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressW + C7                                          7C9298C7 7 Bytes  [ 00, 50, FF, D7, C7, 06, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressW + CF                                          7C9298CF 14 Bytes  [ 00, 00, 83, C6, 04, 4B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressW + DE                                          7C9298DE 36 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAtomFromAtomTable + 15                                       7C929973 39 Bytes  [ 15, 10, 3E, 01, 00, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAtomFromAtomTable + 3D                                       7C92999B 54 Bytes  [ 8B, 45, 0C, 53, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAtomFromAtomTable + 74                                       7C9299D2 41 Bytes  [ 8B, 46, 28, 8B, 4D, 18, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAtomFromAtomTable + 9E                                       7C9299FC 97 Bytes  [ 11, 52, 8D, 85, 68, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAtomFromAtomTable + 100                                      7C929A5E 41 Bytes  JMP 08388D65 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnwind + 12                                                        7C92A80C 56 Bytes  [ 45, 08, 8B, 48, 04, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnwind + 4B                                                        7C92A845 1 Byte  [ 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnwind + 4D                                                        7C92A847 3 Bytes  [ 8B, 55, 8C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnwind + 51                                                        7C92A84B 112 Bytes  CALL 5686EDDB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnwind + C2                                                        7C92A8BC 25 Bytes  [ 73, 0C, 8B, 4D, 80, 8B, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetControlSecurityDescriptor + C                                   7C92AF91 34 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteSecurityObject + 1                                           7C92AFB4 2 Bytes  [ EC, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteSecurityObject + 4                                           7C92AFB7 34 Bytes  [ 75, 0C, 57, 68, 4B, 4D, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteSecurityObject + 27                                          7C92AFDA 145 Bytes  [ 00, C0, 5E, 5D, C2, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSListHead + F                                            7C92B06C 25 Bytes  [ 5E, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSListHead + 29                                           7C92B086 7 Bytes  [ 45, 08, 8B, 48, 0C, 8B, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSListHead + 31                                           7C92B08E 101 Bytes  [ 56, 33, F6, 85, C9, 74, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSListHead + 97                                           7C92B0F4 93 Bytes  [ 5E, 5D, C2, 04, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeSListHead + F5                                           7C92B152 118 Bytes  [ 55, 8B, EC, 51, 8B, 45, 1C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstol + 4                                                            7C92B559 130 Bytes  [ 45, 08, 56, 8B, B0, B4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCharToInteger + 26                                                 7C92B5DC 9 Bytes  [ 00, 33, FF, 8D, 5E, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCharToInteger + 30                                                 7C92B5E6 139 Bytes  [ 13, 8B, 45, 0C, 51, 52, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedPushEntrySList + 11                                     7C92B672 64 Bytes  [ 08, C7, 45, 0C, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedPopEntrySList + 10                                      7C92B6B3 76 Bytes  [ 54, 01, 00, D8, 4D, FC, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedPopEntrySList + 5D                                      7C92B700 259 Bytes  [ D9, 44, 87, 04, 8B, 7E, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlVerifyVersionInfo + A6                                             7C92B804 25 Bytes  [ D8, 65, 08, 74, 3D, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlVerifyVersionInfo + C0                                             7C92B81E 70 Bytes  [ 54, 01, 00, D8, 4D, FC, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlVerifyVersionInfo + 107                                            7C92B865 1 Byte  [ 7D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlVerifyVersionInfo + 109                                            7C92B867 32 Bytes  [ 83, C0, 04, 83, C7, FD, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlVerifyVersionInfo + 12B                                            7C92B889 125 Bytes  [ 00, 8B, 55, F8, 8D, 0C, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPcToFileHeader + 46                                                7C92B907 275 Bytes  [ 83, C1, 08, 3B, C2, 72, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPcToFileHeader + 15A                                               7C92BA1B 33 Bytes  [ 00, 00, 00, 83, C6, 04, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPcToFileHeader + 17C                                               7C92BA3D 30 Bytes  [ 50, FF, 15, 10, 3E, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPcToFileHeader + 19B                                               7C92BA5C 320 Bytes  [ 04, 4B, 75, D5, 8B, C7, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPcToFileHeader + 2DC                                               7C92BB9D 16 Bytes  [ 6A, 00, 89, 45, 0C, 8B, 41, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAtomToAtomTable + 3E                                            7C92BC98 16 Bytes  [ 56, FF, 15, D0, 3C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAtomToAtomTable + 4F                                            7C92BCA9 56 Bytes  [ 15, 0C, 3E, 01, 00, 8B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAtomToAtomTable + 88                                            7C92BCE2 22 Bytes  [ 00, 33, C0, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAtomToAtomTable + 9F                                            7C92BCF9 6 Bytes  [ 50, 20, 8B, 4D, 0C, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAtomToAtomTable + A6                                            7C92BD00 20 Bytes  [ 8B, 48, 24, 89, 50, 20, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAtomTable + 1                                                7C92BE4B 32 Bytes  [ C2, 51, 89, 45, FC, E8, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAtomTable + 22                                               7C92BE6C 15 Bytes  CALL 751DBFDB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAtomTable + 32                                               7C92BE7C 3 Bytes  [ 46, C7, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAtomTable + 37                                               7C92BE81 19 Bytes  [ 4D, F8, 03, F8, 13, DA, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAtomTable + 4B                                               7C92BE95 36 Bytes  [ E5, 5D, C3, CC, CC, CC, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryAtomInAtomTable + 55                                          7C92BF42 70 Bytes  [ 55, 8B, EC, 56, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryAtomInAtomTable + 9C                                          7C92BF89 123 Bytes  [ 89, 51, 04, C7, 46, 1C, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSecurityDescriptor + 1C                                       7C92C005 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSecurityDescriptor + 1E                                       7C92C007 38 Bytes  [ 5F, 33, C0, 5E, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSecurityDescriptor + 45                                       7C92C02E 62 Bytes  [ C7, 40, 04, B0, 60, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSecurityDescriptor + 85                                       7C92C06E 21 Bytes  [ 00, F0, 0F, C1, 08, 41, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidSecurityDescriptor + 9B                                       7C92C084 202 Bytes  [ 5D, C2, 04, 00, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetAce + 8E                                                        7C92C14F 22 Bytes  [ 00, 00, C7, 03, 04, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetAce + A5                                                        7C92C166 73 Bytes  [ 00, B8, 23, 00, 00, C0, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetAce + EF                                                        7C92C1B0 37 Bytes  [ 35, 28, 7F, 03, 00, 89, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetAce + 116                                                       7C92C1D7 26 Bytes  [ 00, BE, 90, 63, 03, 00, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetAce + 131                                                       7C92C1F2 23 Bytes  [ C0, 5B, 5D, C2, 0C, 00, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindMessage + 1A                                                   7C92C313 8 Bytes  [ 89, 4D, F0, 89, 45, E4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindMessage + 23                                                   7C92C31C 41 Bytes  [ 8D, 4D, C0, 51, 66, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindMessage + 4D                                                   7C92C346 31 Bytes  [ E5, 5D, C2, 08, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindMessage + 6D                                                   7C92C366 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindMessage + 73                                                   7C92C36C 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRegisterWait + D8                                                  7C92C739 266 Bytes  [ 60, 11, 52, 05, 83, 02, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRegisterWait + 1E3                                                 7C92C844 17 Bytes  [ 74, 73, 54, 63, 81, 63, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRegisterWait + 1F5                                                 7C92C856 275 Bytes  [ 98, 19, 22, 69, 31, 26, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimer + DA                                                   7C92C96A 638 Bytes  [ 50, 94, 32, 23, 78, 38, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimer + 359                                                  7C92CBE9 143 Bytes  [ 79, 07, 91, 93, 39, 24, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimer + 3E9                                                  7C92CC79 507 Bytes  [ 17, 16, 68, 55, 41, 36, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimer + 5E5                                                  7C92CE75 113 Bytes  [ 04, 01, 98, 21, 41, 80, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimer + 657                                                  7C92CEE7 142 Bytes  [ 40, 51, 74, 60, 28, 27, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__isascii + 16                                                        7C92CF76 74 Bytes  [ 05, 27, 24, 98, 64, 63, 19, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__isascii + 61                                                        7C92CFC1 493 Bytes  [ 52, 08, 33, 31, 20, 86, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrAddRefDll + 1A                                                     7C92D1AF 592 Bytes  [ 85, 98, 09, 96, 70, 52, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimer + 10                                                   7C92D400 32 Bytes  [ 68, 00, 54, 72, 23, 17, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimer + 31                                                   7C92D421 48 Bytes  [ 00, 00, 00, 02, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimer + 64                                                   7C92D454 7 Bytes  [ F4, 76, 03, 00, 40, 5D, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimer + 6C                                                   7C92D45C 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimer + 71                                                   7C92D461 19 Bytes  [ 00, 4E, 00, 08, 4F, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInformationAcl + 1D                                           7C92D582 16 Bytes  [ 00, AA, 00, 38, 9B, 71, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInformationAcl + 2E                                           7C92D593 54 Bytes  [ AA, 00, 38, 9B, 71, 81, 9F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInformationAcl + 65                                           7C92D5CA 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryInformationAcl + 69                                           7C92D5CE 18 Bytes  [ 00, 00, 61, 75, 64, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSaclSecurityDescriptor + B                                      7C92D5E1 23 Bytes  [ 00, 00, 00, 00, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSaclSecurityDescriptor + 23                                     7C92D5F9 17 Bytes  [ 22, 00, C0, 4F, D9, BA, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSaclSecurityDescriptor + 35                                     7C92D60B 38 Bytes  [ 00, 64, 00, 00, 00, 40, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSaclSecurityDescriptor + 5C                                     7C92D632 11 Bytes  [ 00, AA, 00, 38, 9B, 71, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSaclSecurityDescriptor + 68                                     7C92D63E 1 Byte  [ 10 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD + 2                                       7C92D65A 18 Bytes  [ FF, FF, 20, 00, 00, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD + 15                                      7C92D66D 115 Bytes  [ 00, 00, 00, 58, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD + 89                                      7C92D6E1 49 Bytes  [ 00, 00, AA, 00, 38, 9B, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD + BB                                      7C92D713 36 Bytes  [ 00, 64, 00, 00, 00, 40, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD + E0                                      7C92D738 30 Bytes  [ 01, 00, 00, 00, D8, 77, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyString + 44                                                    7C92D8A3 58 Bytes  [ A0, C9, 25, 5A, C1, 00, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidRelativeSecurityDescriptor + 35                               7C92D8DF 12 Bytes  [ 00, D0, E2, 02, 00, 90, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidRelativeSecurityDescriptor + 42                               7C92D8EC 19 Bytes  [ E0, EE, 02, 00, 00, DD, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidRelativeSecurityDescriptor + 56                               7C92D900 11 Bytes  [ 60, E5, 02, 00, 80, D8, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidRelativeSecurityDescriptor + 62                               7C92D90C 19 Bytes  [ 20, F0, 02, 00, E0, DE, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidRelativeSecurityDescriptor + 76                               7C92D920 23 Bytes  [ D0, E2, 02, 00, 90, D7, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunEncodeUnicodeString + E                                         7C92DE23 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunEncodeUnicodeString + 15                                        7C92DE2A 194 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunDecodeUnicodeString + 8C                                        7C92DEEF 108 Bytes  [ 00, 82, 8C, 02, 00, 96, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunDecodeUnicodeString + F9                                        7C92DF5C 26 Bytes  [ 08, 8A, 02, 00, EE, 89, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunDecodeUnicodeString + 114                                       7C92DF77 37 Bytes  [ 00, 44, 89, 02, 00, 28, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunDecodeUnicodeString + 13A                                       7C92DF9D 14 Bytes  [ 00, 00, 00, 24, 87, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRunDecodeUnicodeString + 149                                       7C92DFAC 25 Bytes  [ 60, 87, 02, 00, 7A, 87, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringExW + 20                                        7C92E022 3 Bytes  [ 02, 00, AA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringExW + 24                                        7C92E026 13 Bytes  [ 02, 00, 8E, 85, 02, 00, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringExW + 32                                        7C92E034 90 Bytes  [ 5E, 85, 02, 00, 42, 85, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringW + 15                                          7C92E08F 6 Bytes  [ 00, DA, 8C, 02, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringW + 1C                                          7C92E096 49 Bytes  [ 00, 00, 4F, 01, 49, 6F, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringW + 4E                                          7C92E0C8 303 Bytes  [ 3E, 01, 49, 6F, 43, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimerQueue + 75                                              7C92E1F8 59 Bytes  [ 33, 01, 49, 6F, 43, 61, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateTimerQueue + B1                                              7C92E234 195 Bytes  [ CA, 02, 4D, 6D, 55, 6E, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPrefixString + 23                                                  7C92E2F8 727 Bytes  [ CC, 02, 4D, 6D, 55, 6E, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetIoCompletionCallback + 1B7                                      7C92E5D0 35 Bytes  [ 6E, 70, 00, 00, BB, 00, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetIoCompletionCallback + 1DB                                      7C92E5F4 44 Bytes  [ 4B, 73, 41, 6C, 6C, 6F, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserThread + 7                                               7C92E621 54 Bytes  [ 61, 6E, 64, 6C, 65, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserThread + 3E                                              7C92E658 165 Bytes  [ 15, 00, 4B, 73, 41, 64, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserThread + E4                                              7C92E6FE 1 Byte  [ CF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserThread + E6                                              7C92E700 173 Bytes  [ 4B, 73, 53, 79, 6E, 63, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeContext + 55                                             7C92E7AE 31 Bytes  [ B2, 00, 4B, 73, 52, 65, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeContext + 75                                             7C92E7CE 1 Byte  [ 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeContext + 77                                             7C92E7D0 19 Bytes  [ 4B, 73, 41, 63, 71, 75, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeContext + 8B                                             7C92E7E4 1 Byte  [ D7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeContext + 8D                                             7C92E7E6 247 Bytes  [ 4B, 73, 56, 61, 6C, 69, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtEnumerateSubKey + 23                                            7C92EC44 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtEnumerateSubKey + 25                                            7C92EC46 49 Bytes  [ 49, 00, 6E, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtEnumerateSubKey + 57                                            7C92EC78 19 Bytes  [ 80, 00, 2E, 00, 01, 00, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtEnumerateSubKey + 6B                                            7C92EC8C 41 Bytes  [ 70, 00, 79, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtEnumerateSubKey + 95                                            7C92ECB6 9 Bytes  [ 6F, 00, 72, 00, 70, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAttributeActionToRXact + 18                                     7C92ECF6 70 Bytes  [ 00, 00, 3E, 00, 0B, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAttributeActionToRXact + 60                                     7C92ED3E 14 Bytes  [ 50, 00, 72, 00, 6F, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAttributeActionToRXact + 6F                                     7C92ED4D 180 Bytes  [ 00, 61, 00, 6D, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAttributeActionToRXact + 124                                    7C92EE02 21 Bytes  [ 00, 00, 24, 00, 04, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAttributeActionToRXact + 13A                                    7C92EE18 330 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddActionToRXact + 26                                              7C92EF63 103 Bytes  [ 34, 94, 34, BB, 34, CA, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddActionToRXact + 8E                                              7C92EFCB 2 Bytes  [ 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddActionToRXact + 92                                              7C92EFCF 17 Bytes  [ 00, BC, 30, CC, 30, DD, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObject + A                                              7C92EFE1 78 Bytes  CALL 96C4F317 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_itoa + 1C                                                            7C92F030 4 Bytes  [ E5, 5D, C2, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_itoa + 21                                                            7C92F035 255 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_itoa + 121                                                           7C92F135 16 Bytes  [ 4D, F8, 74, 62, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_itoa + 132                                                           7C92F146 108 Bytes  [ 7D, FC, 8B, 75, 08, D9, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_itoa + 19F                                                           7C92F1B3 4 Bytes  [ 84, 44, 02, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetProcessIsCritical + 7                                           7C92F223 15 Bytes  [ 87, 10, 01, 00, 00, 8B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetProcessIsCritical + 18                                          7C92F234 73 Bytes  [ 03, C2, C1, F8, 0F, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetThreadIsCritical + E                                            7C92F27E 147 Bytes  [ 89, 45, F8, DB, 45, F8, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUniform + 61                                                       7C92F312 41 Bytes  [ 45, 08, D9, 59, 24, 0F, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUniform + 8B                                                       7C92F33C 40 Bytes  [ 8B, 00, 0F, AF, C3, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUniform + B6                                                       7C92F367 36 Bytes  [ 40, 04, 0F, AF, C3, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUniform + DC                                                       7C92F38D 4 Bytes  [ 03, C2, C1, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUniform + E1                                                       7C92F392 28 Bytes  [ 89, 45, F8, DB, 45, F8, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFlushAlternateResourceModules + 55                                 7C92F427 81 Bytes  [ 8B, 00, 0F, AF, C3, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplyRXactNoFlush + A                                              7C92F479 135 Bytes  [ 45, 08, 8B, 48, 04, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserSecurityObject + 11                                      7C92F501 83 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserSecurityObject + 65                                      7C92F555 217 Bytes  [ C1, E3, 08, 89, 5D, 08, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAndSetSD + C7                                                7C92F62F 50 Bytes  [ 78, 04, 8B, 8F, 0C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAndSetSD + FA                                                7C92F662 11 Bytes  [ 06, 8D, 3C, CF, 8D, 34, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAndSetSD + 106                                               7C92F66E 63 Bytes  [ 9C, 85, 00, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAndSetSD + 146                                               7C92F6AE 24 Bytes  [ 8B, 55, 0C, 8B, 48, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateAndSetSD + 15F                                               7C92F6C7 44 Bytes  [ 02, 00, 00, 89, 45, FC, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLengthWithoutTrailingPathSeperators + 75                        7C92FA01 127 Bytes  [ 01, 00, 00, 8B, 47, 04, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryRegistryValues + 4                                            7C92FA81 153 Bytes  [ 78, 18, 0F, AF, 7D, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryRegistryValues + 9E                                           7C92FB1B 24 Bytes  [ B6, 51, 0A, C1, E0, 08, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryRegistryValues + B7                                           7C92FB34 9 Bytes  [ 00, 00, 03, C2, C1, F8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryRegistryValues + C1                                           7C92FB3E 28 Bytes  [ 0F, B6, 41, 0E, 0F, B6, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryRegistryValues + DE                                           7C92FB5B 2 Bytes  [ FF, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetControlSecurityDescriptor + 26                                  7C930184 108 Bytes  [ 0F, B6, 59, 01, C1, E6, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrint + 4                                                          7C9301F1 5 Bytes  [ 01, 99, 81, E2, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrint + A                                                          7C9301F7 15 Bytes  [ 00, 00, 03, C2, C1, F8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrint + 1A                                                         7C930207 28 Bytes  [ FF, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnprintf + F                                                        7C930224 7 Bytes  [ 8B, 41, 0C, 99, 81, E2, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnprintf + 17                                                       7C93022C 137 Bytes  [ 00, 00, 03, C2, C1, F8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnprintf + A1                                                       7C9302B6 39 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnprintf + C9                                                       7C9302DE 1 Byte  [ C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnprintf + CB                                                       7C9302E0 4 Bytes  [ 84, CD, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRXact + 8A                                               7C930552 294 Bytes  [ 74, 17, DB, 02, 83, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRXact + 1B1                                              7C930679 50 Bytes  [ 45, 08, 8B, 48, 08, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessAce + 1                                              7C9306AC 91 Bytes  [ 45, F8, 2B, F3, 8B, 55, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 1                        7C930708 21 Bytes  [ 4F, 20, 78, 1C, DB, 58, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 17                       7C93071E 81 Bytes  [ 8D, 34, 8E, 8B, 4F, 20, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 69                       7C930770 82 Bytes  [ 75, BD, EB, 02, DD, D8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + BC                       7C9307C3 69 Bytes  [ 75, F0, 8B, 5D, F4, C1, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 102                      7C930809 117 Bytes  [ D9, CB, D8, 4F, 14, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckProcessParameters + 3A                                        7C93087F 3 Bytes  [ 78, 0D, D8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckProcessParameters + 3E                                        7C930883 23 Bytes  [ 04, D9, 58, 04, 8D, 40, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckProcessParameters + 56                                        7C93089B 47 Bytes  [ 00, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckProcessParameters + 86                                        7C9308CB 15 Bytes  [ 00, 83, B9, 08, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCheckProcessParameters + 98                                        7C9308DD 69 Bytes  [ 91, 4C, 01, 00, 00, 83, 7A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLockBootStatusData + 9A                                            7C9309FB 131 Bytes  [ 0F, EF, C0, 8B, 57, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockBootStatusData + 6                                           7C930A7F 39 Bytes  [ C3, 02, 78, 25, 0F, 6F, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnlockBootStatusData + 2E                                          7C930AA7 27 Bytes  [ FF, 0F, 6E, 20, 83, C0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSetBootStatusData + 4                                           7C930AC3 59 Bytes  [ E5, 5D, C2, 0C, 00, 83, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSetBootStatusData + 40                                          7C930AFF 80 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSetBootStatusData + 91                                          7C930B50 2 Bytes  [ 56, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSetBootStatusData + 94                                          7C930B53 16 Bytes  [ 4D, F0, 8B, 88, 08, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSetBootStatusData + A5                                          7C930B64 6 Bytes  [ 85, C9, 89, 55, EC, 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserProcess + A2                                             7C930CCB 6 Bytes  [ 8D, 40, 08, 0F, 84, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserProcess + A9                                             7C930CD2 11 Bytes  [ FF, FF, 0F, 7E, 18, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserProcess + B5                                             7C930CDE 91 Bytes  [ FF, 0F, 7E, 10, 83, C0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserProcess + 111                                            7C930D3A 38 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateUserProcess + 138                                            7C930D61 44 Bytes  [ 53, 8B, 1D, 80, 76, 17, B0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageRvaToVa + 99                                                  7C931283 44 Bytes  [ 7E, 4C, 03, 0F, 94, C1, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageRvaToVa + C6                                                  7C9312B0 152 Bytes  [ 00, 00, EB, 02, 33, F6, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageRvaToVa + 15F                                                 7C931349 50 Bytes  [ 48, 10, 8B, 08, 3B, CE, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageRvaToVa + 192                                                 7C93137C 8 Bytes  [ C9, 74, 15, 8B, 92, 48, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImageRvaToVa + 19B                                                 7C931385 28 Bytes  [ 8B, 4A, 5C, 3B, 4A, 60, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDnsHostNameToComputerName + 62                                     7C9315B5 17 Bytes  [ 5C, 02, 7C, 8B, 90, 50, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDnsHostNameToComputerName + 75                                     7C9315C8 87 Bytes  [ 03, D0, 89, 9A, AC, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWriteRegistryValue                                                 7C931620 86 Bytes  [ 50, 01, 00, 00, 83, C2, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWriteRegistryValue + 57                                            7C931677 124 Bytes  [ 00, 33, C0, 66, 83, 7E, 7A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRegistryValue + 78                                           7C9316F4 37 Bytes  [ 01, 00, 00, 8B, 4D, F8, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRegistryValue + 9E                                           7C93171A 79 Bytes  [ 01, 00, 00, C1, E3, 05, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRegistryValue + EE                                           7C93176A 84 Bytes  [ 00, 00, FF, 80, 50, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRegistryValue + 143                                          7C9317BF 15 Bytes  [ C1, E1, 05, 89, 94, 01, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRegistryValue + 153                                          7C9317CF 5 Bytes  [ C1, E2, 05, 3B, FB ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWaitEx + 3                                               7C931935 15 Bytes  [ D4, C1, E1, 05, 89, 94, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWaitEx + 14                                              7C931946 18 Bytes  [ 8B, 86, 48, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWaitEx + 27                                              7C931959 83 Bytes  [ 39, 5D, E0, 8B, 4D, 0C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWaitEx + 7B                                              7C9319AD 105 Bytes  [ 00, 00, 5B, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWaitEx + E5                                              7C931A17 96 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWait + 6F                                                7C931CC9 20 Bytes  [ 00, 80, D3, EB, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWait + 84                                                7C931CDE 9 Bytes  JMP 8C5CA1E6 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWait + 90                                                7C931CEA 33 Bytes  [ 83, E0, 07, 89, 45, 0C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWait + B2                                                7C931D0C 30 Bytes  CALL 7DE9A529 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeregisterWait + D1                                                7C931D2B 76 Bytes  [ 8B, C8, 8B, D0, C1, E9, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCutoverTimeToSystemTime + 56                                       7C932153 51 Bytes  [ 0F, 94, C3, 89, 90, 20, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCutoverTimeToSystemTime + 8A                                       7C932187 172 Bytes  [ 4D, 08, 8B, 4D, 08, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCutoverTimeToSystemTime + 137                                      7C932234 16 Bytes  [ 2A, C1, E1, 05, 89, BC, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCutoverTimeToSystemTime + 148                                      7C932245 16 Bytes  [ C1, E1, 05, 8B, 9C, 01, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCutoverTimeToSystemTime + 159                                      7C932256 5 Bytes  [ 89, 99, AC, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObjectEx + 82                                           7C932E22 35 Bytes  [ AF, C7, 0F, BF, 1E, 03, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObjectEx + A6                                           7C932E46 76 Bytes  [ 08, 89, 11, 0F, BF, 56, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObjectEx + F3                                           7C932E93 5 Bytes  [ EB, 0C, 3D, 00, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObjectEx + F9                                           7C932E99 6 Bytes  [ FF, 7D, 05, B8, 00, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityObjectEx + 100                                          7C932EA0 83 Bytes  [ FF, 89, 01, 8B, 45, 0C, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualPrefixSid + 3B                                                7C93364F 7 Bytes  [ 89, 38, 74, 11, 33, C0, B9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualPrefixSid + 43                                                7C933657 176 Bytes  [ 00, 00, 00, F3, AB, 5F, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualPrefixSid + F4                                                7C933708 21 Bytes  [ 00, 8D, A4, 24, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualPrefixSid + 10A                                               7C93371E 14 Bytes  [ 00, 00, 00, 83, C6, 04, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualPrefixSid + 119                                               7C93372D 36 Bytes  [ 00, CC, CC, CC, CC, CC, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToOemN + 2                                            7C933D04 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToOemN + 4                                            7C933D06 18 Bytes  [ F8, 8B, 45, 08, 40, C7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToOemN + 18                                           7C933D1A 26 Bytes  [ 08, 72, AB, 85, FF, 7D, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToOemN + 33                                           7C933D35 30 Bytes  [ 0F, 6A, 00, 50, FF, 15, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToOemN + 53                                           7C933D55 358 Bytes  [ 83, C6, 04, 4B, 75, D5, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToOemString + 8C                                7C9340B2 69 Bytes  [ 42, 20, 89, 45, D8, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToOemString + D2                                7C9340F8 53 Bytes  [ 45, B0, 8B, 48, 08, 83, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlClearAllBits + 6                                                   7C93412E 48 Bytes  [ 4D, B4, 89, 08, 8B, 55, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAllBits + 6                                                     7C93415F 401 Bytes  [ 55, D8, F7, DA, 89, 55, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAllBits + 198                                                   7C9342F1 164 Bytes  [ D9, 41, C0, D8, 4A, C0, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopySecurityDescriptor + 55                                        7C934396 349 Bytes  [ 89, 55, D0, 8B, 5D, 10, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityObject + FC                                             7C9344F5 65 Bytes  [ FF, 89, 75, DC, 89, 7D, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityObject + 13E                                            7C934537 112 Bytes  [ 55, A0, 8B, 42, 08, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityObject + 1AF                                            7C9345A8 65 Bytes  [ 8B, 45, 98, 8B, 4D, 98, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityObject + 1F1                                            7C9345EA 105 Bytes  [ 45, 0C, 8B, 0C, 90, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityObject + 25B                                            7C934654 34 Bytes  [ 55, F0, 3B, 51, 1C, 73, 5B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpdateTimer + B5                                                   7C934A92 108 Bytes  [ 55, 8B, EC, 83, EC, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpdateTimer + 122                                                  7C934AFF 2 Bytes  [ 8B, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpdateTimer + 125                                                  7C934B02 14 Bytes  [ 83, C1, 04, 3B, CB, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpdateTimer + 134                                                  7C934B11 178 Bytes  [ 8B, 06, 47, 83, C2, 04, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpdateTimer + 1E7                                                  7C934BC4 45 Bytes  [ 15, 10, 4E, 15, B0, 68, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStartRXact + 19                                                    7C934C4F 10 Bytes  CALL 7C933F7E C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStartRXact + 24                                                    7C934C5A 17 Bytes  [ 0F, 8C, 40, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStartRXact + 36                                                    7C934C6C 11 Bytes  [ 00, 8B, F8, 33, DB, 3B, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlStartRXact + 43                                                    7C934C79 38 Bytes  [ 8B, 7D, 10, 39, 7E, 18, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAbortRXact + 18                                                    7C934CA1 175 Bytes  [ 50, 6A, 01, FF, 15, F4, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToSecondsSince1970 + 88                                        7C934D51 25 Bytes  [ D3, 89, 46, 38, 8B, 46, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToSecondsSince1970 + A2                                        7C934D6B 24 Bytes  [ 00, 74, 09, 6A, 00, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToSecondsSince1970 + BB                                        7C934D84 18 Bytes  [ 00, 00, 52, 6A, 01, FF, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTimeToSecondsSince1970 + CE                                        7C934D97 141 Bytes  [ FF, FF, C7, 46, 2C, F4, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImpersonateSelf + 82                                               7C934E25 172 Bytes  [ 0B, 5F, B8, 9A, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImpersonateSelf + 12F                                              7C934ED2 44 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImpersonateSelf + 15C                                              7C934EFF 42 Bytes  [ 8B, C6, 5E, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImpersonateSelf + 187                                              7C934F2A 24 Bytes  [ 06, 85, C0, 74, 0F, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlImpersonateSelf + 1A0                                              7C934F43 58 Bytes  [ FF, 5E, 5D, C2, 04, 00, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sprintf + 4                                                           7C935BB0 61 Bytes  [ 46, 04, 8B, 78, 0C, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sprintf + 43                                                          7C935BEF 50 Bytes  [ 5F, 5E, 5B, 5D, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sprintf + 76                                                          7C935C22 117 Bytes  JMP 07DBD02B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sprintf + EC                                                          7C935C98 40 Bytes  [ 8B, 81, 18, FF, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sprintf + 115                                                         7C935CC1 16 Bytes  [ 03, 85, C0, 57, 8B, 7D, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompactHeap + 16                                                   7C93621F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompactHeap + 1F                                                   7C936228 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompactHeap + 27                                                   7C936230 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompactHeap + 37                                                   7C936240 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompactHeap + 43                                                   7C93624C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtol + 5A                                                            7C93690C 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtol + 95                                                            7C936947 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtol + AF                                                            7C936961 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtol + B7                                                            7C936969 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtol + CA                                                            7C93697C 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExW + 33                                        7C936C0A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExW + 3B                                        7C936C12 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExW + 4B                                        7C936C22 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExW + 4E                                        7C936C25 70 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddVectoredExceptionHandler + C                                    7C936C6E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddVectoredExceptionHandler + 13                                   7C936C75 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddVectoredExceptionHandler + 3C                                   7C936C9E 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddVectoredExceptionHandler + 42                                   7C936CA4 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddVectoredExceptionHandler + 67                                   7C936CC9 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoveVectoredExceptionHandler + 2F                                7C936CFD 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoveVectoredExceptionHandler + 4B                                7C936D19 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoveVectoredExceptionHandler + 53                                7C936D21 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoveVectoredExceptionHandler + 68                                7C936D36 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoveVectoredExceptionHandler + 6E                                7C936D3C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetHeapInformation + 51                                            7C937D6E 228 Bytes  [ 19, B6, F5, 90, 1D, B6, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandomEx + E3                                                      7C937E53 11 Bytes  [ B6, 29, 96, 89, B6, 65, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandomEx + EF                                                      7C937E5F 71 Bytes  [ B6, 91, C0, 88, B6, 77, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandomEx + 137                                                     7C937EA7 301 Bytes  [ B6, 20, BC, 73, B6, 89, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandomEx + 265                                                     7C937FD5 84 Bytes  [ DF, 16, 36, 23, 21, 1D, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandomEx + 2BA                                                     7C93802A 287 Bytes  [ 89, 36, D5, 9F, 8B, 36, AC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAce + 1D0                                                    7C938359 93 Bytes  [ 39, 0E, B7, DF, 84, 0E, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAce + 22E                                                    7C9383B7 18 Bytes  [ B7, 42, 23, 07, B7, 48, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAce + 241                                                    7C9383CA 600 Bytes  [ 02, B7, 6A, D2, 01, B7, AD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAce + 49A                                                    7C938623 567 Bytes  [ 37, EB, 5C, 45, 37, 54, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteAce + 6D2                                                    7C93885B 590 Bytes  [ B7, 3A, 39, 81, B7, 4F, FB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!CsrProbeForRead + 23                                                  7C951D06 19 Bytes  [ C3, B8, 00, 00, 00, 00, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConnectToDbg + 1                                                 7C951D1A 3 Bytes  [ F4, 56, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConnectToDbg + 5                                                 7C951D1E 116 Bytes  [ 08, DD, 1C, 24, 83, EC, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiSetThreadDebugObject + 13                                        7C951D93 87 Bytes  [ 9B, 8A, 8D, 61, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiStopDebugging + 2                                                7C951DEB 14 Bytes  [ FF, 9B, DD, BD, 60, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiStopDebugging + 11                                               7C951DFA 7 Bytes  [ D9, C9, 8A, 8D, 61, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiStopDebugging + 19                                               7C951E02 78 Bytes  [ D9, E5, 9B, DD, BD, 60, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiRemoteBreakin + 46                                               7C951E51 107 Bytes  [ 00, EB, F6, DD, D8, DD, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiDebugActiveProcess + 13                                          7C951EBD 20 Bytes  [ DB, AD, 62, FF, FF, FF, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiDebugActiveProcess + 28                                          7C951ED2 6 Bytes  [ FF, FF, DB, AD, 62, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiDebugActiveProcess + 2F                                          7C951ED9 4 Bytes  [ FF, F6, 85, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiDebugActiveProcess + 36                                          7C951EE0 115 Bytes  [ 40, 74, 09, C6, 85, 70, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConvertStateChangeStructure + 68                                 7C951F54 79 Bytes  [ 08, 8D, 4D, E0, 50, 51, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConvertStateChangeStructure + B8                                 7C951FA4 1 Byte  [ 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConvertStateChangeStructure + BA                                 7C951FA6 16 Bytes  [ 06, D9, 6C, 24, 06, C3, A9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConvertStateChangeStructure + CB                                 7C951FB7 10 Bytes  [ 00, C3, DC, 05, D0, 66, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgUiConvertStateChangeStructure + D6                                 7C951FC2 8 Bytes  [ 00, 00, C3, 8B, 42, 04, 25, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrHotPatchRoutine + 7E                                               7C952254 5 Bytes  [ E3, 15, B0, E9, 84 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrHotPatchRoutine + 85                                               7C95225B 17 Bytes  [ 00, DD, 45, 10, DC, 1D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrHotPatchRoutine + 97                                               7C95226D 147 Bytes  [ 7A, 04, D9, EE, EB, 70, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrHotPatchRoutine + 12B                                              7C952301 81 Bytes  [ 6C, 24, 04, 8B, EC, 81, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrHotPatchRoutine + 17D                                              7C952353 4 Bytes  JMP 7C9523E6 C:\WINDOWS\system32\ntdll.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUnloadEventTrace + 131                                          7C9525F4 58 Bytes  [ 04, 80, 4D, 0F, 80, DD, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUnloadEventTrace + 16C                                          7C95262F 211 Bytes  [ 8B, 45, 10, DD, 5D, F8, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUnloadEventTrace + 240                                          7C952703 16 Bytes  [ 0C, 8B, 07, C1, E0, 04, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUnloadEventTrace + 251                                          7C952714 119 Bytes  [ 8B, 07, D1, E0, F7, D0, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetUnloadEventTrace + 2C9                                          7C95278C 101 Bytes  [ 04, 00, 00, 74, 1A, 3D, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryProcessModuleInformation + 1                                  7C952A2A 14 Bytes  [ 7D, 0C, DD, 07, DA, E9, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryProcessModuleInformation + 10                                 7C952A39 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrQueryProcessModuleInformation + 12                                 7C952A3B 89 Bytes  [ DD, 07, 8D, 45, F8, 50, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrSetAppCompatDllRedirectionCallback + 4C                            7C952A95 15 Bytes  [ FF, 3B, C8, 7D, 1F, 2B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrSetAppCompatDllRedirectionCallback + 5C                            7C952AA5 79 Bytes  [ 8B, F3, D1, 6D, F0, 84, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsThreadWithinLoaderCallout + 3C                                   7C952AF5 256 Bytes  [ 59, 83, E6, EF, 33, C0, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsThreadWithinLoaderCallout + 13D                                  7C952BF6 22 Bytes  [ 90, 4C, 15, B0, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsThreadWithinLoaderCallout + 154                                  7C952C0D 13 Bytes  [ 25, 98, 4C, 15, B0, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsThreadWithinLoaderCallout + 162                                  7C952C1B 10 Bytes  [ 4E, 15, B0, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsThreadWithinLoaderCallout + 16F                                  7C952C28 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitShimEngineDynamic + 4                                          7C952CBE 144 Bytes  [ 02, 00, 4A, 8B, 02, 00, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitShimEngineDynamic + 95                                         7C952D4F 8 Bytes  [ 00, 7A, 87, 02, 00, 92, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitShimEngineDynamic + 9E                                         7C952D58 15 Bytes  [ A8, 87, 02, 00, 12, 84, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitShimEngineDynamic + AE                                         7C952D68 51 Bytes  [ E6, 87, 02, 00, 02, 88, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrInitShimEngineDynamic + E2                                         7C952D9C 107 Bytes  [ 78, 86, 02, 00, 64, 86, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputePrivatizedDllName_U + 2B                                    7C95331E 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputePrivatizedDllName_U + 3B                                    7C95332E 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputePrivatizedDllName_U + 4D                                    7C953340 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputePrivatizedDllName_U + 5F                                    7C953352 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputePrivatizedDllName_U + A0                                    7C953393 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWriteMemoryStream + 4                                              7C9535FF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWriteMemoryStream + 8                                              7C953603 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSeekMemoryStream + B                                               7C953613 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSeekMemoryStream + 16                                              7C95361E 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSeekMemoryStream + 57                                              7C95365F 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSeekMemoryStream + 5D                                              7C953665 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetMemoryStreamSize + 4                                            7C95366E 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetMemoryStreamSize + 8                                            7C953672 125 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRevertMemoryStream + 5                                             7C9536F0 12 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyOutOfProcessMemoryStreamTo + 5                                 7C9536FD 12 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCloneMemoryStream + 5                                              7C95370A 212 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnableEarlyCriticalSectionEventCreation + A                        7C9537DF 26 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNotOwnerCriticalSection + 12                                      7C9537FA 38 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNotOwnerCriticalSection + 39                                      7C953821 236 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQuerySecurityObject + 2C                                           7C95390E 464 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQuerySecurityObject + 1FD                                          7C953ADF 117 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewInstanceSecurityObject + 71                                     7C953B55 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityGrantedAccess + 2E                                      7C953B88 3 Bytes  [ 08, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityGrantedAccess + 32                                      7C953B8C 47 Bytes  [ 20, 06, 02, 00, 20, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityGrantedAccess + 62                                      7C953BBC 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityGrantedAccess + 64                                      7C953BBE 53 Bytes  [ 00, 00, 60, 0C, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNewSecurityGrantedAccess + 9A                                      7C953BF4 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertToAutoInheritSecurityObject + B                             7C953CC3 88 Bytes  [ 00, 00, 00, 00, 00, 23, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDefaultNpAcl + 55                                                  7C953D1D 29 Bytes  [ 00, 00, 00, 20, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDefaultNpAcl + 74                                                  7C953D3C 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDefaultNpAcl + 88                                                  7C953D50 8 Bytes  [ 70, 11, 02, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDefaultNpAcl + 92                                                  7C953D5A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDefaultNpAcl + 98                                                  7C953D60 109 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUiListToApiList + 50                                        7C95401A 41 Bytes  [ 35, 00, 44, 00, 30, 00, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUiListToApiList + 7A                                        7C954044 23 Bytes  [ 38, 00, 44, 00, 42, 00, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUiListToApiList + 93                                        7C95405D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUiListToApiList + 9A                                        7C954064 7 Bytes  [ 20, 4E, 02, 00, 20, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertUiListToApiList + A2                                        7C95406C 4 Bytes  [ 08, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateQueryDebugBuffer + 16                                        7C95457E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateQueryDebugBuffer + 18                                        7C954580 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateQueryDebugBuffer + 1D                                        7C954585 10 Bytes  [ 00, 00, 00, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateQueryDebugBuffer + 28                                        7C954590 1 Byte  [ 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateQueryDebugBuffer + 2A                                        7C954592 60 Bytes  [ 00, 00, 08, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyQueryDebugBuffer + 74                                       7C9546C4 37 Bytes  [ 8C, 56, 01, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyQueryDebugBuffer + 9A                                       7C9546EA 3 Bytes  [ EF, 7F, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyQueryDebugBuffer + 9F                                       7C9546EF 60 Bytes  [ 00, 00, 00, 10, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyQueryDebugBuffer + DC                                       7C95472C 21 Bytes  [ 5F, 79, 31, 00, 5F, 79, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessBackTraceInformation + 11                              7C954742 7 Bytes  [ 00, 00, 5F, 68, 79, 70, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessBackTraceInformation + 19                              7C95474A 22 Bytes  [ 00, 00, 5F, 63, 61, 62, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessBackTraceInformation + 31                              7C954762 15 Bytes  [ 00, 00, 66, 61, 62, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessBackTraceInformation + 41                              7C954772 58 Bytes  [ 00, 00, 63, 65, 69, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessBackTraceInformation + 7C                              7C9547AD 7 Bytes  [ 00, 00, 00, 74, 61, 6E, 68 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessHeapInformation + 23                                   7C9548FC 25 Bytes  [ 80, 25, 00, 00, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessHeapInformation + 3D                                   7C954916 10 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessHeapInformation + 49                                   7C954922 22 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessHeapInformation + 60                                   7C954939 31 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessHeapInformation + 81                                   7C95495A 10 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessLockInformation + 10C                                  7C954F11 130 Bytes  [ 15, C1, 3A, EC, 0C, C8, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessDebugInformation + 19                                  7C954F94 239 Bytes  [ D8, 78, 6C, 3B, 99, 1E, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessDebugInformation + 109                                 7C955084 1 Byte  [ 15 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessDebugInformation + 10B                                 7C955086 67 Bytes  [ 4E, 15, B0, 5E, 5B, B8, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessDebugInformation + 14F                                 7C9550CA 20 Bytes  [ CC, CC, CC, CC, CC, CC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryProcessDebugInformation + 164                                 7C9550DF 117 Bytes  [ 8B, 5D, 08, 56, 8B, 34, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplicationVerifierStop + 30                                       7C95670D 422 Bytes  [ 11, A4, BA, 46, D2, A3, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplicationVerifierStop + 1D7                                      7C9568B4 24 Bytes  [ 70, DE, CD, 3A, 0C, FB, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplicationVerifierStop + 1F0                                      7C9568CD 588 Bytes  [ D7, F2, 3A, 1B, 11, F9, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplicationVerifierStop + 43D                                      7C956B1A 46 Bytes  [ 54, 33, 32, 0C, 5D, 33, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlApplicationVerifierStop + 46C                                      7C956B49 169 Bytes  [ EC, 6B, 33, E2, 09, 73, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZombifyActivationContext + 1C                                      7C9580B9 14 Bytes  [ 00, 56, 00, 61, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZombifyActivationContext + 2B                                      7C9580C8 25 Bytes  [ 49, 00, 6E, 00, 66, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZombifyActivationContext + 45                                      7C9580E2 22 Bytes  [ 73, 00, 6C, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsActivationContextActive + B                                      7C9580F9 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsActivationContextActive + 11                                     7C9580FF 301 Bytes  [ 00, 00, 00, 00, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsActivationContextActive + 13F                                    7C95822D 246 Bytes  [ 33, 19, 34, 42, 34, 75, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsActivationContextActive + 236                                    7C958324 6 Bytes  [ C0, 3B, DC, 3B, E8, 3B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsActivationContextActive + 23D                                    7C95832B 338 Bytes  [ 3C, 10, 3C, 2C, 3C, 38, 3C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeImportTableHash + 24                                        7C9596EB 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeImportTableHash + 2A                                        7C9596F1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeImportTableHash + 34                                        7C9596FB 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeImportTableHash + 3C                                        7C959703 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeImportTableHash + 3E                                        7C959705 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertVariantToProperty + 10                                      7C959BFD 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertVariantToProperty + 14                                      7C959C01 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertVariantToProperty + 48                                      7C959C35 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertVariantToProperty + 53                                      7C959C40 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertVariantToProperty + 5C                                      7C959C49 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertPropertyToVariant + 10                                      7C959C9B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertPropertyToVariant + 14                                      7C959C9F 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertPropertyToVariant + 3F                                      7C959CCA 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertPropertyToVariant + 4A                                      7C959CD5 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlConvertPropertyToVariant + 53                                      7C959CDE 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PropertyLengthAsVariant + 10                                          7C959D33 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PropertyLengthAsVariant + 14                                          7C959D37 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PropertyLengthAsVariant + 3F                                          7C959D62 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PropertyLengthAsVariant + 4A                                          7C959D6D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PropertyLengthAsVariant + 53                                          7C959D76 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUnicodeCallouts + 3                                             7C959DBC 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUnicodeCallouts + E                                             7C959DC7 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUnicodeCallouts + 6C                                            7C959E25 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUnicodeCallouts + 6E                                            7C959E27 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUnicodeCallouts + A2                                            7C959E5B 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintReturnControlC + 5                                            7C959EAF 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintReturnControlC + 1D                                           7C959EC7 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintReturnControlC + 29                                           7C959ED3 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintReturnControlC + 2C                                           7C959ED6 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrintReturnControlC + 69                                           7C959F13 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrompt + 3C                                                        7C959FD5 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!DbgPrompt + 41                                                        7C959FDA 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindEntryForAddress + 2B                                           7C95A02A 9 Bytes  [ 12, 39, 82, 49, 11, 39, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindEntryForAddress + 35                                           7C95A034 436 Bytes  [ 00, EB, 0E, 39, 9D, A6, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumResources + 155                                                7C95A1E9 579 Bytes  [ A2, 1B, B9, 83, C6, 1D, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumResources + 399                                                7C95A42D 291 Bytes  [ 7F, 00, 39, 7E, 37, 04, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumResources + 4BD                                                7C95A551 36 Bytes  [ 85, 65, 39, 65, DB, 63, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumResources + 4E2                                                7C95A576 275 Bytes  [ 53, 39, 43, FA, 50, 39, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrEnumResources + 5F6                                                7C95A68A 34 Bytes  [ B6, B8, 64, 0E, C1, B8, D6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceEx_U + 216                                             7C95AFDC 39 Bytes  [ 23, B7, 25, 3A, 22, 89, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceEx_U + 23E                                             7C95B004 613 Bytes  [ EE, BB, 0C, 3A, 16, DB, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!LdrFindResourceEx_U + 4A4                                             7C95B26A 681 Bytes  [ 99, BA, 10, 78, 98, BA, 2F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCustomCPToUnicodeN + 1F                                            7C95B514 40 Bytes  [ 7F, 6F, B1, 3B, 83, 61, B2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCustomCPToUnicodeN + 48                                            7C95B53D 195 Bytes  [ FB, B9, 3B, DE, B8, BA, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCustomCPToUnicodeN + 10C                                           7C95B601 60 Bytes  [ 00, 80, C0, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCustomCPToUnicodeN + 149                                           7C95B63E 51 Bytes  [ 80, C0, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCustomCPToUnicodeN + 17D                                           7C95B672 26 Bytes  [ 80, 40, 00, 00, 80, 40, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToCustomCPN + 1D                                            7C95B6F6 128 Bytes  [ 00, 00, 00, 00, A0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToCustomCPN + 9E                                            7C95B777 120 Bytes  [ 00, 36, D9, 04, 00, B5, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToCustomCPN + 117                                           7C95B7F0 7 Bytes  [ 29, 8A, 02, 00, 00, 80, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToCustomCPN + 11F                                           7C95B7F8 67 Bytes  [ 27, 76, 02, 00, 9B, 6C, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeToCustomCPN + 163                                           7C95B83C 99 Bytes  [ 83, F3, 01, 00, 7E, ED, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToCustomCPN + 17                                      7C95B8A0 16 Bytes  [ CE, 7E, 01, 00, 42, 7B, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToCustomCPN + 28                                      7C95B8B1 90 Bytes  [ 71, 01, 00, B7, 6D, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToCustomCPN + 83                                      7C95B90C 50 Bytes  [ AC, 31, 01, 00, 68, 2F, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToCustomCPN + B6                                      7C95B93F 56 Bytes  [ 00, A4, 16, 01, 00, C2, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeToCustomCPN + EF                                      7C95B978 106 Bytes  [ 9A, 01, 00, 00, 33, 03, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxRemovePrefix + F9                                                  7C95C210 64 Bytes  JMP 7171C214 C:\WINDOWS\system32\wbem\cimwin32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxRemovePrefix + 13C                                                 7C95C253 16 Bytes  [ 00, 00, 00, 00, 80, FF, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxRemovePrefix + 14D                                                 7C95C264 13 Bytes  [ DC, A7, D7, B9, 85, 66, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxRemovePrefix + 15D                                                 7C95C274 64 Bytes  [ FF, FF, 0D, 40, F7, 36, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxRemovePrefix + 19E                                                 7C95C2B5 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxInsertPrefix + 25                                                  7C95C383 44 Bytes  [ 00, 88, 57, 01, 00, 1E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxInsertPrefix + 52                                                  7C95C3B0 1 Byte  [ 15 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxInsertPrefix + 54                                                  7C95C3B2 80 Bytes  [ 00, 00, 64, 57, 01, 00, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxInsertPrefix + A5                                                  7C95C403 19 Bytes  [ 00, 20, 57, 01, 00, 26, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxInsertPrefix + B9                                                  7C95C417 19 Bytes  [ 00, 00, 00, 00, 80, 10, 44, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxFindPrefix + 5C                                                    7C95C49D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxFindPrefix + 67                                                    7C95C4A8 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!PfxFindPrefix + 75                                                    7C95C4B6 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD2 + 14                                     7C95C4F4 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD2 + 1B                                     7C95C4FB 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD2 + 21                                     7C95C501 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD2 + 2E                                     7C95C50E 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSelfRelativeToAbsoluteSD2 + 7A                                     7C95C55A 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetInformationAcl + 1C                                             7C95C57B 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetInformationAcl + 29                                             7C95C588 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetInformationAcl + 38                                             7C95C597 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetInformationAcl + 42                                             7C95C5A1 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetInformationAcl + 47                                             7C95C5A6 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddCompoundAce + 19                                                7C95C5C4 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddCompoundAce + 2A                                                7C95C5D5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddCompoundAce + 37                                                7C95C5E2 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddCompoundAce + 43                                                7C95C5EE 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddCompoundAce + 4C                                                7C95C5F7 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessDeniedAceEx + 1F                                          7C95C80E 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessAceEx + 9                                            7C95C81C 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessAceEx + 13                                           7C95C826 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessAceEx + 33                                           7C95C846 76 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessAllowedObjectAce + 48                                     7C95C893 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessDeniedObjectAce + 9                                       7C95C8A1 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessDeniedObjectAce + F                                       7C95C8A7 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAccessDeniedObjectAce + 49                                      7C95C8E1 95 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessObjectAce + 5B                                       7C95C941 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessObjectAce + 75                                       7C95C95B 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddAuditAccessObjectAce + 8F                                       7C95C975 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyAtomTable + 22                                              7C95C99C 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyAtomTable + 28                                              7C95C9A2 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyAtomTable + 44                                              7C95C9BE 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyAtomTable + 5B                                              7C95C9D5 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDestroyAtomTable + 6B                                              7C95C9E5 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEmptyAtomTable + 22                                                7C95CA73 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEmptyAtomTable + 28                                                7C95CA79 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEmptyAtomTable + 53                                                7C95CAA4 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEmptyAtomTable + 69                                                7C95CABA 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEmptyAtomTable + 8F                                                7C95CAE0 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPinAtomInAtomTable + 1C                                            7C95CB35 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPinAtomInAtomTable + 2A                                            7C95CB43 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPinAtomInAtomTable + 32                                            7C95CB4B 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPinAtomInAtomTable + 3C                                            7C95CB55 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlPinAtomInAtomTable + 74                                            7C95CB8D 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRangeList + F                                            7C95CBE0 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRangeList + 1C                                           7C95CBED 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRangeList + 31                                           7C95CC02 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRangeList + 53                                           7C95CC24 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeRangeList + 99                                           7C95CC6A 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeRangeList + 10                                                 7C95CDFC 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeRangeList + 14                                                 7C95CE00 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeRangeList + 40                                                 7C95CE2C 83 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFirstRange + 50                                                 7C95CE81 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFirstRange + 56                                                 7C95CE87 85 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFirstRange + AD                                                 7C95CEDE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetFirstRange + B3                                                 7C95CEE4 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNextRange + 16                                                  7C95CEFF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNextRange + 1C                                                  7C95CF05 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNextRange + 2F                                                  7C95CF18 70 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNextRange + 77                                                  7C95CF60 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetNextRange + AA                                                  7C95CF93 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyRangeList + D                                                  7C95D062 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyRangeList + 13                                                 7C95D068 76 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyRangeList + 60                                                 7C95D0B5 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyRangeList + 6A                                                 7C95D0BF 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyRangeList + 8D                                                 7C95D0E2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindRange + 3C                                                     7C95D1E4 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindRange + 4A                                                     7C95D1F2 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindRange + 59                                                     7C95D201 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindRange + 67                                                     7C95D20F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindRange + 6F                                                     7C95D217 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsRangeAvailable + 79                                              7C95D5A4 204 Bytes  [ F9, 03, 75, D5, 83, EB, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsRangeAvailable + 148                                             7C95D673 29 Bytes  [ 8B, 75, FC, 4B, 33, D2, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsRangeAvailable + 166                                             7C95D691 5 Bytes  [ 6E, E8, 0F, 62, ED ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsRangeAvailable + 16C                                             7C95D697 16 Bytes  [ 4D, F4, 8B, 45, F8, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsRangeAvailable + 17D                                             7C95D6A8 31 Bytes  [ 0C, 1E, F7, C1, 03, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMergeRangeLists + 25                                               7C95D783 70 Bytes  [ 0F, 7F, 64, DF, 38, 0F, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMergeRangeLists + 6D                                               7C95D7CB 48 Bytes  [ 5F, 5E, 5B, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMergeRangeLists + 9E                                               7C95D7FC 33 Bytes  CALL 7C96CEDF C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMergeRangeLists + C0                                               7C95D81E 57 Bytes  [ 8B, 50, 08, 8B, 40, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddRange + 1B                                                      7C95D859 10 Bytes  [ 8B, 5D, 0C, 8B, 75, FC, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddRange + 26                                                      7C95D864 49 Bytes  [ FF, FF, 83, FB, 0E, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAddRange + 58                                                      7C95D896 121 Bytes  [ 4C, 9F, 04, 83, EB, 02, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRange + 47                                                   7C95D910 88 Bytes  [ FE, 64, 9F, 38, 0F, 7F, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRange + A0                                                   7C95D969 2 Bytes  [ 8C, E5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRange + A6                                                   7C95D96F 2 Bytes  [ 45, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteRange + A9                                                   7C95D972 405 Bytes  [ 4D, F8, C1, E0, 10, 0B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInvertRangeList + 51                                               7C95DB08 312 Bytes  [ 0C, 9E, 0F, 6E, C9, 43, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateServiceSid + 4                                               7C95DC41 53 Bytes  [ 45, FC, 8B, D0, C1, EA, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateServiceSid + 3A                                              7C95DC77 50 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateServiceSid + 6D                                              7C95DCAA 110 Bytes  [ 00, 8B, 47, 3C, 8B, 76, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateServiceSid + DC                                              7C95DD19 44 Bytes  [ 0F, 00, 00, 0F, 6F, 56, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualLuid + 4                                                      7C95DD46 9 Bytes  [ C8, 0F, 72, E2, 0C, 8B, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualLuid + E                                                      7C95DD50 18 Bytes  [ 0F, FE, CA, 0F, 7F, 4F, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEqualLuid + 21                                                     7C95DD63 33 Bytes  [ 83, C4, 0C, 89, 7D, FC, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCopyLuidAndAttributesArray + 1A                                    7C95DD85 44 Bytes  [ 14, 98, 8D, 1C, 98, 89, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSaclSecurityDescriptor + 18                                     7C95DDB2 7 Bytes  [ 4D, F0, 89, 41, 38, 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSaclSecurityDescriptor + 20                                     7C95DDBA 68 Bytes  [ 5F, 5E, 5B, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSaclSecurityDescriptor + 65                                     7C95DDFF 6 Bytes  [ DC, 53, 56, 8B, 71, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSaclSecurityDescriptor + 6C                                     7C95DE06 17 Bytes  [ 08, 57, 8B, 78, 14, 8B, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetSaclSecurityDescriptor + 7E                                     7C95DE18 129 Bytes  [ 95, F0, 68, 15, B0, 8B, 58, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetSecurityDescriptorRMControl + 6                                 7C95E05D 153 Bytes  [ 7D, D8, 0F, FE, F4, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMapSecurityErrorToNtStatus + 75                                    7C95E0F7 13 Bytes  [ 85, C9, 74, 4A, 8B, 4D, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlMapSecurityErrorToNtStatus + 83                                    7C95E105 109 Bytes  [ 02, 33, C9, 85, DB, 76, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAttributesSecurityDescriptor + 6                                7C95E173 294 Bytes  [ 4D, EC, 8B, 30, 8B, 55, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAttributesSecurityDescriptor + 12D                              7C95E29A 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAttributesSecurityDescriptor + 12F                              7C95E29C 55 Bytes  [ 33, C0, 85, F6, 76, 11, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAttributesSecurityDescriptor + 167                              7C95E2D4 39 Bytes  CALL 087A2862 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetAttributesSecurityDescriptor + 18F                              7C95E2FC 383 Bytes  [ C1, E3, 02, 8B, 7D, D0, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZeroHeap + 31                                                      7C95F16C 2 Bytes  [ 30, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZeroHeap + 35                                                      7C95F170 32 Bytes  [ 8B, 49, 50, 8B, 02, 69, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZeroHeap + 59                                                      7C95F194 9 Bytes  [ 88, 8C, 00, 00, 00, 5B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZeroHeap + 63                                                      7C95F19E 36 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlZeroHeap + 88                                                      7C95F1C3 88 Bytes  [ 84, 89, 00, 00, 00, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeChar + 1                                            7C95F3EF 2 Bytes  [ 14, B1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeChar + 4                                            7C95F3F2 49 Bytes  [ 4D, 10, 89, 11, C7, 47, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeChar + 36                                           7C95F424 19 Bytes  [ EC, 83, EC, 10, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDowncaseUnicodeChar + 4A                                           7C95F438 139 Bytes  [ 57, 04, 8B, 5A, 0C, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToAnsiString + 2E                               7C95F4C5 90 Bytes  [ 00, 8B, 9E, 14, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToAnsiString + 89                               7C95F520 3 Bytes  [ 15, 08, 4E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToAnsiString + 8D                               7C95F524 5 Bytes  [ B0, 8B, 45, 08, 5F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToAnsiString + 93                               7C95F52A 22 Bytes  [ C7, 40, 1C, 04, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToAnsiString + AA                               7C95F541 19 Bytes  [ 00, 00, 3B, C3, 0F, 85, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToCountedOemString + F                                7C95F555 1 Byte  [ 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToCountedOemString + 11                               7C95F557 92 Bytes  [ 75, 21, 8B, 4D, 10, 8B, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToCountedOemString + 6E                               7C95F5B4 11 Bytes  JMP 7C95F518 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToCountedOemString + 7B                               7C95F5C1 3 Bytes  [ 00, 3B, C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnicodeStringToCountedOemString + 7F                               7C95F5C5 3 Bytes  [ 85, BB, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToCountedOemString + 16                         7C95F630 42 Bytes  [ 8B, 49, 0C, 8B, 51, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToCountedOemString + 41                         7C95F65B 5 Bytes  [ 8B, 88, 60, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToCountedOemString + 47                         7C95F661 50 Bytes  [ 8B, 45, 10, 89, 08, 8B, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpcaseUnicodeStringToCountedOemString + 7B                         7C95F695 124 Bytes  [ 89, 50, 04, 33, C0, C7, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareString + 14                                                 7C95F712 74 Bytes  [ 90, 17, B0, 8B, F0, 33, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareString + 5F                                                 7C95F75D 1 Byte  [ 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCompareString + 61                                                 7C95F75F 103 Bytes  [ 66, 3B, 93, 84, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUpperString + 36                                                   7C95F7C7 228 Bytes  [ 15, 08, 4E, 15, B0, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindSetBits + 23                                                   7C95F8AC 40 Bytes  [ AF, C8, 89, 8E, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindSetBits + 4C                                                   7C95F8D5 22 Bytes  [ 50, 52, 8D, 45, B4, 50, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindSetBits + 63                                                   7C95F8EC 80 Bytes  [ 00, 8B, 4D, C8, 3B, 48, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindSetBits + B4                                                   7C95F93D 143 Bytes  [ 51, 52, 8D, 45, B4, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindSetBits + 144                                                  7C95F9CD 50 Bytes  [ 00, 8B, 4A, 24, 8B, 55, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearRuns + C                                                  7C95FB46 33 Bytes  [ 4D, 08, 5F, 5E, 8B, C3, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearRuns + 2E                                                 7C95FB68 24 Bytes  [ 8B, 48, 60, 8B, 51, 18, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearRuns + 47                                                 7C95FB81 109 Bytes  [ BE, B8, 00, 00, 00, 57, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearRuns + B5                                                 7C95FBEF 4 Bytes  [ 42, 0C, 8B, 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindClearRuns + BA                                                 7C95FBF4 37 Bytes  [ 53, 56, 8B, 71, 0C, 57, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLongestRunClear + 20                                           7C95FDA1 91 Bytes  [ 1A, 8B, BE, F8, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberOfClearBits + 45                                             7C95FDFD 51 Bytes  [ 55, 08, 89, 4A, 1C, 33, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberOfSetBits + 29                                               7C95FE31 46 Bytes  [ FF, 55, 8B, EC, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsClear + 1                                                   7C95FE60 7 Bytes  [ 81, D4, 00, 00, 00, 85, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsClear + 9                                                   7C95FE68 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsClear + B                                                   7C95FE6A 114 Bytes  [ 75, 08, 0F, B7, 41, 7A, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAreBitsClear + 7E                                                  7C95FEDD 6 Bytes  [ 00, 00, 80, C7, 40, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindNextForwardRunClear + 2                                        7C95FEE4 25 Bytes  [ FF, FF, 7F, C7, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindNextForwardRunClear + 1C                                       7C95FEFE 59 Bytes  [ 43, 83, C0, 10, 41, 3B, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindNextForwardRunClear + 58                                       7C95FF3A 118 Bytes  [ 49, 60, 8B, 51, 18, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindNextForwardRunClear + CF                                       7C95FFB1 11 Bytes  [ BE, AC, 00, 00, 00, 83, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindNextForwardRunClear + DB                                       7C95FFBD 12 Bytes  [ 8B, 5A, 04, 89, 5F, 04, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLastBackwardRunClear + 6                                       7C95FFE2 2 Bytes  [ 55, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLastBackwardRunClear + 9                                       7C95FFE5 32 Bytes  [ C2, 1C, 8B, 1A, 89, 1F, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLastBackwardRunClear + 2A                                      7C960006 363 Bytes  [ 89, 57, 14, BA, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLeastSignificantBit + 1B                                       7C960172 6 Bytes  [ 55, 8B, EC, 83, EC, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLeastSignificantBit + 22                                       7C960179 80 Bytes  [ 4D, 08, 8B, 49, 60, 8B, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLeastSignificantBit + 73                                       7C9601CA 1 Byte  [ 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLeastSignificantBit + 75                                       7C9601CC 46 Bytes  [ 6A, 00, 8D, 81, B8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFindLeastSignificantBit + A4                                       7C9601FB 57 Bytes  [ 00, 00, 8B, 17, 8B, 4F, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert2 + 2                                                        7C960235 17 Bytes  [ 15, 10, 4E, 15, B0, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert2 + 14                                                       7C960247 295 Bytes  [ 83, BC, 00, 00, 00, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert2 + 13D                                                      7C960370 162 Bytes  [ 85, C0, 8B, 86, BC, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert2 + 1E1                                                      7C960414 34 Bytes  [ 00, 8B, 91, C8, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert2 + 204                                                      7C960437 13 Bytes  [ 85, D2, 74, 7B, 8B, 81, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert + 4                                                         7C960445 74 Bytes  [ 45, 10, 8B, 50, 18, 52, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert + 4F                                                        7C960490 14 Bytes  [ FF, 15, 04, 4E, 15, B0, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlAssert + 5E                                                        7C96049F 32 Bytes  [ 01, 00, 00, 00, FF, 15, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDebugPrintTimes + 1D                                               7C9604C1 263 Bytes  [ C0, 5B, 5D, C2, 0C, 00, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimerQueueEx + 70                                            7C9605C9 53 Bytes  [ 8B, 55, 08, B8, 10, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimerQueueEx + A6                                            7C9605FF 103 Bytes  [ 42, 0C, C7, 40, 44, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimerQueue + 7                                               7C960668 2 Bytes  [ 8D, 46 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteTimerQueue + A                                               7C96066B 168 Bytes  [ 50, 8B, 47, 34, 6A, 00, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkFrameChain + 42                                                7C960714 97 Bytes  [ 83, CC, 50, 00, 00, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkFrameChain + A4                                                7C960776 82 Bytes  [ 35, 10, 4E, 15, B0, 8B, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkFrameChain + F7                                                7C9607C9 108 Bytes  [ 00, 8B, FB, F3, AB, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkFrameChain + 164                                               7C960836 42 Bytes  [ 00, 74, 16, 8B, 4E, 58, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackContext + 18                                           7C960861 11 Bytes  [ C0, 0F, 84, 3E, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackContext + 25                                           7C96086E 22 Bytes  [ 81, C6, 00, 01, 00, 00, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackContext + 3C                                           7C960885 11 Bytes  [ FC, 0F, 8C, 21, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackContext + 48                                           7C960891 7 Bytes  [ 30, B9, 04, 00, 00, 00, BF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackContext + 50                                           7C960899 10 Bytes  [ 90, 17, B0, 8B, F0, 33, D2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCaptureStackBackTrace + E                                          7C960957 268 Bytes  [ 18, C7, 43, 60, 07, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerToChar + 19                                            7C960A65 45 Bytes  [ 18, 0F, B7, 42, 02, C1, E6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerToChar + 48                                            7C960A94 19 Bytes  [ 00, FF, 15, F4, 4D, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerToChar + 5D                                            7C960AA9 107 Bytes  [ FF, 15, F4, 4D, 15, B0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerToChar + C9                                            7C960B15 33 Bytes  [ 45, 08, 68, 84, 76, 17, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerToChar + EB                                            7C960B37 115 Bytes  [ 51, 30, 8B, 45, 10, 89, 43, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInt64ToUnicodeString + 42                                          7C960E5B 4 Bytes  [ 00, F6, 46, 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInt64ToUnicodeString + 47                                          7C960E60 284 Bytes  [ 0F, 85, BF, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryTimeZoneInformation + 64                                      7C960F7D 60 Bytes  [ 00, 00, 00, 83, FB, 02, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryTimeZoneInformation + A1                                      7C960FBA 41 Bytes  [ E0, 83, 48, 40, 08, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryTimeZoneInformation + CB                                      7C960FE4 157 Bytes  [ 8B, F0, 3B, 77, 20, 74, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetTimeZoneInformation + 41                                        7C961082 40 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetTimeZoneInformation + 6A                                        7C9610AB 38 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetTimeZoneInformation + 91                                        7C9610D2 21 Bytes  [ 69, 7A, 65, 43, 72, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetTimeZoneInformation + A7                                        7C9610E8 8 Bytes  [ 70, 69, 6E, 43, 6F, 75, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetTimeZoneInformation + B0                                        7C9610F1 254 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlProtectHeap + 96                                                   7C9611F0 172 Bytes  [ 6C, 65, 6D, 65, 6E, 74, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlProtectHeap + 143                                                  7C96129D 144 Bytes  [ 6C, 49, 6E, 74, 65, 72, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserFlagsHeap + 71                                              7C96132E 16 Bytes  [ 52, 74, 6C, 49, 70, 76, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserFlagsHeap + 82                                              7C96133F 106 Bytes  [ 64, 72, 65, 73, 73, 41, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserFlagsHeap + ED                                              7C9613AA 51 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserFlagsHeap + 121                                             7C9613DE 23 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetUserFlagsHeap + 139                                             7C9613F6 260 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryTagHeap + EE                                                  7C9614FB 161 Bytes  [ 6C, 49, 73, 54, 68, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendHeap + 2C                                                    7C96159D 439 Bytes  [ 52, 74, 6C, 4C, 61, 72, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendHeap + 1E4                                                   7C961755 23 Bytes  [ 61, 74, 75, 73, 00, 52, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExtendHeap + 1FC                                                   7C96176D 221 Bytes  [ 52, 74, 6C, 4D, 6F, 76, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumProcessHeaps + 1A                                              7C96184B 153 Bytes  [ 4D, 75, 6C, 74, 69, 70, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkHeap + 2C                                                      7C9618E5 70 Bytes  [ 6C, 4E, 75, 6D, 62, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkHeap + 73                                                      7C96192C 70 Bytes  [ 52, 74, 6C, 4F, 65, 6D, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkHeap + BA                                                      7C961973 20 Bytes  [ 52, 74, 6C, 4F, 70, 65, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkHeap + CF                                                      7C961988 90 Bytes  [ 6C, 50, 63, 54, 6F, 46, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlWalkHeap + 12A                                                     7C9619E3 68 Bytes  [ 6C, 50, 72, 6F, 74, 65, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlQueryHeapInformation + 48                                          7C96218B 179 Bytes  [ 52, 74, 6C, 53, 75, 62, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateHeap + 8F                                                  7C96223F 5 Bytes  [ 69, 65, 6C, 64, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateHeap + 95                                                  7C962245 134 Bytes  [ 52, 74, 6C, 54, 72, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateHeap + 11C                                                 7C9622CC 70 Bytes  [ 52, 74, 6C, 54, 72, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateHeap + 163                                                 7C962313 166 Bytes  [ 69, 6F, 6E, 00, 52, 74, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateHeap + 20A                                                 7C9623BA 163 Bytes  [ 72, 69, 6E, 67, 54, 6F, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlValidateProcessHeaps + 8B                                          7C96245E 75 Bytes  [ 69, 42, 79, 74, 65, 53, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUsageHeap + 2A                                                     7C9624AA 37 Bytes  [ 52, 74, 6C, 55, 6E, 6C, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUsageHeap + 50                                                     7C9624D0 43 Bytes  [ 52, 74, 6C, 55, 70, 63, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUsageHeap + 7C                                                     7C9624FC 534 Bytes  [ 52, 74, 6C, 55, 70, 63, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUsageHeap + 293                                                    7C962713 27 Bytes  [ 52, 74, 6C, 5A, 6F, 6D, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUsageHeap + 2AF                                                    7C96272F 78 Bytes  [ 52, 74, 6C, 70, 41, 70, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDecompressBuffer + F                                               7C962AD0 35 Bytes  [ 5A, 77, 43, 6C, 65, 61, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDecompressBuffer + 33                                              7C962AF4 22 Bytes  [ 64, 69, 74, 41, 6C, 61, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDecompressBuffer + 4A                                              7C962B0B 120 Bytes  [ 5A, 77, 43, 6F, 6D, 70, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDecompressFragment + 57                                            7C962B84 207 Bytes  [ 5A, 77, 43, 72, 65, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDecompressFragment + 127                                           7C962C54 99 Bytes  [ 77, 43, 72, 65, 61, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeCrc32 + 2F                                                  7C962CB8 250 Bytes  [ 65, 61, 74, 65, 53, 79, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeCrc32 + 12A                                                 7C962DB3 175 Bytes  [ 6E, 74, 72, 6F, 6C, 46, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeCrc32 + 1DA                                                 7C962E63 59 Bytes  [ 6C, 74, 65, 72, 54, 6F, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeCrc32 + 216                                                 7C962E9F 378 Bytes  [ 63, 68, 65, 00, 5A, 77, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlComputeCrc32 + 391                                                 7C96301A 1 Byte  [ 4C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateBootStatusDataFile + 16                                      7C9630DB 390 Bytes  [ 5A, 77, 4D, 61, 70, 56, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateBootStatusDataFile + 19D                                     7C963262 17 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateBootStatusDataFile + 1AF                                     7C963274 19 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateBootStatusDataFile + 1C3                                     7C963288 203 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetCurrentEnvironment + B7                                         7C963354 63 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlExitUserThread + 19                                                7C963394 99 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeUserThreadStack + 53                                           7C9633F8 95 Bytes  [ 65, 72, 79, 46, 75, 6C, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeUserThreadStack + B3                                           7C963458 73 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeUserThreadStack + FD                                           7C9634A2 381 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeUserThreadStack + 27B                                          7C963620 47 Bytes  [ 6E, 76, 69, 72, 6F, 6E, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFreeUserThreadStack + 2AB                                          7C963650 419 Bytes  [ 72, 79, 53, 79, 73, 74, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSystemVolumeInformationFolder + 60                           7C9638EC 99 Bytes  [ 72, 65, 43, 6F, 6E, 6E, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSystemVolumeInformationFolder + C4                           7C963950 8 Bytes  [ 61, 75, 6C, 74, 48, 61, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSystemVolumeInformationFolder + CD                           7C963959 56 Bytes  [ 72, 72, 6F, 72, 50, 6F, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSystemVolumeInformationFolder + 106                          7C963992 203 Bytes  [ 61, 46, 69, 6C, 65, 00, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlCreateSystemVolumeInformationFolder + 1D2                          7C963A5E 6 Bytes  [ 5A, 77, 53, 65, 74, 49 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSecondsSince1980ToTime + 20                                        7C963B0C 452 Bytes  [ 75, 6F, 74, 61, 49, 6E, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetElementGenericTable + 5B                                        7C963CD1 13 Bytes  [ 65, 54, 68, 72, 65, 61, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetElementGenericTable + 69                                        7C963CDF 586 Bytes  [ 41, 6C, 65, 72, 74, 00, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTable + 22B                                        7C963F2A 3 Bytes  [ 6F, 61, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTable + 22F                                        7C963F2E 62 Bytes  [ 69, 74, 6F, 77, 00, 5F, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTable + 26E                                        7C963F6D 19 Bytes  [ 5F, 73, 70, 6C, 69, 74, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTable + 282                                        7C963F81 54 Bytes  [ 5F, 73, 74, 72, 69, 63, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTable + 2B9                                        7C963FB8 24 Bytes  [ 69, 36, 34, 74, 6F, 61, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetElementGenericTableAvl + 2A                                     7C964093 41 Bytes  [ 69, 73, 73, 70, 61, 63, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetElementGenericTableAvl + 54                                     7C9640BD 161 Bytes  [ 00, 69, 73, 77, 6C, 6F, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlNumberGenericTableElementsAvl + 21                                 7C96415F 99 Bytes  [ 73, 74, 72, 6C, 65, 6E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInsertElementGenericTableAvl + 18                                  7C9641C3 39 Bytes  [ 70, 70, 65, 72, 00, 74, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlDeleteElementGenericTableAvl + D                                   7C9641EB 205 Bytes  [ 72, 69, 6E, 74, 45, 78, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableLikeADirectory + 51                           7C9642B9 111 Bytes  [ 12, C2, 2C, 00, 90, B8, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlEnumerateGenericTableLikeADirectory + C1                           7C964329 15 Bytes  [ 12, C2, 18, 00, 90, B8, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTableAvl + 2                                   7C964339 25 Bytes  [ 12, C2, 18, 00, 90, B8, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLookupElementGenericTableAvl + 1C                                  7C964353 126 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFlushSecureMemoryCache + 3E                                        7C9643D2 195 Bytes  [ 00, BA, 00, 03, FE, 7F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFlushSecureMemoryCache + 102                                       7C964496 26 Bytes  [ FE, 7F, FF, 12, C2, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFlushSecureMemoryCache + 11E                                       7C9644B2 115 Bytes  [ 00, BA, 00, 03, FE, 7F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFlushSecureMemoryCache + 192                                       7C964526 85 Bytes  [ FE, 7F, FF, 12, C2, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlFlushSecureMemoryCache + 1E8                                       7C96457C 16 Bytes  [ 00, 90, B8, 30, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsNameLegalDOS8Dot3 + 32                                           7C9646B3 41 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsNameLegalDOS8Dot3 + 5C                                           7C9646DD 51 Bytes  [ 90, B8, 46, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsNameLegalDOS8Dot3 + 90                                           7C964711 11 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsNameLegalDOS8Dot3 + 9C                                           7C96471D 39 Bytes  [ 90, B8, 4A, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIsNameLegalDOS8Dot3 + C4                                           7C964745 119 Bytes  [ 03, FE, 7F, FF, 12, C2, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGenerate8dot3Name + 33                                             7C964835 13 Bytes  [ 03, FE, 7F, FF, 12, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGenerate8dot3Name + 41                                             7C964843 63 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGenerate8dot3Name + 81                                             7C964883 24 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGenerate8dot3Name + 9A                                             7C96489C 25 Bytes  [ 00, 90, B8, 62, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGenerate8dot3Name + B4                                             7C9648B6 30 Bytes  [ FE, 7F, FF, 12, C2, 0C, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLastNtStatus + 4                                                7C964BF3 1 Byte  [ BA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLastNtStatus + 6                                                7C964BF5 8 Bytes  [ 03, FE, 7F, FF, 12, C2, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlGetLastNtStatus + F                                                7C964BFE 22 Bytes  [ B8, 98, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus + 14                      7C964C15 5 Bytes  [ 03, FE, 7F, FF, 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus + 1A                      7C964C1B 1 Byte  [ 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus + 1D                      7C964C1E 14 Bytes  [ B8, 9A, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoteCall + B                                                     7C964C2D 27 Bytes  [ 90, B8, 9B, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoteCall + 27                                                    7C964C49 15 Bytes  [ 12, C2, 14, 00, 90, B8, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoteCall + 37                                                    7C964C59 11 Bytes  [ 12, C2, 04, 00, 90, B8, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoteCall + 43                                                    7C964C65 13 Bytes  [ 03, FE, 7F, FF, 12, C2, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRemoteCall + 51                                                    7C964C73 5 Bytes  [ BA, 00, 03, FE, 7F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedFlushSList + 2E                                         7C964DBD 31 Bytes  [ 90, B8, B4, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedFlushSList + 4E                                         7C964DDD 3 Bytes  [ 90, B8, B6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedFlushSList + 52                                         7C964DE1 28 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedFlushSList + 6F                                         7C964DFE 2 Bytes  [ B8, B8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInterlockedFlushSList + 72                                         7C964E01 3 Bytes  [ 00, 00, BA ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeStackTraceDataBase + 11                                  7C964E82 27 Bytes  [ 00, BA, 00, 03, FE, 7F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeStackTraceDataBase + 2D                                  7C964E9E 47 Bytes  [ B8, C2, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeStackTraceDataBase + 5D                                  7C964ECE 15 Bytes  [ B8, C5, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeStackTraceDataBase + 6D                                  7C964EDE 18 Bytes  [ B8, C6, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlInitializeStackTraceDataBase + 80                                  7C964EF1 43 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringA + 1E                                          7C965061 17 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringA + 30                                          7C965073 1 Byte  [ BA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringA + 32                                          7C965075 7 Bytes  [ 03, FE, 7F, FF, 12, C2, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringA + 3A                                          7C96507D 147 Bytes  [ 90, B8, E0, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringA + CE                                          7C965111 31 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExA + 24                                        7C965293 14 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExA + 34                                        7C9652A3 65 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExA + 76                                        7C9652E5 87 Bytes  [ 03, FE, 7F, FF, 12, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExA + CE                                        7C96533D 5 Bytes  [ 90, B8, 0C, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExA + D4                                        7C965343 1 Byte  [ BA ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringA + 18                                          7C96536D 4 Bytes  [ 90, B8, 0F, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringA + 1E                                          7C965373 8 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4AddressToStringA + 27                                          7C96537C 254 Bytes  [ 00, 90, B8, 10, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringW + 32                                          7C96547B 9 Bytes  [ 00, F0, 7F, 8D, 54, 24, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringW + 3C                                          7C965485 7 Bytes  [ 00, F0, 7F, 0F, 84, 9D, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringW + 45                                          7C96548E 280 Bytes  CALL 7C965696 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringW + 15E                                         7C9655A7 200 Bytes  [ 0F, 85, F7, FE, FF, FF, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringW + 227                                         7C965670 14 Bytes  [ 83, CA, 7F, 66, 89, 54, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExW + 2F                                        7C9656E0 48 Bytes  [ F0, 7F, 3D, 00, 00, F0, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExW + 60                                        7C965711 21 Bytes  [ E0, 20, 74, 0C, B8, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExW + 76                                        7C965727 90 Bytes  [ EC, 08, DD, 14, 24, 8B, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6AddressToStringExW + D3                                        7C965784 92 Bytes  [ 5A, C3, D9, 2C, 24, 5A, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressA + 3D                                          7C9657E2 16 Bytes  [ 00, 00, 00, 00, F0, 3F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressA + 4F                                          7C9657F4 31 Bytes  [ 00, 00, 10, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressA + 70                                          7C965815 188 Bytes  [ 00, 00, 00, 55, 8B, EC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressA + 12E                                         7C9658D3 9 Bytes  [ 89, 5C, 24, 08, C7, 44, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressA + 139                                         7C9658DE 26 Bytes  CALL 7C965946 C:\WINDOWS\system32\ntdll.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExA + 55                                        7C965B19 16 Bytes  [ FF, FF, 8D, 0D, 10, E0, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExA + 66                                        7C965B2A 16 Bytes  [ FF, A9, 00, 00, 00, 80, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExA + 77                                        7C965B3B 131 Bytes  [ 75, 1D, 83, 7C, 24, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExA + FB                                        7C965BBF 55 Bytes  [ 3A, C2, 74, 15, 84, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExA + 133                                       7C965BF7 27 Bytes  [ 74, 17, 8A, 66, FF, 83, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExA + 24                                        7C965D25 55 Bytes  [ C3, 8B, 4D, F0, 64, 89, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExA + 5D                                        7C965D5E 20 Bytes  [ 89, 45, F8, 8B, 45, 10, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExA + 72                                        7C965D73 5 Bytes  [ 53, E8, 03, 9B, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExA + 78                                        7C965D79 50 Bytes  [ 83, C4, 04, 0B, C0, 74, 7B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv4StringToAddressExA + AB                                        7C965DAC 76 Bytes  CALL 7C965E3D C:\WINDOWS\system32\ntdll.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressW + 68                                          7C965F02 18 Bytes  [ 00, 00, 00, 83, C4, 10, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressW + 7B                                          7C965F15 140 Bytes  [ 81, 79, 04, 41, EA, 90, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressW + 108                                         7C965FA2 22 Bytes  [ 0F, B7, 07, 50, FF, 77, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressW + 11F                                         7C965FB9 30 Bytes  [ 8B, F8, 3B, FB, 0F, 8C, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressW + 13E                                         7C965FD8 78 Bytes  [ 85, FF, 8B, 4D, 08, 8B, 1D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExW + 4                                         7C96619C 39 Bytes  [ C3, 5B, 8B, E5, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExW + 2C                                        7C9661C4 73 Bytes  [ 0C, 85, DB, 56, 57, 8B, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExW + 76                                        7C96620E 39 Bytes  [ 00, 85, C0, 89, 75, F4, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExW + 9E                                        7C966236 70 Bytes  [ 00, 8D, 47, 04, 89, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlIpv6StringToAddressExW + E5                                        7C96627D 72 Bytes  [ CB, 2B, CA, 8B, 55, 0C, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerDivide + 30                                            7C96642B 145 Bytes  [ 10, 4A, D8, 0D, F8, 63, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerDivide + C3                                            7C9664BE 9 Bytes  [ 00, 00, D9, 04, 01, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerDivide + CD                                            7C9664C8 22 Bytes  [ FF, 7F, D9, 5D, 08, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerDivide + E4                                            7C9664DF 23 Bytes  [ 55, F4, 89, 10, 8B, 55, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlLargeIntegerDivide + FD                                            7C9664F8 97 Bytes  [ 85, C0, 75, 76, 8D, 0C, 36, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRaiseStatus + 1                                                    7C966643 2 Bytes  [ 4D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRaiseStatus + 4                                                    7C966646 124 Bytes  [ 81, B8, 00, 00, 00, 8B, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandom + 52                                                        7C9666C3 205 Bytes  [ 2B, F1, DB, 04, 38, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandom + 120                                                       7C966791 1 Byte  [ 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandom + 122                                                       7C966793 1 Byte  [ 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandom + 124                                                       7C966795 43 Bytes  [ 14, 8B, 47, 20, 81, FB, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlRandom + 150                                                       7C9667C1 31 Bytes  [ 00, 89, 5F, 18, DB, 5D, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseEnumerate + 1                                         7C96689D 2 Bytes  [ 56, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseEnumerate + 4                                         7C9668A0 25 Bytes  [ 4E, 28, 8B, 46, 20, 89, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseEnumerate + 1E                                        7C9668BA 38 Bytes  [ 56, 14, BB, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseEnumerate + 45                                        7C9668E1 9 Bytes  [ 8B, 7D, 08, 8B, 5E, 08, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseEnumerate + 4F                                        7C9668EB 14 Bytes  [ 16, 8D, 43, FF, C1, E1, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseCreate + 32                                           7C966956 15 Bytes  [ 00, 7C, 28, 8B, 7E, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseCreate + 42                                           7C966966 3 Bytes  [ 04, D7, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseCreate + 46                                           7C96696A 1 Byte  [ 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseCreate + 48                                           7C96696C 20 Bytes  [ 4C, D7, 04, 42, 3B, D0, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseCreate + 5D                                           7C966981 78 Bytes  [ DE, C1, 89, 5E, 18, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseValidate + 15                                         7C966AC8 122 Bytes  [ 16, 8D, 43, FF, C1, E1, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseFind + 46                                             7C966B43 98 Bytes  [ 46, 20, 89, 04, D7, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseFind + A9                                             7C966BA6 25 Bytes  [ 45, 08, 53, 8B, 58, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseFind + C3                                             7C966BC0 103 Bytes  CALL 7C96543E C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseFind + 12B                                            7C966C28 157 Bytes  CALL 7C96543C C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseFind + 1C9                                            7C966CC6 28 Bytes  [ 8B, 40, 08, 57, 8B, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseUnlock + 2                                            7C966CE3 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseUnlock + 4                                            7C966CE5 42 Bytes  [ 45, 08, 57, 53, 50, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseAdd + 1F                                              7C966D10 49 Bytes  [ 15, 5C, 4D, 15, B0, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseAdd + 51                                              7C966D42 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseAdd + 53                                              7C966D44 11 Bytes  [ 33, FF, 85, C0, 76, 5D, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseAdd + 5F                                              7C966D50 129 Bytes  [ 8B, 4D, 08, D9, 04, B9, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlTraceDatabaseAdd + E1                                              7C966DD2 26 Bytes  [ 55, 8B, EC, 51, 8B, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter2 + 6B                                     7C966F70 42 Bytes  CALL 7C96543D C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter2 + 96                                     7C966F9B 123 Bytes  [ FF, 0F, BF, D0, 01, 17, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter2 + 112                                    7C967017 8 Bytes  [ 8B, 89, A4, 00, 00, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter2 + 11B                                    7C967020 3 Bytes  [ 1C, E4, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter2 + 11F                                    7C967024 12 Bytes  [ 8B, 55, 08, 8B, 82, A8, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter + 44                                      7C9678CB 86 Bytes  [ DE, C9, D9, 02, D8, 21, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter + 9C                                      7C967923 20 Bytes  [ 83, C7, 20, 83, C2, 0C, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlUnhandledExceptionFilter + B3                                      7C96793A 22 Bytes  [ 5E, 5B, 8D, 4D, D4, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtCreateKey + 6                                                   7C967951 209 Bytes  [ FF, 55, 8B, EC, 83, EC, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtMakeTemporaryKey + 7F                                           7C967A23 32 Bytes  [ 89, 7D, F0, 89, 7D, EC, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtMakeTemporaryKey + A0                                           7C967A44 22 Bytes  [ 15, F0, D6, 15, B0, D9, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtMakeTemporaryKey + B8                                           7C967A5C 305 Bytes  [ 00, 8D, 49, 00, 85, 34, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtMakeTemporaryKey + 1EA                                          7C967B8E 175 Bytes  [ 4D, 0C, DD, D8, 8B, 45, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!RtlpNtMakeTemporaryKey + 29A                                          7C967C3E 17 Bytes  [ 45, FC, 8D, 14, 98, 89, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!isupper + 20                                                          7C97130C 42 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!islower + 18                                                          7C971337 290 Bytes  [ 00, 00, 80, D3, EB, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!isprint + 32                                                          7C97145A 37 Bytes  [ C2, 0C, 00, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!isgraph + 20                                                          7C971480 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!isgraph + 23                                                          7C971483 13 Bytes  [ 40, 04, 51, 52, 50, E8, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!isgraph + 31                                                          7C971491 76 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__iscsymf + 1                                                         7C9714DE 24 Bytes  [ 3E, C7, 45, E4, CC, 1A, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__iscsymf + 1B                                                        7C9714F8 12 Bytes  [ 85, C0, 89, 75, F0, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__iscsymf + 28                                                        7C971505 33 Bytes  [ 86, 82, 00, 00, 00, 53, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!__iscsym + 4                                                          7C971527 168 Bytes  [ 46, 0C, 89, 5E, 04, 89, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_atoi64 + 67                                                          7C9715D0 32 Bytes  [ 78, 08, 02, 0F, 94, C3, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_atoi64 + 88                                                          7C9715F1 72 Bytes  [ B7, B1, 52, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_ltoa + 14                                                            7C97163A 352 Bytes  [ 75, F8, 75, 07, B9, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_ultow + 30                                                           7C97179B 17 Bytes  [ 9C, 01, 58, 51, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_ultow + 42                                                           7C9717AD 136 Bytes  [ 00, 8B, 88, 20, 52, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_i64tow + 2F                                                          7C971836 23 Bytes  [ 88, B8, 50, 00, 00, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_ui64tow + 10                                                         7C97184F 66 Bytes  [ 8B, 4D, F8, 85, C9, BF, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_lfind + 31                                                           7C971892 104 Bytes  [ 88, 20, 52, 00, 00, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_snprintf + 51                                                        7C9718FB 91 Bytes  [ 00, 8B, 88, 20, 52, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_splitpath + 4F                                                       7C971957 15 Bytes  [ 00, C1, E1, 05, 89, 94, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_splitpath + 60                                                       7C971968 79 Bytes  [ C1, E2, 05, B9, 80, 30, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_splitpath + B0                                                       7C9719B8 13 Bytes  [ C1, E2, 05, 89, 8C, 02, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_splitpath + C0                                                       7C9719C8 2 Bytes  [ 4D, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_splitpath + C3                                                       7C9719CB 112 Bytes  [ C9, 0F, 84, C8, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_strlwr + 24                                                          7C971A74 62 Bytes  [ 00, 8B, 88, 20, 52, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_tolower + 9                                                          7C971AB3 34 Bytes  [ 79, 0E, 10, 74, 05, BB, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!tolower + 1A                                                          7C971AD6 58 Bytes  [ 00, C1, E1, 05, 8B, BC, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnwprintf + 8                                                       7C971B11 6 Bytes  [ 52, 00, 00, C1, E1, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnwprintf + F                                                       7C971B18 47 Bytes  [ 84, 01, 64, 51, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnwprintf + 40                                                      7C971B49 14 Bytes  [ 8B, 90, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnwprintf + 50                                                      7C971B59 20 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_vsnwprintf + 65                                                      7C971B6E 17 Bytes  [ 00, 41, 5F, 89, 88, 20, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wcsupr + 1                                                           7C971B80 54 Bytes  [ E5, 5D, C2, 04, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtoi + 2                                                             7C971BB7 102 Bytes  [ A1, 98, 90, 17, B0, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!_wtoi64 + 59                                                          7C971C1E 67 Bytes  [ 0D, 24, 90, 17, B0, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!abs                                                                   7C971C62 5 Bytes  [ 17, B0, 89, 4D, AC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!abs + 6                                                               7C971C68 10 Bytes  [ 0D, 00, 90, 17, B0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!abs + 11                                                              7C971C73 117 Bytes  [ 17, B0, 89, 4D, C4, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!fabs + 72                                                             7C971CE9 14 Bytes  [ 2F, 00, 6A, 00, 52, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!fabs + 81                                                             7C971CF8 55 Bytes  [ 90, 0F, 85, B5, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswalpha + 1                                                          7C971D30 7 Bytes  [ 37, 3B, F7, C7, 83, 90, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswalpha + A                                                          7C971D39 44 Bytes  [ 01, 00, 00, 00, 74, 72, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswxdigit + 4                                                         7C971D66 3 Bytes  [ 86, A4, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswxdigit + 9                                                         7C971D6B 18 Bytes  [ 8B, 53, 50, 89, 50, 3C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!iswspace + 1                                                          7C971D7E 91 Bytes  [ 86, 48, 01, 00, 00, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sscanf + 45                                                           7C971DDA 35 Bytes  [ 5D, 08, 56, 57, 83, C3, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sscanf + 6A                                                           7C971DFF 91 Bytes  [ 00, 8B, 33, 3B, F3, 74, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sscanf + C7                                                           7C971E5C 16 Bytes  [ 8B, 40, 24, 8D, 14, 80, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sscanf + D9                                                           7C971E6E 48 Bytes  [ 8B, B6, 28, 01, 00, 00, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!sscanf + 10A                                                          7C971E9F 100 Bytes  [ 85, D0, 00, 00, 00, 8B, 88, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!strtol + 9                                                            7C971F93 53 Bytes  [ F8, 0F, 84, B1, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!towupper + 1                                                          7C971FC9 22 Bytes  [ 48, 0C, 85, C9, 75, 1C, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vsprintf + 4                                                          7C971FE0 79 Bytes  [ 0C, 8E, 89, 08, BE, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!vsprintf + 54                                                         7C972030 22 Bytes  [ 0C, 8B, 89, 08, C7, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcspbrk + D                                                           7C972047 269 Bytes  [ 55, FF, FF, FF, 8B, 4F, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstombs + 84                                                         7C972155 113 Bytes  [ 45, 08, 3B, 18, 72, C5, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstombs + F6                                                         7C9721C7 31 Bytes  [ 75, 08, 85, F6, 74, 58, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstombs + 116                                                        7C9721E7 9 Bytes  [ 00, 00, 00, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstombs + 121                                                        7C9721F2 231 Bytes  [ 00, 85, C0, 74, 0F, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ntdll.dll!wcstombs + 209                                                        7C9722DA 23 Bytes  [ F8, 8B, 45, 14, 89, 51, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + FFF821DF                             7C801621 22 Bytes  CALL 7C7EF0BC 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeviceIoControl + 13                                               7C801638 4 Bytes  [ 8D, B0, 78, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeviceIoControl + 19                                               7C80163E 68 Bytes  [ 89, B5, 7C, FF, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeviceIoControl + 5F                                               7C801684 72 Bytes  [ 00, 8D, 97, 5C, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeviceIoControl + A8                                               7C8016CD 132 Bytes  [ D0, 66, A9, FF, FF, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeviceIoControl + 12D                                              7C801752 166 Bytes  [ 0F, 84, 91, BA, 00, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAsFileTime + 14                                       7C8017F9 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAsFileTime + 17                                       7C8017FC 32 Bytes  CALL FD3E2719 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFile + F                                                       7C80181D 11 Bytes  [ D0, 66, A9, FF, FF, 74, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFile + 1C                                                      7C80182A 24 Bytes  [ 74, B7, 0F, BE, 82, 48, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFile + 35                                                      7C801843 1 Byte  [ F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFile + 37                                                      7C801845 22 Bytes  [ FF, 89, 45, F8, 56, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFile + 4E                                                      7C80185C 50 Bytes  [ 85, C0, 0F, 84, 38, D3, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileA + 6                                                    7C801A2A 64 Bytes  [ 73, 04, 8D, 45, EC, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualProtectEx + E                                               7C801A6B 5 Bytes  [ 01, 5F, 5B, 8A, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualProtectEx + 14                                              7C801A71 29 Bytes  [ 5E, C9, C2, 08, 00, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualProtectEx + 32                                              7C801A8F 42 Bytes  [ FC, 57, 8D, 45, F8, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualProtectEx + 5D                                              7C801ABA 214 Bytes  [ 0F, 84, 10, 5A, 02, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExW + A0                                                7C801B91 92 Bytes  [ 0C, 89, 30, 8B, 45, FC, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExW + FD                                                7C801BEE 10 Bytes  [ 00, 8B, 48, 40, 85, C9, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExW + 108                                               7C801BF9 4 Bytes  [ 00, 83, 78, 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExW + 10D                                               7C801BFE 68 Bytes  [ 0F, 84, 2C, B7, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExW + 152                                               7C801C43 79 Bytes  [ FD, FF, 33, FF, 3B, F7, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExA + 6                                                 7C801D55 17 Bytes  [ FF, 48, 0F, 85, FF, 57, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryExA + 18                                                7C801D67 34 Bytes  [ 8B, 1B, 83, FB, FF, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryA + 13                                                  7C801D8A 15 Bytes  JMP 7C8274D9 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryA + 24                                                  7C801D9B 19 Bytes  [ 01, 8D, 45, F4, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryA + 39                                                  7C801DB0 93 Bytes  [ 00, 33, FF, 57, 57, 57, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryA + 97                                                  7C801E0E 31 Bytes  [ F0, 39, 7D, F0, 0F, 85, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateProcess + 18                                              7C801E2E 96 Bytes  [ 80, F9, 4C, 0F, 84, 6C, EA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoW + 3F                                               7C801E8F 49 Bytes  [ 85, 34, FF, FF, FF, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoW + 71                                               7C801EC1 61 Bytes  [ 51, 8B, 40, 30, FF, 70, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoA + 12                                               7C801F00 32 Bytes  [ 00, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoA + 33                                               7C801F21 35 Bytes  [ 8B, F8, 89, 7D, E4, 85, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoA + 57                                               7C801F45 162 Bytes  [ C8, 83, E1, 03, F3, A4, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoA + FA                                               7C801FE8 174 Bytes  JMP 7C7F3A84 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStartupInfoA + 1A9                                              7C802097 130 Bytes  [ 3F, 66, 85, FF, 0F, 84, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProcessMemory + 2E                                            7C80223D 62 Bytes  [ 89, 45, D4, 83, 4D, D4, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProcessMemory + 6D                                            7C80227C 174 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProcessMemory + 11C                                           7C80232B 17 Bytes  CALL FD3E3248 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessW + B                                                 7C80233D 17 Bytes  [ 0F, B6, C4, 0F, BE, 80, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessW + 1D                                                7C80234F 72 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessA + 31                                                7C802398 73 Bytes  [ 00, 37, DF, C8, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SleepEx + 46                                                       7C8023E2 42 Bytes  [ 31, 8B, 40, 30, 6A, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SleepEx + 71                                                       7C80240D 59 Bytes  JMP 7C7F6D7A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Sleep + 7                                                          7C802449 11 Bytes  [ 7E, 03, 33, C0, 40, 5D, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Sleep + 13                                                         7C802455 3 Bytes  [ 25, 00, F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Sleep + 18                                                         7C80245A 56 Bytes  JMP 7C7FC222 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Sleep + 51                                                         7C802493 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Sleep + 53                                                         7C802495 6 Bytes  [ 83, 60, 04, 00, 5D, C2 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReleaseMutex + 40                                                  7C8024E7 16 Bytes  [ 8D, E0, FD, FF, FF, 74, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReleaseMutex + 51                                                  7C8024F8 238 Bytes  CALL 688024FA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForSingleObjectEx + A8                                         7C8025E8 5 Bytes  [ FF, B5, C4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForSingleObjectEx + AE                                         7C8025EE 12 Bytes  [ 8D, 85, D4, FD, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForSingleObjectEx + BC                                         7C8025FC 70 Bytes  [ 8D, 85, EC, FD, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForSingleObjectEx + 103                                        7C802643 39 Bytes  [ 85, FF, 74, 46, 66, 8B, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForSingleObjectEx + 1004                                       7C803544 42 Bytes  [ 00, C0, EB, F3, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTickCount + 22                                                  7C8092DA 40 Bytes  [ F0, FF, 35, F0, 1E, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTickCount + 4E                                                  7C809306 72 Bytes  [ 90, 90, 2C, 65, 19, E2, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTickCount + 97                                                  7C80934F 27 Bytes  [ 00, 8B, C8, 33, D2, BF, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTickCount + B3                                                  7C80936B 10 Bytes  CALL 0878BE72 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTickCount + BE                                                  7C809376 95 Bytes  [ D2, BB, 90, 01, 00, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileMappingW + 2C                                            7C8093D6 81 Bytes  [ 6A, 3C, 89, 55, 0C, 33, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileMappingW + 7F                                            7C809429 353 Bytes  [ 00, 00, 00, 00, 00, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjectsEx + 47                                      7C80958D 10 Bytes  [ 53, 33, D2, 56, 8B, C1, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjectsEx + 52                                      7C809598 14 Bytes  [ F7, F6, 33, D2, 57, BF, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjectsEx + 62                                      7C8095A8 88 Bytes  [ F0, 69, C0, 4F, C5, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjectsEx + BB                                      7C809601 92 Bytes  [ 00, 1F, 00, 3C, 00, 5B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetWaitableTimer + 4D                                              7C80965E 5 Bytes  [ 30, E8, BD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetWaitableTimer + 53                                              7C809664 47 Bytes  [ 89, 45, 84, 85, C0, 75, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetWaitableTimer + 83                                              7C809694 98 Bytes  [ 90, 90, 90, 90, 68, A0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetWaitableTimer + E6                                              7C8096F7 72 Bytes  [ 00, 8B, 55, 10, FF, 4D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentThreadId                                                 7C809740 25 Bytes  [ 0F, B7, 40, 0E, 89, 45, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsGetValue + B                                                    7C80975B 37 Bytes  [ 00, 89, 45, B4, 8B, 5D, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InterlockedIncrement + B                                           7C809781 73 Bytes  [ 84, CA, FE, FF, FF, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InterlockedExchangeAdd + 5                                         7C8097CB 71 Bytes  [ 7D, 9C, EB, 9D, 90, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MulDiv + 3D                                                        7C809813 350 Bytes  [ 0F, 84, 8B, 1F, 00, 00, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFree + 33                                                     7C809972 9 Bytes  [ 68, CE, E0, 97, 7C, E8, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFree + 3D                                                     7C80997C 29 Bytes  [ 89, 45, CC, 85, C0, 0F, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalAlloc                                                         7C80999D 107 Bytes  [ 90, 8B, 45, EC, 8B, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalAlloc + 6D                                                    7C809A0A 25 Bytes  [ 33, DB, 66, 8B, 5F, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrlenW + B                                                       7C809A24 33 Bytes  [ 24, 85, A0, 25, 91, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrlenW + 2D                                                      7C809A46 35 Bytes  [ 45, C4, 83, F8, 0F, 76, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAlloc + 9                                                   7C809A6A 9 Bytes  [ F6, 45, 14, 02, 0F, 85, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAlloc + 13                                                  7C809A74 8 Bytes  [ 8B, 45, 18, 89, 30, 83, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAlloc + 1C                                                  7C809A7D 39 Bytes  JMP 7C80982E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAllocEx + 23                                                7C809AA5 4 Bytes  [ 00, 89, 85, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAllocEx + 28                                                7C809AAA 21 Bytes  [ FF, FF, 8B, 40, 30, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAllocEx + 3F                                                7C809AC1 6 Bytes  [ 00, 89, 85, 50, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAllocEx + 46                                                7C809AC8 9 Bytes  [ 0F, B7, 80, C4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualAllocEx + 52                                                7C809AD4 27 Bytes  [ F6, 45, 14, 04, 0F, 85, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualFree + F                                                    7C809B03 26 Bytes  CALL 7C807764 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualFreeEx + C                                                  7C809B1E 40 Bytes  CALL 7C807756 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualFreeEx + 35                                                 7C809B47 6 Bytes  [ 39, 45, 0C, 0F, 83, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualFreeEx + 3C                                                 7C809B4E 71 Bytes  [ 03, 00, 5E, 85, DB, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseHandle + 3F                                                   7C809B96 35 Bytes  [ 75, 14, 6A, 00, FF, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseHandle + 63                                                   7C809BBA 10 Bytes  [ 74, 24, 10, FF, 74, 24, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseHandle + 6F                                                   7C809BC6 134 Bytes  [ C2, 10, 00, 83, C7, F8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MultiByteToWideChar + 46                                           7C809C4E 5 Bytes  [ 00, 00, 01, 91, 94 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MultiByteToWideChar + 4C                                           7C809C54 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MultiByteToWideChar + 54                                           7C809C5C 26 Bytes  [ 8D, 8C, 94, 7C, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MultiByteToWideChar + 6F                                           7C809C77 5 Bytes  [ 00, 00, 83, B8, 98 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MultiByteToWideChar + 75                                           7C809C7D 56 Bytes  [ 00, 00, 00, 0F, 85, 6E, B9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadReadPtr + C                                                   7C809E1D 70 Bytes  [ 74, 31, 8B, 4D, 14, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadReadPtr + 54                                                  7C809E65 7 Bytes  [ 90, EF, 2A, 91, 7C, E5, 2A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadReadPtr + 5C                                                  7C809E6D 1 Byte  [ 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadReadPtr + 5E                                                  7C809E6F 42 Bytes  [ 2A, 91, 7C, 1F, 2B, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadWritePtr + 11                                                 7C809E9A 35 Bytes  [ 7D, 2B, 91, 7C, 89, 2B, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadWritePtr + 35                                                 7C809EBE 148 Bytes  [ 57, 0F, 85, 49, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserDefaultLCID + 33                                            7C809F53 2 Bytes  [ 59, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserDefaultLCID + 36                                            7C809F56 166 Bytes  [ B7, 58, 12, 8A, 1C, 33, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadResource + 38                                                  7C809FFD 21 Bytes  [ 00, 0F, 87, 99, AF, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadResource + 4E                                                  7C80A013 30 Bytes  [ C3, 16, 00, 00, 50, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEvent + B                                                       7C80A032 10 Bytes  [ 77, 04, 8D, 45, 0C, 50, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEvent + 16                                                      7C80A03D 17 Bytes  CALL 7C809EA9 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ResetEvent + 4                                                     7C80A04F 17 Bytes  [ 46, 04, 8B, 4D, 0C, 88, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ResetEvent + 16                                                    7C80A061 18 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjects + 7                                         7C80A074 53 Bytes  [ 00, 33, C0, 40, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjects + 3D                                        7C80A0AA 21 Bytes  [ 4D, 08, F7, C1, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjects + 53                                        7C80A0C0 10 Bytes  [ 8B, C1, 83, E0, 02, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjects + 5E                                        7C80A0CB 19 Bytes  [ 84, DB, 75, 4A, 33, DB, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForMultipleObjects + 72                                        7C80A0DF 25 Bytes  [ 3B, C2, 0F, 85, C9, 8C, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WideCharToMultiByte + 15                                           7C80A0F9 113 Bytes  [ 00, B9, D8, E0, 97, 7C, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WideCharToMultiByte + 88                                           7C80A16C 42 Bytes  JMP A0C8D481 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WideCharToMultiByte + B3                                           7C80A197 48 Bytes  [ FF, C2, 08, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WideCharToMultiByte + E4                                           7C80A1C8 18 Bytes  [ 89, 5E, 04, 8B, C8, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WideCharToMultiByte + F7                                           7C80A1DB 18 Bytes  [ 89, 0E, 89, 5E, 18, 89, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryPerformanceCounter + 4                                        7C80A43B 180 Bytes  [ 34, 71, 66, 89, 70, 3A, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeW + 50                                                7C80A4F0 58 Bytes  [ 48, 0F, 84, AC, 6A, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeW + 8B                                                7C80A52B 89 Bytes  [ 50, 8D, 85, A8, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeW + E5                                                7C80A585 65 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeW + 127                                               7C80A5C7 4 Bytes  [ B6, 40, 01, 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeW + 12C                                               7C80A5CC 137 Bytes  [ 85, 08, 00, 00, 00, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ActivateActCtx + 2                                                 7C80A656 86 Bytes  [ B6, 78, 05, 00, 00, E8, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeactivateActCtx + 28                                              7C80A6AD 92 Bytes  CALL 7C80A604 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateEventW + 51                                                  7C80A70A 93 Bytes  [ 4D, 08, 3B, 41, 14, 72, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetQueuedCompletionStatus + 3B                                     7C80A768 7 Bytes  [ 4A, 04, 53, 56, 8B, 75, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetQueuedCompletionStatus + 43                                     7C80A770 199 Bytes  [ D9, 57, 33, C0, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocalTime + 54                                                  7C80A838 116 Bytes  [ FC, 33, 45, 08, C9, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocalTime + C9                                                  7C80A8AD 16 Bytes  [ 45, 08, 66, 8B, 08, 6A, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocalTime + DA                                                  7C80A8BE 9 Bytes  [ 66, 83, F9, 2F, 0F, 84, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocalTime + E4                                                  7C80A8C8 9 Bytes  [ 66, 85, C9, 0F, 84, DF, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocalTime + EE                                                  7C80A8D2 14 Bytes  [ 83, 78, 02, 3A, 0F, 85, D4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmpW + 87                                                      7C80AA63 73 Bytes  [ 5F, 5E, 5B, C9, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmpW + D1                                                      7C80AAAD 41 Bytes  [ FF, FF, 00, 00, 0F, 87, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmpW + FC                                                      7C80AAD8 8 Bytes  [ 27, D1, FF, FF, 66, 39, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmpW + 105                                                     7C80AAE1 44 Bytes  [ 1E, D1, FF, FF, 8B, F9, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmpW + 132                                                     7C80AB0E 13 Bytes  [ 00, 66, 83, F8, 2F, C6, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetErrorMode + 46                                                  7C80AC65 16 Bytes  [ 00, 66, 8B, 16, 66, 3B, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetErrorMode + 57                                                  7C80AC76 49 Bytes  [ D2, 74, 1B, 66, 89, 11, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindResourceExW + 10                                               7C80ACA8 125 Bytes  JMP 7C834ED2 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindResourceExW + 8E                                               7C80AD26 103 Bytes  [ 66, 39, 0A, 0F, 84, BE, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWindowsDirectoryW + 3                                           7C80AD8E 14 Bytes  [ BC, EB, 8B, 90, 90, 90, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWindowsDirectoryW + 12                                          7C80AD9D 3 Bytes  [ 00, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWindowsDirectoryW + 18                                          7C80ADA3 14 Bytes  [ 68, 70, 02, 00, 00, 68, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcAddress + 2                                                 7C80ADB2 21 Bytes  [ A1, C8, E0, 97, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcAddress + 19                                                7C80ADC9 34 Bytes  [ 8B, 5D, 14, 33, D2, 89, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcAddress + 3C                                                7C80ADEC 53 Bytes  [ 8B, 40, 04, 89, 85, C4, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcAddress + 73                                                7C80AE23 17 Bytes  [ 64, A1, 18, 00, 00, 00, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcAddress + 85                                                7C80AE35 6 Bytes  [ FF, 89, 85, D0, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsProcessorFeaturePresent + 2                                      7C80AE3C 37 Bytes  [ 85, C0, 0F, 84, 71, A5, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadLibraryW + 7                                                   7C80AE62 57 Bytes  [ 0F, 85, 72, 51, 01, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExW + 27                                                 7C80AE9C 55 Bytes  [ 0F, 85, A4, 53, 00, 00, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExW + 5F                                                 7C80AED4 109 Bytes  [ 89, 85, 80, FD, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExW + CD                                                 7C80AF42 29 Bytes  [ FF, 89, 4E, 04, 8B, 85, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExW + EB                                                 7C80AF60 29 Bytes  [ 95, 9C, FD, FF, FF, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExW + 109                                                7C80AF7E 59 Bytes  [ FF, 85, C0, 0F, 85, 9A, F5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeW + 85                                                 7C80B365 42 Bytes  [ 48, 02, 76, 0D, 0F, B7, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeW + B0                                                 7C80B390 26 Bytes  [ FF, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeW + CB                                                 7C80B3AB 53 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeW + 102                                                7C80B3E2 62 Bytes  [ 8B, FF, 55, 8B, EC, 83, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameW + 3C                                            7C80B421 84 Bytes  [ 0C, 02, 0F, 86, CA, 74, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameW + 91                                            7C80B476 78 Bytes  [ 55, 10, 83, C1, FE, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameW + E0                                            7C80B4C5 86 Bytes  [ FF, FF, 8B, 45, FC, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameA + 3E                                            7C80B51D 44 Bytes  [ FF, 3B, F7, 0F, 84, 3E, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameA + 6B                                            7C80B54A 124 Bytes  [ 84, C0, 0F, 85, FD, A2, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameA + E8                                            7C80B5C7 71 Bytes  [ 8D, 45, BC, 50, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameA + 130                                           7C80B60F 11 Bytes  JMP 7C80B586 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleFileNameA + 13C                                           7C80B61B 77 Bytes  [ 5D, 10, 66, 89, 03, 66, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleA + 23                                              7C80B6D4 72 Bytes  JMP 7C80B379 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleA + 6C                                              7C80B71D 24 Bytes  [ 66, 83, FA, 2F, 0F, 84, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleA + 85                                              7C80B736 147 Bytes  [ 02, 3A, 0F, 84, C2, 24, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesW + 6E                                            7C80B7CA 51 Bytes  [ 5A, 00, 78, 00, 97, 00, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByte + 12                                                7C80B7FE 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByte + 1D                                                7C80B809 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InitializeCriticalSectionAndSpinCount + 1C                         7C80B855 165 Bytes  [ 03, 03, 03, 03, 03, 03, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MapViewOfFileEx + 55                                               7C80B8FB 137 Bytes  [ 08, 08, 08, 08, 08, 08, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnmapViewOfFile + 1                                                7C80B985 12 Bytes  [ 45, 08, 56, 89, 85, F8, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnmapViewOfFile + E                                                7C80B992 47 Bytes  [ FF, 3C, 01, 0F, 85, 11, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualQueryEx + 12                                                7C80B9C2 85 Bytes  [ 0F, 85, EE, 56, 03, 00, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpynW + 19                                                     7C80BA18 17 Bytes  [ FA, 3B, F8, 73, 15, 47, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpynW + 2B                                                     7C80BA2A 8 Bytes  [ 00, 00, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpynW + 34                                                     7C80BA33 37 Bytes  [ C7, 07, 2D, 00, 47, 47, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpynW + 5A                                                     7C80BA59 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpynW + 5D                                                     7C80BA5C 43 Bytes  [ 85, C0, 7C, 6C, FE, C3, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyW + 14                                                      7C80BA88 13 Bytes  [ 2B, F8, 8B, 85, F8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyW + 22                                                      7C80BA96 85 Bytes  [ D1, E7, 3B, F9, 0F, 83, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFileMappingW + 2                                               7C80BAEC 50 Bytes  [ A1, C8, E0, 97, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFileMappingW + 35                                              7C80BB1F 3 Bytes  [ 33, FF, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFileMappingW + 39                                              7C80BB23 46 Bytes  [ 0F, 85, 71, 85, 03, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFileMappingW + 68                                              7C80BB52 16 Bytes  [ C0, 75, E2, 8D, 45, E0, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFileMappingW + 79                                              7C80BB63 21 Bytes  [ 85, 03, 00, 3B, 45, 10, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindResourceW + 76                                                 7C80BC54 139 Bytes  [ 55, 8B, EC, 83, EC, 0C, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadCodePtr + 1                                                   7C80BCE0 66 Bytes  [ 75, 08, 0F, B7, 06, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadCodePtr + 44                                                  7C80BD23 19 Bytes  [ 33, C0, 5F, 5E, 5B, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadCodePtr + 58                                                  7C80BD37 31 Bytes  [ EC, 68, A1, C8, E0, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadCodePtr + 78                                                  7C80BD57 42 Bytes  CALL 7C804A9A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadCodePtr + A3                                                  7C80BD82 25 Bytes  [ 00, 00, 8D, 45, 98, 50, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpy + A                                                        7C80BE1B 36 Bytes  [ 01, 06, 8B, C3, 8B, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpy + 2F                                                       7C80BE40 238 Bytes  [ 5C, 00, 55, 00, 53, 00, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindResourceA + 96                                                 7C80BF2F 48 Bytes  [ A2, 02, 00, 00, 89, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLCID + 14                                          7C80BF61 6 Bytes  [ 2B, 75, 14, 83, 7D, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLCID + 1B                                          7C80BF68 6 Bytes  [ 8B, FE, 0F, 85, 5E, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLCID + 22                                          7C80BF6F 121 Bytes  [ 00, 8D, 43, FF, 39, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReleaseSemaphore + 2C                                              7C80BFE9 46 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExW + 19                                              7C80C018 12 Bytes  [ 85, C0, 0F, 85, DD, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExW + 26                                              7C80C025 5 Bytes  [ 00, 33, DB, 85, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExW + 2D                                              7C80C02C 3 Bytes  [ 4B, 4A, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExW + 31                                              7C80C030 11 Bytes  [ 8B, B9, 00, 02, 00, 00, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExW + 3D                                              7C80C03C 4 Bytes  [ 84, 76, 01, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitThread + 70                                                    7C80C0D8 16 Bytes  [ 00, 03, C3, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitThread + 81                                                    7C80C0E9 50 Bytes  [ 84, 34, 02, 00, 00, 8B, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriority + 4                                              7C80C11C 30 Bytes  [ 4D, 10, 3B, CA, 0F, 82, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriority + 23                                             7C80C13B 11 Bytes  CALL 7C7E8A28 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriority + 31                                             7C80C149 4 Bytes  [ 84, D4, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriority + 36                                             7C80C14E 32 Bytes  [ 8B, 48, 04, 85, C9, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriority + 57                                             7C80C16F 49 Bytes  [ 8B, 55, 14, 03, CB, 89, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeLibraryAndExitThread + 21                                      7C80C1A1 9 Bytes  [ 00, 00, 1B, C0, F7, D8, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeLibraryAndExitThread + 2B                                      7C80C1AB 3 Bytes  [ 84, 70, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeLibraryAndExitThread + 30                                      7C80C1B0 36 Bytes  [ 48, 0F, 84, 79, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeLibraryAndExitThread + 55                                      7C80C1D5 32 Bytes  [ 85, C0, 0F, 84, 9B, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeLibraryAndExitThread + 76                                      7C80C1F6 4 Bytes  [ 33, C0, E9, 79 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LockResource + 2                                                   7C80CCA9 62 Bytes  [ FF, 00, 0F, 85, 26, BA, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringW + 30                                                  7C80CCE8 36 Bytes  [ CE, FD, FF, FF, 01, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringW + 55                                                  7C80CD0D 7 Bytes  [ 66, 8B, 01, 66, 85, C0, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringW + 5D                                                  7C80CD15 59 Bytes  [ 41, 41, 66, 83, F8, 5C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringW + 9A                                                  7C80CD52 6 Bytes  [ 00, 53, 52, 50, E8, B6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringW + A1                                                  7C80CD59 115 Bytes  [ 00, 00, 8B, F0, 3B, F3, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareStringA + 3E                                                7C80D0C5 16 Bytes  CALL 7C807293 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareStringA + 4F                                                7C80D0D6 45 Bytes  [ 90, 90, 90, 90, 90, 68, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareStringA + 7D                                                7C80D104 7 Bytes  [ 8B, 45, 10, 89, 85, D8, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareStringA + 85                                                7C80D10C 3 Bytes  [ FF, 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareStringA + 89                                                7C80D110 17 Bytes  [ 89, 85, B8, FD, FF, FF, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoA + 22                                                7C80D294 70 Bytes  [ 64, A1, 18, 00, 00, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoA + 69                                                7C80D2DB 14 Bytes  [ F9, 5C, 75, DF, EB, D7, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoA + 78                                                7C80D2EA 133 Bytes  [ FF, FF, 00, 00, 00, 00, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoA + FE                                                7C80D370 111 Bytes  CALL 7C7F8500 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoA + 16E                                               7C80D3E0 299 Bytes  CALL 7C805CEB C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateHandle + C                                                7C80DE1A 29 Bytes  [ FF, 84, C0, 0F, 84, 19, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateHandle + 2A                                               7C80DE38 24 Bytes  [ 00, 00, 8B, 40, 30, 56, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateHandle + 43                                               7C80DE51 4 Bytes  [ 3B, FE, 74, 2F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateHandle + 48                                               7C80DE56 20 Bytes  [ DF, 8B, 3F, 83, 7B, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateHandle + 5D                                               7C80DE6B 22 Bytes  CALL 7C80A2DA C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleW + 6A                                              7C80E4B7 14 Bytes  [ 8B, 40, 30, 68, 18, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleW + 79                                              7C80E4C6 52 Bytes  [ FF, FF, 3B, C7, 0F, 84, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleW + AE                                              7C80E4FB 204 Bytes  [ 10, 89, 70, 04, 89, 42, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleW + 17B                                             7C80E5C8 23 Bytes  [ 75, 1E, 8B, 06, 8B, 76, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleW + 193                                             7C80E5E0 6 Bytes  [ FF, 70, 18, E8, 65, 8D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathW + 77                                                   7C80E763 108 Bytes  [ 66, 83, FB, 7A, 0F, 87, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathW + E5                                                   7C80E7D1 6 Bytes  [ 4F, 10, 89, 48, 0C, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathW + EC                                                   7C80E7D8 18 Bytes  [ 03, C8, 8D, 50, 28, 3B, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathW + FF                                                   7C80E7EB 25 Bytes  [ C0, 0F, 85, C5, DC, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToSystemTime + 9                                           7C80E805 151 Bytes  [ 75, F4, 8D, 46, FF, 83, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToLocalFileTime + 27                                       7C80E89D 93 Bytes  [ 7D, 10, 89, 46, 1C, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMutexW + 34                                                  7C80E8FB 16 Bytes  JMP 7C80E7A5 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMutexW + 46                                                  7C80E90D 25 Bytes  [ 00, 68, F8, 76, 91, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMutexW + 60                                                  7C80E927 61 Bytes  [ 8B, 75, 10, 3B, F3, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMutexA + 16                                                  7C80E965 6 Bytes  [ 7F, 0F, 87, 9E, 67, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMutexA + 1D                                                  7C80E96C 89 Bytes  [ 85, C0, 0F, 84, F7, 67, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexW + 21                                                    7C80E9C6 7 Bytes  [ 00, 83, C6, F8, 89, B5, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexW + 29                                                    7C80E9CE 12 Bytes  [ FF, FF, 8A, 46, 05, A8, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexW + 36                                                    7C80E9DB 61 Bytes  [ A8, 08, 0F, 85, C1, 67, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexW + 74                                                    7C80EA19 28 Bytes  [ 00, F6, 46, 05, 08, 75, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexA + B                                                     7C80EA36 11 Bytes  [ 00, 00, F6, 45, 0C, 10, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexA + 17                                                    7C80EA42 64 Bytes  [ 66, 81, 65, 0E, 03, C0, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenMutexA + 59                                                    7C80EA84 55 Bytes  [ 85, DB, 74, 56, 8D, 43, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExW + 2F                                              7C80EABC 15 Bytes  [ 8B, 55, D0, 3B, CA, 76, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExW + 3F                                              7C80EACC 14 Bytes  [ FF, FF, 75, 10, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExW + 4E                                              7C80EADB 54 Bytes  [ 8B, 7D, 08, 8B, 45, 10, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExW + 86                                              7C80EB13 12 Bytes  [ C2, 10, 00, 90, 90, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExW + 93                                              7C80EB20 164 Bytes  [ F7, E2, 94, 7C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindClose + 79                                                     7C80EE60 25 Bytes  [ 45, 18, 8D, 34, 1A, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindClose + 93                                                     7C80EE7A 201 Bytes  [ 8B, 4D, F8, 8D, 0C, CE, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileW + 53                                                7C80EF44 60 Bytes  [ 66, 8B, 06, 66, 3D, 80, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileW + 37                                                 7C80EF81 130 Bytes  [ 0C, 8D, 43, 30, 56, 8B, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileW + BA                                                 7C80F004 52 Bytes  CALL 7C80438C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileW + EF                                                 7C80F039 75 Bytes  [ 00, 0F, B7, 0F, 8D, 0C, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileW + 13C                                                7C80F086 47 Bytes  [ 33, F6, 39, 73, 14, 75, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileW + 16C                                                7C80F0B6 7 Bytes  [ 00, 90, 90, 90, 90, 90, 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableW + 18C                                      7C80F290 41 Bytes  [ 8B, D1, C1, EA, 03, 8D, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableW + 1B6                                      7C80F2BA 106 Bytes  JMP 7C808C4F C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCurrentDirectoryW + 27                                          7C80F325 36 Bytes  [ 6A, 00, 89, 45, 10, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCurrentDirectoryW + 4C                                          7C80F34A 8 Bytes  [ 01, 46, 28, 80, 67, 05, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCurrentDirectoryW + 55                                          7C80F353 38 Bytes  [ 0C, 40, 0F, 85, A5, 56, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCurrentDirectoryW + 7C                                          7C80F37A 6 Bytes  [ 00, 8D, 96, 78, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCurrentDirectoryW + 83                                          7C80F381 40 Bytes  [ 3B, D0, 74, 0F, 66, 8B, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringW + 71                                      7C80F9DE 51 Bytes  [ 68, 10, 27, 00, 00, 13, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationW + 1D                                         7C80FA12 24 Bytes  [ E4, 8B, 45, 14, 89, 45, BC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationW + 36                                         7C80FA2B 49 Bytes  CALL 3F050936 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationW + 68                                         7C80FA5D 33 Bytes  [ 33, D2, F7, 75, 0C, 4E, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationW + 8A                                         7C80FA7F 63 Bytes  [ 3B, C2, 0F, 8F, 4E, 44, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationW + CA                                         7C80FABF 4 Bytes  [ 90, FF, FF, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFree + 28                                                    7C80FC67 162 Bytes  [ 8B, 45, 10, 89, 30, 83, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFree + CB                                                    7C80FD0A 30 Bytes  CALL 7C80FD8C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFree + EA                                                    7C80FD29 56 Bytes  [ FF, FF, FF, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalAlloc + 26                                                   7C80FD63 88 Bytes  [ 33, C0, 5F, 5E, 5B, C9, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalAlloc + 7F                                                   7C80FDBC 17 Bytes  [ C3, 90, 90, 90, 90, 90, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalAlloc + 91                                                   7C80FDCE 5 Bytes  [ 64, A1, 18, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalAlloc + 97                                                   7C80FDD4 11 Bytes  [ 8B, 58, 30, 89, 5D, DC, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalAlloc + A3                                                   7C80FDE0 9 Bytes  [ 00, 0F, 85, C3, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnlock + B                                                   7C80FE9D 6 Bytes  [ 80, 3D, DC, E0, 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnlock + 12                                                  7C80FEA4 9 Bytes  [ 0F, 85, 68, D3, 01, 00, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnlock + 1C                                                  7C80FEAE 20 Bytes  [ FF, C2, 04, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnlock + 31                                                  7C80FEC3 20 Bytes  [ 08, 33, DB, 81, FE, 78, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnlock + 46                                                  7C80FED8 20 Bytes  [ 00, 0F, B6, 4D, 0B, 89, 88, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalLock + 19                                                    7C80FF42 41 Bytes  [ FF, 3D, 02, 01, 00, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalLock + 43                                                    7C80FF6C 13 Bytes  [ 00, 00, 89, 98, 84, 0F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalLock + 51                                                    7C80FF7A 69 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalLock + 98                                                    7C80FFC1 285 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateSemaphoreW + 49                                              7C8100DF 29 Bytes  [ 75, D3, 8B, 46, 1C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateSemaphoreW + 67                                              7C8100FD 62 Bytes  [ 00, 00, C7, 45, B0, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyn + 1B                                                      7C81013C 33 Bytes  CALL 7C81014B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyn + 3E                                                      7C81015F 1 Byte  [ 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyn + 40                                                      7C810161 44 Bytes  [ 56, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcpyn + 6D                                                      7C81018E 62 Bytes  CALL 7C805D24 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableW                                            7C8101CE 81 Bytes  [ 90, 90, FF, FF, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableW + 52                                       7C810220 99 Bytes  [ 83, F8, 01, 0F, 87, 83, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableW + B6                                       7C810284 43 Bytes  [ 55, 8B, EC, 56, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableW + E2                                       7C8102B0 93 Bytes  [ 82, FE, FF, 5E, 5D, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableW + 140                                      7C81030E 166 Bytes  [ BF, E0, E1, 97, 7C, EB, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateRemoteThread + 2F                                            7C81046B 117 Bytes  [ FF, 00, 00, 00, 00, 65, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateRemoteThread + A5                                            7C8104E1 48 Bytes  [ 0F, 83, 9E, 02, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateRemoteThread + D7                                            7C810513 37 Bytes  [ 00, 83, 45, 18, 02, 41, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateRemoteThread + FD                                            7C810539 6 Bytes  [ 4E, 14, 0F, 83, 3D, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateRemoteThread + 104                                           7C810540 58 Bytes  [ 00, 8B, 46, 1C, 03, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateThread + 22                                                  7C810669 70 Bytes  [ 00, 00, 39, 7D, 94, 7C, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SwitchToFiber + 2E                                                 7C8106B0 5 Bytes  [ FF, FF, FF, FF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SwitchToFiber + 36                                                 7C8106B8 77 Bytes  [ 47, C4, 92, 7C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SwitchToFiber + 85                                                 7C810707 9 Bytes  [ 89, 85, 68, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SwitchToFiber + 8F                                                 7C810711 10 Bytes  [ 40, 0C, 8B, 40, 20, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SwitchToFiber + 9A                                                 7C81071C 22 Bytes  [ 83, C0, F0, 89, 85, 6C, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileW + 10                                                   7C810780 106 Bytes  JMP 7C810520 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileW + 7B                                                   7C8107EB 29 Bytes  [ 2B, 7E, 0B, 8D, 46, 01, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileW + 99                                                   7C810809 119 Bytes  [ 04, 70, 5E, C9, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileW + 111                                                  7C810881 76 Bytes  [ 8A, 51, 03, 80, FA, 6C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFileW + 15E                                                  7C8108CE 4 Bytes  [ 84, 3E, 89, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CompareFileTime + 42                                               7C810B2B 110 Bytes  [ 8B, FF, 55, 8B, EC, 83, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToFileTime + 6E                                          7C810B9A 42 Bytes  [ 8B, FF, 55, 8B, EC, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointer + 27                                                7C810BC5 39 Bytes  [ 83, 66, 04, 00, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointer + 4F                                                7C810BED 53 Bytes  [ 33, FF, 89, 7D, E4, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointer + 86                                                7C810C24 35 Bytes  [ C2, 04, 00, 90, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointer + AA                                                7C810C48 39 Bytes  [ 00, C0, 0F, 84, B9, 15, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointer + D2                                                7C810C70 40 Bytes  CALL 7C80DC22 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileInformationByHandle + 1D                                    7C810C9A 51 Bytes  [ FE, 7F, 8B, 02, F7, 62, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileInformationByHandle + 52                                    7C810CCF 2 Bytes  [ 0F, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileInformationByHandle + 56                                    7C810CD3 99 Bytes  CALL 7C805D26 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileInformationByHandle + BA                                    7C810D37 4 Bytes  [ 26, 00, 00, 81 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileInformationByHandle + BF                                    7C810D3C 53 Bytes  [ 8B, 00, 00, C0, 0F, 84, 9C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFile + D                                                      7C810DA4 41 Bytes  [ 10, 89, 51, 04, 89, 08, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFile + 37                                                     7C810DCE 21 Bytes  [ 85, C0, 74, 0D, 83, 7D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFile + 4D                                                     7C810DE4 1 Byte  [ 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFile + 4F                                                     7C810DE6 50 Bytes  [ F0, 8B, 06, 85, C0, 74, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFile + 82                                                     7C810E19 24 Bytes  [ A8, 01, 0F, 85, CD, 72, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileType + 2B                                                   7C810E8C 34 Bytes  [ B7, C9, 8B, D1, D1, EA, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileType + 4E                                                   7C810EAF 25 Bytes  JMP 7C80D566 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileType + 68                                                   7C810EC9 59 Bytes  [ 72, 02, 6A, FF, 8D, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapDestroy                                                        7C810F08 30 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapDestroy + 1F                                                   7C810F27 2 Bytes  [ 0E, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapDestroy + 22                                                   7C810F2A 39 Bytes  [ 0A, 42, 42, 46, 46, 66, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcatW + 10                                                      7C810F52 26 Bytes  [ 44, 00, 49, 00, 52, 00, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcatW + 2E                                                      7C810F70 2 Bytes  [ 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcatW + 31                                                      7C810F73 41 Bytes  [ 55, 8B, EC, 51, 8B, 15, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcatW + 5B                                                      7C810F9D 100 Bytes  [ 02, 8D, 45, FC, 50, E8, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenConsoleW + 11                                                  7C811002 14 Bytes  [ 4D, 10, 74, 0A, 66, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenConsoleW + 20                                                  7C811011 44 Bytes  [ B7, D0, 0F, B7, C1, 2B, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenConsoleW + 4D                                                  7C81103E 3 Bytes  [ 84, FC, DD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenConsoleW + 52                                                  7C811043 38 Bytes  [ 32, C0, 5F, 5E, 5D, C2, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenConsoleW + 7B                                                  7C81106C 15 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidCodePage + 1D                                               7C8110F8 115 Bytes  [ 00, 2B, C3, D1, F8, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExW + 67                                          7C81116C 32 Bytes  [ 0E, 00, 10, 00, 54, 9D, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExW + 88                                          7C81118D 36 Bytes  [ C7, 85, B4, FD, FF, FF, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExW + AD                                          7C8111B2 111 Bytes  [ 10, 74, 22, 38, 0E, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersion + 38                                                    7C811222 68 Bytes  [ 2B, C6, 46, F6, 85, F9, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersion + 7D                                                    7C811267 11 Bytes  [ 00, 0F, B7, C3, 83, E8, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersion + 8A                                                    7C811274 39 Bytes  CALL 2E05217C 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersion + B2                                                    7C81129C 11 Bytes  JMP 7C812D23 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DisableThreadLibraryCalls + 2                                      7C8112A8 4 Bytes  JMP 7C811216 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DisableThreadLibraryCalls + 7                                      7C8112AD 39 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DisableThreadLibraryCalls + 30                                     7C8112D6 28 Bytes  [ 00, C7, 45, E4, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DisableThreadLibraryCalls + 4D                                     7C8112F3 4 Bytes  [ E0, C6, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DisableThreadLibraryCalls + 52                                     7C8112F8 10 Bytes  [ 45, E0, FF, 4D, E4, 0F, 88, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoW + 39                                                7C8115AB 118 Bytes  [ 8A, 45, 1B, 66, FF, 46, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoW + B1                                                7C811623 65 Bytes  [ 75, 0C, FF, 75, 08, E8, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoW + F3                                                7C811665 20 Bytes  [ 55, 8B, EC, 80, 7D, 0C, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoW + 108                                               7C81167A 16 Bytes  [ 40, 30, 8D, 0C, 9D, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLocaleInfoW + 119                                               7C81168B 46 Bytes  [ 5E, FF, FF, 85, C0, 74, 3E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalReAlloc + 26                                                 7C8123EF 8 Bytes  [ B7, 0E, 3B, CB, 0F, 83, 9B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalReAlloc + 2F                                                 7C8123F8 64 Bytes  [ FF, 8B, 00, 89, 85, 78, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalReAlloc + 70                                                 7C812439 18 Bytes  [ 01, 00, 8B, 06, 8B, D0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalReAlloc + 83                                                 7C81244C 87 Bytes  [ 00, 89, 95, 70, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalReAlloc + DB                                                 7C8124A4 5 Bytes  [ 8B, C1, C1, E8, 03 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushFileBuffers + 15                                              7C812666 192 Bytes  [ FB, FF, FF, 04, F7, 9D, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PostQueuedCompletionStatus + 25                                    7C812727 40 Bytes  [ 00, 83, A5, B0, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ChangeTimerQueueTimer + 1D                                         7C812750 29 Bytes  [ 01, 00, 00, 00, 83, C3, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ChangeTimerQueueTimer + 3B                                         7C81276E 8 Bytes  CALL 8C81276E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ChangeTimerQueueTimer + 45                                         7C812778 4 Bytes  [ C7, 85, F0, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ChangeTimerQueueTimer + 4B                                         7C81277E 14 Bytes  JMP 7C812854 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ChangeTimerQueueTimer + 5A                                         7C81278D 74 Bytes  [ FF, 30, 08, 0F, 85, 91, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLangID + 16                                        7C8127D8 5 Bytes  [ FF, E9, 7D, 00, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLangID + 1C                                        7C8127DE 4 Bytes  [ 8B, 8D, F4, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLangID + 22                                        7C8127E4 41 Bytes  [ 8B, 01, 8B, 51, 04, 83, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDefaultLangID + 4C                                        7C81280E 57 Bytes  [ 8D, 50, 01, 8A, 08, 40, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExW + 35                                           7C812848 174 Bytes  [ 00, 00, 39, 85, F0, FB, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExW + E4                                           7C8128F7 2 Bytes  [ 8B, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExW + E7                                           7C8128FA 2 Bytes  [ FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExW + EA                                           7C8128FD 47 Bytes  [ 8D, 50, 01, 8A, 08, 40, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExW + 11A                                          7C81292D 123 Bytes  [ 8B, 85, BC, FB, FF, FF, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RaiseException + 8E                                                7C812AA7 3 Bytes  [ A5, 44, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RaiseException + 92                                                7C812AAB 30 Bytes  CALL 330639B3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RaiseException + B2                                                7C812ACB 8 Bytes  [ 10, 00, 00, 00, 0F, 85, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RaiseException + BD                                                7C812AD6 16 Bytes  [ 9D, F8, FB, FF, FF, BE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RaiseException + CF                                                7C812AE8 44 Bytes  [ 83, 85, F4, FB, FF, FF, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExA + 27                                                 7C812B15 3 Bytes  [ 85, B5, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExA + 2B                                                 7C812B19 14 Bytes  [ FF, FF, 8B, D8, 8B, FA, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExA + 3B                                                 7C812B29 15 Bytes  [ 00, 0F, 8D, D3, 53, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExA + 4C                                                 7C812B3A 15 Bytes  [ 8B, C3, 0B, C7, 0F, 84, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVersionExA + 5C                                                 7C812B4A 14 Bytes  JMP 7C8111DB C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapCreate + 3D                                                    7C812C03 6 Bytes  [ FF, 89, 85, C4, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapCreate + 44                                                    7C812C0A 153 Bytes  [ FF, 35, 10, E2, 97, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessVersion + 71                                             7C812CA4 29 Bytes  [ FF, 89, 8D, EC, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessVersion + 8F                                             7C812CC2 20 Bytes  [ 33, C0, 39, 85, E4, FB, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessVersion + A4                                             7C812CD7 120 Bytes  [ 83, FB, 78, 77, 0D, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessVersion + 11D                                            7C812D50 23 Bytes  [ FF, 89, 85, C0, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemInfo + 2                                                  7C812D68 55 Bytes  [ FF, 89, 85, D8, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemInfo + 3A                                                 7C812DA0 46 Bytes  CALL 7C812DB6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsAlloc + 20                                                      7C812DCF 4 Bytes  [ 00, 00, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsAlloc + 25                                                      7C812DD4 53 Bytes  [ F8, FF, 59, 59, 0F, 84, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsAlloc + 5B                                                      7C812E0A 7 Bytes  [ 83, F8, 49, 0F, 84, 8C, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsAlloc + 64                                                      7C812E13 118 Bytes  [ 83, F8, 68, 0F, 84, 9B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfo + 4                                                      7C812E8A 20 Bytes  [ F0, 0F, 88, 83, 53, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfo + 19                                                     7C812E9F 1 Byte  [ 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfo + 1B                                                     7C812EA1 153 Bytes  [ 03, 00, 8B, 45, E0, C6, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommandLineA + F                                                7C812F3C 146 Bytes  [ FF, 50, 8D, 45, C4, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ProcessIdToSessionId + 36                                          7C812FCF 10 Bytes  CALL 7C8131F4 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ProcessIdToSessionId + 41                                          7C812FDA 27 Bytes  [ B5, 6C, FF, FF, FF, 3B, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ProcessIdToSessionId + 5D                                          7C812FF6 33 Bytes  [ 38, 5D, 18, 0F, 85, EF, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ProcessIdToSessionId + 7F                                          7C813018 42 Bytes  [ 5D, C8, 8B, 85, 78, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ProcessIdToSessionId + AA                                          7C813043 47 Bytes  [ 00, 40, 0F, 94, C0, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReleaseActCtx + 4                                                  7C813073 29 Bytes  [ 45, 1C, 89, 30, 81, FF, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserDefaultUILanguage + 11                                      7C813091 66 Bytes  [ E5, CB, 01, 00, 8B, 45, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDebuggerPresent + 31                                             7C8130D4 73 Bytes  [ 3F, 6C, 02, 00, 39, 5D, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDebuggerPresent + 7B                                             7C81311E 83 Bytes  [ A1, 00, F3, 97, 7C, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventW + 22                                                    7C813172 66 Bytes  [ FF, FF, 9B, 27, 94, 7C, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventW + 65                                                    7C8131B5 45 Bytes  [ FF, 3B, C3, 89, 47, 04, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventW + 93                                                    7C8131E3 10 Bytes  [ 66, C7, 47, 02, FE, FF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventW + 9F                                                    7C8131EF 65 Bytes  [ C0, EB, EA, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventA + 15                                                    7C813231 172 Bytes  [ 8B, 4E, 50, 89, 48, 20, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenEventA + C2                                                    7C8132DE 112 Bytes  [ 20, 68, 08, BF, 91, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WTSGetActiveConsoleSessionId + 52                                  7C813350 127 Bytes  [ 8B, 58, 30, 89, 5D, D0, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameW + 6D                                              7C8133D0 61 Bytes  [ 89, 00, 00, C0, 74, 0C, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameW + AB                                              7C81340E 36 Bytes  [ 33, FF, 47, 89, 7D, FC, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameW + D0                                              7C813433 7 Bytes  CALL 7C807764 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameW + D8                                              7C81343B 71 Bytes  [ 45, BC, 83, 7D, E0, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameW + 120                                             7C813483 37 Bytes  CALL 7C8134B5 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsFree + 16                                                       7C8136FD 21 Bytes  [ 89, 35, 1C, F3, 97, 7C, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsFree + 2C                                                       7C813713 63 Bytes  [ 89, 85, 68, FF, FF, FF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsFree + 6D                                                       7C813754 20 Bytes  [ 08, 33, FF, 47, 57, FF, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsFree + 82                                                       7C813769 11 Bytes  [ 44, 00, 00, 00, 83, 65, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TlsFree + 8F                                                       7C813776 53 Bytes  [ 80, 4E, 36, 08, 80, 7D, DF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExA                                               7C8137C1 5 Bytes  [ 90, 90, 8B, 85, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExA + 6                                           7C8137C7 29 Bytes  [ FF, FF, A3, 1C, F3, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFileAttributesExA + 24                                          7C8137E5 13 Bytes  [ 39, 45, E0, 0F, 85, 9A, E6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileA + B                                                 7C8137F4 20 Bytes  [ 00, 89, 85, 48, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileA + 21                                                7C81380A 31 Bytes  [ 8B, 3E, 89, BD, 7C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileA + 41                                                7C81382A 10 Bytes  [ 8B, 3F, EB, DE, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileA + 4C                                                7C813835 8 Bytes  [ 55, 8B, EC, 57, 8B, 7D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileA + 55                                                7C81383E 29 Bytes  [ 0F, 84, 19, D5, FF, FF, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFullPathNameA + C                                               7C813918 133 Bytes  [ 89, 45, FC, 8B, 45, 08, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFullPathNameA + 92                                              7C81399E 76 Bytes  [ 00, 00, 3B, C3, 89, 45, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFullPathNameA + DF                                              7C8139EB 149 Bytes  [ 92, F7, FF, FF, 3B, C3, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFullPathNameA + 175                                             7C813A81 110 Bytes  [ 47, 04, 89, 5D, A8, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFullPathNameA + 1E4                                             7C813AF0 18 Bytes  [ 26, 64, A1, 18, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableA + 53                                       7C814B55 27 Bytes  [ 80, 6A, 01, 50, 57, E8, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableA + 6F                                       7C814B71 18 Bytes  [ 75, 14, 53, FF, 75, E4, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableA + 82                                       7C814B84 93 Bytes  [ 02, 00, 89, 5D, FC, 68, 7B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableA + E0                                       7C814BE2 8 Bytes  [ 18, 00, 00, C0, 0F, 85, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentVariableA + EA                                       7C814BEC 9 Bytes  [ 8B, 45, 9C, 8B, 4D, A4, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsConvertIntegerToString + B                                      7C814F77 158 Bytes  [ 00, C1, E6, 09, 0B, F2, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsConvertIntegerToString + AA                                     7C815016 72 Bytes  [ 8B, 4E, 7C, 6A, 00, 51, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsConvertIntegerToString + F3                                     7C81505F 15 Bytes  [ 57, 50, 69, D2, 10, 27, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsConvertIntegerToString + 103                                    7C81506F 33 Bytes  [ 00, 00, 00, 00, 5F, C7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsConvertIntegerToString + 125                                    7C815091 9 Bytes  [ 41, 0C, 8B, 40, 10, 8B, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsWow64Process + 8                                                 7C8151B1 62 Bytes  [ F7, E2, 6A, 01, 6A, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsWow64Process + 47                                                7C8151F0 65 Bytes  [ 8B, 4D, F8, 03, F8, 13, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsWow64Process + 8A                                                7C815233 16 Bytes  [ 33, C0, 5E, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsWow64Process + 9B                                                7C815244 16 Bytes  [ EC, 56, 8B, 75, 08, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsWow64Process + AC                                                7C815255 63 Bytes  [ 4D, 10, 89, 01, 89, 51, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxW + 66                                                 7C8154D2 265 Bytes  [ 55, 8B, EC, 8B, 4D, 08, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxW + 170                                                7C8155DC 39 Bytes  [ 45, DC, A1, 38, 8F, 17, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxW + 198                                                7C815604 6 Bytes  [ 00, 00, 00, 89, 55, C8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxW + 19F                                                7C81560B 110 Bytes  [ 75, CC, FF, 15, 6C, 4D, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxW + 20E                                                7C81567A 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryActCtxW + 1                                                   7C8162EC 66 Bytes  [ EC, 81, EC, 50, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryActCtxW + 44                                                  7C81632F 23 Bytes  [ 00, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryActCtxW + 5C                                                  7C816347 30 Bytes  [ 00, 89, 85, D4, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryActCtxW + 7B                                                  7C816366 103 Bytes  [ 8B, 40, 30, 8B, 40, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryActCtxW + E3                                                  7C8163CE 74 Bytes  [ 8B, 4D, FC, 5F, 5E, 5B, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCache + 5                                         7C8164E2 113 Bytes  [ 63, 74, 6F, 72, 79, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCache + 77                                        7C816554 76 Bytes  [ FF, 8B, 45, 14, 89, 85, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCache + C4                                        7C8165A1 68 Bytes  CALL F18165A3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCache + 109                                       7C8165E6 91 Bytes  [ 3B, CF, 0F, 84, 04, 76, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCache + 165                                       7C816642 31 Bytes  [ F4, FD, FF, FF, 89, 85, F0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCheckAppcompatCache + C                                        7C8167F3 22 Bytes  [ FF, 8B, 8D, B4, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCheckAppcompatCache + 23                                       7C81680A 9 Bytes  [ 00, 74, 19, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCheckAppcompatCache + 2D                                       7C816814 70 Bytes  [ B5, E4, FD, FF, FF, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCheckAppcompatCache + 74                                       7C81685B 29 Bytes  [ C9, C2, 1C, 00, 83, F8, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCheckAppcompatCache + 93                                       7C81687A 69 Bytes  [ 8B, F8, 85, FF, 0F, 8D, 4A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForInputIdle + 78                                      7C817016 35 Bytes  [ EB, 0D, 8B, 07, 2B, D8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForInputIdle + 9C                                      7C81703A 11 Bytes  [ 70, 00, 70, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForInputIdle + A8                                      7C817046 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForInputIdle + AA                                      7C817048 202 Bytes  [ 69, 00, 6F, 00, 6E, 00, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForInputIdle + 175                                     7C817113 8 Bytes  [ 27, 08, 00, 00, 89, B5, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseProcessInitPostImport + E8                                     7C81753B 14 Bytes  [ 85, 70, FF, FF, FF, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseProcessInitPostImport + F7                                     7C81754A 25 Bytes  [ FF, FF, 89, 85, 70, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseProcessInitPostImport + 111                                    7C817564 135 Bytes  CALL 7C7F7AB7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseProcessInitPostImport + 199                                    7C8175EC 17 Bytes  JMP 7C7F836B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseProcessInitPostImport + 1AB                                    7C8175FE 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNlsSectionName + A3                                             7C818030 20 Bytes  [ FF, 83, C4, 24, 0F, B7, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNlsSectionName + B8                                             7C818045 11 Bytes  JMP 7C81DC55 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNlsSectionName + C5                                             7C818052 20 Bytes  [ 8B, FF, 55, 8B, EC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNlsSectionName + E3                                             7C818070 65 Bytes  [ 56, 8B, 37, 85, F6, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNlsSectionName + 128                                            7C8180B5 43 Bytes  [ 8B, FF, 55, 8B, EC, 83, EC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalW + 4                                         7C81952B 19 Bytes  [ 83, CB, 01, 89, 58, 08, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalW + 18                                        7C81953F 8 Bytes  [ EC, 8B, 4D, 08, 66, 8B, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalW + 21                                        7C819548 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalW + 23                                        7C81954A 98 Bytes  [ 66, 40, 0F, B7, C0, 56, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalW + 86                                        7C8195AD 21 Bytes  CALL CD61DB3F 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BasepCheckWinSaferRestrictions + 75                                7C81988A 23 Bytes  JMP 7C80FD81 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BasepCheckWinSaferRestrictions + 8D                                7C8198A2 2 Bytes  [ 41, F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BasepCheckWinSaferRestrictions + 90                                7C8198A5 63 Bytes  [ C1, 08, 41, 83, F9, 01, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BasepCheckWinSaferRestrictions + D0                                7C8198E5 91 Bytes  CALL D28198ED 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BasepCheckWinSaferRestrictions + 12C                               7C819941 57 Bytes  [ 48, E0, 89, 01, 8B, C1, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExitCodeProcess + 59                                            7C81AE80 9 Bytes  [ 0D, E0, E0, 97, 7C, 8B, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExitCodeProcess + 63                                            7C81AE8A 177 Bytes  [ 0F, B7, 34, 71, 8B, DA, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleMode + 18                                                7C81AF3C 25 Bytes  [ 0C, 71, 66, 01, 4D, 18, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleMode + 32                                                7C81AF56 155 Bytes  [ 0F, B7, 34, 71, 8B, DA, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleMode + CE                                                7C81AFF2 36 Bytes  [ 0F, 84, C3, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleMode + F3                                                7C81B017 164 Bytes  [ 66, 85, C9, 0F, B6, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleMode + 198                                               7C81B0BC 31 Bytes  [ 45, 10, 85, C0, 0F, 84, E4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleOutputCP + 1D                                            7C81B1BC 86 Bytes  [ 15, C0, E0, 97, 7C, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMode + 13                                                7C81B213 18 Bytes  [ FF, FF, 81, C1, E0, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMode + 26                                                7C81B226 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMode + 28                                                7C81B228 31 Bytes  [ 88, 4A, F9, 0F, B7, 4F, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMode + 48                                                7C81B248 16 Bytes  [ 7D, 18, 7A, 0F, 87, 5D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMode + 59                                                7C81B259 27 Bytes  [ 18, 0F, B7, 4D, 18, 8A, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadUILanguage + D                                            7C81B275 16 Bytes  [ 0F, B7, 0C, 4A, 66, 83, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadUILanguage + 1E                                           7C81B286 235 Bytes  [ 89, 4D, 18, 0F, B7, 4D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameW + E                                        7C81B373 17 Bytes  [ 0C, 3B, F1, 0F, 84, 77, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameW + 20                                       7C81B385 54 Bytes  [ 8B, 45, 14, 3B, C1, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameW + 57                                       7C81B3BC 73 Bytes  [ 85, DB, 89, 7D, 10, BF, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameW + A1                                       7C81B406 3 Bytes  [ 3B, 46, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameW + A5                                       7C81B40A 25 Bytes  [ 87, 74, A0, 01, 00, 66, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCtrlHandler + DF                                         7C81B67A 8 Bytes  [ 35, B8, FF, 97, 7C, E8, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCtrlHandler + E9                                         7C81B684 24 Bytes  [ 68, 52, 43, 92, 7C, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCtrlHandler + 102                                        7C81B69D 37 Bytes  [ 35, B8, FF, 97, 7C, E8, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCtrlHandler + 128                                        7C81B6C3 6 Bytes  [ 97, 7C, E8, AD, 4E, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCtrlHandler + 130                                        7C81B6CB 39 Bytes  CALL 7C811B77 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleW + 17                                              7C81BA63 46 Bytes  [ 8B, 48, 04, 85, C9, 89, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleW + 46                                              7C81BA92 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleW + 48                                              7C81BA94 10 Bytes  [ 85, F6, 89, 72, 04, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleW + 53                                              7C81BA9F 66 Bytes  [ 8B, 31, 3B, F1, 0F, 84, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleW + 96                                              7C81BAE2 22 Bytes  [ 3B, CA, 0F, 84, 57, A3, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadLocale + 2                                                7C81BBCC 43 Bytes  [ FF, 85, C0, 74, 36, 83, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadLocale + 2E                                               7C81BBF8 45 Bytes  [ 57, 89, 47, 0C, FF, 57, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadLocale + 5C                                               7C81BC26 5 Bytes  [ 74, 06, 83, 7E, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadLocale + 62                                               7C81BC2C 18 Bytes  [ 75, 3D, 8B, 46, 04, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleScreenBufferInfo + 4                                     7C81BC3F 40 Bytes  [ 89, 00, 5E, 5D, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleScreenBufferInfo + 2E                                    7C81BC69 7 Bytes  [ EB, D6, 56, 56, E8, 23, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleScreenBufferInfo + 37                                    7C81BC72 14 Bytes  CALL 7C81BC7E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleScreenBufferInfo + 46                                    7C81BC81 141 Bytes  [ 55, 8B, EC, 8B, 45, 08, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleScreenBufferInfo + D4                                    7C81BD0F 4 Bytes  [ F7, C1, EE, 10 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLocale + BB                                                 7C81C556 6 Bytes  [ 00, 00, 0F, 84, 9B, 59 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLocale + C2                                                 7C81C55D 19 Bytes  [ 00, 8B, 8B, 88, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLocale + D6                                                 7C81C571 117 Bytes  [ 83, 88, 00, 00, 00, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLocale + 14C                                                7C81C5E7 45 Bytes  [ 02, 04, 03, 02, 02, 02, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLocale + 17A                                                7C81C615 110 Bytes  [ 01, 01, 01, 05, 04, 03, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateThread + 53                                               7C81CE66 18 Bytes  [ 35, EC, E1, 97, 7C, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateThread + 66                                               7C81CE79 31 Bytes  [ F6, 74, 0B, EB, AB, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateThread + 87                                               7C81CE9A 99 Bytes  [ 00, 90, C8, 5B, 92, 7C, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateThread + EB                                               7C81CEFE 40 Bytes  [ 15, FF, FF, FF, 8B, 7D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TerminateThread + 114                                              7C81CF27 68 Bytes  [ 0F, 76, B2, 0F, B6, 58, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentStrings + 1                                          7C81CF6C 87 Bytes  [ 1C, 5A, 66, 89, 59, 14, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentStrings + 59                                         7C81CFC4 2 Bytes  [ 59, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentStrings + 5C                                         7C81CFC7 42 Bytes  [ B6, 58, 02, 66, 8B, 1C, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentStrings + 87                                         7C81CFF2 34 Bytes  JMP 7C81CF21 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetEnvironmentStrings + AA                                         7C81D015 261 Bytes  [ EC, 53, 33, DB, 38, 1D, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToOEM + 8D                                              7C81D11B 441 Bytes  [ 01, 81, 01, 81, 01, 01, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToOEM + 247                                             7C81D2D5 278 Bytes  [ 00, 85, C0, 59, 0F, 84, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToOEM + 35E                                             7C81D3EC 175 Bytes  [ 43, 00, 4F, 00, 4E, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToOEM + 40E                                             7C81D49C 143 Bytes  [ 89, 55, FC, 8B, 87, 70, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToOEM + 49E                                             7C81D52C 148 Bytes  [ 00, 33, DB, 39, 5D, A0, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetStdHandle + C                                                   7C81DC1F 187 Bytes  [ 23, 00, 43, 43, 89, 5D, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseConsoleHandle + 4E                                            7C81DCDC 48 Bytes  [ 00, 8B, 01, 39, 48, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseConsoleHandle + 7F                                            7C81DD0D 28 Bytes  [ 55, 8B, EC, 8B, 4D, 08, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseConsoleHandle + 9C                                            7C81DD2A 5 Bytes  [ 01, E9, BE, 45, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseConsoleHandle + A2                                            7C81DD30 78 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateConsoleHandle + 22                                        7C81DD7F 18 Bytes  [ 00, 0F, 85, AF, DB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DuplicateConsoleHandle + 35                                        7C81DD92 169 Bytes  [ CE, 89, 4D, 14, 3B, C3, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalA + 56                                        7C81DE3C 63 Bytes  [ 39, 7D, E0, 0F, 8C, D6, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalA + 97                                        7C81DE7D 56 Bytes  [ 00, 8B, 4D, F4, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalA + D0                                        7C81DEB6 121 Bytes  [ C7, 85, B4, FD, FF, FF, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalA + 14A                                       7C81DF30 23 Bytes  [ 75, 10, FF, 75, 08, E8, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalA + 162                                       7C81DF48 10 Bytes  [ 00, 8B, 48, 04, 85, C9, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeEnvironmentStringsA + D3                                       7C81E05A 272 Bytes  [ 4C, 64, 72, 46, 6C, 75, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreatePipe + 94                                                    7C81E16B 8 Bytes  [ 4C, 64, 72, 51, 75, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreatePipe + 9D                                                    7C81E174 252 Bytes  [ 72, 6F, 63, 65, 73, 73, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreatePipe + 19A                                                   7C81E271 79 Bytes  [ 6C, 73, 4D, 62, 4F, 65, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreatePipe + 1EA                                                   7C81E2C1 469 Bytes  [ 4E, 74, 41, 63, 63, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreatePipe + 3C0                                                   7C81E497 28 Bytes  [ 4E, 74, 43, 61, 6E, 63, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringW + 64                                    7C81EEC0 95 Bytes  [ 61, 67, 65, 00, 4E, 74, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringW + C4                                    7C81EF20 170 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringW + 16F                                   7C81EFCB 283 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TermsrvAppInstallMode + 109                                        7C81F0E7 46 Bytes  [ 4E, 74, 52, 65, 61, 64, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TermsrvAppInstallMode + 138                                        7C81F116 27 Bytes  [ 4E, 74, 52, 65, 61, 64, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TermsrvAppInstallMode + 154                                        7C81F132 57 Bytes  [ 65, 72, 54, 68, 72, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TermsrvAppInstallMode + 18E                                        7C81F16C 404 Bytes  [ 4E, 74, 52, 65, 6C, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameW + 83                                             7C81F301 248 Bytes  [ 53, 65, 74, 42, 6F, 6F, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameW + 17C                                            7C81F3FA 247 Bytes  [ 49, 6E, 66, 6F, 72, 6D, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameW + 274                                            7C81F4F2 131 Bytes  [ 50, 61, 69, 72, 00, 4E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameW + 2F8                                            7C81F576 74 Bytes  [ 4E, 74, 53, 65, 74, 53, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameW + 343                                            7C81F5C1 34 Bytes  [ 4E, 74, 53, 65, 74, 54, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressW + 5                                          7C81F743 68 Bytes  [ 4E, 74, 55, 6E, 6D, 61, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressW + 4A                                         7C81F788 71 Bytes  [ 76, 65, 6E, 74, 00, 4E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressW + 92                                         7C81F7D0 18 Bytes  [ 4E, 74, 57, 61, 69, 74, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressW + A5                                         7C81F7E3 140 Bytes  [ 4E, 74, 57, 72, 69, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressW + 132                                        7C81F870 200 Bytes  [ 72, 65, 66, 69, 78, 00, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalMemoryStatusEx + 3B                                          7C81F9DD 57 Bytes  [ 52, 74, 6C, 41, 64, 64, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalMemoryStatusEx + 75                                          7C81FA17 321 Bytes  [ 52, 74, 6C, 41, 64, 64, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerifyVersionInfoW + 23                                            7C81FB59 141 Bytes  [ 52, 74, 6C, 41, 6C, 6C, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointW + 4F                             7C81FBE7 135 Bytes  [ 52, 74, 6C, 41, 70, 70, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointW + D7                             7C81FC6F 30 Bytes  [ 46, 6C, 75, 73, 68, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointW + F6                             7C81FC8E 218 Bytes  [ 52, 74, 6C, 41, 72, 65, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExW + 98                                            7C81FD69 6 Bytes  [ 72, 6F, 63, 65, 73, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExW + 9F                                            7C81FD70 45 Bytes  [ 61, 72, 61, 6D, 65, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExW + CD                                            7C81FD9E 210 Bytes  [ 52, 74, 6C, 43, 6C, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExW + 1A0                                           7C81FE71 29 Bytes  [ 52, 74, 6C, 43, 6F, 6D, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExW + 1BE                                           7C81FE8F 335 Bytes  [ 52, 74, 6C, 43, 6F, 6E, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivCopyFileExW + 12                                               7C820081 131 Bytes  [ 10, 3B, CB, 0F, 85, BD, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivCopyFileExW + 97                                               7C820106 9 Bytes  [ F3, AB, A1, BC, F9, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivCopyFileExW + A1                                               7C820110 36 Bytes  [ 85, 7C, FF, FF, FF, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivCopyFileExW + C6                                               7C820135 42 Bytes  [ FF, B5, 7C, FF, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivCopyFileExW + F1                                               7C820160 10 Bytes  [ 8D, 8D, 60, FD, FF, FF, C7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExW + 24                                            7C820225 43 Bytes  [ 0F, 85, 9E, 73, 00, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExW + 52                                            7C820253 29 Bytes  [ 51, 8D, 4C, 9E, 20, 51, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExW + 70                                            7C820271 36 Bytes  [ 00, 00, 50, FF, 75, 0C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExW + 95                                            7C820296 3 Bytes  [ 5B, F6, 47 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExW + 99                                            7C82029A 31 Bytes  [ 04, 0F, 84, 0D, BD, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameW + 1D                              7C820D41 27 Bytes  [ 08, 8B, 4D, FC, 89, 48, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameW + 39                              7C820D5D 70 Bytes  [ C0, 44, 3B, D1, 73, 09, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameW + 80                              7C820DA4 16 Bytes  [ 00, 00, C0, 8B, 75, 0C, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameW + 91                              7C820DB5 127 Bytes  [ 8B, C6, 25, FF, 3F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameW + 112                             7C820E36 144 Bytes  CALL 7C8078B0 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointerEx                                                   7C821067 11 Bytes  CALL 79158755 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointerEx + C                                               7C821073 31 Bytes  [ 2B, C8, 8B, 02, 3B, 04, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFilePointerEx + 2C                                              7C821093 225 Bytes  JMP 7C7F1096 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueueTimer + 35                                         7C821175 8 Bytes  JMP 7C7F1B0A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueueTimer + 3E                                         7C82117E 5 Bytes  [ C0, E9, 8E, F2, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueueTimer + 44                                         7C821184 23 Bytes  [ B8, 58, 00, 00, C0, E9, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateTimerQueueTimer + F                                          7C82119C 65 Bytes  JMP 7C800450 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObject + 1                                    7C8211DE 2 Bytes  [ 45, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObject + 4                                    7C8211E1 15 Bytes  [ 00, 3B, C3, 74, 0F, 50, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObject + 14                                   7C8211F1 46 Bytes  [ 45, 14, 89, 18, 8B, 45, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObject + 43                                   7C821220 24 Bytes  [ 89, 1E, 80, 7D, FF, 01, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObject + 5C                                   7C821239 113 Bytes  JMP 7C804DD0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileW + 3A                                                     7C8212AB 12 Bytes  JMP 7C806629 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileW + 47                                                     7C8212B8 89 Bytes  CALL 7C7E4A2E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemWindowsDirectoryA + 11                                    7C821312 9 Bytes  [ 57, 53, FF, 75, F4, E8, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemWindowsDirectoryA + 1B                                    7C82131C 52 Bytes  [ 33, C0, 40, 6A, 12, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemWindowsDirectoryA + 50                                    7C821351 56 Bytes  [ C7, 06, 5A, 00, 00, C0, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWindowsDirectoryA + 18                                          7C82138B 31 Bytes  [ FF, 50, 56, C7, 45, D0, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWindowsDirectoryA + 38                                          7C8213AB 171 Bytes  [ 24, 4E, 74, 08, 4E, 75, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExitCodeThread + 14                                             7C821459 1 Byte  [ 2C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExitCodeThread + 16                                             7C82145B 117 Bytes  CALL 7C83543D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileStringA + 2C                                             7C8214D1 151 Bytes  JMP 7C8213C7 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeA + 76                                                 7C821569 38 Bytes  [ 00, 8A, 80, 50, 38, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeA + 9D                                                 7C821590 26 Bytes  [ 8B, F8, F3, A5, 8B, CA, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeA + B8                                                 7C8215AB 53 Bytes  [ 8B, 45, B0, 8B, 38, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeA + EE                                                 7C8215E1 102 Bytes  [ F6, 43, 01, 03, C6, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDriveTypeA + 156                                                7C821649 34 Bytes  [ 57, 8F, FE, FF, 0F, B7, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessAffinityMask + 1C                                        7C821791 24 Bytes  [ F6, 89, 75, D4, 0F, 8C, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessAffinityMask + 36                                        7C8217AB 72 Bytes  JMP 7C80BBD0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryA + 39                                              7C8217F5 181 Bytes  JMP 7C80BBD0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathA + B1                                                   7C8218AB 7 Bytes  [ D0, A1, 34, E2, 97, 7C, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathA + BA                                                   7C8218B4 101 Bytes  [ 14, 00, 50, FF, 75, F0, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathA + 120                                                  7C82191A 20 Bytes  CALL 7C83521A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SearchPathA + 135                                                  7C82192F 127 Bytes  [ F6, 0F, 8C, 7D, A2, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFile + 1D                                                      7C8219AF 36 Bytes  [ 0C, 85, C9, 75, 04, 33, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFile + 42                                                      7C8219D4 79 Bytes  [ 75, 20, D1, EF, FF, 75, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFile + 92                                                      7C821A24 114 Bytes  [ 14, 00, 00, 0B, C8, D1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFile + 105                                                     7C821A97 47 Bytes  JMP 7C80BAB0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenFile + 135                                                     7C821AC7 7 Bytes  [ 83, 63, 10, 00, E9, 46, A0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationA + 61                                         7C821C16 10 Bytes  [ 4E, 02, 01, 4D, F8, 81, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationA + 6D                                         7C821C22 28 Bytes  [ 76, 0A, B8, 7D, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationA + 8A                                         7C821C3F 77 Bytes  JMP 7C80A6D6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationA + D8                                         7C821C8D 18 Bytes  [ 4B, 04, 8B, 45, 08, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeInformationA + EB                                         7C821CA0 43 Bytes  JMP 7C80A6D7 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceW + 23                                               7C821DC0 57 Bytes  CALL 7C7E734B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceW + 5D                                               7C821DFA 21 Bytes  [ BE, 5A, 00, 00, C0, E9, 13, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceW + 73                                               7C821E10 19 Bytes  [ 7D, FE, FF, 85, F6, 74, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceW + 87                                               7C821E24 18 Bytes  [ 85, C0, 0F, 84, D8, 5E, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceW + 9A                                               7C821E37 24 Bytes  JMP 7C809F16 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceW + 9B                                              7C821FC9 7 Bytes  [ 75, D8, 8B, 40, 30, 6A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceW + A3                                              7C821FD1 62 Bytes  CALL 7C7E734B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceW + E2                                              7C822010 63 Bytes  [ 8B, 75, 08, 8B, 45, E4, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceW + 122                                             7C822050 9 Bytes  [ 68, 52, AC, 94, 7C, E8, B3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceW + 12C                                             7C82205A 169 Bytes  [ 8B, 45, 08, 83, C4, 10, E9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommTimeouts + FA                                               7C822232 517 Bytes  [ 00, 00, 51, 8B, F8, E8, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommTimeouts + 300                                              7C822438 247 Bytes  CALL 7C80760D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommTimeouts + 3F8                                              7C822530 67 Bytes  CALL 7C836507 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommTimeouts + 43C                                              7C822574 31 Bytes  [ 00, 8B, 40, 30, 8B, 40, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommTimeouts + 45C                                              7C822594 172 Bytes  [ 57, 68, AC, B2, 94, 7C, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeResource + 5                                                   7C8260D7 277 Bytes  [ 85, DB, 74, 14, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeResource + 11B                                                 7C8261ED 156 Bytes  [ 1A, FF, 75, 24, 8B, 43, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeResource + 1B8                                                 7C82628A 77 Bytes  [ 00, 85, C0, 7C, 3E, B3, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeResource + 206                                                 7C8262D8 56 Bytes  [ 90, 8B, FF, 55, 8B, EC, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeResource + 23F                                                 7C826311 41 Bytes  CALL 7C80476E C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExW + 45                                                   7C827B87 21 Bytes  [ 00, 8B, 45, DC, 8B, C8, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExW + 5B                                                   7C827B9D 126 Bytes  [ 0B, C8, D1, E1, C6, 45, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExW + DA                                                   7C827C1C 8 Bytes  CALL A56AD374 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExW + E3                                                   7C827C25 10 Bytes  JMP 7C829F57 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExW + EE                                                   7C827C30 14 Bytes  [ FF, 55, 8B, EC, 8B, 55, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileA + B6                                                     7C8287B4 15 Bytes  [ 46, 89, 45, 0C, 46, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileA + C6                                                     7C8287C4 1 Byte  [ 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileA + C9                                                     7C8287C7 39 Bytes  JMP 7C827095 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileA + F1                                                     7C8287EF 25 Bytes  JMP 7C828741 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileA + 10B                                                    7C828809 165 Bytes  [ 7A, 0F, 87, 0C, AD, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesW + A6                                              7C82A992 107 Bytes  [ 8B, 75, BC, 0F, B6, 4E, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesW + 112                                             7C82A9FE 44 Bytes  [ 40, 04, 81, FB, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesW + 13F                                             7C82AA2B 85 Bytes  [ C9, C2, 40, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesW + 196                                             7C82AA82 26 Bytes  [ 01, 01, 00, 00, 00, 01, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesW + 1B1                                             7C82AA9D 17 Bytes  [ 85, F6, 0F, 8F, CB, 65, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNlsSecurityDescriptor + D8                                   7C82AD54 259 Bytes  JMP 7C82B1C9 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenDataFile + B1                                                  7C82AE59 60 Bytes  [ 0F, B7, 55, 18, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenDataFile + EE                                                  7C82AE96 39 Bytes  [ 8B, F2, C1, EE, 08, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenDataFile + 116                                                 7C82AEBE 40 Bytes  [ 00, 0F, B7, 55, 18, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenDataFile + 13F                                                 7C82AEE7 11 Bytes  [ 0C, 71, 66, 01, 4D, 18, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenDataFile + 14B                                                 7C82AEF3 38 Bytes  [ B7, 55, 18, 8B, 0D, E0, E0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryInformationJobObject + 17                                     7C82AFF0 42 Bytes  [ 00, 85, C0, 8B, 7D, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryInformationJobObject + 42                                     7C82B01B 48 Bytes  [ 14, 02, 0F, B6, CC, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryInformationJobObject + 73                                     7C82B04C 27 Bytes  [ F0, 66, 83, FE, 61, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryInformationJobObject + 8F                                     7C82B068 70 Bytes  [ 00, EB, EB, A1, E0, E0, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObjectEx + 19                                 7C82B0AF 94 Bytes  [ F9, 02, 72, 15, 88, 07, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObjectEx + 78                                 7C82B10E 21 Bytes  [ 3D, 93, 7C, 8B, 3D, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObjectEx + 8E                                 7C82B124 27 Bytes  [ 55, 8B, EC, 51, 51, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWaitForSingleObjectEx + AA                                 7C82B140 37 Bytes  [ FF, 8B, 4D, 0C, 3B, C1, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualLock + 17                                                   7C82B166 62 Bytes  [ 89, 4D, 10, 8D, 3C, 4A, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualLock + 56                                                   7C82B1A5 181 Bytes  [ 8B, 55, 08, 88, 4A, F2, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VirtualLock + 10C                                                  7C82B25B 82 Bytes  [ B7, 4D, 18, 8A, 0C, 01, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimerQueueTimer + 30                                            7C82B2AE 12 Bytes  [ 18, 72, 11, 66, 83, 7D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimerQueueTimer + 3D                                            7C82B2BB 242 Bytes  [ FF, 81, C1, E0, FF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCacheSupport + 11                                 7C82B3AE 95 Bytes  [ 4D, 18, 0F, B7, 4D, 18, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCacheSupport + 71                                 7C82B40E 78 Bytes  [ 0F, B7, 4D, 18, 8A, 0C, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCacheSupport + C0                                 7C82B45D 159 Bytes  [ B7, 07, 40, 40, D1, E8, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCacheSupport + 160                                7C82B4FD 59 Bytes  [ 01, 0F, 85, 1E, 52, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseInitAppcompatCacheSupport + 19C                                7C82B539 32 Bytes  [ 82, 5A, FF, FF, FF, E9, DC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileEx + 1                                                     7C82BD0C 7 Bytes  [ 5D, 0C, 56, 8B, 75, 10, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileEx + 9                                                     7C82BD14 60 Bytes  [ 7D, 14, 57, 56, 53, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileEx + 46                                                    7C82BD51 65 Bytes  JMP 0D134DE6 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileEx + 88                                                    7C82BD93 2 Bytes  [ FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileEx + 8B                                                    7C82BD96 3 Bytes  [ 89, 45, E0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetHandleInformation + B                                           7C82BDD0 100 Bytes  [ FF, FF, FF, FF, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetHandleInformation + 70                                          7C82BE35 91 Bytes  [ 00, 00, 8B, 40, 30, 6A, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetHandleInformation + CC                                          7C82BE91 13 Bytes  [ 5E, 5F, 5D, C2, 10, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetHandleInformation + DA                                          7C82BE9F 10 Bytes  [ 75, E0, 56, 68, 80, E4, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetHandleInformation + E5                                          7C82BEAA 120 Bytes  [ FF, FF, 84, C0, 0F, 84, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddRefActCtx + 12                                                  7C82BF23 10 Bytes  [ 8B, 46, 18, 3B, C2, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddRefActCtx + 1D                                                  7C82BF2E 58 Bytes  [ 8B, 45, 08, 83, C0, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddRefActCtx + 58                                                  7C82BF69 91 Bytes  JMP 7C81E8DE C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddRefActCtx + B5                                                  7C82BFC6 74 Bytes  [ 85, C0, 0F, 8D, E6, 42, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterWait + 9                                                 7C82C011 5 Bytes  [ 00, 50, E8, 19, 26 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterWait + 10                                                7C82C018 169 Bytes  [ 03, C7, 13, D3, 89, 86, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserAPC + 30                                                  7C82C0C2 25 Bytes  [ FF, 76, 0C, 8B, 40, 30, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserAPC + 4A                                                  7C82C0DC 73 Bytes  [ FF, 33, C0, 5E, 5D, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserAPC + 94                                                  7C82C126 15 Bytes  [ 5D, C2, 08, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserAPC + A4                                                  7C82C136 33 Bytes  [ 00, 00, 83, C8, FF, 5D, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserAPC + C6                                                  7C82C158 65 Bytes  JMP 7C822A19 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathW + 10                                         7C82C207 35 Bytes  [ FD, FF, 8B, F0, 3B, F3, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathW + 35                                         7C82C22C 48 Bytes  [ 8D, 45, 08, 50, 6A, 05, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathW + 66                                         7C82C25D 65 Bytes  [ 66, 8B, 50, 02, 66, 83, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathW + A8                                         7C82C29F 39 Bytes  [ FF, 75, 0C, C7, 07, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathW + D0                                         7C82C2C7 53 Bytes  [ 03, CE, 3B, C8, 0F, 83, AD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDriveStringsA + 1A                                       7C82C2FD 20 Bytes  JMP 7C809680 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDriveStringsA + 30                                       7C82C313 70 Bytes  JMP 7C80B174 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetPriorityClass + 12                                              7C82C35A 32 Bytes  [ 84, E5, 1B, FF, FF, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetPriorityClass + 33                                              7C82C37B 34 Bytes  [ 82, 1B, FF, FF, FF, 0F, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetPriorityClass + 56                                              7C82C39E 88 Bytes  [ 14, 56, 66, 89, 50, 32, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalGetAtomNameW + 29                                            7C82C3F7 144 Bytes  [ 0F, B6, D2, 66, 8B, 14, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalGetAtomNameW + BA                                            7C82C488 36 Bytes  [ 3B, D6, 0F, 85, C2, 1A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalGetAtomNameW + DF                                            7C82C4AD 41 Bytes  [ 2D, 8B, 50, 18, 03, D0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalGetAtomNameW + 109                                           7C82C4D7 42 Bytes  [ 39, 30, 74, 0F, 8B, 85, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalGetAtomNameW + 134                                           7C82C502 77 Bytes  [ 00, 51, 56, FF, 70, 18, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitNamedPipeW + 18                                                7C82C68C 4 Bytes  [ 8D, D7, 06, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitNamedPipeW + 1D                                                7C82C691 6 Bytes  [ 83, 8D, E8, FD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitNamedPipeW + 24                                                7C82C698 159 Bytes  JMP 7C82CD68 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitNamedPipeW + C4                                                7C82C738 22 Bytes  [ 3C, 64, 0F, 84, 28, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitNamedPipeW + DB                                                7C82C74F 60 Bytes  [ 00, 3C, 75, 0F, 84, 10, 06, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseProfileUserMapping + 5                                        7C82C882 12 Bytes  [ 10, 08, 8B, 85, EC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseProfileUserMapping + 12                                       7C82C88F 34 Bytes  [ FC, 50, 8D, 85, F4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseProfileUserMapping + 36                                       7C82C8B3 44 Bytes  [ EB, 2C, 8B, 8D, EC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseProfileUserMapping + 64                                       7C82C8E1 5 Bytes  [ 8D, 85, F4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CloseProfileUserMapping + 6A                                       7C82C8E7 9 Bytes  [ 89, 85, E4, FD, FF, FF, E9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessShutdownParameters + 2                                   7C82C8FF 41 Bytes  [ 8B, 40, FC, 85, C0, 74, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessShutdownParameters + 2C                                  7C82C929 21 Bytes  [ FF, 01, 00, 00, 00, E9, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessShutdownParameters + 42                                  7C82C93F 55 Bytes  [ A1, F8, 0E, 98, 7C, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessShutdownParameters + 7B                                  7C82C978 8 Bytes  [ 7E, 06, 89, 85, E8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessShutdownParameters + 84                                  7C82C981 8 Bytes  [ A3, 00, 00, 00, 39, 85, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreA + B                                                 7C82CA62 13 Bytes  [ 85, C0, 75, 0B, A1, F8, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreA + 19                                                7C82CA70 25 Bytes  [ FF, 8B, 85, E4, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreA + 33                                                7C82CA8A 12 Bytes  JMP 7C82CB93 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreA + 40                                                7C82CA97 6 Bytes  [ 00, 00, 89, 8D, BC, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreA + 47                                                7C82CA9E 5 Bytes  [ FF, E9, 2F, 03, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetInformationJobObject + 2                                        7C82CAB1 17 Bytes  [ FF, 30, 88, 85, D9, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetInformationJobObject + 14                                       7C82CAC3 32 Bytes  JMP 7C82CDEA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetInformationJobObject + 35                                       7C82CAE4 12 Bytes  JMP 7C82CDE8 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetInformationJobObject + 42                                       7C82CAF1 35 Bytes  [ 04, F6, 85, F0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectW + 2                                               7C82CB15 25 Bytes  [ FF, 89, 08, C7, 85, C0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectW + 1C                                              7C82CB2F 42 Bytes  JMP 7C825DE6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectW + 47                                              7C82CB5A 1 Byte  [ 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectW + 4A                                              7C82CB5D 21 Bytes  CALL 8C82CB5F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectW + 60                                              7C82CB73 17 Bytes  [ 00, 8B, CE, 80, 39, 30, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelWaitableTimer + 2                                            7C82CC1B 8 Bytes  [ FF, 8D, 4D, F4, E8, B9, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelWaitableTimer + B                                            7C82CC24 12 Bytes  [ 83, BD, B0, FD, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelWaitableTimer + 18                                           7C82CC31 13 Bytes  [ 00, EB, BA, FF, B5, C8, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelWaitableTimer + 26                                           7C82CC3F 86 Bytes  CALL 7C82CF70 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelWaitableTimer + 7D                                           7C82CC96 6 Bytes  [ FF, 89, 85, C4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotA + 2                                                7C82CC9D 19 Bytes  JMP 7C82CD68 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotA + 17                                               7C82CCB2 7 Bytes  [ A1, C8, E0, 97, 7C, 8B, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotA + 1F                                               7C82CCBA 23 Bytes  [ 89, 45, FC, 8B, 45, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotA + 37                                               7C82CCD2 8 Bytes  [ 33, C9, 84, DB, 89, 85, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotA + 40                                               7C82CCDB 18 Bytes  [ FF, 89, 8D, E0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotW + 2                                                7C82CCEE 6 Bytes  [ 56, 57, FF, 85, D4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotW + 9                                                7C82CCF5 77 Bytes  [ FF, 33, C0, 39, 85, DC, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotW + 57                                               7C82CD43 42 Bytes  [ FD, FF, FF, 00, 0F, B6, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotW + 82                                               7C82CD6E 100 Bytes  [ 8A, 18, 84, DB, 0F, 84, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMailslotW + E7                                               7C82CDD3 22 Bytes  [ F6, 85, F0, FD, FF, FF, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMailslotInfo + 2                                                7C82CDEA 23 Bytes  [ 8B, 9D, F0, FD, FF, FF, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMailslotInfo + 1A                                               7C82CE02 8 Bytes  [ FF, 04, F6, C3, 20, 8B, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMailslotInfo + 24                                               7C82CE0C 97 Bytes  [ FF, 0F, 85, 14, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMailslotInfo + 86                                               7C82CE6E 30 Bytes  [ 00, 00, 8B, C3, 0B, C7, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMailslotInfo + A5                                               7C82CE8D 5 Bytes  [ 89, B5, E4, FD, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameW + 9A                                    7C82CF5C 19 Bytes  [ FF, 8B, D8, 8B, FA, 0F, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindVolumeClose                                                    7C82CF70 39 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindVolumeClose + 28                                               7C82CF98 119 Bytes  [ 90, 90, 90, 90, 90, F6, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeW + 65                                               7C82D010 104 Bytes  [ 45, E0, C6, 00, 00, 8B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeW + CE                                               7C82D079 10 Bytes  [ FF, 03, 8D, BC, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeW + D9                                               7C82D084 167 Bytes  [ FF, C7, 45, C0, 14, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeW + 181                                              7C82D12C 20 Bytes  [ 48, 20, 66, F7, C1, FF, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeW + 196                                              7C82D141 74 Bytes  CALL 7C804CCB C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeW + 71                                              7C82D330 8 Bytes  [ 8D, 45, 08, 50, 6A, 0E, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeW + 7A                                              7C82D339 79 Bytes  CALL 7C807764 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAdjustment + A                                        7C82D389 42 Bytes  [ 89, 5D, A4, 83, BF, 70, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAdjustment + 36                                       7C82D3B5 34 Bytes  [ E4, 66, 3B, 08, 76, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAdjustment + 59                                       7C82D3D8 78 Bytes  CALL 7C808BBC C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAdjustment + A9                                       7C82D428 9 Bytes  [ 53, 8D, 45, D0, 50, E8, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimeAdjustment + B3                                       7C82D432 46 Bytes  [ 8B, 45, D0, 2B, 45, D8, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleW + 11                                              7C82D9DE 42 Bytes  [ FF, F3, AB, 8D, 85, E4, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleW + 3C                                              7C82DA09 5 Bytes  [ 15, 20, F3, 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleW + 42                                              7C82DA0F 11 Bytes  [ C0, 0F, 84, 3C, 66, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleW + 4E                                              7C82DA1B 75 Bytes  [ FF, 85, C0, 0F, 84, 2E, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleW + 9A                                              7C82DA67 19 Bytes  [ 0F, 84, 05, 77, 00, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFileGather + 30                                               7C82DDE5 23 Bytes  [ C3, 83, C7, F8, 89, BD, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFileGather + 48                                               7C82DDFD 83 Bytes  [ 8B, 8D, 74, FE, FF, FF, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFileGather + 9C                                               7C82DE51 45 Bytes  [ 8B, 85, 64, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileScatter + 1E                                               7C82DE7F 3 Bytes  [ FB, 00, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileScatter + 22                                               7C82DE83 169 Bytes  [ 00, 0F, 87, 84, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileScatter + CD                                               7C82DF2E 67 Bytes  CALL 7C856506 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileScatter + 111                                              7C82DF72 45 Bytes  [ CB, 23, CF, 33, C0, 0B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadFileScatter + 13F                                              7C82DFA0 5 Bytes  [ 0F, B7, 80, 14, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesA + 12                                        7C82E022 26 Bytes  [ 85, C0, 7D, A1, B8, 0D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesA + 2D                                        7C82E03D 38 Bytes  [ FF, 6A, 04, B8, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesA + 54                                        7C82E064 39 Bytes  [ 11, 8B, 45, 08, 8B, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesA + 7D                                        7C82E08D 179 Bytes  [ 00, 8B, 40, 30, 6A, 0C, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesA + 131                                       7C82E141 50 Bytes  CALL 7C80734A C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetHandleInformation + 90                                          7C82E22C 32 Bytes  [ 90, 90, 90, 90, 90, 68, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetHandleInformation + B1                                          7C82E24D 121 Bytes  [ 89, 5D, D8, 83, C0, 07, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetHandleInformation + 12B                                         7C82E2C7 3 Bytes  [ 50, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetHandleInformation + 12F                                         7C82E2CB 8 Bytes  [ 66, 85, C0, 0F, 84, 8B, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetHandleInformation + 138                                         7C82E2D4 6 Bytes  [ 8B, 4B, 04, 89, 8D, 58 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreW + 39                                                7C82E358 36 Bytes  [ 83, 4D, FC, FF, 85, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreW + 5E                                                7C82E37D 28 Bytes  [ 00, 00, 00, 0F, 83, 04, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreW + 7C                                                7C82E39B 12 Bytes  [ FF, 57, 06, 95, 7C, 60, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreW + 89                                                7C82E3A8 43 Bytes  [ B2, 06, 95, 7C, BB, 06, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenSemaphoreW + B5                                                7C82E3D4 113 Bytes  [ F6, 05, F0, 02, FE, 7F, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AssignProcessToJobObject + 24                                      7C82E47E 52 Bytes  [ 00, 8B, 45, E0, 8A, 48, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AssignProcessToJobObject + 5A                                      7C82E4B4 83 Bytes  [ 00, 81, FE, 00, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AssignProcessToJobObject + AE                                      7C82E508 111 Bytes  [ 74, 0E, FF, 45, DC, 8B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AssignProcessToJobObject + 11E                                     7C82E578 41 Bytes  CALL 022F6306 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AssignProcessToJobObject + 148                                     7C82E5A2 44 Bytes  [ FF, FF, FF, 30, 56, 8B, D7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameW + 57                                            7C82E683 13 Bytes  [ 0F, B7, 0F, C1, E1, 10, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameW + 65                                            7C82E691 12 Bytes  [ 25, FF, FF, 00, 00, 0B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameW + 72                                            7C82E69E 63 Bytes  [ FF, FF, 89, 9D, 70, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameW + B2                                            7C82E6DE 39 Bytes  [ 0F, 84, C8, 04, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameW + DA                                            7C82E706 113 Bytes  [ 80, 79, 07, FF, 0F, 85, C6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNameA + C3                                            7C82E985 160 Bytes  [ 89, 5D, F4, 8D, 4E, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToTzSpecificLocalTime + 55                               7C82EA26 29 Bytes  [ 88, 55, E4, 8B, F9, 89, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToTzSpecificLocalTime + 74                               7C82EA45 72 Bytes  [ DC, 85, C0, 0F, 84, C4, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToTzSpecificLocalTime + BD                               7C82EA8E 10 Bytes  [ D1, 8D, 47, 10, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToTzSpecificLocalTime + C8                               7C82EA99 21 Bytes  CALL 05872B29 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SystemTimeToTzSpecificLocalTime + DE                               7C82EAAF 21 Bytes  [ 45, 10, 89, 55, F0, 83, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatA + 2                                               7C82EC68 42 Bytes  JMP DD107571 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatA + 2D                                              7C82EC93 104 Bytes  [ FF, 0F, 85, AF, FC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatA + 96                                              7C82ECFC 11 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatA + A3                                              7C82ED09 39 Bytes  [ F6, 05, F0, 02, FE, 7F, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatA + CB                                              7C82ED31 5 Bytes  [ 33, FF, E9, 9D, F9 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerLanguageNameA + 55                                              7C82F029 70 Bytes  [ BC, 38, 88, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerLanguageNameW + 14                                              7C82F070 113 Bytes  JMP 7C82E7D5 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerLanguageNameW + 86                                              7C82F0E2 3 Bytes  [ FF, 52, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerLanguageNameW + 8A                                              7C82F0E6 40 Bytes  CALL 7C80734A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeW + 20                                              7C82F10F 7 Bytes  [ FF, 76, 24, E8, 36, 82, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeW + 28                                              7C82F117 9 Bytes  [ 8D, 84, 9E, B4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeW + 32                                              7C82F121 4 Bytes  [ F0, 0F, C1, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeW + 37                                              7C82F126 49 Bytes  [ 84, 9E, B4, 00, 00, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeW + 69                                              7C82F158 17 Bytes  [ 10, 83, 38, 02, 75, 0C, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LockFileEx + 19                                                    7C82F59E 71 Bytes  JMP 7C81F736 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LockFileEx + 61                                                    7C82F5E6 9 Bytes  [ 0F, B7, 48, 02, 51, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LockFileEx + 6B                                                    7C82F5F0 113 Bytes  [ 00, 66, FF, 4E, 04, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CmdBatNotification + 3D                                            7C82F662 42 Bytes  [ 90, 90, 90, 90, 90, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CmdBatNotification + 69                                            7C82F68E 4 Bytes  [ 84, EA, 28, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CmdBatNotification + 6E                                            7C82F693 10 Bytes  [ 3A, C3, 75, 2C, 38, 1D, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CmdBatNotification + 79                                            7C82F69E 29 Bytes  [ 24, 6A, 03, 58, 57, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CmdBatNotification + 97                                            7C82F6BC 30 Bytes  JMP 7C821F7B C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FormatMessageA + 6A                                                7C82F826 29 Bytes  [ 00, 00, 8B, 0D, 88, 0B, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindAtomW + 1                                                      7C82F844 105 Bytes  [ D9, 33, D2, 85, DB, 7C, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileW + 1F                                                     7C82F8AE 9 Bytes  [ 08, 72, 71, 57, 8B, 7E, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntW + 2                                                 7C82F8B8 75 Bytes  [ 74, 5B, 33, D2, 89, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntW + 4E                                                7C82F904 77 Bytes  [ 39, 34, 85, 90, 0B, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntW + 9C                                                7C82F952 4 Bytes  [ 68, 4C, 85, 93 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntW + A1                                                7C82F957 95 Bytes  CALL 7C82F97C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntW + 101                                               7C82F9B7 24 Bytes  [ C4, 1C, 38, 1D, C1, E1, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadAffinityMask + 98                                         7C82FB2E 80 Bytes  CALL 7C80BCC6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerW + 11                                          7C82FB7F 50 Bytes  [ 05, 70, 0B, 98, 7C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerW + 44                                          7C82FBB2 7 Bytes  [ 5C, 00, 6D, 00, 73, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerW + 4C                                          7C82FBBA 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerW + 4E                                          7C82FBBC 11 Bytes  [ 72, 00, 65, 00, 65, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerW + 5A                                          7C82FBC8 3 Bytes  [ 6C, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenThread + 2B                                                    7C82FC47 12 Bytes  [ 0C, FF, 70, 04, 56, E8, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenThread + 38                                                    7C82FC54 65 Bytes  [ 45, FC, 0F, 8C, EC, 8C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenThread + 7A                                                    7C82FC96 28 Bytes  [ 84, AE, 74, FD, FF, E9, A7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenThread + 99                                                    7C82FCB5 3 Bytes  [ 75, 20, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenThread + 9D                                                    7C82FCB9 36 Bytes  CALL 7C82FCC8 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionStringW + 4                                       7C82FD6C 84 Bytes  [ 45, 08, C7, 00, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionStringW + 59                                      7C82FDC1 25 Bytes  [ 16, 00, 66, C7, 85, 7E, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionStringW + 73                                      7C82FDDB 3 Bytes  [ 85, 7C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionStringW + 77                                      7C82FDDF 15 Bytes  CALL 7C80CBE5 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionStringW + 87                                      7C82FDEF 24 Bytes  [ 8B, 75, DC, 66, 83, 7E, 38, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFiber + 2                                                    7C82FEA2 8 Bytes  [ 8B, F0, 3B, F3, 0F, 8C, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFiber + C                                                    7C82FEAC 159 Bytes  [ 68, 7C, 0B, 98, 7C, 53, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertThreadToFiber + 1A                                          7C82FF4C 21 Bytes  [ 8B, 45, 8C, 3B, 07, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertThreadToFiber + 30                                          7C82FF62 13 Bytes  JMP 7C818F15 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertThreadToFiber + 3E                                          7C82FF70 36 Bytes  [ EC, 8B, 45, 08, 8B, 0D, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertThreadToFiber + 63                                          7C82FF95 34 Bytes  [ 7D, 08, 8B, 75, 10, 83, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertThreadToFiber + 86                                          7C82FFB8 7 Bytes  [ 3B, 7D, FC, 0F, 83, AD, 05 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiber + D                                                    7C82FFD8 13 Bytes  [ 8A, 56, 02, 88, 57, 01, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiber + 1B                                                   7C82FFE6 27 Bytes  [ 8A, 56, 03, 88, 57, 02, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiberEx + 17                                                 7C830002 44 Bytes  [ 8A, 56, 05, 88, 57, 04, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiberEx + 44                                                 7C83002F 43 Bytes  [ 88, 57, 07, 83, C6, 09, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiberEx + 70                                                 7C83005B 1 Byte  [ 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiberEx + 72                                                 7C83005D 27 Bytes  [ 00, 00, 01, 00, 00, 80, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateFiberEx + 8E                                                 7C830079 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterWaitEx + 28                                              7C8300A6 3 Bytes  [ FF, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterWaitEx + 2C                                              7C8300AA 8 Bytes  [ FF, 03, 00, 00, FF, 07, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterWaitEx + 35                                              7C8300B3 33 Bytes  [ 0F, 00, 00, FF, 1F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentActCtx + 10                                              7C8300D5 89 Bytes  [ 8D, 56, 01, 89, 55, F4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelIo + 39                                                      7C83012F 42 Bytes  [ 00, 8A, 56, 04, 88, 57, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelIo + 64                                                      7C83015A 121 Bytes  [ 8A, 56, 07, 88, 57, 06, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceW + 9                                              7C8301D4 17 Bytes  [ 75, F4, 83, EF, 02, A8, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceW + 1B                                             7C8301E6 4 Bytes  [ 85, 09, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceW + 20                                             7C8301EB 27 Bytes  [ 8A, 56, 04, 88, 57, 03, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceW + 3C                                             7C830207 55 Bytes  [ 8A, 56, 06, 88, 57, 05, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceW + 74                                             7C83023F 151 Bytes  JMP 7C83018C C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceA + 4                                              7C83030D 136 Bytes  [ F1, 23, 0C, 9D, 62, 8C, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceA + 8D                                             7C830396 40 Bytes  [ 3B, 7D, F8, 77, 72, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDiskFreeSpaceExA + 8                                            7C8303BF 56 Bytes  [ 0F, 82, FE, 05, 00, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessWorkingSetSize + C                                       7C8303F8 51 Bytes  [ 0E, 01, 00, 00, 8A, 56, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessWorkingSetSize + 40                                      7C83042C 66 Bytes  [ 4E, 06, 8D, 56, 01, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessWorkingSetSize + 83                                      7C83046F 324 Bytes  [ 07, 88, 57, 06, A8, 80, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessWorkingSetSize + 1C8                                     7C8305B4 208 Bytes  [ 3B, 7D, F8, 77, 40, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToDosDateTime + C                                          7C830685 66 Bytes  [ 55, 08, 03, 14, 9D, 1E, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToDosDateTime + 4F                                         7C8306C8 103 Bytes  [ 3B, 7D, F8, 77, 40, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToDosDateTime + B8                                         7C830731 3 Bytes  [ 3B, 7D, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToDosDateTime + BC                                         7C830735 101 Bytes  [ 84, 90, 02, 00, 00, A8, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FileTimeToDosDateTime + 122                                        7C83079B 31 Bytes  [ 03, 14, 9D, 1E, 8C, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathW + 16                                                  7C8307BB 58 Bytes  [ 3B, 7D, 0C, 0F, 84, 06, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathW + 51                                                  7C8307F6 15 Bytes  [ 87, D9, D3, EE, 87, D9, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathW + 61                                                  7C830806 8 Bytes  [ 82, B8, 01, 00, 00, 83, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathW + 6A                                                  7C83080F 35 Bytes  [ 14, 39, 3B, 55, 0C, 0F, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathW + 8E                                                  7C830833 119 Bytes  [ 14, 11, 8B, 75, F4, 4E, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateEventA + 27                                                  7C8308F0 311 Bytes  [ 3B, 7D, F8, 77, 40, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenProcess + 27                                                   7C830A28 28 Bytes  [ FF, D0, E1, D0, F9, D0, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenProcess + 44                                                   7C830A45 33 Bytes  [ 23, 80, 7A, 0E, 05, 75, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenProcess + 66                                                   7C830A67 32 Bytes  [ FF, D9, AD, 5E, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserWorkItem + 6                                              7C830A88 8 Bytes  [ 00, D9, C9, 8A, 8D, 61, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserWorkItem + F                                              7C830A91 144 Bytes  [ D9, E5, 9B, DD, BD, 60, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserWorkItem + A1                                             7C830B23 6 Bytes  [ FF, DB, AD, 62, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserWorkItem + A8                                             7C830B2A 3 Bytes  [ F6, 85, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueueUserWorkItem + AD                                             7C830B2F 61 Bytes  [ FF, 40, 74, 09, C6, 85, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDrives + 39                                              7C830B6D 15 Bytes  [ FF, FF, 40, 74, 09, C6, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDrives + 49                                              7C830B7D 3 Bytes  [ 70, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDrives + 4D                                              7C830B81 20 Bytes  [ 01, DE, C1, C3, DD, D8, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDrives + 62                                              7C830B96 70 Bytes  [ 7F, 07, C6, 85, 70, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalDeleteAtom + 2                                               7C830BDD 29 Bytes  CALL 3F79FDC0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalDeleteAtom + 20                                              7C830BFB 42 Bytes  [ 56, 01, 00, 00, 0B, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalDeleteAtom + 4B                                              7C830C26 81 Bytes  [ C6, 85, 70, FF, FF, FF, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalDeleteAtom + 9D                                              7C830C78 70 Bytes  JMP 7C830AEA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalDeleteAtom + E5                                              7C830CC0 64 Bytes  [ 58, D9, E4, 9B, DD, BD, 60, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindAtomA + 6                                                      7C830D24 23 Bytes  [ FF, 9B, F6, 85, 61, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindAtomA + 1E                                                     7C830D3C 46 Bytes  [ 9B, 8A, 95, 61, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindAtomA + 4D                                                     7C830D6B 77 Bytes  [ D9, FC, DE, D9, 9B, DF, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmp + 25                                                       7C830DB9 271 Bytes  JMP 7C830B96 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcmp + 135                                                      7C830EC9 120 Bytes  [ C3, 23, C7, 8B, 69, 18, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionGuid + 1                                          7C830F42 267 Bytes  [ C7, 03, F7, 33, C3, 23, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionGuid + 10D                                        7C83104E 62 Bytes  [ 03, F8, C1, C7, 09, 03, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionGuid + 14C                                        7C83108D 119 Bytes  [ C2, 23, C7, 33, C6, 03, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindActCtxSectionGuid + 1C4                                        7C831105 196 Bytes  [ 69, 08, 03, DA, 33, C3, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalMemoryStatus + B8                                            7C8311CA 297 Bytes  [ C2, 8B, 69, 10, 33, C3, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalMemoryStatus + 1E2                                           7C8312F4 11 Bytes  [ 2A, 43, 03, F8, C1, C7, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalMemoryStatus + 1EE                                           7C831300 25 Bytes  [ 03, FB, 8B, 69, 38, 0B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TransactNamedPipe + 15                                             7C83131A 178 Bytes  [ 03, F7, 8B, 69, 14, 0B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateIoCompletionPort + 28                                        7C8313CD 77 Bytes  [ C2, 83, F0, FF, 03, FB, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetNamedPipeHandleState + F                                        7C83141B 209 Bytes  [ C6, 83, F0, FF, 03, DA, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConnectNamedPipe + 72                                              7C8314ED 79 Bytes  [ C6, 83, C1, 08, D1, C0, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileAttributesW + 48                                            7C83153D 192 Bytes  [ 8B, 6C, 24, 04, D1, C8, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetOverlappedResult + 1A                                           7C8315FE 180 Bytes  [ 6C, 24, 1C, D1, CF, 33, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadDirectoryChangesW + 64                                         7C8316B3 89 Bytes  JMP 9F88DC79 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameW + 26                                              7C83170D 161 Bytes  JMP 740EFF35 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameW + C8                                              7C8317AF 45 Bytes  CALL 740F00E7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameW + F6                                              7C8317DD 238 Bytes  [ 24, 58, 8D, 8C, 0D, A1, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameW + 1E5                                             7C8318CC 172 Bytes  [ 74, 24, 78, 8D, BC, 3D, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameW + 292                                             7C831979 104 Bytes  CALL 740F02B1 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileTime + 30                                                   7C831D08 207 Bytes  [ 00, 03, C6, 8B, F1, 23, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileTime + 101                                                  7C831DD9 31 Bytes  [ 8D, BC, 3D, D6, C1, 62, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileTime + 122                                                  7C831DFA 163 Bytes  [ 8D, 94, 15, D6, C1, 62, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDirectoryW + 9C                                           7C831E9F 65 Bytes  [ 8D, 94, 15, D6, C1, 62, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemDirectoryW + DE                                           7C831EE1 98 Bytes  [ 8D, 9C, 1D, D6, C1, 62, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFileA + 4F                                                   7C831F44 113 Bytes  [ 8D, 94, 15, D6, C1, 62, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFileW + 3B                                                   7C831FB6 7 Bytes  [ 00, 81, C4, 40, 01, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFileW + 43                                                   7C831FBE 72 Bytes  [ 2E, 03, C5, 8B, 6E, 04, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteFileW + 8C                                                   7C832007 342 Bytes  [ 8B, 5D, 04, 8B, 4D, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextChangeNotification + 1                                     7C83215E 46 Bytes  [ 75, 24, 0F, CE, 89, 74, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextChangeNotification + 30                                    7C83218D 11 Bytes  [ F0, C1, C6, 05, 8D, BC, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosDateTimeToFileTime + 1                                          7C832199 25 Bytes  [ F1, 33, F2, 23, F3, 33, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosDateTimeToFileTime + 1B                                         7C8321B3 27 Bytes  [ C6, 05, 8D, 94, 16, 99, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosDateTimeToFileTime + 37                                         7C8321CF 98 Bytes  [ 74, 24, 30, 03, CE, 8B, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosDateTimeToFileTime + 9A                                         7C832232 14 Bytes  [ 02, 03, C6, 8B, 75, 3C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosDateTimeToFileTime + A9                                         7C832241 168 Bytes  [ F0, C1, C6, 05, 8D, BC, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsBadStringPtrA + 47                                               7C8322EA 29 Bytes  [ 99, 79, 82, 5A, 03, DE, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnlockFile + 4                                                     7C832308 97 Bytes  [ 6C, 24, 2C, 33, F5, 8B, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnlockFileEx + 27                                                  7C83236A 145 Bytes  [ 74, 24, 14, 8B, 6C, 24, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LockFile + 53                                                      7C8323FC 40 Bytes  [ DE, 8B, EA, 33, EF, 33, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryW + B                                               7C832425 40 Bytes  [ EB, C1, C5, 05, 8D, 84, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryW + 34                                              7C83244E 133 Bytes  [ 6C, 24, 58, 33, F5, D1, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryW + BA                                              7C8324D4 40 Bytes  CALL 4C45100C 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryW + E3                                              7C8324FD 189 Bytes  [ 8D, 9C, 1D, A1, EB, D9, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryW + 1A1                                             7C8325BB 13 Bytes  [ 6C, 24, 60, 33, F5, 8B, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalSize + A3                                                     7C8326A7 14 Bytes  [ 00, 00, 00, 33, F5, D1, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalSize + B2                                                     7C8326B6 57 Bytes  [ EF, C1, C5, 05, 8D, 94, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteAtom + 13                                                    7C8326F0 25 Bytes  [ 8B, EA, C1, C5, 05, 8D, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddAtomW + 1                                                       7C83270A 19 Bytes  [ 74, 24, 58, 8B, 6C, 24, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddAtomW + 15                                                      7C83271E 101 Bytes  [ 00, 00, 33, F5, D1, C6, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileIntW + C                                          7C832784 19 Bytes  [ 6C, 24, 68, 33, F5, 8B, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileIntW + 20                                         7C832798 11 Bytes  [ 00, 33, F5, D1, C6, 89, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileIntW + 2C                                         7C8327A4 9 Bytes  CALL 0988ED6A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileIntW + 36                                         7C8327AE 126 Bytes  [ 1B, 8F, 03, FE, 8B, EB, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileIntW + B5                                         7C83282D 151 Bytes  [ EA, C1, C5, 05, 8D, 8C, 29, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ResumeThread + 1                                                   7C832940 4 Bytes  [ EF, C1, C5, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ResumeThread + 6                                                   7C832945 125 Bytes  [ 94, 2A, DC, BC, 1B, 8F, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ResumeThread + 85                                                  7C8329C4 345 Bytes  [ 00, 33, F5, D1, C6, 89, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpandEnvironmentStringsA + FE                                     7C832B1F 91 Bytes  [ AC, 24, 9C, 00, 00, 00, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpandEnvironmentStringsA + 15A                                    7C832B7B 83 Bytes  [ AC, 24, CC, 00, 00, 00, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringA + 31                                      7C832BCF 78 Bytes  [ 89, B4, 24, DC, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringA + 80                                      7C832C1E 114 Bytes  [ 00, 00, 8B, EF, C1, C5, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringA + F3                                      7C832C91 5 Bytes  [ AC, 24, B0, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringA + F9                                      7C832C97 64 Bytes  [ 33, F5, 8B, AC, 24, C8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStringA + 13A                                     7C832CD8 11 Bytes  [ 00, 00, 8B, AC, 24, B4, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileSectionNamesA + 9                                 7C832DF8 47 Bytes  [ F5, 8B, AC, 24, DC, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileSectionNamesA + 39                                7C832E28 16 Bytes  [ C1, CA, 02, 03, DD, 8B, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileSectionNamesA + 4C                                7C832E3B 54 Bytes  [ 33, F5, 8B, AC, 24, E0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalLock + D                                                      7C832E72 10 Bytes  [ B4, 24, C4, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalLock + 18                                                     7C832E7D 78 Bytes  [ 00, 00, 33, F5, 8B, AC, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalLock + 67                                                     7C832ECC 73 Bytes  [ 33, F5, 8B, AC, 24, FC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalUnlock + 1D                                                   7C832F16 61 Bytes  [ 01, 00, 00, 33, F5, D1, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalUnlock + 5B                                                   7C832F54 201 Bytes  [ 33, F5, 8B, AC, 24, 04, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalUnlock + 125                                                  7C83301E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalUnlock + 127                                                  7C833020 154 Bytes  [ 33, F5, 8B, AC, 24, 10, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalUnlock + 1C2                                                  7C8330BB 47 Bytes  JMP 0988F681 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameW + 4                                                   7C833133 16 Bytes  [ AC, 24, 20, 01, 00, 00, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameW + 15                                                  7C833144 14 Bytes  CALL 0988F70A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameW + 24                                                  7C833153 21 Bytes  JMP 48451B8B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameW + 3B                                                  7C83316A 28 Bytes  [ 00, 33, F5, 8B, AC, 24, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameW + 58                                                  7C833187 99 Bytes  [ 00, 8B, EF, C1, C5, 05, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileStringW + 8                                            7C833301 53 Bytes  [ 39, 5D, 0C, 0F, 85, 04, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileStringW + 3F                                           7C833338 48 Bytes  JMP 7C81C10B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenProfileUserMapping + 2                                         7C833369 280 Bytes  [ FF, 83, C4, 10, 53, E8, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenProfileUserMapping + 11B                                       7C833482 65 Bytes  CALL 7C804D9E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableA + 4                                        7C8334C4 65 Bytes  [ 45, E4, 89, B0, 74, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableA + 46                                       7C833506 75 Bytes  [ C7, 40, 48, 17, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableA + 92                                       7C833552 221 Bytes  [ 00, 8D, 45, CC, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableA + 170                                      7C833630 8 Bytes  [ 8D, 45, F0, 50, E8, 63, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetEnvironmentVariableA + 179                                      7C833639 12 Bytes  JMP 7C81348A C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatW + 1F                                                7C8337DC 30 Bytes  [ 64, A1, 18, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatW + 3E                                                7C8337FB 37 Bytes  [ FF, 53, 68, C2, C5, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatW + 64                                                7C833821 3 Bytes  [ 00, 00, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatW + 68                                                7C833825 8 Bytes  [ 20, FF, FF, FF, 53, FF, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatW + 71                                                7C83382E 57 Bytes  [ 70, 20, 68, E2, C5, 93, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeFormatW + FD                                                7C834118 90 Bytes  [ 39, 5D, 08, 0F, 84, 41, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeFormatW + 158                                               7C834173 16 Bytes  JMP 7C80F75E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeFormatW + 169                                               7C834184 98 Bytes  [ 50, 8D, 45, F8, 50, 6A, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeFormatW + 1CC                                               7C8341E7 53 Bytes  [ 85, C0, 7C, 4A, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeFormatW + 202                                               7C83421D 11 Bytes  [ 68, 1C, CE, 93, 7C, E8, E6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatW + 2A                                              7C83452E 12 Bytes  [ FF, FF, C6, 46, 06, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatW + 39                                              7C83453D 43 Bytes  [ B0, 66, 8B, 00, 66, 3D, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatW + 65                                              7C834569 2 Bytes  [ 30, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatW + 69                                              7C83456D 21 Bytes  [ 00, 33, C9, 8A, 08, 33, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberFormatW + 7F                                              7C834583 88 Bytes  [ 0F, B7, C3, 8D, 84, C6, 78, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateVirtualBuffer + 36                                           7C8349B0 46 Bytes  [ FF, 75, 10, FF, 75, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateVirtualBuffer + 65                                           7C8349DF 67 Bytes  [ 75, 0C, FF, 75, 08, 68, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateVirtualBuffer + A9                                           7C834A23 8 Bytes  [ EE, FE, EE, FE, 8D, 04, C5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateVirtualBuffer + B2                                           7C834A2C 20 Bytes  [ FF, FF, 50, 8D, 47, 10, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateVirtualBuffer + C7                                           7C834A41 23 Bytes  [ A1, 9C, FF, 97, 7C, 85, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeVirtualBuffer + C                                              7C834BBD 34 Bytes  [ 8D, 45, F8, 50, 8D, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FormatMessageW + 9                                                 7C834BE0 158 Bytes  [ 83, 7D, FC, 00, 0F, 84, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationW + 48                                  7C834C7F 16 Bytes  CALL 7C86BDA9 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationW + 59                                  7C834C90 10 Bytes  JMP 7C82D521 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationW + 64                                  7C834C9B 19 Bytes  JMP 7C82D522 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationW + 78                                  7C834CAF 15 Bytes  JMP 7C817C78 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationW + 88                                  7C834CBF 60 Bytes  CALL 7C80440B C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalHandle + 4A                                                  7C834D4B 37 Bytes  [ A1, C0, DA, 93, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalHandle + 70                                                  7C834D71 41 Bytes  [ 00, 8D, 43, 06, 89, 45, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcat + 12                                                       7C834D9B 1 Byte  [ D0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcat + 14                                                       7C834D9D 47 Bytes  [ 4D, B0, 8D, 74, 08, 02, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcat + 44                                                       7C834DCD 2 Bytes  [ E4, 38 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!lstrcat + 48                                                       7C834DD1 43 Bytes  JMP 7C820FDA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalSize + 14                                                    7C834DFD 18 Bytes  [ 74, 66, 83, FE, 06, 75, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalSize + 27                                                    7C834E10 29 Bytes  JMP 7C810ECA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalSize + 45                                                    7C834E2E 74 Bytes  [ B7, 4D, D0, 39, 4D, C0, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalSize + 90                                                    7C834E79 78 Bytes  [ 66, 8B, 56, 04, 66, 3B, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_lclose + 1C                                                       7C834EC8 21 Bytes  [ 4D, BC, 83, 45, D8, 04, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFindAtomW                                                    7C834EDF 58 Bytes  [ 90, 08, 00, 0A, 00, 50, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileA + 21                                                 7C834F1A 17 Bytes  JMP 7C80AA62 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileA + 34                                                 7C834F2D 34 Bytes  [ 1A, C2, FD, FF, 66, F7, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileA + 58                                                 7C834F51 30 Bytes  CALL 7C85688F C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileA + 77                                                 7C834F70 113 Bytes  [ B8, 05, 00, 00, 80, E9, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextFileA + E9                                                 7C834FE2 19 Bytes  JMP 7C80A059 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentDirectoryA + 1                                           7C835047 86 Bytes  [ F8, 23, FE, 8D, 3C, BA, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentDirectoryA + 58                                          7C83509E 5 Bytes  [ 79, 00, 6E, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentDirectoryA + 5E                                          7C8350A4 25 Bytes  [ 6D, 00, 69, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentDirectoryA + 78                                          7C8350BE 13 Bytes  [ 61, 00, 74, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentDirectoryA + 86                                          7C8350CC 9 Bytes  [ 6D, 00, 6F, 00, 72, 00, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeZoneInformation + 57                                        7C83515E 60 Bytes  CALL 7C827757 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeZoneInformation + 94                                        7C83519B 22 Bytes  [ D0, 8B, 45, 08, 8D, 48, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeZoneInformation + AB                                        7C8351B2 11 Bytes  [ 40, 20, 89, 45, E0, 8B, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeZoneInformation + B7                                        7C8351BE 48 Bytes  [ 75, E4, 81, FE, 50, E2, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTimeZoneInformation + E8                                        7C8351EF 18 Bytes  [ 8B, 75, E0, 83, C6, C4, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hread                                                             7C835416 17 Bytes  [ 90, 8B, FF, 55, 8B, EC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hread + 12                                                        7C835428 103 Bytes  [ 35, 48, E2, 97, 7C, E8, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_llseek + 42                                                       7C835490 47 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_llseek + 72                                                       7C8354C0 47 Bytes  [ 45, 08, 8B, 45, 08, 3B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleW + 25                                                 7C8354F1 74 Bytes  [ FF, FF, 0F, 85, 71, FB, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddAtomA + 7                                                       7C83553C 51 Bytes  [ 16, 8B, 4B, 08, 8B, 33, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFileTimeToFileTime + 4                                        7C835570 20 Bytes  [ 03, 89, 06, 83, C3, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFileTimeToFileTime + 1A                                       7C835586 109 Bytes  [ 00, 8B, 06, 33, C9, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFileTimeToFileTime + 88                                       7C8355F4 17 Bytes  [ 68, CC, E0, 97, 7C, E8, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushInstructionCache + 2                                          7C835606 56 Bytes  JMP 7C85FCBA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushInstructionCache + 3B                                         7C83563F 84 Bytes  JMP 7C854E76 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushInstructionCache + 90                                         7C835694 8 Bytes  [ 75, 10, FF, 75, 0C, E8, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushInstructionCache + 9A                                         7C83569E 17 Bytes  [ 85, C0, 0F, 85, DC, 1F, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExW + D                                                    7C8356B0 9 Bytes  CALL 7C825D26 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExW + 17                                                   7C8356BA 10 Bytes  [ FF, FF, 50, 84, 94, 7C, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExW + 22                                                   7C8356C5 17 Bytes  [ FF, FF, FF, F6, 84, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExW + 34                                                   7C8356D7 7 Bytes  [ 55, 8B, EC, 8D, 45, 14, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExW + 3C                                                   7C8356DF 112 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindCloseChangeNotification + 3F                                   7C83585C 41 Bytes  [ 01, 0F, 85, 32, 7C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsGetCacheUpdateCount + 25                                        7C835886 29 Bytes  [ FF, 1F, 0F, 87, 07, 7C, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsGetCacheUpdateCount + 43                                        7C8358A4 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsGetCacheUpdateCount + 45                                        7C8358A6 13 Bytes  JMP FF835A26 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsGetCacheUpdateCount + 53                                        7C8358B4 90 Bytes  [ A8, 02, 74, 45, 83, 65, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsGetCacheUpdateCount + AE                                        7C83590F 39 Bytes  [ 09, 83, 65, D4, 00, 85, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushViewOfFile + 41                                               7C8359FA 26 Bytes  [ 00, 0F, 83, DD, 99, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameW + 16                                              7C835A15 63 Bytes  [ 0F, 84, F8, 99, 02, 00, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameW + 56                                              7C835A55 50 Bytes  CALL 05E99B9B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameW + 89                                              7C835A88 57 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameW + C3                                              7C835AC2 71 Bytes  [ FF, 53, 8B, 5D, 10, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameW + 10B                                             7C835B0A 28 Bytes  [ 39, 7D, F8, 74, 48, 8B, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameA + F                                              7C835C07 76 Bytes  [ 0F, 84, CD, 89, 02, 00, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameA + 5D                                             7C835C55 31 Bytes  [ 0F, 87, 0B, 85, 02, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameA + 7D                                             7C835C75 6 Bytes  [ FF, 89, 9D, D8, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameA + 84                                             7C835C7C 28 Bytes  [ 66, 8B, 48, 50, 66, 89, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetShortPathNameA + A1                                             7C835C99 5 Bytes  [ 8D, 85, E4, FD, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringA + 20                                    7C835DBC 1 Byte  [ 35 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringA + 22                                    7C835DBE 3 Bytes  [ 13, F9, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringA + 26                                    7C835DC2 33 Bytes  [ 83, C4, 10, 46, 3B, B5, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringA + 48                                    7C835DE4 17 Bytes  [ 0F, 84, 55, 84, 02, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStringA + 5B                                    7C835DF7 7 Bytes  [ FF, 75, 10, FF, B5, 78, FB ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempPathA + 40                                                  7C835E52 222 Bytes  [ 39, 9D, 88, FB, FF, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressA + 3B                                         7C835F31 12 Bytes  [ FF, 3B, FB, 0F, 85, 3C, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileWithProgressA + 48                                         7C835F3E 44 Bytes  CALL 7C835F6F C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileSectionA + 2                                      7C835F6B 9 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileSectionA + C                                      7C835F75 263 Bytes  [ EC, 51, 51, 57, 8B, F8, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindResourceExA + BD                                               7C83607D 336 Bytes  [ 75, 0E, 80, 3D, 80, 0B, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapCompact + 68                                                   7C8361CE 2 Bytes  [ 38, 1D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapCompact + 6B                                                   7C8361D1 74 Bytes  [ E1, 97, 7C, 75, 0B, 38, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapCompact + B6                                                   7C83621C 43 Bytes  JMP 7C80CF16 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatA + 12                                                7C836248 7 Bytes  CALL 7A23EFD8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatA + 1A                                                7C836250 5 Bytes  [ 89, 8D, C4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatA + 20                                                7C836256 67 Bytes  [ 33, DB, 38, 1D, C1, E1, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatA + 64                                                7C83629A 33 Bytes  [ 85, C8, FD, FF, FF, 89, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDateFormatA + 86                                                7C8362BC 64 Bytes  [ FF, 8B, 40, 30, 8B, 40, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntA + 14                                                7C836505 18 Bytes  JMP 7C819D5A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntA + 27                                                7C836518 200 Bytes  JMP 7C819E1B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileIntA + F0                                                7C8365E1 28 Bytes  [ C1, FC, 89, 4D, F4, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_lcreat + 11                                                       7C8365FE 72 Bytes  [ 00, 8B, 4D, D8, 8B, 45, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToANSI + A                                              7C836648 119 Bytes  [ 00, 2B, C1, 53, 83, E8, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToANSI + 82                                             7C8366C0 8 Bytes  [ 01, 89, 5D, F0, E8, 9D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileApisToANSI + 8B                                             7C8366C9 267 Bytes  [ 8B, F0, 3B, F3, 74, 4C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFlags + 1B                                                   7C8367D5 152 Bytes  [ 39, 7D, 14, 0F, 84, CE, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFlags + B4                                                   7C83686E 21 Bytes  [ 45, 1C, 85, C0, 0F, 84, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFlags + CA                                                   7C836884 109 Bytes  [ 00, 8B, 40, 30, 56, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFlags + 138                                                  7C8368F2 29 Bytes  [ 53, 6A, 04, 5F, 57, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalFlags + 156                                                  7C836910 40 Bytes  [ 1A, 33, C0, 39, 5D, D0, 57, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFile + 33                                                   7C836CB7 7 Bytes  [ 4D, FC, FF, 8B, B5, C0, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFile + 3B                                                   7C836CBF 5 Bytes  [ FF, 8B, 9D, CC, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFile + 41                                                   7C836CC5 25 Bytes  [ FF, 33, FF, 3B, C7, 7C, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFile + 5B                                                   7C836CDF 38 Bytes  [ FF, 50, FF, B5, BC, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFile + 82                                                   7C836D06 5 Bytes  [ 75, EC, E8, 70, 8C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryW + 14                                              7C836FB7 42 Bytes  [ 8D, 85, DC, FE, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryW + 3F                                              7C836FE2 41 Bytes  [ 85, D8, FE, FF, FF, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryW + 69                                              7C83700C 53 Bytes  [ 89, 19, 8B, 59, FC, 89, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryW + A0                                              7C837043 49 Bytes  [ 4D, F4, 2B, CF, 83, C1, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryW + D2                                              7C837075 5 Bytes  [ 54, C8, FC, 89, 55 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNativeSystemInfo + 11                                           7C83799E 14 Bytes  JMP 7C837A75 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNativeSystemInfo + 20                                           7C8379AD 112 Bytes  [ 66, FC, FF, 85, C0, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserGeoID + 48                                                  7C837A1E 41 Bytes  [ 8B, F0, 3B, F3, 7D, 0F, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserGeoID + 72                                                  7C837A48 27 Bytes  CALL 7C802AFE C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserGeoID + 8E                                                  7C837A64 14 Bytes  CALL 7C8040C8 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserGeoID + 9E                                                  7C837A74 7 Bytes  [ C6, 5E, 5B, 5F, C9, C2, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetUserGeoID + A6                                                  7C837A7C 18 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Beep + EC                                                          7C837BAB 61 Bytes  [ FF, 6C, 07, 96, 7C, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Beep + 12A                                                         7C837BE9 38 Bytes  [ 8B, 45, E4, 3B, 45, 0C, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Beep + 151                                                         7C837C10 47 Bytes  [ 30, 89, 75, CC, 56, E8, AA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Beep + 186                                                         7C837C45 21 Bytes  CALL 7C7FC9CD 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Beep + 19D                                                         7C837C5C 31 Bytes  [ 1B, 08, 96, 7C, 24, 08, 96, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleDisplayMode + 1F                                         7C837CBA 1 Byte  [ 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleDisplayMode + 21                                         7C837CBC 174 Bytes  [ 75, F8, EB, 07, 39, 3E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesA + 42                                            7C837D6B 130 Bytes  [ 55, 8B, EC, 81, EC, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesA + C5                                            7C837DEE 94 Bytes  [ C6, 04, 3B, 55, 0C, 72, EA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesA + 124                                           7C837E4D 21 Bytes  [ 89, 11, 8B, 4D, 0C, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesA + 13A                                           7C837E63 23 Bytes  [ C9, C2, 08, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesA + 152                                           7C837E7B 49 Bytes  [ A1, C8, E0, 97, 7C, 89, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoA + 7                                              7C838260 72 Bytes  [ CC, CC, CC, CC, CC, CC, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoA + 50                                             7C8382A9 216 Bytes  [ 83, C4, 14, 38, 1D, DC, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoA + 129                                            7C838382 22 Bytes  CALL 7C849EEC C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoA + 140                                            7C838399 2 Bytes  [ 69, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoA + 144                                            7C83839D 150 Bytes  [ 38, 5D, E7, 75, 08, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertDefaultLocale + 1D                                          7C838434 78 Bytes  [ 5F, 4C, 64, 72, 70, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertDefaultLocale + 6D                                          7C838484 23 Bytes  [ 5F, 4C, 64, 72, 70, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertDefaultLocale + 85                                          7C83849C 113 Bytes  [ 2D, 20, 63, 61, 6C, 6C, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConvertDefaultLocale + F7                                          7C83850E 59 Bytes  [ 0F, 84, E2, 88, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPFileNameFromRegistry + 27                                     7C83854A 6 Bytes  [ 66, 89, 9D, B8, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPFileNameFromRegistry + 2E                                     7C838551 72 Bytes  [ 8B, 85, A8, FD, FF, FF, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPFileNameFromRegistry + 77                                     7C83859A 21 Bytes  JMP 7C80CD73 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPFileNameFromRegistry + 8D                                     7C8385B0 74 Bytes  CALL 7C82760B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPFileNameFromRegistry + D8                                     7C8385FB 4 Bytes  [ 68, 68, 13, 94 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumTimeFormatsW + 19                                              7C83891F 47 Bytes  [ 00, 4C, 44, 52, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumTimeFormatsW + 49                                              7C83894F 53 Bytes  CALL 7C80532B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumTimeFormatsW + 7F                                              7C838985 48 Bytes  JMP 7C813D15 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumTimeFormatsW + B0                                              7C8389B6 52 Bytes  [ FF, B5, 7C, FE, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumTimeFormatsW + E5                                              7C8389EB 14 Bytes  [ 6A, 50, 8D, 45, AC, 50, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeA + 45                                                7C838A99 47 Bytes  CALL 7C810577 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeA + 75                                                7C838AC9 2 Bytes  [ 85, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeA + 78                                                7C838ACC 3 Bytes  [ 8C, AA, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeA + 7D                                                7C838AD1 107 Bytes  [ 39, 1D, B0, 14, 98, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hwrite + E                                                        7C838B3D 3 Bytes  [ 85, 68, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hwrite + 12                                                       7C838B41 5 Bytes  [ FF, 50, 6A, 02, 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hwrite + 18                                                       7C838B47 21 Bytes  [ B5, 74, FE, FF, FF, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hwrite + 2E                                                       7C838B5D 16 Bytes  [ BD, 68, FE, FF, FF, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_hwrite + 3F                                                       7C838B6E 23 Bytes  [ FF, FF, FF, 15, B0, 14, 98, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringA + 97                                                  7C838EC7 20 Bytes  CALL 7C810C66 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringA + AC                                                  7C838EDC 2 Bytes  [ 75, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringA + AF                                                  7C838EDF 41 Bytes  [ 15, 88, 04, 91, 7C, 81, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringA + DA                                                  7C838F0A 264 Bytes  [ BF, 06, 01, 00, C0, E9, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LCMapStringA + 1E3                                                 7C839013 6 Bytes  [ 63, 74, 69, 6F, 6E, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoW + 11F                                             7C839187 33 Bytes  [ 8A, 51, 02, 80, FA, 64, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoW + 141                                             7C8391A9 98 Bytes  [ 8A, 51, 04, 80, FA, 6C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoW + 1A4                                             7C83920C 4 Bytes  JMP 7C821E18 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoW + 1A9                                             7C839211 79 Bytes  [ 8D, 4D, 1C, 51, 33, F6, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoW + 1F9                                             7C839261 16 Bytes  [ 4D, FC, 89, 4D, D8, EB, 22, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadExecutionState + 1A                                       7C839317 52 Bytes  [ 38, 1D, C1, E1, 97, 7C, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadExecutionState + 4F                                       7C83934C 64 Bytes  [ 83, C4, 10, 38, 1D, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadExecutionState + 90                                       7C83938D 41 Bytes  [ 75, 98, 68, D4, 21, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadExecutionState + BB                                       7C8393B8 8 Bytes  [ 83, C4, 0C, C7, 45, A8, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadExecutionState + C4                                       7C8393C1 72 Bytes  JMP 7C813A85 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapSetInformation + F                                             7C8394C0 532 Bytes  JMP 7C813A83 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMemoryResourceNotification + 33                              7C8396D5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMemoryResourceNotification + 35                              7C8396D7 61 Bytes  [ 00, 4C, 64, 72, 70, 52, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMemoryResourceNotification + 73                              7C839715 4 Bytes  [ 65, 64, 0A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMemoryResourceNotification + 78                              7C83971A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateMemoryResourceNotification + 7A                              7C83971C 14 Bytes  [ 20, 20, 20, 44, 6C, 6C, 4E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SuspendThread + BE                                                 7C839838 52 Bytes  [ 75, 08, 56, 53, FF, D0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLocale + 2D                                                7C83986D 29 Bytes  [ 68, 24, 29, 94, 7C, 50, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLocale + 4B                                                7C83988B 13 Bytes  [ C6, 45, 18, 01, 8B, 75, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLocale + 59                                                7C839899 66 Bytes  [ 35, 01, 00, C0, 0F, 84, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLocale + 9C                                                7C8398DC 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLocale + 9E                                                7C8398DE 40 Bytes  [ 89, 85, 64, FF, FF, FF, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUnhandledExceptionFilter + 91                                   7C84487E 37 Bytes  [ 75, 08, BF, 80, 1D, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUnhandledExceptionFilter + B7                                   7C8448A4 17 Bytes  [ 5A, 04, 03, DE, 3B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUnhandledExceptionFilter + C9                                   7C8448B6 63 Bytes  [ 05, 8B, 14, 90, 3B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUnhandledExceptionFilter + 109                                  7C8448F6 2 Bytes  [ 13, 2D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUnhandledExceptionFilter + 10D                                  7C8448FA 59 Bytes  [ 59, C3, 45, 6E, 74, 72, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesW + C                                             7C8558A5 224 Bytes  [ B8, 35, 01, 00, C0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesW + ED                                            7C855986 96 Bytes  [ 64, 72, 65, 73, 73, 00, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesW + 14E                                           7C8559E7 36 Bytes  CALL 7C82440C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesW + 173                                           7C855A0C 3 Bytes  [ FF, 75, A8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesW + 178                                           7C855A11 56 Bytes  CALL 7C87A036 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalTime + 29                                                  7C855ADA 194 Bytes  [ 4C, 44, 52, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFlags                                                         7C855B9E 133 Bytes  [ 90, 90, 90, 68, A6, E7, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFlags + 87                                                    7C855C25 48 Bytes  CALL 7C87DA61 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFlags + B8                                                    7C855C56 27 Bytes  [ 00, 00, 89, 45, E0, E9, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFlags + D4                                                    7C855C72 24 Bytes  [ 90, 90, 90, 90, 90, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalFlags + EE                                                    7C855C8C 48 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalHandle + 24                                                   7C855CBD 76 Bytes  CALL 7C8356D3 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalHandle + 71                                                   7C855D0A 178 Bytes  [ 78, 63, 65, 70, 74, 69, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalHandle + 124                                                  7C855DBD 81 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalHandle + 17A                                                  7C855E13 20 Bytes  JMP 7C844667 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LocalHandle + 18F                                                  7C855E28 71 Bytes  [ C7, 45, DC, 0D, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupSeek + 4                                                     7C856083 8 Bytes  [ 75, AC, 0F, B7, 4E, 02, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupSeek + D                                                     7C85608C 137 Bytes  JMP 082B5393 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupSeek + 97                                                    7C856116 23 Bytes  [ EF, D2, FC, FF, 84, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupSeek + AF                                                    7C85612E 171 Bytes  [ 00, 89, 55, 0C, 74, 06, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupSeek + 15B                                                   7C8561DA 32 Bytes  [ 00, 00, 33, FF, 66, 39, 7D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupRead + 1                                                     7C856F70 10 Bytes  [ F1, 83, E6, 07, 57, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupRead + C                                                     7C856F7B 2 Bytes  [ 48, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupRead + F                                                     7C856F7E 52 Bytes  [ 96, A8, 57, 92, 7C, 8D, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupRead + 44                                                    7C856FB3 11 Bytes  CALL 7E5DF5C7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupRead + 50                                                    7C856FBF 64 Bytes  [ 4D, F0, 8A, 19, FF, 45, F0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupWrite + 5C                                                   7C8575EA 9 Bytes  [ 00, 00, 2C, 18, 95, 7C, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupWrite + 66                                                   7C8575F4 15 Bytes  [ 28, 18, 95, 7C, 24, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupWrite + 76                                                   7C857604 6 Bytes  [ 1C, 18, 95, 7C, 26, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupWrite + 7E                                                   7C85760C 9 Bytes  [ 10, 18, 95, 7C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BackupWrite + 88                                                   7C857616 6 Bytes  [ F0, 7F, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameW + 13                                              7C858230 203 Bytes  [ E6, 0D, 96, 7C, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameW + DF                                              7C8582FC 5 Bytes  [ 02, E8, 36, EE, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameW + E5                                              7C858302 90 Bytes  [ 5D, C2, 08, 00, 54, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameExW + 1A                                            7C85835D 75 Bytes  [ 57, 6A, 2B, 59, 6A, 38, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameExW + 66                                            7C8583A9 6 Bytes  [ FF, FF, 89, 85, 2C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameExW + 6E                                            7C8583B1 78 Bytes  [ 89, 85, 48, FF, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameA + 3C                                              7C858400 12 Bytes  [ 14, FF, FF, FF, 28, 17, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameA + 49                                              7C85840D 5 Bytes  [ FF, C7, 85, 30, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetComputerNameA + 50                                              7C858414 165 Bytes  [ 34, 17, 95, 7C, C7, 85, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComputerNameExA + 83                                            7C8584BA 186 Bytes  CALL 7C828A3D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesW + 42                                  7C858575 68 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesW + 87                                  7C8585BA 21 Bytes  [ 10, 00, 00, 75, 47, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesW + 9D                                  7C8585D0 27 Bytes  [ 00, 89, 75, F8, 74, 0B, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesW + B9                                  7C8585EC 3 Bytes  [ 4D, F4, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesW + BD                                  7C8585F0 154 Bytes  [ 8D, 45, 08, 50, 8D, 45, F8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesA + 5B                                  7C85870E 40 Bytes  [ FF, 75, 14, FF, 75, 10, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesA + 84                                  7C858737 7 Bytes  [ 5D, E6, 89, 5D, FC, 8B, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesA + 8C                                  7C85873F 14 Bytes  [ 83, C1, F8, 89, 4D, D8, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumerateLocalComputerNamesA + 9B                                  7C85874E 114 Bytes  [ 00, 00, 89, 45, D4, B9, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameA + 62                                    7C8587C1 44 Bytes  [ E0, 89, 01, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameA + 8F                                    7C8587EE 3 Bytes  [ 34, D5, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameA + 93                                    7C8587F2 4 Bytes  [ C2, 14, 00, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameA + 9B                                    7C8587FA 84 Bytes  [ 80, 7D, E6, 00, 74, 0E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DnsHostnameToComputerNameA + F0                                    7C85884F 38 Bytes  [ F6, C4, 08, 75, 07, 33, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddLocalAlternateComputerNameW + 4                                 7C858F9E 213 Bytes  CALL B046C2A6 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddLocalAlternateComputerNameW + DA                                7C859074 160 Bytes  [ 9C, FF, 97, 7C, 85, C0, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveLocalAlternateComputerNameW + 16                             7C859115 36 Bytes  [ 00, 00, 8B, 35, 04, 17, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveLocalAlternateComputerNameW + 3B                             7C85913A 27 Bytes  [ 53, 8D, 5E, 3C, 39, 3B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveLocalAlternateComputerNameW + 57                             7C859156 16 Bytes  CALL 7C80438C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveLocalAlternateComputerNameW + 69                             7C859168 314 Bytes  [ FF, 45, 0C, 66, C7, 46, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameW + 7A                                  7C8592A3 40 Bytes  [ 00, EB, 03, 8B, 45, 08, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameW + A3                                  7C8592CC 1 Byte  [ 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameW + A5                                  7C8592CE 9 Bytes  [ 65, 00, 63, 00, 74, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameW + AF                                  7C8592D8 33 Bytes  [ 25, 00, 34, 00, 75, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameW + D1                                  7C8592FA 5 Bytes  [ 69, 00, 72, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocalPrimaryComputerNameA + 3E                                  7C85947D 25 Bytes  [ C3, EB, 0C, 4F, F7, DF, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCopy + F                                                         7C859497 63 Bytes  [ 80, 00, 00, FF, 01, 01, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCopy + 50                                                        7C8594D8 50 Bytes  [ 50, 89, 45, 08, 8D, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCopy + 83                                                        7C85950B 35 Bytes  [ 83, 6D, 08, 10, 8B, C1, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCopy + A7                                                        7C85952F 10 Bytes  [ 33, C0, 5E, C9, C2, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCopy + B3                                                        7C85953B 3 Bytes  [ 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyLZFile + 1                                                     7C85953F 217 Bytes  [ EC, 8B, 4D, 0C, 85, C9, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimeZoneInformation + 2B                                        7C859619 43 Bytes  [ 00, EB, 02, 33, C0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimeZoneInformation + 57                                        7C859645 105 Bytes  CALL 7C80760F C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimeZoneInformation + C2                                        7C8596B0 17 Bytes  [ 88, 45, E7, 83, 65, FC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimeZoneInformation + D4                                        7C8596C2 2 Bytes  [ 00, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTimeZoneInformation + D7                                        7C8596C5 157 Bytes  [ 89, 45, C8, 33, C0, 40, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TzSpecificLocalTimeToSystemTime + 12                               7C859763 58 Bytes  [ 55, D4, 66, 89, 50, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TzSpecificLocalTimeToSystemTime + 4D                               7C85979E 69 Bytes  [ B3, 78, 05, 00, 00, E8, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TzSpecificLocalTimeToSystemTime + 93                               7C8597E4 70 Bytes  [ 65, 61, 70, 00, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TzSpecificLocalTimeToSystemTime + DB                               7C85982C 39 Bytes  [ 89, 45, F4, 8D, 45, F4, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TzSpecificLocalTimeToSystemTime + 103                              7C859854 46 Bytes  [ F8, 33, F6, 3B, FB, 76, 19, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetClientTimeZoneInformation + 5A                                  7C859C1B 34 Bytes  [ EB, F0, 85, C0, 75, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetClientTimeZoneInformation + 7E                                  7C859C3F 99 Bytes  [ 83, 7D, E0, 00, 0F, 8C, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetClientTimeZoneInformation + E2                                  7C859CA3 14 Bytes  [ FF, F6, C4, 08, 75, 07, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CheckRemoteDebuggerPresent + 4                                     7C859CB2 173 Bytes  [ 43, 0A, 66, 89, 47, 0E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugBreak + 5E                                                    7C859D60 55 Bytes  [ 45, D8, 8B, 3F, 89, 7D, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugBreak + 96                                                    7C859D98 31 Bytes  [ 89, 45, D4, 83, 20, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugBreak + B6                                                    7C859DB8 4 Bytes  [ 00, 83, 4D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugBreak + BB                                                    7C859DBD 46 Bytes  CALL 7C859DD2 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugBreak + EA                                                    7C859DEC 99 Bytes  [ 00, 00, 00, 00, B2, 29, 96, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringA + 14                                            7C859F1C 15 Bytes  [ EB, 05, B8, 0D, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringA + 24                                            7C859F2C 76 Bytes  [ 00, 00, 00, 00, 4E, 0A, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringA + 71                                            7C859F79 5 Bytes  [ 75, 1C, FF, 75, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringA + 77                                            7C859F7F 5 Bytes  [ 75, 14, FF, 75, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringA + 7D                                            7C859F85 34 Bytes  [ 75, 0C, FF, 14, 85, 7C, 2B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadSelectorEntry + 169                                       7C85A4E1 51 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadSelectorEntry + 19D                                       7C85A515 2 Bytes  [ 86, D4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadSelectorEntry + 1A1                                       7C85A519 118 Bytes  [ 8D, 85, F8, FD, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadSelectorEntry + 218                                       7C85A590 12 Bytes  [ 9D, C0, FD, FF, FF, C7, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadSelectorEntry + 225                                       7C85A59D 48 Bytes  [ 00, 00, 89, 9D, CC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringW + 11                                            7C85A5CE 37 Bytes  [ FF, 53, 8D, 85, EC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringW + 37                                            7C85A5F4 2 Bytes  [ FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OutputDebugStringW + 3A                                            7C85A5F7 26 Bytes  CALL 7C80539E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForDebugEvent + 2                                              7C85A612 18 Bytes  CALL 7C8109E6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitForDebugEvent + 15                                             7C85A625 211 Bytes  [ FF, 50, 8D, 85, D4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ContinueDebugEvent + 4                                             7C85A6F9 11 Bytes  [ 40, 30, 8B, 40, 10, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ContinueDebugEvent + 10                                            7C85A705 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ContinueDebugEvent + 12                                            7C85A707 4 Bytes  [ 85, C0, 74, 21 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ContinueDebugEvent + 17                                            7C85A70C 57 Bytes  [ 30, 33, F6, 89, 75, E4, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DebugActiveProcessStop + D                                         7C85A746 61 Bytes  [ C2, 08, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExW + 2                                             7C85A784 23 Bytes  [ 85, C0, 7C, 09, 33, C0, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExW + 1A                                            7C85A79C 8 Bytes  [ FF, 55, 8B, EC, E8, A9, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExW + 23                                            7C85A7A5 113 Bytes  [ 64, A1, 18, 00, 00, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExW + 95                                            7C85A817 107 Bytes  [ 75, 08, 89, 75, FC, E8, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExW + 102                                           7C85A884 86 Bytes  [ 5E, 5D, C2, 04, 00, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryA + 6                                               7C85B3AF 22 Bytes  [ 56, 2C, 8B, D8, 85, DB, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RemoveDirectoryA + 1D                                              7C85B3C6 78 Bytes  [ 00, 57, 33, C0, 8B, FB, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateDirectoryExA + 4A                                            7C85B415 38 Bytes  [ 8B, F8, 8B, 00, EB, E5, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameA + 1                                                   7C85B43C 6 Bytes  [ C1, C1, E9, 02, 8D, 7B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameA + 8                                                   7C85B443 64 Bytes  [ F3, A5, 8B, C8, 83, E1, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameA + 49                                                  7C85B484 46 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameA + 78                                                  7C85B4B3 17 Bytes  [ 00, 85, C0, 75, 14, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetAtomNameA + 8A                                                  7C85B4C5 161 Bytes  [ F7, 21, 4E, 14, 89, 46, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryWin31IniFilesMappedToRegistry + 14                            7C85B8C0 71 Bytes  [ FC, 66, 8B, 55, FC, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryWin31IniFilesMappedToRegistry + 5C                            7C85B908 44 Bytes  [ B7, 04, 41, 66, 8B, D0, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryWin31IniFilesMappedToRegistry + 89                            7C85B935 72 Bytes  [ F9, C1, EF, 08, 0F, B7, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryWin31IniFilesMappedToRegistry + D2                            7C85B97E 22 Bytes  [ 55, 8B, EC, 53, 8B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryWin31IniFilesMappedToRegistry + E9                            7C85B995 134 Bytes  [ 3C, 41, 40, 66, 83, FF, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileSectionA + 4                                    7C85BC10 8 Bytes  [ 4D, FC, 5F, 5E, E8, 7E, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileSectionA + D                                    7C85BC19 69 Bytes  [ C9, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileSectionW + C                                    7C85BC5F 7 Bytes  [ 80, 7B, 03, 00, 0F, 85, A7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileSectionW + 14                                   7C85BC67 8 Bytes  [ 00, 00, 66, 8B, 37, 83, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileSectionW + 1D                                   7C85BC70 178 Bytes  [ 83, 65, D8, 00, 66, 85, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructA + 68                                      7C85BD23 27 Bytes  [ 66, 85, C0, 75, A3, 80, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructA + 84                                      7C85BD3F 117 Bytes  [ 66, 89, 03, 89, 45, D8, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructA + FA                                      7C85BDB5 50 Bytes  [ 74, 28, 66, 83, F8, 7F, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructA + 12D                                     7C85BDE8 40 Bytes  [ 43, 14, 6A, 01, 8D, 45, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructA + 156                                     7C85BE11 61 Bytes  [ 43, 20, 83, 7B, 20, 04, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructW + 2A                                      7C85BE4F 64 Bytes  [ 4B, 06, 66, 83, F9, 7F, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructW + 6B                                      7C85BE90 51 Bytes  [ 4C, 43, 04, 2B, F0, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructW + 9F                                      7C85BEC4 63 Bytes  [ 20, 01, 00, 00, 00, 88, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPrivateProfileStructW + DF                                      7C85BF04 247 Bytes  [ 4D, E4, 03, C9, 8D, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructA + 49                                    7C85BFFC 22 Bytes  [ 4D, FC, 5F, 5E, 5B, E8, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructA + 61                                    7C85C014 5 Bytes  [ 00, 8B, 80, F4, 0B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructA + 67                                    7C85C01A 41 Bytes  [ 00, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructA + 91                                    7C85C044 58 Bytes  [ 55, 8B, EC, 81, EC, F4, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructA + CC                                    7C85C07F 108 Bytes  [ 76, 0A, B8, 0D, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructW + 1F                                    7C85C114 10 Bytes  [ 4D, 14, FF, 45, 14, 89, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructW + 2A                                    7C85C11F 5 Bytes  [ 8D, BD, 10, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructW + 30                                    7C85C125 71 Bytes  [ EB, 09, 8B, 4D, 14, 8D, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructW + 78                                    7C85C16D 17 Bytes  [ 8D, 85, 30, FD, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WritePrivateProfileStructW + 8A                                    7C85C17F 15 Bytes  CALL 7C804FCD C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionA + 7                                           7C85C28C 18 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionA + 1A                                          7C85C29F 11 Bytes  [ 7C, 68, 00, 10, 90, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileSectionW + C                                             7C85C2AC 1 Byte  [ 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProfileSectionW + F                                             7C85C2AF 13 Bytes  CALL 7C85C1C1 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionW                                               7C85C2BE 108 Bytes  [ 90, 90, 90, A1, 70, E1, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionW + 6D                                          7C85C32B 10 Bytes  [ 3B, 46, 4C, 89, 07, 73, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionW + 79                                          7C85C337 6 Bytes  [ 89, 07, E9, 93, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionW + 80                                          7C85C33E 47 Bytes  [ 6A, 04, BB, 00, 10, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteProfileSectionW + B0                                          7C85C36E 79 Bytes  [ 44, 8D, 46, 4C, 8B, 08, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceA + 2C                                              7C85C481 74 Bytes  [ 66, 39, 56, 02, 0F, 85, A6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DefineDosDeviceA + 77                                              7C85C4CC 200 Bytes  [ 05, B8, 18, 52, 96, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceA + 99                                               7C85C595 74 Bytes  [ 8B, 5D, 0C, 33, FF, 39, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceA + E4                                               7C85C5E0 85 Bytes  CALL 3395926F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!QueryDosDeviceA + 13A                                              7C85C636 26 Bytes  [ 00, 00, 66, 66, 66, 66, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationA + 17                                  7C85C652 29 Bytes  [ 00, 00, 3A, 3A, 66, 66, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationA + 35                                  7C85C670 6 Bytes  [ 3A, 00, 00, 00, 25, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationA + 3D                                  7C85C678 24 Bytes  [ 3A, 25, 75, 2E, 25, 75, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstChangeNotificationA + 56                                  7C85C691 139 Bytes  [ 55, 8B, EC, 83, EC, 48, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExA + 7C                                              7C85C71E 88 Bytes  [ 83, C4, 0C, 03, F0, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExA + D5                                              7C85C777 90 Bytes  [ 55, 8B, EC, 8B, 45, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExA + 130                                             7C85C7D2 93 Bytes  [ FC, 8B, 45, 08, 85, C0, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExA + 18E                                             7C85C830 84 Bytes  JMP 60FB5537 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstFileExA + 1E5                                             7C85C887 25 Bytes  [ 66, 39, 56, 02, 0F, 85, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteFileEx + 10                                                   7C85C8A1 178 Bytes  [ 94, 00, 00, 00, 66, 39, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileValidData + 23                                              7C85C954 167 Bytes  [ F8, 06, 00, 00, 00, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameW + 75                                             7C85C9FC 28 Bytes  [ 83, C4, 0C, 43, 3B, 5D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameW + 92                                             7C85CA19 65 Bytes  [ 0F, B6, 46, 0D, 50, 0F, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameA + 7                                              7C85CA5B 24 Bytes  [ 00, 2E, 00, 25, 00, 75, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameA + 20                                             7C85CA74 101 Bytes  [ 66, 00, 66, 00, 3A, 00, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameA + 86                                             7C85CADA 77 Bytes  [ 00, 00, A1, C8, E0, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameA + D5                                             7C85CB29 194 Bytes  CALL 7C85C867 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetFileShortNameA + 198                                            7C85CBEC 7 Bytes  [ 55, F0, 75, 07, E9, 09, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivMoveFileIdentityW + 28                                         7C85D2A1 123 Bytes  [ 75, 08, 66, 8B, 45, 08, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivMoveFileIdentityW + A4                                         7C85D31D 2 Bytes  [ 68, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivMoveFileIdentityW + A7                                         7C85D320 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivMoveFileIdentityW + A9                                         7C85D322 26 Bytes  CALL 7C81D298 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrivMoveFileIdentityW + C4                                         7C85D33D 163 Bytes  JMP 7C85D4C5 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCompressedFileSizeW + 1B                                        7C85D51C 22 Bytes  CALL 069299A4 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCompressedFileSizeW + 32                                        7C85D533 35 Bytes  [ 77, 72, 6A, 0A, 50, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCompressedFileSizeW + 56                                        7C85D557 278 Bytes  [ 0D, 83, 7D, F0, 02, 75, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExA + 1B                                                   7C85D66E 111 Bytes  [ 8B, 45, F8, 6A, 0A, 59, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExA + 8B                                                   7C85D6DE 61 Bytes  [ 3F, 30, C7, 45, 0C, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExA + CA                                                   7C85D71D 106 Bytes  [ 66, 81, FE, 80, 00, 73, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExA + 135                                                  7C85D788 60 Bytes  [ 00, 00, 6A, 02, 56, E8, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!MoveFileExA + 172                                                  7C85D7C5 34 Bytes  [ 83, C0, 41, 2B, F0, 8B, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFileA + 49                                                  7C85E4E0 51 Bytes  [ 50, 8D, 85, 98, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFileA + 7D                                                  7C85E514 25 Bytes  [ 89, 85, B4, FB, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFileA + 97                                                  7C85E52E 5 Bytes  [ 8B, 85, 74, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFileA + 9D                                                  7C85E534 5 Bytes  [ 89, 85, 4C, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReplaceFileA + A3                                                  7C85E53A 9 Bytes  [ 6A, 21, 8D, 85, B4, FB, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExA + 2                                                    7C85E556 62 Bytes  [ FF, 50, 68, 20, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CopyFileExA + 41                                                   7C85E595 100 Bytes  [ 57, FF, 70, 04, 68, DE, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetFirmwareEnvironmentVariableW + 4D                               7C85E5FA 575 Bytes  JMP 7C835E11 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GlobalUnfix + A                                                    7C85E83A 339 Bytes  [ 69, 6F, 6E, 20, 63, 61, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetWriteWatch + 34                                                 7C85E98E 105 Bytes  [ 53, 58, 53, 3A, 20, 41, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_lopen + 38                                                        7C85E9F8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_lopen + 3A                                                        7C85E9FA 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!_lopen + 3E                                                        7C85E9FE 612 Bytes  [ 53, 58, 53, 3A, 20, 55, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!HeapWalk + B3                                                      7C85EC63 218 Bytes  [ 6C, 47, 65, 74, 41, 73, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetMailslotInfo + 56                                               7C85ED3E 121 Bytes  [ 65, 72, 48, 65, 61, 64, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExtendVirtualBuffer + 34                                           7C85EDB8 188 Bytes  [ 52, 74, 6C, 47, 65, 74, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetSearchPathMode + 35                                             7C85EE75 116 Bytes  [ CC, CC, CC, CC, CC, 8B, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDllDirectoryW + 19                                              7C85EEEA 55 Bytes  [ 94, 7C, 68, 1D, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDllDirectoryW + 51                                              7C85EF22 40 Bytes  [ EB, 9E, 8B, 4F, 28, E9, 9B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDllDirectoryW + 7A                                              7C85EF4B 21 Bytes  [ 8B, 47, 0C, 89, 06, 8B, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDllDirectoryW + 90                                              7C85EF61 65 Bytes  [ 66, 83, 20, 00, 66, 8B, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDllDirectoryA + 3C                                              7C85EFA3 132 Bytes  [ 00, 00, 00, 49, 6E, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDllDirectoryW + 30                                              7C85F028 40 Bytes  [ 66, 65, 72, 20, 3D, 3D, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDllDirectoryW + 59                                              7C85F051 32 Bytes  [ 70, 00, 00, 00, 00, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerifyVersionInfoA + B                                             7C85F072 60 Bytes  [ 72, 55, 53, 2E, 4C, 65, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerifyVersionInfoA + 4A                                            7C85F0B1 29 Bytes  [ 00, 64, 3A, 5C, 6E, 74, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VerifyVersionInfoA + 6A                                            7C85F0D1 136 Bytes  [ 00, 49, 6E, 74, 65, 72, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UTRegister + 49                                                    7C85F15A 116 Bytes  [ 64, 53, 74, 72, 69, 6E, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDllDirectoryA + 68                                              7C85F1CF 11 Bytes  [ B8, F8, FF, 00, 00, 66, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDllDirectoryA + 74                                              7C85F1DB 77 Bytes  [ 66, 01, 45, EC, 83, C1, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExA + 23                                            7C85F229 19 Bytes  [ 8D, 45, A4, 50, 89, 4D, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetModuleHandleExA + 37                                            7C85F23D 81 Bytes  [ 68, F2, 80, 94, 7C, 68, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesA + 33                                            7C85F28F 7 Bytes  [ 7D, AC, 0F, 87, FE, E1, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesA + 3B                                            7C85F297 99 Bytes  [ 03, C8, 8B, 39, 83, CB, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesA + 9F                                            7C85F2FB 247 Bytes  JMP 7C835988 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesA + 197                                           7C85F3F3 72 Bytes  [ 4D, C8, B8, FE, FF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesA + 1E0                                           7C85F43C 18 Bytes  [ 0F, B7, 45, D8, 66, 83, 26, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesA + 6                                             7C85F44F 89 Bytes  [ FF, 74, 05, 3B, 46, 10, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesA + 60                                            7C85F4A9 47 Bytes  JMP 7C835A78 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceNamesA + 90                                            7C85F4D9 461 Bytes  [ 20, 53, 58, 53, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesW + 3E                                            7C85F6A7 174 Bytes  [ 8F, 68, FD, FF, 8B, 8D, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesW + ED                                            7C85F756 123 Bytes  [ CC, CC, CC, CC, CC, CC, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesW + 169                                           7C85F7D2 113 Bytes  [ 8B, 41, 3C, 03, C1, 81, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesW + 1DB                                           7C85F844 8 Bytes  [ FE, FF, EB, EA, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceTypesW + 1E4                                           7C85F84D 7 Bytes  [ 33, C0, 40, C3, 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesW + 4                                         7C85F855 3 Bytes  [ 90, 8B, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesW + 8                                         7C85F859 27 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesW + 24                                        7C85F875 29 Bytes  [ 8B, 00, 89, 85, D4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesW + 43                                        7C85F894 22 Bytes  [ B5, D8, FD, FF, FF, E9, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumResourceLanguagesW + 5A                                        7C85F8AB 9 Bytes  JMP 7C8356A6 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeInfo + 5F                                              7C85FB09 12 Bytes  [ 85, C8, FE, FF, FF, 3B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeInfo + 6C                                              7C85FB16 111 Bytes  [ 8D, 85, C4, FE, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekNamedPipe + 57                                                 7C85FB86 79 Bytes  [ 66, 83, 7D, DC, 01, 0F, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekNamedPipe + A7                                                 7C85FBD6 98 Bytes  [ 52, FC, FF, 89, 85, C8, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekNamedPipe + 10A                                                7C85FC39 55 Bytes  [ FF, 85, A4, FE, FF, FF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekNamedPipe + 142                                                7C85FC71 6 Bytes  [ FF, 8D, 85, 44, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekNamedPipe + 149                                                7C85FC78 11 Bytes  CALL 7C827885 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateW + 2                                       7C85FCA7 41 Bytes  [ 89, 85, C8, FE, FF, FF, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateW + 2C                                      7C85FCD1 18 Bytes  [ 55, 08, 74, 06, 4E, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateW + 3F                                      7C85FCE4 156 Bytes  [ FD, FF, 4E, 89, 75, E0, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateW + DC                                      7C85FD81 2 Bytes  [ FF, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateW + DF                                      7C85FD84 78 Bytes  [ 35, 44, 29, 98, 7C, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeW + 35                                                7C85FDD4 38 Bytes  [ E4, A1, 5C, E2, 97, 7C, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeW + 5C                                                7C85FDFB 59 Bytes  CALL 7C82532E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeW + 98                                                7C85FE37 23 Bytes  [ 8D, 85, 8C, F3, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeW + B0                                                7C85FE4F 96 Bytes  [ 89, 85, 24, F3, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeA + 1C                                              7C85FEB0 55 Bytes  [ 8B, CB, 8D, BD, D0, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateNamedPipeA + 54                                              7C85FEE8 118 Bytes  [ 3B, C3, 0F, 8C, DA, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateA + 54                                      7C85FF5F 55 Bytes  [ FF, 66, 89, B5, 48, F3, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateA + 8C                                      7C85FF97 4 Bytes  CALL 7C82BC52 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateA + 91                                      7C85FF9C 4 Bytes  [ 68, 16, 91, 94 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateA + 96                                      7C85FFA1 20 Bytes  [ 8D, 85, 64, F3, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNamedPipeHandleStateA + AC                                      7C85FFB7 8 Bytes  [ 33, DB, 43, 89, 9D, D8, F2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeA + 2                                                 7C85FFF0 12 Bytes  [ 50, 8D, 85, 48, F3, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeA + F                                                 7C85FFFD 72 Bytes  [ FF, 50, 56, 65, 61, 64, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CallNamedPipeA + 58                                                7C860046 47 Bytes  [ 81, F9, 0B, 01, 00, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaHighestNodeNumber + 15                                      7C860076 54 Bytes  [ FF, 85, C0, 74, 1B, 8B, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorNode + 1                                           7C8600AD 2 Bytes  [ 46, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorNode + 4                                           7C8600B0 4 Bytes  [ 40, 34, 83, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorNode + 9                                           7C8600B5 29 Bytes  [ 74, 5E, 48, 74, 54, 48, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorNode + 27                                          7C8600D3 65 Bytes  [ 83, C4, 0C, 32, C0, EB, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorNode + 69                                          7C860115 142 Bytes  [ 68, 6A, 8D, 96, 7C, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaProcessorMap + 6                                            7C8601A4 118 Bytes  [ FF, 55, 8B, EC, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaAvailableMemory + 38                                        7C86021C 70 Bytes  [ 8B, FE, F3, AB, 8B, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaAvailableMemoryNode + 39                                    7C860263 56 Bytes  [ 7C, 07, 8B, 45, 08, 89, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaAvailableMemoryNode + 72                                    7C86029C 23 Bytes  [ FF, 55, 8B, EC, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaAvailableMemoryNode + 8A                                    7C8602B4 26 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumaAvailableMemoryNode + A5                                    7C8602CF 54 Bytes  [ 8B, EC, 83, EC, 50, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NumaVirtualQueryNode + 14                                          7C860306 2 Bytes  [ E1, 59 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NumaVirtualQueryNode + 18                                          7C86030A 193 Bytes  [ 83, 65, FC, 00, 8B, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NumaVirtualQueryNode + DA                                          7C8603CC 32 Bytes  [ FF, 55, 8B, EC, 8B, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NumaVirtualQueryNode + FB                                          7C8603ED 47 Bytes  [ 04, 75, 42, B8, 46, 90, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NumaVirtualQueryNode + 12B                                         7C86041D 34 Bytes  CALL FFC27842 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDriveStringsW + B6                                       7C8606A5 13 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLogicalDriveStringsW + C4                                       7C8606B3 190 Bytes  [ 68, 00, 80, 00, 00, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelW + B9                                               7C860772 81 Bytes  [ 85, C0, 7D, 1C, 56, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelW + 10B                                              7C8607C4 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelW + 112                                              7C8607CB 17 Bytes  [ 55, 8B, EC, 51, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelW + 125                                              7C8607DE 8 Bytes  [ 23, C1, 23, F9, 3B, C7, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelW + 12E                                              7C8607E7 13 Bytes  [ 00, 89, 45, 08, 73, 5C, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CheckNameLegalDOS8Dot3W + 74                                       7C860AA5 145 Bytes  [ 4D, E4, 51, 6A, 00, 50, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameA + 18                                              7C860B37 13 Bytes  [ 46, 48, 85, C0, 89, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameA + 26                                              7C860B45 54 Bytes  [ 5A, 8B, 55, 08, 39, 4A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameA + 5D                                              7C860B7C 97 Bytes  [ FC, FF, FF, FF, 4E, 48, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTempFileNameA + BF                                              7C860BDE 57 Bytes  [ 4E, 48, EB, 03, 89, 7E, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelA + B                                                7C860C18 45 Bytes  CALL 7C860942 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeLabelA + 39                                               7C860C46 392 Bytes  [ 8B, 50, 64, 85, D2, 75, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelDeviceWakeupRequest + 18                                     7C860DCF 25 Bytes  [ FF, 85, F6, 75, 32, 57, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMessageWaitingIndicator + A                                     7C860DE9 87 Bytes  CALL 7C860853 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMessageWaitingIndicator + 62                                    7C860E41 27 Bytes  CALL 7C860CD0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMessageWaitingIndicator + 7E                                    7C860E5D 1 Byte  [ 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMessageWaitingIndicator + 81                                    7C860E60 1 Byte  [ FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetMessageWaitingIndicator + 83                                    7C860E62 60 Bytes  CALL 7C86087C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessId + A                                                   7C860E9F 8 Bytes  [ 73, 0E, 53, 8B, FB, E8, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessId + 13                                                  7C860EA8 13 Bytes  [ FF, 8B, F0, 85, F6, 75, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessId + 21                                                  7C860EB6 3 Bytes  [ C4, F9, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessId + 25                                                  7C860EBA 31 Bytes  [ FF, 75, F8, FF, 75, 08, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalAppExitW + 10                                                 7C860EDA 8 Bytes  [ FF, 8B, 45, F8, 50, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalAppExitW + 19                                                 7C860EE3 18 Bytes  [ 70, 04, 89, 78, 08, E8, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalAppExitW + 2C                                                 7C860EF6 13 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalAppExitW + 3A                                                 7C860F04 169 Bytes  [ 08, 17, 00, 00, C0, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalExit + 48                                                     7C860FAE 95 Bytes  [ 2E, 63, 78, 72, 20, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalExit + A8                                                     7C86100E 19 Bytes  [ 74, 00, 69, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalExit + BC                                                     7C861022 2 Bytes  [ 73, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalExit + C0                                                     7C861026 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FatalExit + C2                                                     7C861028 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPriorityClass + 7                                               7C86103A 59 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPriorityClass + 43                                              7C861076 3 Bytes  [ 45, 00, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPriorityClass + 47                                              7C86107A 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPriorityClass + 49                                              7C86107C 7 Bytes  [ 20, 00, 66, 00, 61, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetPriorityClass + 51                                              7C861084 5 Bytes  [ 6C, 00, 65, 00, 64 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessShutdownParameters + 9                                   7C8610A2 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessShutdownParameters + B                                   7C8610A4 17 Bytes  [ 66, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessShutdownParameters + 1D                                  7C8610B6 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessShutdownParameters + 1F                                  7C8610B8 123 Bytes  [ 6D, 00, 20, 00, 64, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessShutdownParameters + 9B                                  7C861134 1 Byte  [ 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimes + 12                                                7C861154 13 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimes + 20                                                7C861162 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimes + 22                                                7C861164 31 Bytes  [ 20, 00, 45, 00, 41, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimes + 42                                                7C861184 3 Bytes  [ 69, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemTimes + 46                                                7C861188 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetProcessPriorityBoost + 36                                       7C861336 11 Bytes  [ 0A, 00, 00, 00, 00, 00, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessPriorityBoost + 7                                        7C861342 45 Bytes  [ 20, 00, 72, 00, 65, 00, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessPriorityBoost + 35                                       7C861370 11 Bytes  [ 6E, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetProcessIoCounters + 7                                           7C86137C 109 Bytes  [ 65, 00, 20, 00, 67, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemRegistryQuota + A                                         7C8613EA 115 Bytes  [ 20, 00, 6F, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemRegistryQuota + 7E                                        7C86145E 11 Bytes  [ 74, 00, 65, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemRegistryQuota + 8A                                        7C86146A 35 Bytes  [ 64, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemRegistryQuota + AE                                        7C86148E 5 Bytes  [ 6D, 00, 70, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetSystemRegistryQuota + B4                                        7C861494 57 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WinExec + 37                                                       7C8615C4 7 Bytes  [ 64, 00, 20, 00, 6F, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WinExec + 3F                                                       7C8615CC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WinExec + 41                                                       7C8615CE 73 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WinExec + 8B                                                       7C861618 5 Bytes  [ 76, 00, 69, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WinExec + 91                                                       7C86161E 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadModule + 4                                                     7C8616A2 23 Bytes  [ 0A, 00, 00, 00, 00, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadModule + 1C                                                    7C8616BA 13 Bytes  [ 65, 00, 73, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadModule + 2A                                                    7C8616C8 13 Bytes  [ 72, 00, 65, 00, 76, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadModule + 38                                                    7C8616D6 11 Bytes  [ 6E, 00, 20, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LoadModule + 44                                                    7C8616E2 51 Bytes  [ 6C, 00, 73, 00, 20, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathA + 15                                         7C8619CE 17 Bytes  [ 68, 00, 65, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathA + 27                                         7C8619E0 17 Bytes  [ 63, 00, 75, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathA + 39                                         7C8619F2 47 Bytes  [ 20, 00, 6E, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathA + 69                                         7C861A22 1 Byte  [ 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DosPathToSessionPathA + 6B                                         7C861A24 35 Bytes  [ 6C, 00, 65, 00, 20, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerW + 8                                             7C861BAD 8 Bytes  [ 00, 62, 00, 79, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerW + 11                                            7C861BB6 21 Bytes  [ 68, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerW + 27                                            7C861BCC 1 Byte  [ 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerW + 29                                            7C861BCE 20 Bytes  [ 00, 00, 7C, 00, 01, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerW + 3E                                            7C861BE3 82 Bytes  [ 00, 20, 00, 70, 00, 72, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerA + 13                                          7C861CB4 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerA + 15                                          7C861CB6 7 Bytes  [ 65, 00, 64, 00, 20, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerA + 1D                                          7C861CBE 31 Bytes  [ 73, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerA + 3D                                          7C861CDE 5 Bytes  [ 73, 00, 74, 00, 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateWaitableTimerA + 43                                          7C861CE4 1 Byte  [ 0D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerA + 12                                            7C861D22 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerA + 14                                            7C861D24 7 Bytes  [ 79, 00, 20, 00, 65, 00, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerA + 1C                                            7C861D2C 16 Bytes  [ 69, 00, 73, 00, 74, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerA + 2D                                            7C861D3D 14 Bytes  [ 00, 01, 00, 54, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenWaitableTimerA + 3C                                            7C861D4C 5 Bytes  [ 65, 00, 63, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTermsrvAppInstallMode + 3C                                      7C861DC0 11 Bytes  [ 6E, 00, 74, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTermsrvAppInstallMode + 48                                      7C861DCC 21 Bytes  [ 61, 00, 6C, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTermsrvAppInstallMode + 5E                                      7C861DE2 19 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTermsrvAppInstallMode + 72                                      7C861DF6 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTermsrvAppInstallMode + 74                                      7C861DF8 17 Bytes  [ 65, 00, 64, 00, 20, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadPriorityBoost + 36                                        7C862C4A 11 Bytes  [ 20, 00, 53, 00, 45, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadPriorityBoost + 7                                         7C862C56 45 Bytes  [ 49, 00, 54, 00, 59, 00, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadPriorityBoost + 35                                        7C862C84 93 Bytes  [ 65, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadContext + 59                                              7C862CE2 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadContext + 5B                                              7C862CE4 21 Bytes  [ 65, 00, 64, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadContext + 71                                              7C862CFA 25 Bytes  [ 73, 00, 73, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadContext + 8B                                              7C862D14 13 Bytes  [ 66, 00, 6F, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetThreadContext + 99                                              7C862D22 11 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadTimes + A                                                 7C862E8E 93 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadTimes + 68                                                7C862EEC 11 Bytes  [ 79, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetThreadIOPendingFlag + 7                                         7C862EF8 141 Bytes  [ 72, 00, 65, 00, 6E, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueueEx + 22                                            7C862F86 31 Bytes  [ 73, 00, 6F, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueueEx + 42                                            7C862FA6 13 Bytes  [ 74, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueue + 9                                               7C862FB4 3 Bytes  [ 49, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteTimerQueue + D                                               7C862FB8 63 Bytes  [ 64, 00, 69, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CancelTimerQueueTimer + 20                                         7C862FF8 85 Bytes  [ 20, 00, 65, 00, 69, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnhandledExceptionFilter + 4                                       7C86304E 43 Bytes  [ 63, 00, 65, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnhandledExceptionFilter + 30                                      7C86307A 21 Bytes  [ 63, 00, 61, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnhandledExceptionFilter + 46                                      7C863090 7 Bytes  [ 20, 00, 6E, 00, 75, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnhandledExceptionFilter + 4E                                      7C863098 31 Bytes  [ 62, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnhandledExceptionFilter + 6E                                      7C8630B8 37 Bytes  [ 6E, 00, 65, 00, 20, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32ListFirst + 22                                               7C863BA3 118 Bytes  [ 00, 45, 00, 50, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32ListFirst + 99                                               7C863C1A 15 Bytes  [ 72, 00, 20, 00, 64, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32ListFirst + A9                                               7C863C2A 135 Bytes  [ 6F, 00, 6E, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32ListNext + 83                                                7C863CB2 43 Bytes  [ 69, 00, 76, 00, 69, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32First + 18                                                   7C863CDE 7 Bytes  [ 0A, 00, 00, 00, 00, 00, A0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32First + 20                                                   7C863CE6 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32First + 22                                                   7C863CE8 17 Bytes  [ 41, 00, 6E, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32First + 34                                                   7C863CFA 5 Bytes  [ 74, 00, 20, 00, 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32First + 3A                                                   7C863D00 33 Bytes  [ 61, 00, 73, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32Next + 12                                                    7C863DF2 7 Bytes  [ 68, 00, 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32Next + 1A                                                    7C863DFA 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32Next + 1C                                                    7C863DFC 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32Next + 1E                                                    7C863DFE 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Heap32Next + 20                                                    7C863E00 15 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32FirstW + 1A                                               7C863F66 5 Bytes  [ 69, 00, 6E, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32FirstW + 20                                               7C863F6C 103 Bytes  [ 6F, 00, 72, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32FirstW + 88                                               7C863FD4 27 Bytes  [ 66, 00, 20, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32FirstW + A4                                               7C863FF0 15 Bytes  [ 6E, 00, 61, 00, 6C, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32FirstW + B4                                               7C864000 15 Bytes  [ 6C, 00, 6F, 00, 74, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32First + B                                                 7C864010 21 Bytes  [ 0A, 00, 53, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32First + 21                                                7C864026 5 Bytes  [ 61, 00, 20, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32First + 27                                                7C86402C 5 Bytes  [ 61, 00, 79, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32First + 2D                                                7C864032 19 Bytes  [ 61, 00, 6C, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32First + 41                                                7C864046 13 Bytes  [ 76, 00, 65, 00, 20, 00, 62, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32NextW + 19                                                7C8640F0 69 Bytes  [ 6F, 00, 6E, 00, 61, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32NextW + 5F                                                7C864136 11 Bytes  [ 6F, 00, 63, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32NextW + 6B                                                7C864142 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32NextW + 6D                                                7C864144 31 Bytes  [ 6D, 00, 65, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32NextW + 8D                                                7C864164 29 Bytes  [ 2C, 00, 20, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32Next + A                                                  7C864182 21 Bytes  [ 74, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32Next + 20                                                 7C864198 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32Next + 22                                                 7C86419A 5 Bytes  [ 6F, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32Next + 28                                                 7C8641A0 3 Bytes  [ 20, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Process32Next + 2C                                                 7C8641A4 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Thread32First + 1A                                                 7C864264 133 Bytes  [ 7C, 00, 01, 00, 49, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Thread32First + A0                                                 7C8642EA 153 Bytes  [ 61, 00, 74, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Thread32Next + 86                                                  7C864384 13 Bytes  [ 45, 00, 5F, 00, 44, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Thread32Next + 94                                                  7C864392 29 Bytes  [ 45, 00, 52, 00, 52, 00, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32FirstW + 19                                                7C8643B0 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32FirstW + 1B                                                7C8643B2 5 Bytes  [ 53, 00, 5F, 00, 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32FirstW + 21                                                7C8643B8 103 Bytes  [ 45, 00, 56, 00, 49, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32FirstW + 89                                                7C864420 27 Bytes  [ 0A, 00, 00, 00, F4, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32FirstW + A5                                                7C86443C 29 Bytes  [ 6D, 00, 6F, 00, 72, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32First + A                                                  7C86445A 25 Bytes  [ 66, 00, 72, 00, 65, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32First + 24                                                 7C864474 5 Bytes  [ 20, 00, 61, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32First + 2A                                                 7C86447A 5 Bytes  [ 64, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32First + 30                                                 7C864480 19 Bytes  [ 73, 00, 73, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32First + 44                                                 7C864494 11 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32NextW + 18                                                 7C86454C 69 Bytes  [ 72, 00, 65, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32NextW + 5E                                                 7C864592 13 Bytes  [ 6F, 00, 63, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32NextW + 6C                                                 7C8645A0 33 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32NextW + 8E                                                 7C8645C2 13 Bytes  [ 20, 00, 73, 00, 65, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32NextW + 9C                                                 7C8645D0 15 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32Next + B                                                   7C8645E0 23 Bytes  [ 20, 00, 65, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32Next + 23                                                  7C8645F8 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32Next + 25                                                  7C8645FA 5 Bytes  [ 6C, 00, 6F, 00, 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32Next + 2B                                                  7C864600 3 Bytes  [ 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!Module32Next + 2F                                                  7C864604 1 Byte  [ 68 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateToolhelp32Snapshot + 83                                      7C864DB2 13 Bytes  [ 20, 00, 64, 00, 6F, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameA + 9                                               7C864DC0 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameA + B                                               7C864DC2 11 Bytes  [ 74, 00, 20, 00, 73, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameA + 17                                              7C864DCE 13 Bytes  [ 6F, 00, 72, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameA + 25                                              7C864DDC 71 Bytes  [ 6C, 00, 69, 00, 67, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameA + 6D                                              7C864E24 73 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameW + A                                               7C864E6E 107 Bytes  [ 20, 00, 68, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameW + 76                                              7C864EDA 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameW + 78                                              7C864EDC 25 Bytes  [ 6F, 00, 74, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameW + 92                                              7C864EF6 11 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetExpandedNameW + 9E                                              7C864F02 115 Bytes  [ 6C, 00, 69, 00, 73, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZInit + 4F                                                        7C865061 22 Bytes  [ 00, 73, 00, 6F, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZInit + 66                                                        7C865078 7 Bytes  [ 74, 00, 20, 00, 62, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZInit + 6E                                                        7C865080 9 Bytes  [ 20, 00, 63, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZInit + 78                                                        7C86508A 8 Bytes  [ 67, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZInit + 81                                                        7C865093 6 Bytes  [ 00, 6F, 00, 20, 00, 71 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCreateFileW + B                                                  7C865178 39 Bytes  [ 6D, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCreateFileW + 33                                                 7C8651A0 5 Bytes  [ 69, 00, 73, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCreateFileW + 39                                                 7C8651A6 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCreateFileW + 3B                                                 7C8651A8 37 Bytes  [ 6E, 00, 6E, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCreateFileW + 61                                                 7C8651CE 123 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileA + A                                                    7C86524A 21 Bytes  [ 63, 00, 69, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileA + 20                                                   7C865260 21 Bytes  [ 64, 00, 20, 00, 70, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileA + 36                                                   7C865276 139 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileA + C2                                                   7C865302 15 Bytes  [ 67, 00, 20, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileW + B                                                    7C865312 67 Bytes  [ 0D, 00, 0A, 00, 00, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZOpenFileW + 4F                                                   7C865356 89 Bytes  [ 6F, 00, 74, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZSeek + 12                                                        7C8653B0 3 Bytes  [ 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZSeek + 16                                                        7C8653B4 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZSeek + 18                                                        7C8653B6 109 Bytes  [ 70, 00, 65, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZSeek + 86                                                        7C865424 19 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZRead + F                                                         7C865438 9 Bytes  [ 75, 00, 74, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZRead + 19                                                        7C865442 3 Bytes  [ 72, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZRead + 1D                                                        7C865446 5 Bytes  [ 6F, 00, 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZRead + 23                                                        7C86544C 15 Bytes  [ 65, 00, 78, 00, 70, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZRead + 33                                                        7C86545C 25 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCloseFile + 13                                                   7C86564A 7 Bytes  [ 61, 00, 6E, 00, 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCloseFile + 1B                                                   7C865652 21 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZCloseFile + 31                                                   7C865668 87 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZClose + 12                                                       7C8656C0 5 Bytes  [ 72, 00, 65, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZClose + 18                                                       7C8656C6 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZClose + 1A                                                       7C8656C8 37 Bytes  [ 6F, 00, 72, 00, 79, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZClose + 40                                                       7C8656EE 31 Bytes  [ 73, 00, 74, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZClose + 60                                                       7C86570E 17 Bytes  [ 74, 00, 65, 00, 64, 00, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ClearCommError + 2F                                                7C86579E 37 Bytes  [ 69, 00, 73, 00, 74, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ClearCommError + 55                                                7C8657C4 23 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ClearCommError + 6D                                                7C8657DC 27 Bytes  [ 74, 00, 77, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ClearCommError + 89                                                7C8657F8 62 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ClearCommError + C8                                                7C865837 76 Bytes  [ 00, 69, 00, 73, 00, 20, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetupComm + 3B                                                     7C8658F5 46 Bytes  [ 00, 0A, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetupComm + 6A                                                     7C865924 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetupComm + 6C                                                     7C865926 23 Bytes  [ 77, 00, 61, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetupComm + 84                                                     7C86593E 21 Bytes  [ 61, 00, 73, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetupComm + 9A                                                     7C865954 1 Byte  [ 2E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EscapeCommFunction + 15                                            7C865996 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EscapeCommFunction + 17                                            7C865998 9 Bytes  [ 65, 00, 63, 00, 74, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EscapeCommFunction + 21                                            7C8659A2 1 Byte  [ 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EscapeCommFunction + 23                                            7C8659A4 4 Bytes  [ 0D, 00, 0A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EscapeCommFunction + 28                                            7C8659A9 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommMask + 2D                                                   7C865AAA 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommMask + 2F                                                   7C865AAC 19 Bytes  [ 74, 00, 6F, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommMask + 43                                                   7C865AC0 23 Bytes  [ 69, 00, 6C, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommMask + 5B                                                   7C865AD8 113 Bytes  [ 74, 00, 6F, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommModemStatus + 45                                            7C865B4B 20 Bytes  [ 00, 65, 00, 73, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommModemStatus + 5A                                            7C865B60 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommModemStatus + 5C                                            7C865B62 39 Bytes  [ 20, 00, 66, 00, 69, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommModemStatus + 84                                            7C865B8A 31 Bytes  [ 6C, 00, 65, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommProperties + 1B                                             7C865BAA 83 Bytes  [ 77, 00, 6F, 00, 72, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommProperties + 6F                                             7C865BFE 67 Bytes  [ 69, 00, 73, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommProperties + B3                                             7C865C42 41 Bytes  [ 52, 00, 65, 00, 73, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommState + 25                                                  7C865C6C 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommState + 27                                                  7C865C6E 17 Bytes  [ 65, 00, 63, 00, 69, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommState + 39                                                  7C865C80 37 Bytes  [ 65, 00, 76, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommState + 5F                                                  7C865CA6 33 Bytes  [ 72, 00, 20, 00, 65, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommState + 81                                                  7C865CC8 1 Byte  [ 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PurgeComm + 2B                                                     7C865F20 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PurgeComm + 2D                                                     7C865F22 23 Bytes  [ 65, 00, 6E, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PurgeComm + 45                                                     7C865F3A 21 Bytes  [ 6C, 00, 79, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PurgeComm + 5B                                                     7C865F50 1 Byte  [ 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PurgeComm + 5D                                                     7C865F52 39 Bytes  [ 00, 00, 28, 01, 01, 00, 4E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommBreak + 13                                                  7C865F92 65 Bytes  [ 64, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommMask + 3D                                                   7C865FD4 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommMask + 3F                                                   7C865FD6 25 Bytes  [ 20, 00, 74, 00, 69, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommMask + 59                                                   7C865FF0 321 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommState + FC                                                  7C866132 18 Bytes  [ FF, 84, C0, 75, 04, 32, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommState + 10F                                                 7C866145 5 Bytes  [ 74, 15, 83, 65, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommState + 115                                                 7C86614B 21 Bytes  [ 68, 00, 80, 00, 00, 8D, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommState + 12B                                                 7C866161 56 Bytes  [ 04, 00, 90, 48, 45, 41, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommState + 164                                                 7C86619A 42 Bytes  [ 6C, 44, 65, 73, 74, 72, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommTimeouts + 1                                                7C86633F 48 Bytes  [ 46, 30, 66, 3B, 05, 46, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommTimeouts + 32                                               7C866370 2 Bytes  [ 99, 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommTimeouts + 36                                               7C866374 34 Bytes  CALL 7C85920B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommTimeouts + 59                                               7C866397 11 Bytes  JMP 7C866426 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommTimeouts + 65                                               7C8663A3 41 Bytes  [ 89, 45, AC, 8B, 40, 30, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TransmitCommChar + 11                                              7C8663FA 25 Bytes  [ 64, A1, 18, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TransmitCommChar + 2B                                              7C866414 79 Bytes  [ 8B, F0, 89, 75, 9C, FF, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TransmitCommChar + 7B                                              7C866464 9 Bytes  [ 00, 00, 00, 00, 24, F0, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!TransmitCommChar + 85                                              7C86646E 304 Bytes  [ 00, 00, BB, EF, 96, 7C, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitCommEvent + 12C                                                7C86659F 7 Bytes  [ 0D, 00, 01, 00, 10, 09, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitCommEvent + 134                                                7C8665A7 72 Bytes  [ 8B, 7D, 14, 85, FF, 8B, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitCommEvent + 17E                                                7C8665F1 27 Bytes  [ 8B, 5D, 10, 8D, 7B, F8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitCommEvent + 19A                                                7C86660D 85 Bytes  [ 00, 3B, 1D, 48, FF, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WaitCommEvent + 1F0                                                7C866663 48 Bytes  [ 00, 00, 83, 3D, 4C, FF, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogW + 2                                              7C86696F 243 Bytes  [ 30, 78, 25, 78, 20, 62, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogA + 2                                              7C866A63 47 Bytes  [ 73, 69, 7A, 65, 20, 2D, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogA + 32                                             7C866A93 81 Bytes  [ 8B, 75, 08, 89, 75, D8, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogA + 84                                             7C866AE5 22 Bytes  [ 12, FF, B6, 78, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogA + 9B                                             7C866AFC 3 Bytes  [ 7F, EE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CommConfigDialogA + 9F                                             7C866B00 24 Bytes  [ 8B, 5D, 10, 8D, 7B, F8, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigW + 4C                                         7C866B85 18 Bytes  [ 00, 00, F6, 47, 05, 02, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigW + 5F                                         7C866B98 54 Bytes  [ 66, 8B, 78, 02, EB, 0F, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigW + 96                                         7C866BCF 41 Bytes  [ 00, 00, 89, 45, BC, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigW + C0                                         7C866BF9 42 Bytes  [ FF, 50, 53, 68, F4, F8, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigW + EB                                         7C866C24 2 Bytes  [ FF, 6A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigA                                              7C866C31 25 Bytes  [ 90, 90, 90, 8B, 45, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigA + 1F                                         7C866C50 96 Bytes  [ 89, 45, B0, 8D, 88, F4, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigA + 80                                         7C866CB1 2 Bytes  [ FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultCommConfigA + 83                                         7C866CB4 179 Bytes  [ 00, 00, 00, 00, 74, F8, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigW + 60                                         7C866D69 1 Byte  [ 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigW + 62                                         7C866D6B 12 Bytes  [ 75, 14, FF, 75, 10, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigW + 6F                                         7C866D78 3 Bytes  JMP 7C866E49 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigW + 74                                         7C866D7D 24 Bytes  [ 00, 83, 65, FC, 00, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigW + 8D                                         7C866D96 6 Bytes  [ 08, 88, 45, E7, E9, 9B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigA + 18                                         7C866E19 23 Bytes  [ D4, 8D, 88, F4, 0B, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigA + 30                                         7C866E31 51 Bytes  CALL 7C806A4C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigA + 64                                         7C866E65 22 Bytes  CALL 7C7F84FF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigA + 7B                                         7C866E7C 56 Bytes  [ 00, 00, 00, 00, DB, F9, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetDefaultCommConfigA + B8                                         7C866EB9 11 Bytes  [ 6A, 20, 68, C0, FB, 96, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommConfig + 3E                                                 7C866F37 15 Bytes  [ 8B, 7D, 10, 8D, 47, F8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommConfig + 4E                                                 7C866F47 69 Bytes  CALL 7C865823 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommConfig + 94                                                 7C866F8D 43 Bytes  [ D4, 8D, 88, F4, 0B, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommConfig + C1                                                 7C866FBA 146 Bytes  CALL 7C805D22 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCommConfig + 154                                                7C86704D 90 Bytes  [ 18, FF, 75, 14, FF, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommConfig + D                                                  7C8670A8 25 Bytes  [ 75, 11, FF, B6, 78, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommConfig + 27                                                 7C8670C2 81 Bytes  [ FF, 8B, 7D, 10, 8D, 47, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommConfig + 79                                                 7C867114 25 Bytes  [ 64, A1, 18, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCommConfig + 93                                                 7C86712E 41 Bytes  [ 8B, F0, 89, 75, D0, FF, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNextVDMCommand + 25                                             7C867158 39 Bytes  [ 74, 0E, 8B, 45, DC, FF, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNextVDMCommand + 4D                                             7C867180 84 Bytes  [ 34, FD, 96, 7C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNextVDMCommand + A2                                             7C8671D5 10 Bytes  [ C6, 45, E7, 00, F6, 46, 13, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNextVDMCommand + AD                                             7C8671E0 70 Bytes  [ 75, 10, FF, 75, 0C, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNextVDMCommand + F4                                             7C867227 57 Bytes  [ B6, 78, 05, 00, 00, E8, EF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitVDM + B                                                        7C867890 26 Bytes  [ 74, 0E, 8B, 45, D8, FF, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitVDM + 27                                                       7C8678AC 32 Bytes  [ 00, 00, 00, 00, 6C, 04, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitVDM + 48                                                       7C8678CD 21 Bytes  [ CC, CC, CC, CC, CC, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExitVDM + 5E                                                       7C8678E3 87 Bytes  [ 33, DB, 88, 5D, E7, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVDMCurrentDirectories + 38                                      7C86793C 28 Bytes  CALL 7C806A49 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVDMCurrentDirectories + 55                                      7C867959 57 Bytes  [ FF, FF, FF, EF, 04, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVDMCurrentDirectories + 8F                                      7C867993 32 Bytes  CALL 7C82778E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVDMCurrentDirectories + B0                                      7C8679B4 1 Byte  [ 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVDMCurrentDirectories + B2                                      7C8679B6 70 Bytes  [ 0F, C1, 08, 53, 56, 57, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVDMCurrentDirectories + 53                                      7C867A8C 17 Bytes  [ 83, C0, 10, EB, 0D, C1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVDMCurrentDirectories + 65                                      7C867A9E 14 Bytes  [ 8D, 70, 20, 33, C0, 40, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVDMCurrentDirectories + 74                                      7C867AAD 9 Bytes  [ F7, D0, F7, D2, 23, 55, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVDMCurrentDirectories + 7E                                      7C867AB7 29 Bytes  CALL 067EC049 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVDMCurrentDirectories + 9D                                      7C867AD6 7 Bytes  [ 3B, 55, FC, 0F, 85, DD, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWowExec + 12                                               7C867BAB 29 Bytes  [ F0, 75, CB, 3B, 55, F4, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWowExec + 30                                               7C867BC9 14 Bytes  [ 8B, 40, 24, 89, 04, 9D, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWowExec + 40                                               7C867BD9 19 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWowExec + 54                                               7C867BED 7 Bytes  [ 8B, FF, 55, 8B, EC, 53, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterWowExec + 5C                                               7C867BF5 102 Bytes  CALL 7C7F841D 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryTypeW + 2D                                                7C867DE9 147 Bytes  [ FF, 8B, 5D, FC, 57, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryTypeW + C1                                                7C867E7D 61 Bytes  [ 5D, 08, 03, CB, 89, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryTypeW + FF                                                7C867EBB 40 Bytes  [ F6, 45, 11, 80, 74, 25, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryTypeW + 128                                               7C867EE4 4 Bytes  [ 00, 00, 8D, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryTypeW + 12D                                               7C867EE9 154 Bytes  [ 10, 00, 00, 3B, 45, FC, B9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMOperationStarted + 38                                           7C868041 41 Bytes  [ 4D, 10, 23, CF, 83, C1, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMOperationStarted + 62                                           7C86806B 125 Bytes  [ 8B, 45, 1C, 83, 20, 00, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMOperationStarted + E0                                           7C8680E9 15 Bytes  [ F0, 3B, 55, F8, 0F, 82, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMOperationStarted + F0                                           7C8680F9 42 Bytes  [ 14, 01, 8D, 54, 16, 02, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMOperationStarted + 11B                                          7C868124 139 Bytes  [ 01, 45, 14, 29, 45, 0C, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryType + 9F                                                 7C8682BA 45 Bytes  [ FF, 4A, C1, E2, 0C, E9, A2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryType + CD                                                 7C8682E8 31 Bytes  [ FF, 4A, C1, E2, 0A, EB, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryType + ED                                                 7C868308 4 Bytes  [ 8A, C8, 80, E9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryType + F2                                                 7C86830D 88 Bytes  [ 66, 0F, B6, C9, FE, CA, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetBinaryType + 14B                                                7C868366 206 Bytes  [ 0B, CA, 8B, 5D, EC, 8B, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameA + 36                                              7C8687AC 117 Bytes  [ 55, 8B, EC, 83, 3D, 10, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameA + AD                                              7C868823 15 Bytes  CALL 7C86B59A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameA + BD                                              7C868833 24 Bytes  [ 0D, D0, E3, 97, 7C, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameA + D6                                              7C86884C 15 Bytes  [ EC, 83, 3D, 10, E2, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLongPathNameA + E6                                              7C86885C 55 Bytes  CALL 7C86B59B C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointW + 4                                     7C868FA5 58 Bytes  [ 45, 08, 66, 83, 38, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointW + 3F                                    7C868FE0 44 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointW + 6C                                    7C86900D 19 Bytes  [ 85, C0, 59, 59, 75, EB, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointW + 80                                    7C869021 40 Bytes  [ F8, 2B, 75, 05, 0F, B7, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointW + A9                                    7C86904A 24 Bytes  [ 45, 08, 13, C2, 89, 45, F8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointW + 2D                                     7C86927A 87 Bytes  [ 00, 00, EB, 2E, 8A, 07, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointW + 85                                     7C8692D2 217 Bytes  [ A9, 03, 01, 74, 43, 80, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointW + 15F                                    7C8693AC 6 Bytes  [ 55, 8B, EC, 6A, 00, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointW + 166                                    7C8693B3 38 Bytes  [ 10, FF, 75, 0C, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointW + 18D                                    7C8693DA 3 Bytes  [ 18, FE, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointW + 8F                                          7C869614 140 Bytes  [ 75, 3E, 39, 55, 10, 75, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointW + 11C                                         7C8696A1 107 Bytes  [ DD, 45, 10, DC, 1D, F0, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointW + 188                                         7C86970D 114 Bytes  [ D9, E0, DD, 5D, 10, DD, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointW + 1FD                                         7C869782 26 Bytes  [ 3B, FA, 89, 45, FC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointW + 219                                         7C86979E 55 Bytes  [ 00, 74, 73, 6A, 02, 5A, 2B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteVolumeMountPointW + 3A                                       7C869B5A 42 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteVolumeMountPointW + 66                                       7C869B86 64 Bytes  [ C0, A8, 02, 74, 0B, 83, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteVolumeMountPointW + A7                                       7C869BC7 38 Bytes  [ 07, C1, E0, 04, F7, D0, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteVolumeMountPointW + CE                                       7C869BEE 88 Bytes  [ 83, E0, 04, 31, 46, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DeleteVolumeMountPointW + 128                                      7C869C48 123 Bytes  [ 23, C1, 74, 2D, 3D, 00, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeA + 2E                                               7C869E1D 10 Bytes  [ 08, 00, 00, 74, 2A, 3B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeA + 39                                               7C869E28 212 Bytes  [ 00, 00, 8B, 4D, 0C, DD, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeA + 10E                                              7C869EFD 252 Bytes  [ DD, 07, 8D, 45, F8, 50, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeMountPointA + F2                                    7C869FFB 76 Bytes  [ 8B, FF, 55, 8B, EC, 8A, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointA + F                                      7C86A048 42 Bytes  [ 74, 66, 40, 83, F8, 1D, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointA + 3B                                     7C86A074 15 Bytes  [ F4, 8B, 45, 20, 89, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointA + 4B                                     7C86A084 17 Bytes  [ 75, 28, 89, 75, E0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointA + 5D                                     7C86A096 9 Bytes  [ 03, 15, 00, 00, 83, C4, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindNextVolumeMountPointA + 67                                     7C86A0A0 4 Bytes  [ 09, 56, E8, 24 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointA + 29                             7C86A17A 169 Bytes  [ 50, FF, 73, 0C, 8D, 43, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointA + D3                             7C86A224 32 Bytes  [ FE, DD, 45, F8, C9, C3, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumeNameForVolumeMountPointA + F4                             7C86A245 76 Bytes  [ C0, 40, 5D, C3, 81, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetVolumeMountPointA + 11                                          7C86A292 110 Bytes  [ FF, 55, 8B, EC, 51, 51, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameA + 11                              7C86A301 9 Bytes  [ 65, 0E, EF, 3B, C1, 74, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameA + 1B                              7C86A30B 45 Bytes  [ 80, DD, 45, 08, 51, 51, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameA + 49                              7C86A339 104 Bytes  [ 83, C4, 0C, 81, EA, FE, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameA + B2                              7C86A3A2 26 Bytes  [ FC, C9, C3, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetVolumePathNamesForVolumeNameA + CD                              7C86A3BD 1 Byte  [ 98 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeA + 9E                                              7C86A4E7 71 Bytes  [ 01, 56, 8B, F0, 7E, 0C, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeA + E7                                              7C86A530 50 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeA + 11A                                             7C86A563 25 Bytes  JMP D9E66CF3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeA + 134                                             7C86A57D 44 Bytes  [ A1, C8, E0, 97, 7C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FindFirstVolumeA + 161                                             7C86A5AA 27 Bytes  [ 8D, 68, FE, FF, FF, 88, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsA + 2                                       7C86B0B1 45 Bytes  [ FF, FF, B5, 60, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBA + 2                                                  7C86B0DF 42 Bytes  [ F7, D8, 83, D1, 00, F7, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBA + 2D                                                 7C86B10A 6 Bytes  [ 83, FF, 78, 74, 48, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsW + 2                                       7C86B111 3 Bytes  [ 70, 74, 43 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsW + 6                                       7C86B115 1 Byte  [ 3D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsW + 8                                       7C86B117 69 Bytes  [ E2, 97, 7C, 01, 7E, 0C, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsW + 4E                                      7C86B15D 6 Bytes  [ 01, 7E, 0F, 68, 80, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBAndTimeoutsW + 55                                      7C86B164 51 Bytes  CALL 7C86B59B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBW + 2F                                                 7C86B198 5 Bytes  [ FF, 83, BD, 50, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBW + 35                                                 7C86B19E 22 Bytes  [ FF, 00, 8D, 74, 1E, D0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBW + 4C                                                 7C86B1B5 45 Bytes  [ 95, 60, FE, FF, FF, FF, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBW + 7A                                                 7C86B1E3 8 Bytes  [ FF, 59, 59, 80, BD, 5F, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BuildCommDCBW + 83                                                 7C86B1EC 12 Bytes  [ 00, 74, 08, F7, DE, 89, B5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapePosition + 9                                                7C86B285 97 Bytes  [ D8, 0F, B6, 07, 47, 3B, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PrepareTape + 10                                                   7C86B2E8 74 Bytes  [ 07, 84, C0, 74, 37, E9, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EraseTape + 2A                                                     7C86B335 17 Bytes  [ 85, C0, 75, 13, 38, 85, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateTapePartition + 9                                            7C86B347 5 Bytes  [ 85, 3C, FE, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateTapePartition + F                                            7C86B34D 52 Bytes  [ 4D, FC, 5F, 5E, 5B, E8, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteTapemark + A                                                  7C86B382 49 Bytes  [ FC, 8B, 43, 10, 0F, B7, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeParameters + 2                                              7C86B3B4 73 Bytes  [ FF, FF, 10, 00, 00, 00, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeParameters + 4C                                             7C86B3FE 2 Bytes  [ FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeParameters + 4F                                             7C86B401 2 Bytes  [ 9B, E9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeParameters + 53                                             7C86B405 27 Bytes  [ 83, C4, 0C, 85, C0, 75, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTapeParameters + 13                                             7C86B421 1 Byte  [ FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTapeParameters + 15                                             7C86B423 34 Bytes  [ 12, 8B, 4D, C0, DD, 46, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetTapeParameters + 38                                             7C86B446 10 Bytes  [ FF, FF, 50, 8D, 45, 80, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeStatus + 2                                                  7C86B451 14 Bytes  [ FF, 83, C4, 18, 68, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetTapeStatus + 11                                                 7C86B460 37 Bytes  CALL 7C86A37F C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenJobObjectW + 16                                                7C86B486 27 Bytes  [ FF, 59, 8B, 4D, FC, E8, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenJobObjectW + 32                                                7C86B4A2 27 Bytes  [ EC, 51, 51, DD, 45, 08, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenJobObjectW + 4E                                                7C86B4BE 210 Bytes  [ 0E, B9, F0, 7F, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateJobObjectA + 15                                              7C86B591 127 Bytes  [ 00, 00, 8B, 45, 08, 5D, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenJobObjectA + 29                                                7C86B611 37 Bytes  [ 00, 00, EB, E2, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!OpenJobObjectA + 4F                                                7C86B637 48 Bytes  [ 00, 00, 5D, C3, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkW + C                                                7C86B668 387 Bytes  [ 56, 57, BF, 80, FF, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkW + 190                                              7C86B7EC 4 Bytes  [ 35, 9C, FF, 97 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkW + 195                                              7C86B7F1 17 Bytes  CALL 7C80734D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkW + 1A7                                              7C86B803 9 Bytes  [ 00, 83, 4D, FC, FF, E8, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkW + 1B1                                              7C86B80D 7 Bytes  CALL 7C805D26 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkA + 10                                               7C86B829 28 Bytes  [ FF, FF, FF, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkA + 2D                                               7C86B846 7 Bytes  [ DB, 89, 5D, E4, 89, 5D, E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateHardLinkA + 35                                               7C86B84E 84 Bytes  [ 35, 38, 17, 98, 7C, E8, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateSocketHandle + 1F                                            7C86B8A3 9 Bytes  [ 83, C8, FF, F0, 0F, C1, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateSocketHandle + 29                                            7C86B8AD 45 Bytes  [ C8, FF, F0, 0F, C1, 07, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateSocketHandle + 57                                            7C86B8DB 12 Bytes  CALL 7C805D22 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ZombifyActCtx                                                      7C86B8EB 1 Byte  [ 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ZombifyActCtx + 2                                                  7C86B8ED 39 Bytes  [ 35, 38, 17, 98, 7C, E8, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ZombifyActCtx + 2A                                                 7C86B915 30 Bytes  [ A1, 38, 17, 98, 7C, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ZombifyActCtx + 49                                                 7C86B934 4 Bytes  [ 38, 17, 98, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ZombifyActCtx + 4E                                                 7C86B939 34 Bytes  [ 48, 20, 8B, 50, 24, 8B, F1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxA + B                                                  7C86B9A0 10 Bytes  [ 00, 83, 4D, FC, FF, E8, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxA + 16                                                 7C86B9AB 52 Bytes  [ 35, 38, 17, 98, 7C, E8, E5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxA + 4B                                                 7C86B9E0 61 Bytes  [ 35, 38, 17, 98, 7C, E8, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxA + 89                                                 7C86BA1E 15 Bytes  [ 78, 18, BE, A4, 18, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateActCtxA + 99                                                 7C86BA2E 9 Bytes  [ 45, F8, 50, 6A, 08, A5, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetComPlusPackageInstallStatus + 50                                7C86BDE2 263 Bytes  [ F0, 0F, C1, 08, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseDumpAppcompatCache + 39                                        7C86BEEA 15 Bytes  [ C0, 39, 5D, FC, 0F, 8C, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseDumpAppcompatCache + 49                                        7C86BEFA 30 Bytes  [ 00, 00, 33, C9, 83, C0, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseDumpAppcompatCache + 68                                        7C86BF19 36 Bytes  [ 4D, 08, 89, 01, 0F, 85, 9B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseDumpAppcompatCache + 8D                                        7C86BF3E 282 Bytes  [ C0, 0C, 83, C9, FF, F0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCache + 63                                     7C86C059 154 Bytes  [ 00, 00, FF, B3, 8C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCacheSupport + 7A                              7C86C0F4 12 Bytes  [ 46, 04, 5F, 5E, 89, 43, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCacheSupport + 87                              7C86C101 12 Bytes  [ C9, C2, 08, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCacheSupport + 94                              7C86C10E 63 Bytes  [ 25, 00, 64, 00, 00, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCacheSupport + D4                              7C86C14E 6 Bytes  [ 8B, 4D, 10, B8, A8, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BaseCleanupAppcompatCacheSupport + DB                              7C86C155 16 Bytes  [ 00, 39, 45, 08, 89, 01, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceW + 11                                               7C86F7E2 21 Bytes  CALL 7C80726A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceW + 28                                               7C86F7F9 1 Byte  [ 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceW + 2A                                               7C86F7FB 3 Bytes  [ 6B, 7A, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceW + 2E                                               7C86F7FF 60 Bytes  [ 59, 8D, 74, 46, 04, 83, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceW + 6B                                               7C86F83C 8 Bytes  [ 4D, 14, 89, 48, 10, 8D, 78, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceA + 2                                                7C86F8DA 147 Bytes  [ FF, FF, 3B, F3, 75, 17, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UpdateResourceA + 96                                               7C86F96E 78 Bytes  CALL 7C80734B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceW + 1B                                            7C86F9BD 5 Bytes  [ D4, 50, FF, B5, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceW + 22                                            7C86F9C4 10 Bytes  CALL 7C8718AF C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceW + 2D                                            7C86F9CF 16 Bytes  [ FF, FF, 3B, C3, 75, 3C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceW + 3E                                            7C86F9E0 35 Bytes  [ FF, 75, 98, 53, FF, 35, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceW + 62                                            7C86FA04 32 Bytes  CALL 7C80734B C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceA + F                                             7C86FB88 11 Bytes  [ C1, E6, 05, 03, 75, 9C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceA + 1B                                            7C86FB94 12 Bytes  [ 8D, 78, 08, 6A, 08, 59, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceA + 28                                            7C86FBA1 29 Bytes  [ FF, 8B, 75, 90, 8D, 4C, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceA + 46                                            7C86FBBF 41 Bytes  CALL 7C80440D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EndUpdateResourceA + 70                                            7C86FBE9 106 Bytes  CALL 7C871A41 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceW + 3D                                          7C86FD45 39 Bytes  [ FF, 76, 04, FF, 36, E8, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceW + 65                                          7C86FD6D 10 Bytes  [ 89, 1E, 89, 5E, 04, EB, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceW + 70                                          7C86FD78 35 Bytes  [ FF, FF, 8B, 37, EB, 1B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceW + 94                                          7C86FD9C 6 Bytes  [ E1, 57, 53, FF, 35, 9C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceW + 9B                                          7C86FDA3 30 Bytes  CALL 7C80734B C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceA                                               7C86FEAB 126 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceA + 7F                                          7C86FF2A 5 Bytes  [ 75, FC, FF, 75, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceA + 85                                          7C86FF30 5 Bytes  [ 75, 18, FF, 75, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceA + 8B                                          7C86FF36 5 Bytes  [ 75, 10, FF, 75, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!BeginUpdateResourceA + 91                                          7C86FF3C 5 Bytes  [ 75, 08, E8, 96, F7 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasW + 18                                              7C8702CE 3 Bytes  [ 03, 7D, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasW + 1C                                              7C8702D2 101 Bytes  [ 45, 0C, 8B, 45, 0C, 3B, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasA + 56                                              7C870338 38 Bytes  [ 4F, 0C, 89, 48, 04, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasA + 7D                                              7C87035F 93 Bytes  [ 5E, 5F, C9, C2, 10, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasA + DB                                              7C8703BD 14 Bytes  [ EB, 1E, 81, C3, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasA + EA                                              7C8703CC 10 Bytes  [ 85, C0, 74, 4F, 8D, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesLengthW + 6                                       7C8703D7 30 Bytes  CALL 7C804D4D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesLengthA + D                                       7C8703F6 34 Bytes  CALL 7C8702E6 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesLengthA + 31                                      7C87041A 46 Bytes  [ 5E, C9, C2, 08, 00, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesLengthA + 60                                      7C870449 7 Bytes  [ 00, C0, EB, 48, 56, 6A, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesLengthA + 68                                      7C870451 101 Bytes  CALL 7C84C399 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesLengthA + 36                                    7C8704B8 18 Bytes  CALL 70CCCABE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesLengthA + 49                                    7C8704CB 63 Bytes  [ 3B, DF, 89, 5D, D4, 75, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesLengthA + 89                                    7C87050B 2 Bytes  [ 48, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesLengthA + 8C                                    7C87050E 51 Bytes  [ 3D, 04, 00, 00, C0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesLengthA + C0                                    7C870542 32 Bytes  CALL 7C81FEBA C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesW + E                                             7C870607 23 Bytes  [ 85, C0, 89, 45, FC, 7C, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesA + 8                                             7C87061F 68 Bytes  [ 85, C0, 89, 45, FC, 7C, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesA + 4D                                            7C870664 32 Bytes  [ FF, 00, C7, 45, F8, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesA + 6E                                            7C870685 74 Bytes  [ 85, C0, 0F, 84, C5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesA + B9                                            7C8706D0 61 Bytes  [ 75, CC, 8B, D1, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasesA + F7                                            7C87070E 45 Bytes  CALL 7C87023E C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesW + 12                                          7C870773 29 Bytes  CALL 7C871C37 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesA + 15                                          7C870791 49 Bytes  [ 8B, 45, 0C, 66, 83, 21, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesA + 47                                          7C8707C3 56 Bytes  [ 30, 89, 10, 0F, 84, 83, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleAliasExesA + 80                                          7C8707FC 89 Bytes  CALL 7C80536E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpungeConsoleCommandHistoryA                                      7C870857 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpungeConsoleCommandHistoryA + 4                                  7C87085B 20 Bytes  [ FF, 55, 8B, EC, 83, EC, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpungeConsoleCommandHistoryA + 19                                 7C870870 39 Bytes  [ 45, 08, 89, 45, EC, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpungeConsoleCommandHistoryA + 41                                 7C870898 11 Bytes  CALL 7C86DAA8 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ExpungeConsoleCommandHistoryA + 4D                                 7C8708A4 74 Bytes  CALL 7C807295 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleNumberOfCommandsA + 2                                    7C870957 85 Bytes  JMP 7C870DB0 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleNumberOfCommandsA + 58                                   7C8709AD 21 Bytes  CALL 7C804D4D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleNumberOfCommandsA + 6E                                   7C8709C3 104 Bytes  [ FF, C1, E1, 0A, 6A, 05, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthW + F                                7C870A2C 16 Bytes  JMP 7C870AEA C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthA + 8                                7C870A3D 30 Bytes  [ FF, FF, 8B, 43, 3C, C1, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthA + 27                               7C870A5C 24 Bytes  [ FF, 89, 85, 04, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthA + 41                               7C870A76 28 Bytes  CALL 7C80507D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthA + 5F                               7C870A94 86 Bytes  [ FF, 50, 56, 56, 56, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryLengthA + B6                               7C870AEB 8 Bytes  [ FF, 6A, 0E, 6A, 08, 8D, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryW + E                                      7C870BC7 5 Bytes  [ FF, 50, 8D, 85, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCommandHistoryW + 15                                     7C870BCE 121 Bytes  [ FF, 50, FF, B5, 0C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCommandHistoryMode + 53                                  7C870C48 34 Bytes  [ 50, 8D, 85, 10, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleA + 2                                               7C870C6B 10 Bytes  [ B5, 2C, FF, FF, FF, E8, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleA + D                                               7C870C76 8 Bytes  [ 0E, 6A, 08, 8D, 85, 18, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleTitleA + 16                                              7C870C7F 25 Bytes  [ 50, 8D, 85, 10, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleA + 8                                               7C870C99 2 Bytes  [ E1, 43 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleA + C                                               7C870C9D 55 Bytes  [ 3B, C6, 0F, 8C, D1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTitleA + 44                                              7C870CD5 75 Bytes  [ 75, 3A, F9, FF, FF, B5, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameW + 20                                       7C870D21 56 Bytes  [ 43, 68, 50, 8D, 85, 10, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameW + 59                                       7C870D5A 38 Bytes  [ FF, 50, 57, C7, 85, 18, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameW + 81                                       7C870D82 51 Bytes  [ EB, 2E, 56, 56, 6A, 04, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameW + B5                                       7C870DB6 50 Bytes  CALL 7C80440C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameW + E8                                       7C870DE9 116 Bytes  [ C9, C2, 04, 00, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasW + 23                                              7C870ED4 6 Bytes  [ FF, 89, BD, F8, FC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasW + 2A                                              7C870EDB 10 Bytes  [ 75, 48, 83, 63, 40, FB, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasW + 35                                              7C870EE6 10 Bytes  [ FF, 00, 56, 6A, 2C, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasA + 2                                               7C870EF1 9 Bytes  [ 50, 56, 89, 73, 50, E8, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasA + C                                               7C870EFB 23 Bytes  [ 8B, F8, 3B, FE, 0F, 8D, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AddConsoleAliasA + 24                                              7C870F13 65 Bytes  [ 56, FF, 35, 9C, FF, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameA + 2B                                       7C870F57 31 Bytes  [ 74, 12, FF, B5, 04, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameA + 4B                                       7C870F77 31 Bytes  JMP 7C87181B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameA + 6B                                       7C870F97 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputExeNameA + 6D                                       7C870F99 188 Bytes  [ 43, 64, 8B, 85, 8C, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameA + 7E                                       7C871056 24 Bytes  [ 64, F9, FF, 3B, C6, 89, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameA + 99                                       7C871071 13 Bytes  [ F8, F3, A5, 6A, 44, 8D, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameA + A8                                       7C871080 74 Bytes  JMP 7C870EE4 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameA + F3                                       7C8710CB 30 Bytes  [ FD, FF, FF, EB, 0E, 83, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleInputExeNameA + 112                                      7C8710EA 2 Bytes  [ 00, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeConsole + 39                                                   7C8712F6 152 Bytes  [ FF, 8B, B5, F8, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeConsole + D2                                                   7C87138F 38 Bytes  [ 83, C7, 18, 8D, 73, 18, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeConsole + F9                                                   7C8713B6 1 Byte  [ 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeConsole + FB                                                   7C8713B8 11 Bytes  [ 74, 1F, 8B, 85, 94, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FreeConsole + 107                                                  7C8713C4 1 Byte  [ 6A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AllocConsole + 33                                                  7C871574 9 Bytes  [ 41, 41, 8B, D1, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AllocConsole + 3D                                                  7C87157E 42 Bytes  [ CA, 83, E1, 03, F3, A4, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AllocConsole + 68                                                  7C8715A9 2 Bytes  [ F4, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AllocConsole + 6C                                                  7C8715AD 58 Bytes  [ C7, 40, 2C, 04, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AllocConsole + A8                                                  7C8715E9 11 Bytes  [ 6A, 0C, 59, 8B, F8, F3, A5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AttachConsole + F                                                  7C871738 26 Bytes  [ 56, 56, 6A, 04, 8D, 45, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AttachConsole + 2A                                                 7C871753 13 Bytes  [ 24, 8D, 85, DC, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AttachConsole + 38                                                 7C871761 51 Bytes  CALL 7C80474E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AttachConsole + 6C                                                 7C871795 3 Bytes  [ 17, C5, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!AttachConsole + 70                                                 7C871799 4 Bytes  [ 39, B5, 04, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputWaitHandle + 7                                      7C871830 8 Bytes  [ AE, 47, E1, 7A, 14, AE, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputWaitHandle + 10                                     7C871839 115 Bytes  [ 00, 00, 00, 00, 00, 50, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputWaitHandle + 84                                     7C8718AD 22 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputWaitHandle + 9B                                     7C8718C4 2 Bytes  [ BE, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleInputWaitHandle + 9E                                     7C8718C7 1 Byte  [ 98 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleW + 3E                                                  7C871CDA 3 Bytes  [ 48, 40, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleW + 42                                                  7C871CDE 10 Bytes  [ C2, 04, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleW + 4D                                                  7C871CE9 33 Bytes  [ FF, FF, FF, 5B, A8, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleVDM + 19                                            7C871D0B 6 Bytes  [ F4, 50, E8, A3, 69, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleVDM + 20                                            7C871D12 1 Byte  [ 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleVDM + 22                                            7C871D14 16 Bytes  [ D4, 50, 33, F6, 56, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleVDM + 33                                            7C871D25 45 Bytes  [ 84, C0, 75, 0F, 6A, 03, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleVDM + 62                                            7C871D54 1 Byte  [ DC ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleHardwareState + 39                                       7C871E82 15 Bytes  CALL 7C80734B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleHardwareState + 49                                       7C871E92 48 Bytes  CALL 7C80734B C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleHardwareState + 7A                                       7C871EC3 35 Bytes  [ 45, 08, 8D, 50, 01, 8A, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleHardwareState + 9E                                       7C871EE7 2 Bytes  [ 7F, 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleHardwareState + A2                                       7C871EEB 41 Bytes  [ FF, 75, 08, 8D, 74, 00, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleHardwareState + 21                                       7C871F3A 53 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleHardwareState + 57                                       7C871F70 2 Bytes  [ 75, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleHardwareState + 5A                                       7C871F73 189 Bytes  CALL 7C871F15 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleKeyShortcuts + 98                                        7C872031 4 Bytes  CALL 7C7F8420 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleKeyShortcuts + 9D                                        7C872036 73 Bytes  [ A1, 6C, 10, 98, 7C, BA, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMenuClose + 20                                           7C872080 25 Bytes  [ FF, 55, 8B, EC, 51, 51, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMenuClose + 3A                                           7C87209A 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMenuClose + 3C                                           7C87209C 9 Bytes  [ 8B, D8, 85, DB, 75, 57, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMenuClose + 46                                           7C8720A6 9 Bytes  [ 35, 9C, FF, 97, 7C, E8, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMenuClose + 50                                           7C8720B0 16 Bytes  [ 8B, D8, 85, DB, 75, 08, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputVDMA + 9                                          7C8720DD 98 Bytes  [ 00, 00, 89, 43, 20, A1, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursor + 26                                              7C872140 46 Bytes  [ 55, 10, C1, E0, 04, 89, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursor + 55                                              7C87216F 4 Bytes  [ EB, 39, BE, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursor + 5A                                              7C872174 126 Bytes  [ 00, 00, EB, 22, 03, F6, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConsoleMenuControl + 4                                             7C8721F3 24 Bytes  [ 55, 08, 8B, 45, F8, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConsoleMenuControl + 1D                                            7C87220C 2 Bytes  [ 4B, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConsoleMenuControl + 20                                            7C87220F 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConsoleMenuControl + 23                                            7C872212 16 Bytes  [ 54, 01, 08, 8B, 4B, 20, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ConsoleMenuControl + 34                                            7C872223 2 Bytes  [ 55, 18 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleDisplayMode + AF                                         7C87237F 123 Bytes  [ 57, 1C, 85, D2, 76, 22, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsolePalette + 2                                              7C8723FB 68 Bytes  [ FF, 84, C0, 74, 4E, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsolePalette + 47                                             7C872440 70 Bytes  [ 40, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsolePalette + 8F                                             7C872488 73 Bytes  [ 90, 8B, FF, 55, 8B, EC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsolePalette + D9                                             7C8724D2 79 Bytes  [ 0B, 33, C0, 39, 46, 1C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsolePalette + 129                                            7C872522 44 Bytes  CALL 7C871F5E C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputA + 19                                            7C87260E 11 Bytes  [ 8D, 45, 23, 50, 56, 88, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputW + 2                                             7C87261A 116 Bytes  [ FF, 89, 07, 8B, 45, 14, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputW + 77                                            7C87268F 4 Bytes  CALL 7C7F8420 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputW + 7C                                            7C872694 39 Bytes  [ A1, 6C, 10, 98, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputW + A4                                            7C8726BC 3 Bytes  [ 00, 00, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleInputW + A8                                            7C8726C0 193 Bytes  [ EC, 89, 4D, F0, 8B, 58, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputW + 1                                             7C872A12 2 Bytes  [ 45, F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputW + 4                                             7C872A15 38 Bytes  [ 40, 10, 6A, 01, FF, 35, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputA + 7                                             7C872A3C 18 Bytes  [ 00, 81, 7D, F4, E5, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputA + 1A                                            7C872A4F 63 Bytes  [ 35, 94, 29, 98, 7C, E8, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputA + 5A                                            7C872A8F 29 Bytes  [ 75, EC, 8B, 7D, E0, E9, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputA + 78                                            7C872AAD 48 Bytes  [ 45, FC, A3, 98, 29, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputA + A9                                            7C872ADE 26 Bytes  [ FF, 68, FA, 00, 00, 00, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputW + 1B                                           7C872D6C 120 Bytes  [ 55, 8B, EC, 83, EC, 10, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputA + 70                                           7C872DE5 1 Byte  [ 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputA + 72                                           7C872DE7 3 Bytes  [ 33, D2, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputA + 76                                           7C872DEB 1 Byte  [ F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputA + 78                                           7C872DED 116 Bytes  [ 46, 08, 13, 55, F4, 89, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputA + EE                                           7C872E63 87 Bytes  [ FF, FF, B9, 68, 29, 98, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputCharacterA + 1                                    7C872F0A 2 Bytes  [ D1, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputCharacterA + 4                                    7C872F0D 33 Bytes  JMP 082D2214 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputCharacterW                                        7C872F2F 5 Bytes  [ 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputCharacterW + 6                                    7C872F35 33 Bytes  [ 55, 8B, EC, 83, EC, 10, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputAttribute + 2                                     7C872F57 16 Bytes  [ 0F, 94, C0, 50, 8D, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputAttribute + 13                                    7C872F68 157 Bytes  [ 85, FF, 74, 17, 0F, B7, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputAttribute + B1                                    7C873006 72 Bytes  CALL 7C8074E2 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputAttribute + FA                                    7C87304F 5 Bytes  [ 43, 08, 8B, 4D, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleOutputAttribute + 100                                   7C873055 1 Byte  [ 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputCharacterW + 2                                   7C8730FD 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputCharacterW + 4                                   7C8730FF 178 Bytes  [ F0, 33, C0, 3B, F0, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputAttribute + 91                                   7C8731B2 23 Bytes  [ FF, 50, FF, B5, F8, F7, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputAttribute + A9                                   7C8731CA 9 Bytes  [ 35, 9C, FF, 97, 7C, E8, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputAttribute + B3                                   7C8731D4 44 Bytes  [ FF, B5, F4, F7, FF, FF, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputAttribute + E0                                   7C873201 25 Bytes  [ F7, FF, FF, 50, FF, B5, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!WriteConsoleOutputAttribute + FA                                   7C87321B 32 Bytes  [ B5, F4, F7, FF, FF, 68, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterA + 13                                   7C87323C 28 Bytes  [ 8B, F8, 8B, C1, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterW + 9                                    7C873259 10 Bytes  [ BF, 00, 10, 00, 00, FF, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterW + 14                                   7C873264 2 Bytes  [ 8D, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterW + 17                                   7C873267 2 Bytes  [ F7, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterW + 1A                                   7C87326A 4 Bytes  [ 50, 57, 53, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputCharacterW + 1F                                   7C87326F 6 Bytes  [ FF, B5, EC, F7, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputAttribute + 2                                     7C873276 3 Bytes  [ B5, F0, F7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputAttribute + 6                                     7C87327A 19 Bytes  CALL 7C8046ED C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FillConsoleOutputAttribute + 1A                                    7C87328E 24 Bytes  [ 33, F6, EB, 10, BE, 17, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateConsoleScreenBuffer + F                                      7C8732A7 36 Bytes  CALL 7C80440D C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateConsoleScreenBuffer + 34                                     7C8732CC 5 Bytes  [ C9, C2, 04, 00, 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateConsoleScreenBuffer + 3A                                     7C8732D2 15 Bytes  [ 65, 00, 73, 00, 63, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateConsoleScreenBuffer + 4A                                     7C8732E2 4 Bytes  [ 6F, 00, 6E, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateConsoleScreenBuffer + 50                                     7C8732E8 65 Bytes  [ 25, 00, 77, 00, 73, 00, 5C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InvalidateConsoleDIBits + 1D                                       7C873462 13 Bytes  [ 00, 56, 57, 8D, 85, A0, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InvalidateConsoleDIBits + 2C                                       7C873471 24 Bytes  [ 68, 20, C3, 97, 7C, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InvalidateConsoleDIBits + 45                                       7C87348A 3 Bytes  [ FF, 85, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InvalidateConsoleDIBits + 4A                                       7C87348F 2 Bytes  [ F8, F7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!InvalidateConsoleDIBits + 4E                                       7C873493 6 Bytes  [ 0F, 8C, C8, 01, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekConsoleInputA + 7                                              7C8736C4 57 Bytes  [ 48, 00, 41, 00, 52, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!PeekConsoleInputW + 1E                                             7C8736FE 11 Bytes  [ 65, 00, 6E, 00, 74, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputA + 7                                              7C87370A 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputA + 9                                              7C87370C 55 Bytes  [ 72, 00, 6F, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputW + 1E                                             7C873744 11 Bytes  [ 65, 00, 67, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputExA + 7                                            7C873750 23 Bytes  [ 79, 00, 5C, 00, 4D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputExA + 1F                                           7C873768 35 Bytes  [ 73, 00, 74, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ReadConsoleInputExW + 1F                                           7C87378C 7 Bytes  [ 6C, 00, 53, 00, 65, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorInfo + 3                                           7C873794 1 Byte  [ 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorInfo + 5                                           7C873796 25 Bytes  [ 43, 00, 6F, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorInfo + 1F                                          7C8737B0 31 Bytes  [ 74, 00, 65, 00, 72, 00, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorInfo + 3F                                          7C8737D0 39 Bytes  [ 4E, 00, 61, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorInfo + 69                                          7C8737FA 7 Bytes  [ 53, 56, 68, 00, 10, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleSelectionInfo + 5                                        7C87385E 24 Bytes  [ 8B, 85, 70, E7, FF, FF, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleSelectionInfo + 1F                                       7C873878 53 Bytes  [ FF, B5, F0, E7, FF, FF, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleSelectionInfo + 56                                       7C8738AF 41 Bytes  [ 50, 8D, 85, B0, E7, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleSelectionInfo + 80                                       7C8738D9 8 Bytes  [ 40, 00, 00, 00, 89, 9D, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleSelectionInfo + 89                                       7C8738E2 51 Bytes  [ FF, 89, 9D, C4, E7, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleMouseButtons + 5                                 7C873916 68 Bytes  [ 00, 07, 00, 8D, 85, C8, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleMouseButtons + 4B                                7C87395C 9 Bytes  [ B5, E0, E7, FF, FF, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleMouseButtons + 56                                7C873967 65 Bytes  CALL 7C80440E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleMouseButtons + 98                                7C8739A9 8 Bytes  [ E7, FF, FF, 89, BD, E4, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleMouseButtons + A1                                7C8739B2 68 Bytes  CALL 7C8112B3 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontInfo + 2F                                            7C8739F8 17 Bytes  CALL 7C872FE4 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontInfo + 41                                            7C873A0A 6 Bytes  [ 97, 7C, E8, 3C, 39, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontInfo + 49                                            7C873A12 9 Bytes  [ B5, EC, E7, FF, FF, 53, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontInfo + 53                                            7C873A1C 54 Bytes  CALL 7C8074E2 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontInfo + 8B                                            7C873A54 25 Bytes  [ 3B, C7, 89, 85, F8, E7, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontSize + 26                                            7C873B17 52 Bytes  [ 8D, EC, E7, FF, FF, 8B, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontSize + 5B                                            7C873B4C 27 Bytes  [ 59, 59, 56, 8D, 85, D8, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontSize + 77                                            7C873B68 1 Byte  [ 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontSize + 79                                            7C873B6A 2 Bytes  [ D8, E7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleFontSize + 7D                                            7C873B6E 31 Bytes  [ 89, 85, B8, E7, FF, FF, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentConsoleFont + F                                          7C873B8E 27 Bytes  [ 50, 66, C7, 85, DA, E7, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentConsoleFont + 2B                                         7C873BAA 2 Bytes  [ BC, E7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentConsoleFont + 2F                                         7C873BAE 8 Bytes  [ 40, 00, 00, 00, 89, 9D, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentConsoleFont + 38                                         7C873BB7 6 Bytes  [ FF, 89, 9D, C4, E7, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrentConsoleFont + 3F                                         7C873BBE 48 Bytes  CALL 7C8044CE C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GenerateConsoleCtrlEvent + 2A                                      7C873C7B 42 Bytes  [ 42, 10, 66, 3B, C3, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GenerateConsoleCtrlEvent + 55                                      7C873CA6 16 Bytes  [ E1, 03, F3, A4, 66, 89, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GenerateConsoleCtrlEvent + 67                                      7C873CB8 7 Bytes  [ 50, 8D, 85, D8, E7, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GenerateConsoleCtrlEvent + 70                                      7C873CC1 3 Bytes  [ F0, 49, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GenerateConsoleCtrlEvent + 74                                      7C873CC5 4 Bytes  [ 6A, 10, 8D, 85 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleActiveScreenBuffer + 2                                   7C873CDA 66 Bytes  CALL 7C810FC3 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleActiveScreenBuffer + 45                                  7C873D1D 10 Bytes  [ 89, 9D, C4, E7, FF, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleActiveScreenBuffer + 50                                  7C873D28 9 Bytes  [ 53, 53, 6A, 20, 6A, 03, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleActiveScreenBuffer + 5A                                  7C873D32 72 Bytes  [ 00, 00, 00, 8B, F0, 53, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushConsoleInputBuffer + 2F                                       7C873D7B 12 Bytes  [ 8D, BD, FC, E7, FF, FF, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushConsoleInputBuffer + 3C                                       7C873D88 19 Bytes  [ FF, 50, 53, 53, 68, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushConsoleInputBuffer + 51                                       7C873D9D 2 Bytes  [ E4, E7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushConsoleInputBuffer + 55                                       7C873DA1 11 Bytes  CALL 7C80469E C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FlushConsoleInputBuffer + 61                                       7C873DAD 43 Bytes  [ FF, 7C, 7D, 8B, 85, FC, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleScreenBufferSize + 19                                    7C873DD9 32 Bytes  [ 00, C0, EB, 50, FF, B5, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleScreenBufferSize + 3A                                    7C873DFA 213 Bytes  [ 00, C0, EB, 6F, 3B, F3, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorInfo + 1C                                          7C873ED0 153 Bytes  [ 74, 00, 50, 00, 6F, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorInfo + B6                                          7C873F6A 25 Bytes  [ 72, 00, 74, 00, 20, 00, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleWindowInfo + 3                                           7C873F84 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleWindowInfo + 5                                           7C873F86 21 Bytes  [ 20, 00, 25, 00, 64, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleWindowInfo + 1B                                          7C873F9C 1 Byte  [ 49 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleWindowInfo + 1D                                          7C873F9E 135 Bytes  [ 44, 00, 20, 00, 25, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleWindowInfo + A5                                          7C874026 3 Bytes  [ B5, F7, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ScrollConsoleScreenBufferW + 8                                     7C87417D 28 Bytes  [ 8B, 55, 0C, 83, C2, 40, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTextAttribute + 1                                        7C87419A 36 Bytes  [ CB, 8D, 7C, 02, 18, 8B, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTextAttribute + 26                                       7C8741BF 17 Bytes  [ EC, 83, EC, 4C, A1, C8, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTextAttribute + 39                                       7C8741D2 22 Bytes  [ FC, 8B, 06, 89, 46, 58, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleTextAttribute + 50                                       7C8741E9 45 Bytes  [ 00, 72, 05, BA, 78, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleFont + 2                                                 7C874217 23 Bytes  [ 6A, 08, 8D, 7E, 58, 57, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleFont + 1A                                                7C87422F 195 Bytes  [ 46, 14, 89, 4E, 5C, 89, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleIcon + 64                                                7C8742F3 25 Bytes  [ 0C, 85, 78, 10, 98, 7C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCP + B                                                   7C87430E 104 Bytes  [ 00, 00, C7, 40, 18, 01, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCP + 4                                                   7C874377 226 Bytes  [ 5D, 0C, 8D, 7C, 02, 34, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCP + E7                                                  7C87445A 128 Bytes  [ E5, 5D, C2, 0C, 00, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOutputCP + 4A                                            7C8744DB 51 Bytes  CALL 7C87433C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOutputCP + 7E                                            7C87450F 68 Bytes  [ 8B, E5, 5D, C2, 08, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOutputCP + C3                                            7C874554 35 Bytes  [ 22, 00, 00, 00, 60, D1, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleKeyboardLayoutNameW + 7                                  7C874578 41 Bytes  [ 5C, C5, 07, 00, 38, 0E, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleWindow + 19                                              7C8745A2 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleWindow + 29                                              7C8745B2 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleWindow + 2E                                              7C8745B7 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleWindow + 42                                              7C8745CB 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleProcessList + 5                                          7C8745FA 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleProcessList + 2B                                         7C874620 5 Bytes  [ 63, 6F, 73, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleProcessList + 33                                         7C874628 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleProcessList + 39                                         7C87462E 63 Bytes  [ 00, 00, 6C, 6F, 67, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleProcessList + 79                                         7C87466E 13 Bytes  [ 00, 00, 61, 74, 61, 6E, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleFonts + B                                        7C87473C 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleFonts + 19                                       7C87474A 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleFonts + 29                                       7C87475A 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleFonts + 2E                                       7C87475F 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleFonts + 42                                       7C874773 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleInputEvents + 5                                  7C8747A2 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleInputEvents + 20                                 7C8747BD 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleInputEvents + 3F                                 7C8747DC 109 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetNumberOfConsoleInputEvents + AD                                 7C87484A 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLargestConsoleWindowSize + B                                    7C87486C 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLargestConsoleWindowSize + 19                                   7C87487A 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLargestConsoleWindowSize + 2F                                   7C874890 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLargestConsoleWindowSize + 34                                   7C874895 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLargestConsoleWindowSize + 48                                   7C8748A9 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleLocalEUDC + B                                            7C8748F4 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleLocalEUDC + 1F                                           7C874908 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleLocalEUDC + 7B                                           7C874964 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleLocalEUDC + 97                                           7C874980 41 Bytes  [ 08, 00, 0A, 00, 44, 56, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleLocalEUDC + C1                                           7C8749AA 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorMode + B                                           7C8749BA 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorMode + 19                                          7C8749C8 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorMode + 3B                                          7C8749EA 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorMode + 40                                          7C8749EF 19 Bytes  [ 00, 42, 64, 92, 7C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleCursorMode + 54                                          7C874A03 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorMode + 5                                           7C874A34 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorMode + 23                                          7C874A52 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorMode + 42                                          7C874A71 117 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCursorMode + B8                                          7C874AE7 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleOS2 + B                                             7C874B04 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleOS2 + 19                                            7C874B12 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleOS2 + 2F                                            7C874B28 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleOS2 + 34                                            7C874B2D 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleOS2 + 48                                            7C874B41 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOS2OemFormat + B                                         7C874B78 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOS2OemFormat + 19                                        7C874B86 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOS2OemFormat + 2F                                        7C874B9C 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOS2OemFormat + 34                                        7C874BA1 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleOS2OemFormat + 48                                        7C874BB5 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleIME + 28                                            7C874D11 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleIME + 32                                            7C874D1B 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleIME + 54                                            7C874D3D 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleIME + 64                                            7C874D4D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!RegisterConsoleIME + 72                                            7C874D5B 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterConsoleIME + 2D                                          7C874DE3 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterConsoleIME + 31                                          7C874DE7 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterConsoleIME + 41                                          7C874DF7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterConsoleIME + 43                                          7C874DF9 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UnregisterConsoleIME + 4D                                          7C874E03 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleNlsMode                                                  7C8751B7 66 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleNlsMode + 43                                             7C8751FA 188 Bytes  [ F1, 03, C8, 8B, 55, 10, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleNlsMode + 100                                            7C8752B7 20 Bytes  [ 40, 30, 0F, B7, DB, 53, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleNlsMode + 115                                            7C8752CC 127 Bytes  [ 85, C0, 8B, 7D, 14, 89, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleNlsMode + 43                                             7C87534C 111 Bytes  [ 8D, 44, 18, 0C, 8B, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleNlsMode + B3                                             7C8753BC 26 Bytes  [ 66, 0F, B6, 49, 01, 66, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCharType + 4                                             7C8753D7 17 Bytes  [ 04, 66, C7, 40, 08, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCharType + 16                                            7C8753E9 88 Bytes  [ 08, 0F, B7, 40, 04, 39, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCharType + 6F                                            7C875442 91 Bytes  [ 55, 8B, EC, 33, C0, 39, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCharType + CE                                            7C8754A1 99 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetConsoleCharType + 133                                           7C875506 12 Bytes  [ C0, EB, 1A, B8, 22, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMConsoleOperation + 28                                           7C87573C 91 Bytes  [ 4D, F4, 03, C1, 3B, C3, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMConsoleOperation + 84                                           7C875798 51 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMConsoleOperation + B8                                           7C8757CC 41 Bytes  [ 3B, C3, 89, 06, 74, 4B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMConsoleOperation + E3                                           7C8757F7 18 Bytes  [ 8B, F8, 3B, FB, 7D, 27, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!VDMConsoleOperation + F6                                           7C87580A 41 Bytes  [ 23, 00, 00, C0, 89, 1E, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoExA + 13                                           7C87598C 47 Bytes  [ 84, C0, 0F, 85, A5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsA + 2                                               7C8759BC 39 Bytes  [ FF, 6A, 01, 8D, 45, F4, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExA + A                                             7C8759E4 5 Bytes  [ 85, C0, 0F, 8C, 15 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExA + 10                                            7C8759EA 47 Bytes  [ FF, FF, 8D, 45, AC, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumLanguageGroupLocalesA + 2                                      7C875A1A 2 Bytes  [ FF, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumLanguageGroupLocalesA + 5                                      7C875A1D 11 Bytes  CALL 7B60DE31 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumLanguageGroupLocalesA + 12                                     7C875A2A 28 Bytes  CALL 327B4282 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumUILanguagesA + E                                               7C875A47 115 Bytes  [ 55, 8B, EC, 81, EC, C8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoA + 49                                                   7C875ABB 8 Bytes  [ 45, F4, 50, 8D, 85, 38, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoA + 52                                                   7C875AC4 34 Bytes  CALL 7C83106C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoA + 75                                                   7C875AE7 14 Bytes  CALL 7C83106C C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoA + 84                                                   7C875AF6 22 Bytes  [ 00, 8B, 45, E4, C7, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoA + 12                                                7C875B0D 51 Bytes  [ 01, 00, 00, 00, 74, 0C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoA + 46                                                7C875B41 123 Bytes  [ 33, C0, 3B, F0, 0F, 95, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoA + 22                                              7C875BBD 35 Bytes  [ 45, D8, 0F, 84, B6, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoA + 46                                              7C875BE1 117 Bytes  [ 0F, 87, 3E, 03, 00, 00, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoA + BC                                              7C875C57 15 Bytes  [ 07, 89, 16, 89, 56, 0C, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoA + CC                                              7C875C67 38 Bytes  [ 74, 08, 89, 56, 04, 89, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCalendarInfoA + F3                                              7C875C8E 63 Bytes  [ FF, FF, 8B, 4D, C0, 83, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoA + A                                               7C875D10 26 Bytes  [ 8B, 40, 04, 8B, 75, D4, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoA + 25                                              7C875D2B 128 Bytes  [ 19, 80, FB, 05, 74, 14, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatA + 3                                             7C875DAC 16 Bytes  CALL F363A33A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatA + 14                                            7C875DBD 72 Bytes  [ 9C, FF, 75, DC, FF, 75, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatA + 5D                                            7C875E06 64 Bytes  [ B7, 47, 04, FF, 45, E8, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatA + 9E                                            7C875E47 15 Bytes  [ 01, 00, 00, 0F, B7, 50, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatA + AE                                            7C875E57 50 Bytes  [ 38, 93, 7C, 84, D2, 75, 09, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringA + B                                                    7C8760EC 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringA + 2D                                                   7C87610E 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringA + 37                                                   7C876118 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringA + 3F                                                   7C876120 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringA + 7E                                                   7C87615F 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExA + B                                                   7C876282 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExA + 39                                                  7C8762B0 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExA + 45                                                  7C8762BC 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExA + 83                                                  7C8762FA 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExA + 3A                                              7C876339 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExA + 4B                                              7C87634A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExA + 51                                              7C876350 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExA + 56                                              7C876355 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetStringTypeExA + 65                                              7C876364 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsResetProcessLocale + 6                                          7C8765FF 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsResetProcessLocale + D                                          7C876606 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!NlsResetProcessLocale + 16                                         7C87660F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLanguageGroup + B                                           7C87662A 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLanguageGroup + 30                                          7C87664F 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLanguageGroup + 45                                          7C876664 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLanguageGroup + 4A                                          7C876669 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidLanguageGroup + 4C                                          7C87666B 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidUILanguage + B                                              7C876736 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidUILanguage + 3C                                             7C876767 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidUILanguage + 44                                             7C87676F 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidUILanguage + 67                                             7C876792 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsValidUILanguage + 69                                             7C876794 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoW + 2A                                              7C876F75 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoW + 2D                                              7C876F78 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoW + 35                                              7C876F80 242 Bytes  [ 16, FB, 75, 77, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoW + 129                                             7C877074 15 Bytes  [ 90, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCalendarInfoW + 139                                             7C877084 25 Bytes  [ 65, 00, 63, 00, 69, 00, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoW + B                                                 7C8770AE 49 Bytes  [ 76, 00, 69, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoW + 3D                                                7C8770E0 17 Bytes  [ 6F, 00, 65, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoW + 4F                                                7C8770F2 21 Bytes  [ 78, 00, 69, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoW + 65                                                7C877108 39 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetLocaleInfoW + 8D                                                7C877130 7 Bytes  [ 20, 00, 73, 00, 70, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLanguageGroupsW + 19                                     7C87892E 59 Bytes  [ 73, 00, 74, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemLocalesW + 16                                            7C87896A 61 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumCalendarInfoW + 1E                                             7C8789A8 50 Bytes  [ 65, 00, 74, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExW + B                                             7C8789DB 36 Bytes  [ 00, 66, 00, 66, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExW + 30                                            7C878A00 7 Bytes  [ 6E, 00, 6F, 00, 77, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExW + 38                                            7C878A08 19 Bytes  [ 6E, 00, 65, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExW + 4C                                            7C878A1C 13 Bytes  [ 6E, 00, 75, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumDateFormatsExW + 5A                                            7C878A2A 85 Bytes  [ 65, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoW + 9                                                    7C878A80 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoW + B                                                    7C878A82 55 Bytes  [ 74, 00, 61, 00, 73, 00, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoW + 43                                                   7C878ABA 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoW + 45                                                   7C878ABC 23 Bytes  [ 61, 00, 72, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetGeoInfoW + 5D                                                   7C878AD4 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemGeoID + 21                                               7C878E2A 11 Bytes  [ 69, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemGeoID + 2D                                               7C878E36 7 Bytes  [ 20, 00, 72, 00, 65, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemGeoID + 35                                               7C878E3E 17 Bytes  [ 64, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemGeoID + 47                                               7C878E50 11 Bytes  [ 20, 00, 61, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!EnumSystemGeoID + 53                                               7C878E5C 31 Bytes  [ 6F, 00, 6E, 00, 64, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUserGeoID + A                                                   7C878E96 51 Bytes  [ 61, 00, 63, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUserGeoID + 3E                                                  7C878ECA 7 Bytes  [ 6E, 00, 67, 00, 20, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUserGeoID + 46                                                  7C878ED2 9 Bytes  [ 70, 00, 65, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUserGeoID + 50                                                  7C878EDC 12 Bytes  [ 69, 00, 6F, 00, 6E, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetUserGeoID + 5E                                                  7C878EEA 15 Bytes  [ 00, 00, 4C, 00, 01, 00, 43, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringW + 12                                                   7C879878 11 Bytes  [ 64, 00, 72, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringW + 1E                                                   7C879884 9 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringW + 28                                                   7C87988E 15 Bytes  [ 66, 00, 69, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringW + 38                                                   7C87989E 7 Bytes  [ 74, 00, 68, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!FoldStringW + 40                                                   7C8798A6 19 Bytes  [ 69, 00, 6D, 00, 61, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCPGlobal + 17                                                   7C879A0A 51 Bytes  [ 64, 00, 20, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCPGlobal + 4B                                                   7C879A3E 19 Bytes  [ 53, 00, 65, 00, 67, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCPGlobal + 5F                                                   7C879A52 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCPGlobal + 61                                                   7C879A54 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetCPGlobal + 63                                                   7C879A56 45 Bytes  [ 7D, 00, 0D, 00, 0A, 00, 41, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExW + F                                                   7C87A40C 13 Bytes  [ 74, 00, 6F, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExW + 1D                                                  7C87A41A 11 Bytes  [ 74, 00, 20, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExW + 29                                                  7C87A426 5 Bytes  [ 20, 00, 73, 00, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExW + 2F                                                  7C87A42C 17 Bytes  [ 73, 00, 74, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCPInfoExW + 41                                                  7C87A43E 5 Bytes  [ 65, 00, 73, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByteEx + E                                               7C87A70C 9 Bytes  [ 68, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByteEx + 18                                              7C87A716 11 Bytes  [ 65, 00, 72, 00, 6F, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByteEx + 24                                              7C87A722 11 Bytes  [ 0A, 00, 00, 00, 00, 00, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByteEx + 30                                              7C87A72E 7 Bytes  [ 50, 00, 61, 00, 73, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!IsDBCSLeadByteEx + 38                                              7C87A736 7 Bytes  [ 77, 00, 6F, 00, 72, 00, 64 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultSortkeySize + 11                                         7C87AC82 9 Bytes  [ 74, 00, 20, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultSortkeySize + 1B                                         7C87AC8C 9 Bytes  [ 20, 00, 74, 00, 68, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetDefaultSortkeySize + 25                                         7C87AC96 18 Bytes  [ 20, 00, 64, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLinguistLangSize + E                                            7C87ACA9 2 Bytes  [ 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLinguistLangSize + 11                                           7C87ACAC 9 Bytes  [ 61, 00, 72, 00, 6B, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLinguistLangSize + 1B                                           7C87ACB6 9 Bytes  [ 20, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetLinguistLangSize + 25                                           7C87ACC0 21 Bytes  [ 78, 00, 70, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLCType + 11                                                7C87ACD6 5 Bytes  [ 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLCType + 17                                                7C87ACDC 11 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLCType + 23                                                7C87ACE8 11 Bytes  [ 74, 00, 65, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLCType + 2F                                                7C87ACF4 11 Bytes  [ 74, 00, 65, 00, 6D, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!ValidateLCType + 3B                                                7C87AD00 3 Bytes  [ 68, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatW + A                                             7C87B904 15 Bytes  [ 6F, 00, 64, 00, 65, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatW + 1A                                            7C87B914 3 Bytes  [ 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatW + 1E                                            7C87B918 47 Bytes  [ 6F, 00, 70, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatW + 4E                                            7C87B948 29 Bytes  [ 72, 00, 72, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!GetCurrencyFormatW + 6C                                            7C87B966 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DelayLoadFailureHook + 10                                          7C87E0ED 21 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DelayLoadFailureHook + 26                                          7C87E103 185 Bytes  JMP 7C87DC98 C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DelayLoadFailureHook + E0                                          7C87E1BD 33 Bytes  [ EC, 81, EC, 28, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DelayLoadFailureHook + 102                                         7C87E1DF 87 Bytes  [ FF, 68, 30, 00, FE, 7F, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!DelayLoadFailureHook + 15A                                         7C87E237 134 Bytes  CALL 7C82BC51 C:\WINDOWS\system32\kernel32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZStart + 73                                                       7C87E73A 143 Bytes  [ 00, 00, 54, 68, 65, 20, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZStart + 103                                                      7C87E7CA 94 Bytes  [ 00, 00, 54, 68, 65, 20, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZStart + 162                                                      7C87E829 98 Bytes  [ 00, 00, 00, 54, 68, 65, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZStart + 1C5                                                      7C87E88C 39 Bytes  [ 0A, 0A, 20, 2A, 2A, 2A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!LZStart + 1ED                                                      7C87E8B4 9 Bytes  [ 25, 77, 73, 3A, 25, 73, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!UTUnRegister + 28                                                  7C87ECA7 192 Bytes  [ 8B, FF, 55, 8B, EC, 68, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalWSecure + 94                                  7C87ED6B 35 Bytes  [ 8B, FF, 55, 8B, EC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalWSecure + B8                                  7C87ED8F 36 Bytes  [ 5D, C2, 18, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalWSecure + DD                                  7C87EDB4 17 Bytes  CALL 7C8251EC C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalWSecure + EF                                  7C87EDC6 9 Bytes  JMP 7C82466A C:\WINDOWS\system32\kernel32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!CreateProcessInternalWSecure + FA                                  7C87EDD1 12 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + D4                                   7C87F516 15 Bytes  [ 7F, 0C, 85, FF, 75, C6, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + E4                                   7C87F526 44 Bytes  [ C7, EB, F5, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + 111                                  7C87F553 51 Bytes  [ 82, FA, FF, 8D, 4F, 0C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + 145                                  7C87F587 2 Bytes  [ 55, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] kernel32.dll!SetConsoleMaximumWindowSize + 148                                  7C87F58A 38 Bytes  [ 7D, 18, 89, 45, 08, 0F, B7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + FFF98D55                                        77DD16A6 1 Byte  [ 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + FFF98D57                                        77DD16A8 5 Bytes  [ 61, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + FFF98D5D                                        77DD16AE 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + FFF98D5F                                        77DD16B0 3 Bytes  [ 6E, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + FFF98D63                                        77DD16B4 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExW + 13                                                 77DD6AA2 11 Bytes  [ 6D, 00, 20, 00, 73, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExW + 1F                                                 77DD6AAE 3 Bytes  [ 20, 00, 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExW + 23                                                 77DD6AB2 7 Bytes  [ 6C, 00, 6F, 00, 62, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExW + 2B                                                 77DD6ABA 3 Bytes  [ 6C, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExW + 2F                                                 77DD6ABE 7 Bytes  [ 6F, 00, 72, 00, 20, 00, 6C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCloseKey + F                                                    77DD6C16 3 Bytes  [ 68, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCloseKey + 13                                                   77DD6C1A 7 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCloseKey + 1B                                                   77DD6C22 3 Bytes  [ 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCloseKey + 1F                                                   77DD6C26 3 Bytes  [ 62, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCloseKey + 23                                                   77DD6C2A 5 Bytes  [ 65, 00, 6E, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExW + 3D                                              77DD701C 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExW + 3F                                              77DD701E 39 Bytes  [ 69, 00, 6E, 00, 66, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExW + 67                                              77DD7046 1 Byte  [ 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExW + 69                                              77DD7048 27 Bytes  [ 69, 00, 63, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExW + 85                                              77DD7064 64 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenThreadToken + 34                                               77DD72E0 37 Bytes  [ 20, 00, 61, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTokenInformation + 21                                           77DD7306 7 Bytes  [ 20, 00, 62, 00, 79, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTokenInformation + 29                                           77DD730E 19 Bytes  [ 65, 00, 2E, 00, 20, 00, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RevertToSelf + A                                                   77DD7322 23 Bytes  [ 20, 00, 55, 00, 6E, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RevertToSelf + 22                                                  77DD733A 25 Bytes  [ 72, 00, 61, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RevertToSelf + 3C                                                  77DD7354 17 Bytes  [ 69, 00, 73, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RevertToSelf + 4E                                                  77DD7366 5 Bytes  [ 65, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RevertToSelf + 54                                                  77DD736C 2 Bytes  [ 74, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheck + 2C                                                   77DD73AC 3 Bytes  [ 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheck + 30                                                   77DD73B0 5 Bytes  [ 0A, 00, 00, 00, A8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheck + 36                                                   77DD73B6 11 Bytes  [ 01, 00, 4E, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheck + 42                                                   77DD73C2 37 Bytes  [ 70, 00, 70, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorDacl + 21                                     77DD73E8 73 Bytes  [ 64, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateNamedPipeClient + 2C                                    77DD7432 79 Bytes  [ 74, 00, 69, 00, 2D, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AllocateLocallyUniqueId + 16                                       77DD7482 51 Bytes  [ 63, 00, 74, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorLength + 1B                                   77DD74B6 137 Bytes  [ 20, 00, 55, 00, 6E, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorLength + A5                                   77DD7540 65 Bytes  [ 63, 00, 61, 00, 6E, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorLength + E7                                   77DD7582 31 Bytes  [ 6B, 00, 65, 00, 74, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorLength + 107                                  77DD75A2 17 Bytes  [ 70, 00, 79, 00, 20, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorLength + 119                                  77DD75B4 29 Bytes  [ 72, 00, 72, 00, 6F, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExW + 12                                               77DD775E 9 Bytes  [ 64, 00, 64, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExW + 1C                                               77DD7768 3 Bytes  [ 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExW + 20                                               77DD776C 9 Bytes  [ 6D, 00, 61, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExW + 2A                                               77DD7776 7 Bytes  [ 61, 00, 69, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExW + 32                                               77DD777E 17 Bytes  [ 64, 00, 20, 00, 62, 00, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExA + C                                                  77DD783E 9 Bytes  [ 69, 00, 73, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExA + 16                                                 77DD7848 7 Bytes  [ 74, 00, 20, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExA + 1E                                                 77DD7850 3 Bytes  [ 63, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExA + 22                                                 77DD7854 7 Bytes  [ 67, 00, 6E, 00, 69, 00, 7A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyExA + 2A                                                 77DD785C 3 Bytes  [ 65, 00, 64 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyW + 10                                                   77DD7936 13 Bytes  [ 20, 00, 69, 00, 6E, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyW + 1E                                                   77DD7944 5 Bytes  [ 69, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyW + 24                                                   77DD794A 3 Bytes  [ 65, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyW + 28                                                   77DD794E 13 Bytes  [ 74, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyW + 36                                                   77DD795C 7 Bytes  [ 74, 00, 73, 00, 20, 00, 76 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenProcessToken + 23                                              77DD798E 55 Bytes  [ 01, 00, 7B, 00, 48, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSecurityDescriptor + 20                                  77DD79C6 35 Bytes  [ 63, 00, 65, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorDacl + 1F                                     77DD79EA 79 Bytes  [ 69, 00, 73, 00, 6B, 00, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorDacl + 6F                                     77DD7A3A 71 Bytes  [ 6E, 00, 20, 00, 61, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorDacl + B7                                     77DD7A82 87 Bytes  [ 72, 00, 7D, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExA + 3F                                              77DD7ADA 7 Bytes  [ 65, 00, 72, 00, 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExA + 47                                              77DD7AE2 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExA + 49                                              77DD7AE4 7 Bytes  [ 6F, 00, 6E, 00, 20, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExA + 51                                              77DD7AEC 47 Bytes  [ 61, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueExA + 81                                              77DD7B1C 37 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExW + 19                                                 77DD7BD2 21 Bytes  [ 20, 00, 62, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExW + 2F                                                 77DD7BE8 19 Bytes  [ 68, 00, 61, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExW + 43                                                 77DD7BFC 13 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExW + 51                                                 77DD7C0A 9 Bytes  [ 6E, 00, 20, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExW + 5B                                                 77DD7C14 27 Bytes  [ 65, 00, 6D, 00, 70, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AllocateAndInitializeSid + 14                                      77DD7CBD 38 Bytes  [ 00, 6F, 00, 6E, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AllocateAndInitializeSid + 3B                                      77DD7CE4 39 Bytes  [ 61, 00, 74, 00, 20, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeAcl + 23                                                 77DD7D0C 35 Bytes  [ 20, 00, 61, 00, 6C, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedAce + 1F                                           77DD7D30 47 Bytes  [ 54, 00, 77, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLengthSid + 24                                                  77DD7D60 17 Bytes  [ 64, 00, 65, 00, 76, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLengthSid + 36                                                  77DD7D72 59 Bytes  [ 68, 00, 61, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLengthSid + 72                                                  77DD7DAE 7 Bytes  [ 20, 00, 76, 00, 69, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLengthSid + 7A                                                  77DD7DB6 3 Bytes  [ 20, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLengthSid + 7E                                                  77DD7DBA 5 Bytes  [ 6E, 00, 74, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueW + 19                                                 77DD7EE6 15 Bytes  [ 20, 00, 6C, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueW + 29                                                 77DD7EF6 7 Bytes  [ 62, 00, 65, 00, 20, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueW + 31                                                 77DD7EFE 11 Bytes  [ 63, 00, 63, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueW + 3D                                                 77DD7F0A 19 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueW + 51                                                 77DD7F1E 33 Bytes  [ 20, 00, 73, 00, 79, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CheckTokenMembership + D                                           77DD7FB7 22 Bytes  [ 00, 68, 00, 69, 00, 63, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CheckTokenMembership + 24                                          77DD7FCE 1 Byte  [ 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CheckTokenMembership + 26                                          77DD7FD0 29 Bytes  [ 69, 00, 63, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CheckTokenMembership + 44                                          77DD7FEE 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CheckTokenMembership + 46                                          77DD7FF0 5 Bytes  [ 2E, 00, 0D, 00, 0A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenCurrentUser + 11                                            77DD810C 23 Bytes  [ 61, 00, 72, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenCurrentUser + 29                                            77DD8124 5 Bytes  [ 6F, 00, 72, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenCurrentUser + 2F                                            77DD812A 27 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenCurrentUser + 4B                                            77DD8146 9 Bytes  [ 74, 00, 20, 00, 62, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenCurrentUser + 55                                            77DD8150 23 Bytes  [ 66, 00, 6F, 00, 75, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateTokenEx + 18                                              77DD8196 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateTokenEx + 1A                                              77DD8198 7 Bytes  [ 6D, 00, 70, 00, 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateTokenEx + 22                                              77DD81A0 5 Bytes  [ 74, 00, 6F, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateTokenEx + 28                                              77DD81A6 17 Bytes  [ 6C, 00, 6F, 00, 63, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateTokenEx + 3A                                              77DD81B8 7 Bytes  [ 65, 00, 6A, 00, 65, 00, 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateToken + F                                                 77DD8200 13 Bytes  [ 6C, 00, 6F, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateToken + 1D                                                77DD820E 21 Bytes  [ 64, 00, 69, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateToken + 33                                                77DD8224 111 Bytes  [ 0A, 00, 00, 00, 50, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction036 + 12                                             77DD8294 1 Byte  [ 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction036 + 14                                             77DD8296 3 Bytes  [ 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction036 + 18                                             77DD829A 33 Bytes  [ 72, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction036 + 3A                                             77DD82BC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction036 + 3C                                             77DD82BE 5 Bytes  [ 74, 00, 68, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Init + 2F                                                       77DD878C 51 Bytes  [ 61, 00, 74, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Final + 2F                                                      77DD87C0 43 Bytes  [ 65, 00, 67, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Final + 5B                                                      77DD87EC 11 Bytes  [ 64, 00, 79, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Final + 67                                                      77DD87F8 31 Bytes  [ 20, 00, 73, 00, 75, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Final + 87                                                      77DD8818 19 Bytes  [ 65, 00, 73, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Final + 9B                                                      77DD882C 824 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Update + 20                                                     77DD8D16 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Update + 22                                                     77DD8D18 15 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Update + 32                                                     77DD8D28 125 Bytes  [ 6D, 00, 6F, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Update + B0                                                     77DD8DA6 13 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD4Update + BE                                                     77DD8DB4 5 Bytes  [ 6D, 00, 61, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IdentifyCodeAuthzLevelW + 11                                       77DD9CA6 3 Bytes  [ 73, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IdentifyCodeAuthzLevelW + 15                                       77DD9CAA 49 Bytes  [ 6F, 00, 6E, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IdentifyCodeAuthzLevelW + 47                                       77DD9CDC 35 Bytes  [ 49, 00, 6E, 00, 64, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IdentifyCodeAuthzLevelW + 6B                                       77DD9D00 19 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IdentifyCodeAuthzLevelW + 7F                                       77DD9D14 25 Bytes  [ 75, 00, 72, 00, 63, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseCodeAuthzLevel + B                                            77DDAB8A 1 Byte  [ 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseCodeAuthzLevel + D                                            77DDAB8C 7 Bytes  [ 0A, 00, 54, 00, 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseCodeAuthzLevel + 15                                           77DDAB94 35 Bytes  [ 20, 00, 73, 00, 79, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseCodeAuthzLevel + 39                                           77DDABB8 5 Bytes  [ 68, 00, 75, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseCodeAuthzLevel + 3F                                           77DDABBE 16 Bytes  [ 20, 00, 64, 00, 6F, 00, 77, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ComputeAccessTokenFromCodeAuthzLevel + 33                          77DDAC58 21 Bytes  [ 69, 00, 76, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ComputeAccessTokenFromCodeAuthzLevel + 49                          77DDAC6E 89 Bytes  [ 20, 00, 61, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ComputeAccessTokenFromCodeAuthzLevel + A3                          77DDACC8 29 Bytes  [ 73, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ComputeAccessTokenFromCodeAuthzLevel + C1                          77DDACE6 7 Bytes  [ 7D, 00, 0D, 00, 0A, 00, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ComputeAccessTokenFromCodeAuthzLevel + C9                          77DDACEE 9 Bytes  [ 68, 00, 65, 00, 20, 00, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyW + E                                                    77DDD4EE 33 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyW + 30                                                   77DDD510 15 Bytes  [ 65, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyW + 40                                                   77DDD520 87 Bytes  [ 41, 00, 20, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyW + 98                                                   77DDD578 7 Bytes  [ 78, 00, 65, 00, 63, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyW + A0                                                   77DDD580 61 Bytes  [ 74, 00, 65, 00, 64, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExW + 17                                                77DDD67A 7 Bytes  [ 6F, 00, 6E, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExW + 1F                                                77DDD682 3 Bytes  [ 63, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExW + 23                                                77DDD686 9 Bytes  [ 69, 00, 6F, 00, 6E, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExW + 2D                                                77DDD690 7 Bytes  [ 63, 00, 61, 00, 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExW + 35                                                77DDD698 31 Bytes  [ 62, 00, 65, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueW + 10                                                77DDD78A 33 Bytes  [ 73, 00, 77, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueW + 32                                                77DDD7AC 9 Bytes  [ 20, 00, 74, 00, 6F, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueW + 3C                                                77DDD7B6 9 Bytes  [ 73, 00, 68, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueW + 46                                                77DDD7C0 23 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueW + 5E                                                77DDD7D8 31 Bytes  [ 20, 00, 70, 00, 6F, 00, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegNotifyChangeKeyValue + E                                        77DDD80C 63 Bytes  [ 6E, 00, 74, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegNotifyChangeKeyValue + 4E                                       77DDD84C 33 Bytes  [ 77, 00, 6F, 00, 72, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegNotifyChangeKeyValue + 70                                       77DDD86E 99 Bytes  [ 69, 00, 63, 00, 79, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegNotifyChangeKeyValue + D4                                       77DDD8D2 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegNotifyChangeKeyValue + D6                                       77DDD8D4 5 Bytes  [ 67, 00, 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExA + 12                                               77DDE846 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExA + 1C                                               77DDE850 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExA + 20                                               77DDE854 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExA + 27                                               77DDE85B 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyExA + 2B                                               77DDE85F 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExA + 17                                                77DDE93E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExA + 1E                                                77DDE945 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExA + 27                                                77DDE94E 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExA + 3E                                                77DDE965 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueExA + 47                                                77DDE96E 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueA + C                                                77DDEB31 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueA + 12                                               77DDEB37 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueA + 19                                               77DDEB3E 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueA + 31                                               77DDEB56 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueA + 46                                               77DDEB6B 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueW + C                                                77DDEC3D 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueW + 12                                               77DDEC43 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueW + 19                                               77DDEC4A 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueW + 31                                               77DDEC62 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteValueW + 46                                               77DDEC77 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyA + 10                                                   77DDEE18 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyA + 1D                                                   77DDEE25 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyA + 24                                                   77DDEE2C 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyA + 27                                                   77DDEE2F 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenKeyA + 32                                                   77DDEE3A 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AdjustTokenPrivileges + 32                                         77DDEE7E 19 Bytes  [ 16, 00, 74, DA, 91, 7C, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AdjustTokenPrivileges + 47                                         77DDEE93 52 Bytes  [ FF, 02, 00, 00, 00, FC, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualSid + 7                                                       77DDEEC8 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualSid + 20                                                      77DDEEE1 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualSid + 25                                                      77DDEEE6 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualSid + 27                                                      77DDEEE8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualSid + 29                                                      77DDEEEA 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateLoggedOnUser + 2A                                       77DDEF59 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateLoggedOnUser + 52                                       77DDEF81 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateLoggedOnUser + 76                                       77DDEFA5 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateLoggedOnUser + A1                                       77DDEFD0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateLoggedOnUser + AB                                       77DDEFDA 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectCloseAuditAlarmW + 33                                        77DDF012 84 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmW + 3F                                         77DDF067 40 Bytes  [ 00, 6C, 00, 61, 00, 79, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmW + 68                                         77DDF090 39 Bytes  [ 64, 00, 72, 00, 69, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CopySid + 23                                                       77DDF0B8 15 Bytes  [ 61, 00, 67, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidW + B                                         77DDF0C8 57 Bytes  [ 6F, 00, 74, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidW + 45                                        77DDF102 35 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidW + 69                                        77DDF126 21 Bytes  [ 20, 00, 6C, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidW + 7F                                        77DDF13C 19 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetThreadToken + F                                                 77DDF150 33 Bytes  [ 73, 00, 6F, 00, 6C, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetThreadToken + 31                                                77DDF172 57 Bytes  [ 68, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByType + 35                                             77DDF1AC 3 Bytes  [ 6C, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByType + 39                                             77DDF1B0 5 Bytes  [ 64, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByType + 3F                                             77DDF1B6 11 Bytes  [ 0A, 00, 00, 00, 00, 00, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByType + 4B                                             77DDF1C2 33 Bytes  [ 68, 00, 65, 00, 20, 00, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidSid + 1D                                                    77DDF1E4 11 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidIdentifierAuthority + 7                                      77DDF1F0 32 Bytes  [ 72, 00, 65, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidIdentifierAuthority + 2B                                     77DDF214 5 Bytes  [ 94, 00, 01, 00, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidIdentifierAuthority + 31                                     77DDF21A 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidIdentifierAuthority + 33                                     77DDF21C 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidIdentifierAuthority + 35                                     77DDF21E 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicy + 21                                                 77DE1D20 17 Bytes  [ 75, 00, 65, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicy + 33                                                 77DE1D32 13 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicy + 41                                                 77DE1D40 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicy + 43                                                 77DE1D42 41 Bytes  [ 63, 00, 69, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicy + 6D                                                 77DE1D6C 22 Bytes  [ 69, 00, 6E, 00, 76, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClose + 16                                                      77DE1DE2 7 Bytes  [ 20, 00, 67, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClose + 1E                                                      77DE1DEA 15 Bytes  [ 75, 00, 70, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClose + 2E                                                      77DE1DFA 30 Bytes  [ 63, 00, 75, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClose + 4D                                                      77DE1E19 64 Bytes  [ 00, 0A, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClose + 8E                                                      77DE1E5A 1 Byte  [ 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaFreeMemory + C                                                  77DE2CC2 83 Bytes  [ 20, 00, 63, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInformationPolicy + 37                                     77DE2D16 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInformationPolicy + 39                                     77DE2D18 19 Bytes  [ 68, 00, 65, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInformationPolicy + 4D                                     77DE2D2C 7 Bytes  [ 20, 00, 6F, 00, 66, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInformationPolicy + 55                                     77DE2D34 75 Bytes  [ 73, 00, 68, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInformationPolicy + A1                                     77DE2D80 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedAceEx + 22                                         77DE2DD2 48 Bytes  [ 20, 00, 65, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 25          77DE2E03 5 Bytes  [ 00, 73, 00, 3A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 2C          77DE2E0A 1 Byte  [ 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 2E          77DE2E0C 21 Bytes  [ 78, 00, 25, 00, 78, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 44          77DE2E22 89 Bytes  [ 65, 00, 20, 00, 63, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 9E          77DE2E7C 3 Bytes  [ 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyW + 55                                              77DE3E78 22 Bytes  [ 20, 00, 66, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyW + 6C                                              77DE3E8F 14 Bytes  [ 00, 98, 00, 01, 00, 43, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyW + 7B                                              77DE3E9E 35 Bytes  [ 70, 00, 72, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyW + 9F                                              77DE3EC2 13 Bytes  [ 20, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyW + AD                                              77DE3ED0 35 Bytes  [ 76, 00, 65, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorOwner + 1C                                    77DE3F76 39 Bytes  [ 65, 00, 79, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorGroup + 1C                                    77DE3F9E 139 Bytes  [ 0A, 00, 00, 00, 00, 00, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorControl + 1C                                  77DE402A 18 Bytes  [ 72, 00, 79, 00, 70, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorControl + 2F                                  77DE403D 18 Bytes  [ 00, 00, 00, D8, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorControl + 42                                  77DE4050 43 Bytes  [ 72, 00, 6F, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidSecurityDescriptor + 16                                     77DE407C 39 Bytes  [ 67, 00, 69, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAce + 1C                                                        77DE40A4 33 Bytes  [ 6F, 00, 65, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateAnonymousToken + 16                                     77DE40C6 43 Bytes  [ 64, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenRestricted + 20                                             77DE40F2 7 Bytes  [ 6E, 00, 67, 00, 20, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenRestricted + 28                                             77DE40FA 47 Bytes  [ 66, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenRestricted + 58                                             77DE412A 15 Bytes  [ 6F, 00, 74, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenRestricted + 68                                             77DE413A 73 Bytes  [ 20, 00, 65, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameW + E                                                   77DE4184 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameW + 10                                                  77DE4186 3 Bytes  [ 79, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameW + 14                                                  77DE418A 7 Bytes  [ 62, 00, 65, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameW + 1C                                                  77DE4192 25 Bytes  [ 65, 00, 72, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameW + 36                                                  77DE41AC 73 Bytes  [ D8, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueW + 1F                                         77DE41F6 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueW + 21                                         77DE41F8 5 Bytes  [ 20, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueW + 27                                         77DE41FE 13 Bytes  [ 72, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueW + 35                                         77DE420C 21 Bytes  [ 6C, 00, 65, 00, 20, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueW + 4B                                         77DE4222 5 Bytes  [ 6E, 00, 67, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeValue + 1D                                       77DE4292 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeValue + 1F                                       77DE4294 31 Bytes  [ 72, 00, 62, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeValue + 3F                                       77DE42B4 42 Bytes  [ 65, 00, 6E, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeValue + 6A                                       77DE42DF 32 Bytes  [ 00, 68, 00, 69, 00, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueA + 10                                                77DE4300 33 Bytes  [ 74, 00, 6F, 00, 20, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueA + 32                                                77DE4322 91 Bytes  [ 61, 00, 72, 00, 74, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueA + 8E                                                77DE437E 7 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryValueA + 96                                                77DE4386 101 Bytes  [ 68, 00, 61, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DestroyPrivateObjectSecurity + 1D                                  77DE43EC 47 Bytes  [ 73, 00, 70, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreatePrivateObjectSecurityEx + 2B                                 77DE441C 95 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetKernelObjectSecurity + 54                                       77DE447C 15 Bytes  [ 61, 00, 75, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetKernelObjectSecurity + 64                                       77DE448C 23 Bytes  [ 63, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetKernelObjectSecurity + 7C                                       77DE44A4 13 Bytes  [ 6E, 00, 69, 00, 73, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoW + 9                                          77DE44B2 5 Bytes  [ 73, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoW + F                                          77DE44B8 48 Bytes  [ 72, 00, 65, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoW + 41                                         77DE44EA 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoW + 43                                         77DE44EC 33 Bytes  [ 61, 00, 63, 00, 6B, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoW + 65                                         77DE450E 51 Bytes  [ 6E, 00, 63, 00, 72, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetKernelObjectSecurity + 23                                       77DE4542 63 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateSelf + 1D                                               77DE4582 9 Bytes  [ 20, 00, 6B, 00, 65, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateSelf + 27                                               77DE458C 47 Bytes  [ 62, 00, 75, 00, 66, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ImpersonateSelf + 57                                               77DE45BC 63 Bytes  [ 20, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyW + E                                                  77DE45FC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyW + 10                                                 77DE45FE 25 Bytes  [ 61, 00, 74, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyW + 2A                                                 77DE4618 25 Bytes  [ 6D, 00, 6F, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyW + 44                                                 77DE4632 71 Bytes  [ 73, 00, 65, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegeCheck + 2D                                                77DE467A 157 Bytes  [ 61, 00, 73, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyA + 12                                                 77DE4718 23 Bytes  [ 6F, 00, 6E, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyA + 2A                                                 77DE4730 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegCreateKeyA + 2C                                                 77DE4732 28 Bytes  [ 72, 00, 74, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTextUnicode + 7                                                  77DE474F 22 Bytes  [ 00, 73, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTextUnicode + 1E                                                 77DE4766 23 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTextUnicode + 36                                                 77DE477E 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTextUnicode + 38                                                 77DE4780 3 Bytes  [ 6F, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTextUnicode + 3C                                                 77DE4784 3 Bytes  [ 65, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataW + 2D                                              77DE4B0B 16 Bytes  [ 00, D0, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataW + 3E                                              77DE4B1C 7 Bytes  [ 65, 00, 63, 00, 69, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataW + 46                                              77DE4B24 7 Bytes  [ 69, 00, 65, 00, 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataW + 4E                                              77DE4B2C 7 Bytes  [ 69, 00, 6D, 00, 61, 00, 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataW + 56                                              77DE4B34 3 Bytes  [ 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseServiceHandle + 17                                            77DE5C04 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseServiceHandle + 19                                            77DE5C06 25 Bytes  [ 65, 00, 20, 00, 73, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseServiceHandle + 33                                            77DE5C20 71 Bytes  [ 68, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatus + 10                                            77DE5C68 9 Bytes  [ 65, 00, 74, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatus + 1A                                            77DE5C72 15 Bytes  [ 65, 00, 64, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatus + 2A                                            77DE5C82 88 Bytes  [ 73, 00, 69, 00, 62, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatus + 83                                            77DE5CDB 8 Bytes  [ 00, 65, 00, 6E, 00, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatus + 8C                                            77DE5CE4 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerW + 1D                                                77DE5E7A 19 Bytes  [ 6F, 00, 72, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerW + 31                                                77DE5E8E 15 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerW + 41                                                77DE5E9E 97 Bytes  [ 76, 00, 65, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerW + A3                                                77DE5F00 22 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceW + 12                                                  77DE5F17 18 Bytes  [ 00, 64, 00, 20, 00, 57, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceW + 25                                                  77DE5F2A 15 Bytes  [ 72, 00, 6F, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceW + 35                                                  77DE5F3A 221 Bytes  [ 67, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceW + 113                                                 77DE6018 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceW + 115                                                 77DE601A 15 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationW + 1C                                  77DE6450 1 Byte  [ 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationW + 1E                                  77DE6452 3 Bytes  [ 67, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationW + 22                                  77DE6456 93 Bytes  [ 72, 00, 20, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationW + 80                                  77DE64B4 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationW + 82                                  77DE64B6 17 Bytes  [ 20, 00, 73, 00, 74, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenBlock + 27                                                  77DE6612 7 Bytes  [ 72, 00, 6F, 00, 74, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenBlock + 2F                                                  77DE661A 7 Bytes  [ 63, 00, 6F, 00, 6C, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenBlock + 37                                                  77DE6622 15 Bytes  [ 73, 00, 65, 00, 71, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenBlock + 47                                                  77DE6632 23 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenBlock + 5F                                                  77DE664A 17 Bytes  [ 0D, 00, 0A, 00, 00, 00, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsW + 3                                            77DE6A14 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsW + 5                                            77DE6A16 103 Bytes  [ 6B, 00, 6E, 00, 6F, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsW + 6D                                           77DE6A7E 7 Bytes  [ 70, 00, 72, 00, 6F, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsW + 75                                           77DE6A86 7 Bytes  [ 6F, 00, 63, 00, 6F, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsW + 7D                                           77DE6A8E 39 Bytes  [ 20, 00, 73, 00, 65, 00, 71, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsA + 25                                           77DE6D4E 9 Bytes  [ 0D, 00, 0A, 00, 00, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsA + 2F                                           77DE6D58 7 Bytes  [ 54, 00, 68, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsA + 37                                           77DE6D60 9 Bytes  [ 72, 00, 65, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsA + 41                                           77DE6D6A 5 Bytes  [ 65, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterTraceGuidsA + 47                                           77DE6D70 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScPnPGetServiceName + 11                                         77DE6E3E 5 Bytes  [ 73, 00, 20, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScPnPGetServiceName + 17                                         77DE6E44 33 Bytes  [ 6F, 00, 74, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScPnPGetServiceName + 39                                         77DE6E66 15 Bytes  [ 68, 00, 65, 00, 20, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialW + B                                       77DE6E76 19 Bytes  [ 65, 00, 72, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialW + 1F                                      77DE6E8A 7 Bytes  [ 01, 00, 54, 00, 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialW + 27                                      77DE6E92 3 Bytes  [ 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialW + 2B                                      77DE6E96 75 Bytes  [ 79, 00, 70, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialW + 77                                      77DE6EE2 3 Bytes  [ 20, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigW + 1B                                           77DE6F3A 127 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction040 + 16                                             77DE6FBA 9 Bytes  [ 73, 00, 79, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction040 + 20                                             77DE6FC4 3 Bytes  [ 78, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction040 + 24                                             77DE6FC8 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction040 + 26                                             77DE6FCA 57 Bytes  [ 73, 00, 20, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction040 + 60                                             77DE7004 17 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Init + B                                                        77DE720C 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Init + D                                                        77DE720E 5 Bytes  [ 6D, 00, 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Init + 13                                                       77DE7214 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Init + 15                                                       77DE7216 31 Bytes  [ 68, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Init + 35                                                       77DE7236 49 Bytes  [ 75, 00, 69, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Final + 2D                                                      77DE7268 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Final + 2F                                                      77DE726A 41 Bytes  [ 66, 00, 6F, 00, 72, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Final + 59                                                      77DE7294 1 Byte  [ 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Final + 5B                                                      77DE7296 9 Bytes  [ 68, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Final + 65                                                      77DE72A0 1 Byte  [ 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Update + 1F                                                     77DE72FA 1 Byte  [ 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Update + 21                                                     77DE72FC 44 Bytes  [ 78, 00, 25, 00, 30, 00, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Update + 4E                                                     77DE7329 4 Bytes  [ 00, 6C, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Update + 53                                                     77DE732E 29 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MD5Update + 73                                                     77DE734E 21 Bytes  [ 00, 00, 38, 01, 01, 00, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextA + 4                                           77DE7ACA 107 Bytes  [ 6B, 00, 65, 00, 72, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextA + 70                                          77DE7B36 5 Bytes  [ 69, 00, 76, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextA + 76                                          77DE7B3C 5 Bytes  [ 2E, 00, 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextA + 7C                                          77DE7B42 7 Bytes  [ 50, 00, 6C, 00, 65, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextA + 84                                          77DE7B4A 7 Bytes  [ 73, 00, 65, 00, 20, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptReleaseContext + 57                                           77DE80CD 26 Bytes  [ 00, 69, 00, 72, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptReleaseContext + 72                                           77DE80E8 5 Bytes  [ 20, 00, 63, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptReleaseContext + 78                                           77DE80EE 9 Bytes  [ 6E, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptReleaseContext + 82                                           77DE80F8 11 Bytes  [ 62, 00, 65, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptReleaseContext + 8E                                           77DE8104 85 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextW + 39                                          77DE815A 8 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextW + 42                                          77DE8163 168 Bytes  [ 00, 8C, 00, 01, 00, 41, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextW + EB                                          77DE820C 33 Bytes  [ 0A, 00, 49, 00, 6C, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextW + 10D                                         77DE822E 55 Bytes  [ 69, 00, 6F, 00, 6E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptAcquireContextW + 145                                         77DE8266 8 Bytes  [ 65, 00, 78, 00, 65, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction035 + B                                              77DE8318 61 Bytes  [ 75, 00, 74, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction035 + 4A                                             77DE8357 18 Bytes  [ 00, D8, 00, 01, 00, 7B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction035 + 5D                                             77DE836A 15 Bytes  [ 64, 00, 20, 00, 4D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction035 + 6D                                             77DE837A 17 Bytes  [ 67, 00, 7D, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction035 + 7F                                             77DE838C 7 Bytes  [ 74, 00, 65, 00, 6D, 00, 70 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashData + 2E                                                 77DE9C70 67 Bytes  [ 71, 00, 75, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashData + 72                                                 77DE9CB4 3 Bytes  [ 61, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashData + 76                                                 77DE9CB8 7 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashData + 7E                                                 77DE9CC0 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashData + 80                                                 77DE9CC2 3 Bytes  [ 62, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyHash + 3                                               77DE9D77 60 Bytes  [ 00, 65, 00, 20, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyHash + 40                                              77DE9DB4 17 Bytes  [ 31, 00, 20, 00, 77, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyHash + 52                                              77DE9DC6 9 Bytes  [ 20, 00, 66, 00, 6F, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyHash + 5C                                              77DE9DD0 39 Bytes  [ 64, 00, 20, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyHash + 84                                              77DE9DF8 79 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptCreateHash + 2F                                               77DE9E48 7 Bytes  [ 6E, 00, 74, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptCreateHash + 37                                               77DE9E50 19 Bytes  [ 6C, 00, 6C, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptCreateHash + 4B                                               77DE9E64 5 Bytes  [ 65, 00, 6C, 00, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptCreateHash + 51                                               77DE9E6A 9 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptCreateHash + 5B                                               77DE9E74 39 Bytes  [ 75, 00, 20, 00, 63, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetHashParam + 42                                             77DE9F9E 73 Bytes  [ 73, 00, 20, 00, 66, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetHashParam + 8C                                             77DE9FE8 32 Bytes  [ 64, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetHashParam + AD                                             77DEA009 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetHashParam + BD                                             77DEA019 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetHashParam + D6                                             77DEA032 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyKey + 30                                               77DEA094 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyKey + 43                                               77DEA0A7 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyKey + 55                                               77DEA0B9 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyKey + 73                                               77DEA0D7 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDestroyKey + 77                                               77DEA0DB 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDeriveKey + 38                                                77DEA1DD 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDeriveKey + 40                                                77DEA1E5 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDeriveKey + 5A                                                77DEA1FF 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDeriveKey + 6C                                                77DEA211 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDeriveKey + 7E                                                77DEA223 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDecrypt + 3A                                                  77DEA30B 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDecrypt + 4C                                                  77DEA31D 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDecrypt + 61                                                  77DEA332 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDecrypt + 8F                                                  77DEA360 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDecrypt + A5                                                  77DEA376 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptImportKey + 37                                                77DEA3D0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptImportKey + 3F                                                77DEA3D8 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptImportKey + 46                                                77DEA3DF 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptImportKey + 54                                                77DEA3ED 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptImportKey + 63                                                77DEA3FC 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityW + 15                                              77DEA59E 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityW + 31                                              77DEA5BA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityW + 43                                              77DEA5CC 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityW + 57                                              77DEA5E0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityW + 59                                              77DEA5E2 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction002 + 10                                             77DEC6DD 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction002 + 20                                             77DEC6ED 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction002 + 25                                             77DEC6F2 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction002 + 2C                                             77DEC6F9 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction002 + 3D                                             77DEC70A 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction001 + 20                                             77DECF42 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction001 + 25                                             77DECF47 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction001 + 4F                                             77DECF71 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction001 + 75                                             77DECF97 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction001 + 7C                                             77DECF9E 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction004 + A5                                             77DED124 24 Bytes  [ C8, 00, 00, 00, 3F, 30, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction004 + BE                                             77DED13D 353 Bytes  [ 32, 14, 33, A4, 33, 86, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction029 + B                                              77DED29F 19 Bytes  [ 34, C7, 34, 54, 36, 67, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction029 + 1F                                             77DED2B3 223 Bytes  [ 38, 13, 38, 17, 38, 1B, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction029 + FF                                             77DED393 4 Bytes  [ 00, 00, 70, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction029 + 104                                            77DED398 26 Bytes  [ 84, 00, 00, 00, 0A, 30, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction029 + 11F                                            77DED3B3 13 Bytes  [ 31, 40, 31, 4D, 31, A4, 31, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction005 + 4F                                             77DED456 32 Bytes  [ 00, 00, A9, 30, E4, 32, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction005 + 70                                             77DED477 81 Bytes  [ 00, 00, A0, 02, 00, 4C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction005 + C2                                             77DED4C9 107 Bytes  [ 00, 00, 00, 87, 30, 71, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction034 + 7                                              77DED535 1 Byte  [ 3F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction034 + B                                              77DED539 267 Bytes  [ C0, 02, 00, 5C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRetrievePrivateData + 3F                                        77DED645 30 Bytes  [ F0, 02, 00, 1C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRetrievePrivateData + 5E                                        77DED664 5 Bytes  [ 30, 00, 00, 00, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRetrievePrivateData + 64                                        77DED66A 119 Bytes  [ D4, 34, 04, 35, F9, 35, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRetrievePrivateData + DC                                        77DED6E2 231 Bytes  [ 03, 00, 28, 00, 00, 00, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerA + C5                                                77DED7CA 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerA + C7                                                77DED7CC 55 Bytes  [ E6, 33, 20, 35, B3, 35, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerA + FF                                                77DED804 3 Bytes  [ 00, 60, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerA + 103                                               77DED808 1 Byte  [ 4C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenSCManagerA + 105                                               77DED80A 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusA + D9                                           77DED978 11 Bytes  [ 10, 00, 00, 00, 92, 3E, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusA + E5                                           77DED984 222 Bytes  [ 00, C0, 03, 00, 78, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventW + CE                                                  77DEDA63 12 Bytes  [ 33, 8E, 33, 99, 33, 09, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventW + DB                                                  77DEDA70 121 Bytes  [ 4B, 34, 75, 34, A4, 34, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventW + 2D                                               77DEDAEA 100 Bytes  [ 00, 00, 12, 31, 37, 33, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventW + 92                                               77DEDB4F 54 Bytes  [ 3F, 86, 3F, 8B, 3F, CA, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventW + C9                                               77DEDB86 365 Bytes  [ 05, 31, 54, 31, 5D, 31, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceStatus + 140                                             77DEDCF4 181 Bytes  [ 08, 30, 19, 30, 21, 30, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceStatus + 1F6                                             77DEDDAA 98 Bytes  [ 00, 00, 00, 30, 11, 30, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceStatus + 259                                             77DEDE0D 50 Bytes  [ 3C, 2D, 3C, 34, 3C, 46, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceStatus + 28C                                             77DEDE40 183 Bytes  [ B8, 30, C5, 30, D1, 30, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptVerifySignatureW + 76                                         77DEDEF8 56 Bytes  [ 59, 31, CA, 31, 55, 32, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherW + 34                                   77DEDF31 175 Bytes  [ 70, 04, 00, 60, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherW + E4                                   77DEDFE1 225 Bytes  [ 90, 04, 00, 20, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlService + 6E                                                77DEE0C3 526 Bytes  [ 00, 4C, 31, E5, 31, 93, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenServiceA + 26                                                  77DEE2D4 820 Bytes  [ F7, 30, CC, 31, D0, 31, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceW + 65                                                 77DEE609 334 Bytes  [ 3D, 90, 3D, 78, 3E, 83, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceW + 1B4                                                77DEE758 78 Bytes  [ 0C, 00, 00, 00, 49, 3C, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceW + 204                                                77DEE7A8 174 Bytes  [ F0, 30, 3E, 31, 90, 32, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceW + 2B3                                                77DEE857 32 Bytes  [ 3A, 45, 3B, 76, 3B, 1C, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceW + 2D4                                                77DEE878 3 Bytes  [ 00, 10, 06 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidW + 10                                        77DEEB77 92 Bytes  [ 00, 00, A0, 06, 00, CC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidW + 6D                                        77DEEBD4 115 Bytes  [ 6B, 36, 8D, 36, 98, 36, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidW + E1                                        77DEEC48 229 Bytes  [ E4, 00, 00, 00, 0B, 30, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExW + 7B                                                  77DEED2E 59 Bytes  [ 00, 00, 2C, 30, 4A, 30, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExW + B7                                                  77DEED6A 28 Bytes  [ 9F, 36, C4, 36, 3C, 37, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExW + D4                                                  77DEED87 65 Bytes  [ 39, CA, 39, EF, 39, 74, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExW + 116                                                 77DEEDC9 531 Bytes  [ D0, 06, 00, 30, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExW + 32A                                                 77DEEFDD 50 Bytes  [ 3B, D0, 3B, D4, 3B, 0E, 3C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegGetKeySecurity + 15                                             77DEF10A 15 Bytes  [ 66, 00, 61, 00, 75, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegGetKeySecurity + 25                                             77DEF11A 11 Bytes  [ 63, 00, 75, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegGetKeySecurity + 31                                             77DEF126 8 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegGetKeySecurity + 3A                                             77DEF12F 2 Bytes  [ 00, B4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegGetKeySecurity + 3D                                             77DEF132 5 Bytes  [ 01, 00, 54, 00, 68 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetKeySecurity + 14                                             77DEF2EE 19 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetKeySecurity + 28                                             77DEF302 11 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetKeySecurity + 34                                             77DEF30E 5 Bytes  [ 69, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetKeySecurity + 3A                                             77DEF314 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetKeySecurity + 3C                                             77DEF316 3 Bytes  [ 68, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateWellKnownSid + 22                                            77DEF4B2 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateWellKnownSid + 24                                            77DEF4B4 48 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateWellKnownSid + 55                                            77DEF4E5 40 Bytes  [ 00, 61, 00, 74, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateWellKnownSid + 7E                                            77DEF50E 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateWellKnownSid + 80                                            77DEF510 11 Bytes  [ 66, 00, 20, 00, 61, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction007 + 29                                             77DEF5CA 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction007 + 2B                                             77DEF5CC 7 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction007 + 33                                             77DEF5D4 67 Bytes  [ 20, 00, 63, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction007 + 77                                             77DEF618 21 Bytes  [ 66, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction007 + 8E                                             77DEF62F 4 Bytes  [ 00, 8C, 00, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction006 + B                                              77DEF685 46 Bytes  [ 00, 73, 00, 20, 00, 64, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction006 + 3A                                             77DEF6B4 15 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction006 + 4A                                             77DEF6C4 29 Bytes  [ 6E, 00, 66, 00, 69, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction006 + 68                                             77DEF6E2 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction006 + 6A                                             77DEF6E4 15 Bytes  [ 72, 00, 6D, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction003 + 3F                                             77DEF748 115 Bytes  [ 65, 00, 72, 00, 2C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseEventLog + B                                                  77DEF7BC 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseEventLog + D                                                  77DEF7BE 7 Bytes  [ 73, 00, 20, 00, 62, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseEventLog + 15                                                 77DEF7C6 15 Bytes  [ 65, 00, 6E, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfCloseEventLog + 4                                               77DEF7D6 19 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfCloseEventLog + 18                                              77DEF7EA 15 Bytes  [ 69, 00, 63, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfCloseEventLog + 28                                              77DEF7FA 41 Bytes  [ 68, 00, 61, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfCloseEventLog + 52                                              77DEF824 189 Bytes  [ 64, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction008 + 9D                                             77DEF8E2 45 Bytes  [ 64, 00, 20, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction010 + 1C                                             77DEF910 5 Bytes  [ 73, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction010 + 22                                             77DEF916 31 Bytes  [ 0A, 00, 00, 00, 00, 00, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction010 + 42                                             77DEF936 69 Bytes  [ 68, 00, 65, 00, 20, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction010 + 88                                             77DEF97C 87 Bytes  [ 65, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaNtStatusToWinError + 14                                         77DEF9D4 9 Bytes  [ 63, 00, 61, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaNtStatusToWinError + 1E                                         77DEF9DE 3 Bytes  [ 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaNtStatusToWinError + 22                                         77DEF9E2 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaNtStatusToWinError + 24                                         77DEF9E4 5 Bytes  [ 65, 00, 20, 00, 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaNtStatusToWinError + 2A                                         77DEF9EA 7 Bytes  [ 6F, 00, 6D, 00, 61, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredProfileLoaded + 10                                             77DEFAAA 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredProfileLoaded + 12                                             77DEFAAC 3 Bytes  [ 20, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredProfileLoaded + 16                                             77DEFAB0 7 Bytes  [ 6F, 00, 72, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredProfileLoaded + 1E                                             77DEFAB8 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredProfileLoaded + 20                                             77DEFABA 64 Bytes  [ 65, 00, 20, 00, 50, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfo + 51                                               77DEFC78 13 Bytes  [ 0A, 00, 00, 00, 74, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfo + 9                                                77DEFC86 5 Bytes  [ 6F, 00, 72, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfo + F                                                77DEFC8C 49 Bytes  [ 73, 00, 74, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfo + 41                                               77DEFCBE 35 Bytes  [ 63, 00, 6B, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorSacl + 1F                                     77DEFCE2 49 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerA + 19                                   77DEFD14 29 Bytes  [ 75, 00, 72, 00, 6E, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerA + 37                                   77DEFD32 17 Bytes  [ 6E, 00, 76, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerA + 49                                   77DEFD44 5 Bytes  [ 6C, 00, 6F, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerA + 4F                                   77DEFD4A 3 Bytes  [ 6B, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerA + 53                                   77DEFD4E 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSendTSMessage + 38                                             77DEFD98 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSendTSMessage + 3A                                             77DEFD9A 25 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSendTSMessage + 54                                             77DEFDB4 109 Bytes  [ 69, 00, 73, 00, 20, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsW + 32                                           77DEFE22 15 Bytes  [ 62, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsW + 42                                           77DEFE32 107 Bytes  [ 65, 00, 74, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsW + AE                                           77DEFE9E 25 Bytes  [ 74, 00, 61, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsW + C8                                           77DEFEB8 13 Bytes  [ 63, 00, 6F, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsW + D6                                           77DEFEC6 5 Bytes  [ 69, 00, 6F, 00, 6E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterIdleTask + 2E                                              77DF0239 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterIdleTask + 51                                              77DF025C 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterIdleTask + 6D                                              77DF0278 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterIdleTask + 84                                              77DF028F 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterIdleTask + 95                                              77DF02A0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileW + 5                                           77DF03B2 71 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileW + 4E                                          77DF03FB 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileW + 60                                          77DF040D 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileW + 6E                                          77DF041B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileW + 78                                          77DF0425 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoW + C                                          77DF0639 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoW + 12                                         77DF063F 63 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoW + 52                                         77DF067F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoW + 5C                                         77DF0689 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoW + 60                                         77DF068D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction041 + 16                                             77DF079B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction041 + 21                                             77DF07A6 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction041 + 24                                             77DF07A9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction041 + 26                                             77DF07AB 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction041 + 4B                                             77DF07D0 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorControl + 1C                                  77DF0814 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorControl + 23                                  77DF081B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorControl + 25                                  77DF081D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorControl + 28                                  77DF0820 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorControl + 50                                  77DF0848 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetUserName + 30                                                77DF08A8 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetUserName + 50                                                77DF08C8 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetUserName + 83                                                77DF08FB 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEncrypt + 3A                                                  77DF093A 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEncrypt + 4C                                                  77DF094C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEncrypt + 61                                                  77DF0961 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEncrypt + 92                                                  77DF0992 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEncrypt + A8                                                  77DF09A8 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyW + C                                                    77DF09D5 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyW + 12                                                   77DF09DB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyW + 19                                                   77DF09E2 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyW + 31                                                   77DF09FA 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyW + 49                                                   77DF0A12 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyBootConfigStatus + 10                                        77DF0BCC 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyBootConfigStatus + 15                                        77DF0BD1 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyBootConfigStatus + 1A                                        77DF0BD6 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyBootConfigStatus + 29                                        77DF0BE5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyBootConfigStatus + 34                                        77DF0BF0 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEventLogInformation + 19                                        77DF0C41 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEventLogInformation + 21                                        77DF0C49 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEventLogInformation + 28                                        77DF0C50 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEventLogInformation + 44                                        77DF0C6C 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEventLogInformation + 59                                        77DF0C81 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogW + 32                                                 77DF0CFA 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogW + 3B                                                 77DF0D03 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogW + 42                                                 77DF0D0A 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogW + 1C                                              77DF0D2B 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogW + 27                                              77DF0D36 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogW + 30                                              77DF0D3F 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogW + 40                                              77DF0D4F 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogW + 77                                              77DF0D86 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScIsSecurityProcess + A                                          77DF0E32 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScIsSecurityProcess + 18                                         77DF0E40 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatusEx + 17                                          77DF0E61 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatusEx + 23                                          77DF0E6D 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatusEx + 38                                          77DF0E82 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatusEx + 47                                          77DF0E91 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceStatusEx + 52                                          77DF0E9C 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetKeyParam + 42                                              77DF0F1A 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetKeyParam + 69                                              77DF0F41 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetKeyParam + 77                                              77DF0F4F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetKeyParam + 81                                              77DF0F59 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetKeyParam + 8C                                              77DF0F64 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetProvParam + 26                                             77DF0F9F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetProvParam + 31                                             77DF0FAA 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetProvParam + 57                                             77DF0FD0 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetProvParam + 62                                             77DF0FDB 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetProvParam + 7D                                             77DF0FF6 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesW + 17                                     77DF1720 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesW + 20                                     77DF1729 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesW + 25                                     77DF172E 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesW + 52                                     77DF175B 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesW + 6A                                     77DF1773 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiPopulateDefaultsInRegistry + B                               77DF1A0F 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiPopulateDefaultsInRegistry + 1E                              77DF1A22 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiPopulateDefaultsInRegistry + 4A                              77DF1A4E 334 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiPopulateDefaultsInRegistry + 199                             77DF1B9D 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiPopulateDefaultsInRegistry + 1C6                             77DF1BCA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceA + 10                                                 77DF25E8 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceA + 1E                                                 77DF25F6 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceA + 2D                                                 77DF2605 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceA + 38                                                 77DF2610 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceA + 6B                                                 77DF2643 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzLevelW + C                                  77DF277C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzLevelW + 13                                 77DF2783 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzLevelW + 17                                 77DF2787 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzLevelW + 1D                                 77DF278D 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzLevelW + 3E                                 77DF27AE 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseBlock + 13                                                 77DF2897 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseBlock + 19                                                 77DF289D 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseBlock + 1D                                                 77DF28A1 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseBlock + 3B                                                 77DF28BF 98 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseBlock + 9E                                                 77DF2922 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerExA + 19                                 77DF2944 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterServiceCtrlHandlerExA + 3A                                 77DF2965 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsW + 1D                                      77DF2987 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsW + 21                                      77DF298B 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsW + 3F                                      77DF29A9 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsW + 46                                      77DF29B0 88 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsW + A1                                      77DF2A0B 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReadEventLogA + 1F                                                 77DF33F5 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReadEventLogA + 27                                                 77DF33FD 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReadEventLogA + 2E                                                 77DF3404 90 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogA + 58                                              77DF3461 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogA + 67                                              77DF3470 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogA + 6B                                              77DF3474 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogA + 93                                              77DF349C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogA + A2                                              77DF34AB 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNumberOfEventLogRecords + 10                                    77DF34CB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNumberOfEventLogRecords + 18                                    77DF34D3 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNumberOfEventLogRecords + 1F                                    77DF34DA 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfNumberOfRecords + 10                                            77DF34EF 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfNumberOfRecords + 16                                            77DF34F5 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfNumberOfRecords + 1A                                            77DF34F9 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfNumberOfRecords + 25                                            77DF3504 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfNumberOfRecords + 34                                            77DF3513 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOldestEventLogRecord + 10                                       77DF3560 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOldestEventLogRecord + 18                                       77DF3568 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOldestEventLogRecord + 1F                                       77DF356F 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOldestRecord + 10                                               77DF3584 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOldestRecord + 16                                               77DF358A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOldestRecord + 1A                                               77DF358E 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOldestRecord + 25                                               77DF3599 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOldestRecord + 34                                               77DF35A8 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogA + 32                                                 77DF3612 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogA + 3B                                                 77DF361B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEventLogA + 42                                                 77DF3622 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogA + 1C                                              77DF3643 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogA + 38                                              77DF365F 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogA + 6B                                              77DF3692 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogA + 82                                              77DF36A9 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenEventLogA + 91                                              77DF36B8 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigA + 1E                                           77DF4D78 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigA + 49                                           77DF4DA3 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigA + 7C                                           77DF4DD6 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigA + 90                                           77DF4DEA 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfigA + 9D                                           77DF4DF7 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryWindows31FilesMigration + 5                                   77DF52EE 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryWindows31FilesMigration + 21                                  77DF530A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryWindows31FilesMigration + 30                                  77DF5319 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryWindows31FilesMigration + 38                                  77DF5321 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryWindows31FilesMigration + 57                                  77DF5340 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterTraceGuids + 28                                          77DF572D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterTraceGuids + 34                                          77DF5739 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterTraceGuids + 4D                                          77DF5752 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterTraceGuids + 5E                                          77DF5763 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterTraceGuids + 7C                                          77DF5781 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueA + 13                                                 77DF5AEB 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueA + 1F                                                 77DF5AF7 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueA + 28                                                 77DF5B00 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueA + 33                                                 77DF5B0B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumValueA + 3C                                                 77DF5B14 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserW + C                                           77DF6291 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserW + 1B                                          77DF62A0 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserW + 24                                          77DF62A9 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserW + 2D                                          77DF62B2 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserW + 49                                          77DF62CE 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiCompareTokenLevels + 27                                      77DF7210 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiCompareTokenLevels + 2E                                      77DF7217 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiCompareTokenLevels + 34                                      77DF721D 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiCompareTokenLevels + 46                                      77DF722F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiCompareTokenLevels + 61                                      77DF724A 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsWellKnownSid + F                                                 77DF791A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsWellKnownSid + 13                                                77DF791E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsWellKnownSid + 21                                                77DF792C 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsWellKnownSid + 40                                                77DF794B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsWellKnownSid + 4B                                                77DF7956 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeregisterEventSource + D                                          77DF7A40 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeregisterEventSource + 15                                         77DF7A48 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeregisterEventSource + 1C                                         77DF7A4F 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfDeregisterEventSource + 10                                      77DF7A64 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfDeregisterEventSource + 19                                      77DF7A6D 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfDeregisterEventSource + 28                                      77DF7A7C 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfDeregisterEventSource + 50                                      77DF7AA4 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfDeregisterEventSource + 5F                                      77DF7AB3 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceA + 32                                          77DF7BF2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceA + 3B                                          77DF7BFB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceA + 42                                          77DF7C02 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceA + 2F                                       77DF7C36 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceA + 58                                       77DF7C5F 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceA + 67                                       77DF7C6E 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceA + 6B                                       77DF7C72 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceA + 95                                       77DF7C9C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventA + 10                                                  77DF7D22 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventA + 16                                                  77DF7D28 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventA + 22                                                  77DF7D34 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventA + 3D                                                  77DF7D4F 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReportEventA + 41                                                  77DF7D53 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventA + 2D                                               77DF7E62 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventA + 5A                                               77DF7E8F 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventA + 69                                               77DF7E9E 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventA + 74                                               77DF7EA9 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReportEventA + 8F                                               77DF7EC4 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAclInformation + 1F                                             77DF7EF7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAclInformation + 26                                             77DF7EFE 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAce + 22                                                        77DF7F25 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAce + 29                                                        77DF7F2C 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MakeAbsoluteSD + 3C                                                77DF7F6D 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidAcl + 16                                                    77DF7F8D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidAcl + 1D                                                    77DF7F94 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidAcl + 1F                                                    77DF7F96 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidAcl + 38                                                    77DF7FAF 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsValidAcl + 3A                                                    77DF7FB1 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceW + 32                                          77DF80CE 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceW + 3B                                          77DF80D7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegisterEventSourceW + 42                                          77DF80DE 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceW + 2D                                       77DF8110 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceW + 2F                                       77DF8112 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceW + 54                                       77DF8137 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceW + 63                                       77DF8146 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfRegisterEventSourceW + 67                                       77DF814A 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedAce + 1F                                            77DF81CE 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedAce + 26                                            77DF81D5 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryW + 25                                           77DF81FF 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryW + 32                                           77DF820C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryW + 41                                           77DF821B 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryW + 52                                           77DF822C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryW + 5B                                           77DF8235 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDisablePredefinedCache + 4                                      77DF83DF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDisablePredefinedCache + A                                      77DF83E5 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDisablePredefinedCache + 21                                     77DF83FC 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDisablePredefinedCache + 2B                                     77DF8406 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDisablePredefinedCache + 61                                     77DF843C 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFreeBuffer + C                                                  77DF847B 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFreeBuffer + 12                                                 77DF8481 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFreeBuffer + 16                                                 77DF8485 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFreeBuffer + 1D                                                 77DF848C 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFreeBuffer + 2D                                                 77DF849C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExA + B                                                  77DF84AC 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExA + 56                                                 77DF84F7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExA + 5E                                                 77DF84FF 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExA + 66                                                 77DF8507 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyExA + 7E                                                 77DF851F 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyA + B                                                    77DF86AE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyA + 12                                                   77DF86B5 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyA + 2E                                                   77DF86D1 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyA + 53                                                   77DF86F6 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegEnumKeyA + 65                                                   77DF8708 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameA + E                                                   77DF87BD 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameA + 10                                                  77DF87BF 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameA + 15                                                  77DF87C4 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameA + 1C                                                  77DF87CB 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetUserNameA + 57                                                  77DF8806 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidSubAuthority + 7                                             77DF8842 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidLengthRequired + 14                                          77DF8868 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSidSubAuthorityCount + 7                                        77DF8874 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyW + C                                                  77DF8892 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyW + 10                                                 77DF8896 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyW + 16                                                 77DF889C 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyW + 1C                                                 77DF88A2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyW + 23                                                 77DF88A9 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSid + 1C                                                 77DF8993 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSid + 23                                                 77DF899A 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSid + 27                                                 77DF899E 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSid + 3A                                                 77DF89B1 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitializeSid + 65                                                 77DF89DC 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidW + 21                                             77DF8A14 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidW + 25                                             77DF8A18 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidW + 44                                             77DF8A37 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidW + 4B                                             77DF8A3E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidW + 59                                             77DF8A4C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupSids + 1C                                                 77DF8BC3 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupSids + 3B                                                 77DF8BE2 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupSids + 49                                                 77DF8BF0 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupSids + 75                                                 77DF8C1C 139 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupSids + 101                                                77DF8CA8 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSids + 10                                               77DF8CC1 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSids + 29                                               77DF8CDA 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSids + 34                                               77DF8CE5 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSids + 37                                               77DF8CE8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSids + 3A                                               77DF8CEB 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameW + 21                                            77DF8E9D 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameW + 25                                            77DF8EA1 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameW + 51                                            77DF8ECD 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameW + 58                                            77DF8ED4 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameW + 66                                            77DF8EE2 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames2 + 39                                               77DF904A 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames2 + 3E                                               77DF904F 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames2 + 42                                               77DF9053 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNames + 5                                               77DF9060 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNames + 42                                              77DF909D 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNames + 61                                              77DF90BC 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNames + 64                                              77DF90BF 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNames + 6A                                              77DF90C5 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountRights + 26                                     77DF93F5 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountRights + 43                                     77DF9412 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountRights + 4B                                     77DF941A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountRights + 4F                                     77DF941E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountRights + 57                                     77DF9426 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenUserClassesRoot + B                                         77DF9473 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenUserClassesRoot + 31                                        77DF9499 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenUserClassesRoot + 39                                        77DF94A1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenUserClassesRoot + 42                                        77DF94AA 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOpenUserClassesRoot + 4E                                        77DF94B6 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiIsExecutableFileType + 24                                    77DF9B17 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiIsExecutableFileType + 2C                                    77DF9B1F 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiIsExecutableFileType + 30                                    77DF9B23 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiIsExecutableFileType + 3A                                    77DF9B2D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiIsExecutableFileType + 46                                    77DF9B39 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzPolicyW + 19                                77DF9C3E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzPolicyW + 21                                77DF9C46 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzPolicyW + 28                                77DF9C4D 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzPolicyW + 3C                                77DF9C61 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInformationCodeAuthzPolicyW + 43                                77DF9C68 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAInit + 1E                                                     77DFB0A0 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAInit + 25                                                     77DFB0A7 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAInit + 4F                                                     77DFB0D1 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAUpdate + 29                                                   77DFB0FF 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAUpdate + 31                                                   77DFB107 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAUpdate + 4E                                                   77DFB124 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAUpdate + 57                                                   77DFB12D 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAFinal + 1D                                                    77DFB14F 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAFinal + 32                                                    77DFB164 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAFinal + 75                                                    77DFB1A7 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAFinal + 8F                                                    77DFB1C1 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!A_SHAFinal + 96                                                    77DFB1C8 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenRandom + 31                                                77DFB32D 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenRandom + 5C                                                77DFB358 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenRandom + 78                                                77DFB374 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenRandom + 8A                                                77DFB386 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenRandom + 91                                                77DFB38D 106 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyA + C                                                  77DFB6CA 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyA + 10                                                 77DFB6CE 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyA + 16                                                 77DFB6D4 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyA + 1C                                                 77DFB6DA 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegDeleteKeyA + 23                                                 77DFB6E1 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyA + 40                                              77DFB790 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyA + 4D                                              77DFB79D 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyA + 80                                              77DFB7D0 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyA + DD                                              77DFB82D 98 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryInfoKeyA + 141                                             77DFB891 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAllAccessesGranted + 18                                         77DFBC6C 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAllAccessesGranted + 2E                                         77DFBC82 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAllAccessesGranted + 49                                         77DFBC9D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAllAccessesGranted + 55                                         77DFBCA9 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAllAccessesGranted + 61                                         77DFBCB5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CommandLineFromMsiDescriptor + 3B                                  77DFBD2A 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CommandLineFromMsiDescriptor + 48                                  77DFBD37 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CommandLineFromMsiDescriptor + 54                                  77DFBD43 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CommandLineFromMsiDescriptor + 5F                                  77DFBD4E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CommandLineFromMsiDescriptor + 6C                                  77DFBD5B 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityW + 15                                              77DFBEF0 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityW + 31                                              77DFBF0C 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityW + 43                                              77DFBF1E 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityW + 57                                              77DFBF32 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityW + 59                                              77DFBF34 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidA + 18                                        77DFC07D 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidA + 63                                        77DFC0C8 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidA + 7D                                        77DFC0E2 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSidToStringSidA + A1                                        77DFC106 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueA + 2C                                         77DFC13C 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueA + 30                                         77DFC140 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueA + 46                                         77DFC156 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueA + 83                                         77DFC193 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeValueA + 8C                                         77DFC19C 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueA + F                                                   77DFC685 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueA + 19                                                  77DFC68F 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueA + 3E                                                  77DFC6B4 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueA + 5C                                                  77DFC6D2 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueA + 7D                                                  77DFC6F3 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptVerifySignatureA + 2B                                         77DFC744 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptVerifySignatureA + 5E                                         77DFC777 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiSearchMatchingHashRules + C                                  77DFC795 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiSearchMatchingHashRules + 21                                 77DFC7AA 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiSearchMatchingHashRules + 27                                 77DFC7B0 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiSearchMatchingHashRules + 2B                                 77DFC7B4 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiSearchMatchingHashRules + 31                                 77DFC7BA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesW + 5                                                77DFC9F8 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesW + 3A                                               77DFCA2D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesW + 44                                               77DFCA37 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesW + 4C                                               77DFCA3F 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesW + 78                                               77DFCA6B 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceW + 19                                                 77DFCCB7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceW + 1C                                                 77DFCCBA 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceW + 2E                                                 77DFCCCC 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceW + 39                                                 77DFCCD7 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceW + 47                                                 77DFCCE5 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaStorePrivateData + 5E                                           77DFD04D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaStorePrivateData + 6C                                           77DFD05B 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaStorePrivateData + 79                                           77DFD068 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaStorePrivateData + 87                                           77DFD076 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaStorePrivateData + 95                                           77DFD084 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AreAnyAccessesGranted + 18                                         77DFD245 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteAce + 19                                                     77DFD263 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteAce + 20                                                     77DFD26A 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteAce + 57                                                     77DFD2A1 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteAce + 77                                                     77DFD2C1 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteAce + 8C                                                     77DFD2D6 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownW + 17                                          77DFD422 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownW + 2E                                          77DFD439 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownW + 3E                                          77DFD449 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownW + 57                                          77DFD462 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownW + 73                                          77DFD47E 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyChangeEventLog + 10                                          77E0C123 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!NotifyChangeEventLog + 25                                          77E0C138 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogW + 35                                                77E0C172 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogW + 4E                                                77E0C18B 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogW + 5B                                                77E0C198 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogW + 62                                                77E0C19F 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogW + 6B                                                77E0C1A8 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogW + 14                                               77E0C270 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogW + 2E                                               77E0C28A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogW + 3C                                               77E0C298 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogW + 49                                               77E0C2A5 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogW + 58                                               77E0C2B4 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogW + 47                                           77E0C3AF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogW + 4D                                           77E0C3B5 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogW + 5E                                           77E0C3C6 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogW + 62                                           77E0C3CA 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogW + 6C                                           77E0C3D4 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReadEventLogW + 1F                                                 77E0C4B6 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ReadEventLogW + 34                                                 77E0C4CB 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogA + C                                                 77E0C4DC 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogA + 3B                                                77E0C50B 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ClearEventLogA + 64                                                77E0C534 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogA + C                                                77E0C545 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogA + 3B                                               77E0C574 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BackupEventLogA + 64                                               77E0C59D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogA + C                                            77E0C5AE 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogA + 41                                           77E0C5E3 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogA + 4B                                           77E0C5ED 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogA + 7E                                           77E0C620 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenBackupEventLogA + AC                                           77E0C64E 102 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileA + 5                                           77E0C6BF 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileA + 24                                          77E0C6DE 99 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileA + 88                                          77E0C742 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileA + C5                                          77E0C77F 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetCurrentHwProfileA + D2                                          77E0C78C 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultList + 69                                   77E0C822 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTokenInformation + 2C                                           77E0C853 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AdjustTokenGroups + 32                                             77E0C88A 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmW + 1A                               77E0C8A9 106 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmW + 85                               77E0C914 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmW + 90                               77E0C91F 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmW + A6                               77E0C935 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmW + 1B                     77E0C955 145 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmW + AD                     77E0C9E7 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleW + 1B             77E0CA07 148 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleW + B0             77E0CA9C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckAndAuditAlarmA + 11                                     77E0CAB2 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckAndAuditAlarmA + 20                                     77E0CAC1 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckAndAuditAlarmA + 75                                     77E0CB16 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckAndAuditAlarmA + 97                                     77E0CB38 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckAndAuditAlarmA + E1                                     77E0CB82 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmA + 11                               77E0CB98 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmA + 20                               77E0CBA7 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmA + 75                               77E0CBFC 122 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeAndAuditAlarmA + F0                               77E0CC77 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmA + 11                     77E0CC8D 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmA + 20                     77E0CC9C 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmA + 75                     77E0CCF1 122 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmA + F0                     77E0CD6C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleA + 11             77E0CD82 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleA + 20             77E0CD91 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleA + 75             77E0CDE6 125 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AccessCheckByTypeResultListAndAuditAlarmByHandleA + F3             77E0CE64 70 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectPrivilegeAuditAlarmW + 42                                    77E0CEAB 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectDeleteAuditAlarmW + 39                                       77E0CEE9 82 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegedServiceAuditAlarmW + 4E                                  77E0CF3C 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualPrefixSid + 7                                                 77E0CF48 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualPrefixSid + 20                                                77E0CF61 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetAclInformation + 2C                                             77E0CF92 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedAceEx + 22                                          77E0CFB9 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedAceEx + 2A                                          77E0CFC1 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedAceEx + 43                                          77E0CFDA 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessAce + 32                                             77E0D011 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessAceEx + 28                                           77E0D03E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessAceEx + 30                                           77E0D046 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessAceEx + 49                                           77E0D05F 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedObjectAce + 1D                                     77E0D081 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedObjectAce + 28                                     77E0D08C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedObjectAce + 30                                     77E0D094 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessAllowedObjectAce + 49                                     77E0D0AD 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedObjectAce + 28                                      77E0D0DA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedObjectAce + 30                                      77E0D0E2 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAccessDeniedObjectAce + 49                                      77E0D0FB 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessObjectAce + 2E                                       77E0D12E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessObjectAce + 36                                       77E0D136 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddAuditAccessObjectAce + 4F                                       77E0D14F 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FindFirstFreeAce + 1A                                              77E0D16E 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FindFirstFreeAce + 2B                                              77E0D17F 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorSacl + 40                                     77E0D1C4 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreatePrivateObjectSecurity + 32                                   77E0D1FB 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertToAutoInheritPrivateObjectSecurity + 1C                     77E0D21C 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertToAutoInheritPrivateObjectSecurity + 31                     77E0D231 63 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreatePrivateObjectSecurityWithMultipleInheritance + 3B            77E0D271 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetPrivateObjectSecurity + 2F                                      77E0D2A5 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetPrivateObjectSecurityEx + 32                                    77E0D2DC 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetPrivateObjectSecurity + 2F                                      77E0D310 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityA + E                                               77E0D323 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityA + 17                                              77E0D32C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityA + 29                                              77E0D33E 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetFileSecurityA + 61                                              77E0D376 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityA + E                                               77E0D389 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityA + 17                                              77E0D392 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityA + 29                                              77E0D3A4 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetFileSecurityA + 67                                              77E0D3E2 86 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameA + 52                                            77E0D439 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameA + 5B                                            77E0D442 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameA + 6E                                            77E0D455 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameA + 75                                            77E0D45C 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountNameA + 97                                            77E0D47E 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidA + 46                                             77E0D58A 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidA + 6C                                             77E0D5B0 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidA + 70                                             77E0D5B4 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidA + 97                                             77E0D5DB 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupAccountSidA + B3                                             77E0D5F7 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameW + 1D                                          77E0D6E0 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameW + 24                                          77E0D6E7 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameW + 32                                          77E0D6F5 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameW + 56                                          77E0D719 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameW + 59                                          77E0D71C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameW + 24                                   77E0D7EB 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameW + 2B                                   77E0D7F2 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameW + 39                                   77E0D800 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameW + 59                                   77E0D820 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameW + 5C                                   77E0D823 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateRestrictedToken + 2C                                         77E0D910 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateRestrictedToken + 32                                         77E0D916 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateRestrictedToken + 39                                         77E0D91D 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateRestrictedToken + 6A                                         77E0D94E 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateRestrictedToken + A3                                         77E0D987 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MakeAbsoluteSD2 + 26                                               77E0DA33 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityDescriptorRMControl + 20                                77E0DA58 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityDescriptorRMControl + 17                                77E0DA74 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetWindowsAccountDomainSid + 17                                    77E0DA90 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetWindowsAccountDomainSid + 1D                                    77E0DA96 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetWindowsAccountDomainSid + 2E                                    77E0DAA7 67 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetWindowsAccountDomainSid + 73                                    77E0DAEC 111 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetWindowsAccountDomainSid + E3                                    77E0DB5C 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualDomainSid + B                                                 77E0DB6C 71 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualDomainSid + 54                                                77E0DBB5 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualDomainSid + 5F                                                77E0DBC0 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualDomainSid + 66                                                77E0DBC7 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EqualDomainSid + 6F                                                77E0DBD0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmA + 11                                         77E0DD3F 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmA + 20                                         77E0DD4E 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmA + 75                                         77E0DDA3 110 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectOpenAuditAlarmA + E4                                         77E0DE12 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectPrivilegeAuditAlarmA + E                                     77E0DE25 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectPrivilegeAuditAlarmA + 17                                    77E0DE2E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectPrivilegeAuditAlarmA + 23                                    77E0DE3A 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectPrivilegeAuditAlarmA + 58                                    77E0DE6F 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectCloseAuditAlarmA + E                                         77E0DE82 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectCloseAuditAlarmA + 17                                        77E0DE8B 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectCloseAuditAlarmA + 23                                        77E0DE97 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectCloseAuditAlarmA + 4F                                        77E0DEC3 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectDeleteAuditAlarmA + E                                        77E0DED6 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectDeleteAuditAlarmA + 17                                       77E0DEDF 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectDeleteAuditAlarmA + 23                                       77E0DEEB 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ObjectDeleteAuditAlarmA + 4F                                       77E0DF17 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegedServiceAuditAlarmA + 11                                  77E0DF2D 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegedServiceAuditAlarmA + 20                                  77E0DF3C 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegedServiceAuditAlarmA + 2E                                  77E0DF4A 86 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!PrivilegedServiceAuditAlarmA + 85                                  77E0DFA1 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameA + 39                                          77E0DFDF 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameA + 42                                          77E0DFE8 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameA + 4F                                          77E0DFF5 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameA + 75                                          77E0E01B 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeNameA + 82                                          77E0E028 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameA + 3C                                   77E0E100 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameA + 45                                   77E0E109 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameA + 51                                   77E0E115 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameA + 5B                                   77E0E11F 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupPrivilegeDisplayNameA + 79                                   77E0E13D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry + 5                  77E0EB16 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry + 7                  77E0EB18 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry + 25                 77E0EB36 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry + 31                 77E0EB42 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry + 48                 77E0EB59 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserW + 28                                                    77E0FDE9 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExExW + 31                                                77E0FE1F 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExExW + 4E                                                77E0FE3C 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExExW + 6A                                                77E0FE58 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExExW + 87                                                77E0FE75 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExExW + A3                                                77E0FE91 138 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiReplaceProcessThreadTokens + 31                              77E1029F 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiReplaceProcessThreadTokens + 4C                              77E102BA 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiReplaceProcessThreadTokens + 7B                              77E102E9 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiReplaceProcessThreadTokens + 8A                              77E102F8 107 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiReplaceProcessThreadTokens + F7                              77E10365 156 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserSecure + 19                                     77E107BE 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserSecure + 4B                                     77E107F0 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserSecure + 59                                     77E107FE 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserSecure + 6D                                     77E10812 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserSecure + 71                                     77E10816 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserA + C                                           77E109BC 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserA + 1B                                          77E109CB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserA + 24                                          77E109D4 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserA + 2D                                          77E109DD 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessAsUserA + 4B                                          77E109FB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserA + 28                                                    77E10CFE 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExA + 16                                                  77E10D19 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LogonUserExA + 30                                                  77E10D33 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptContextAddRef + 42                                            77E10D7A 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptContextAddRef + 6C                                            77E10DA4 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProvParam + 10                                             77E10DC9 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProvParam + 14                                             77E10DCD 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProvParam + 2C                                             77E10DE5 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProvParam + 52                                             77E10E0B 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProvParam + 8B                                             77E10E44 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesA + 57                                       77E10F20 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesA + 5F                                       77E10F28 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesA + 66                                       77E10F2F 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesA + 6D                                       77E10F36 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesA + 6F                                       77E10F38 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersA + 29                                           77E11152 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersA + 31                                           77E1115A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersA + 38                                           77E11161 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersA + 3F                                           77E11168 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersA + 41                                           77E1116A 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenKey + 3A                                                   77E1154B 112 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenKey + AB                                                   77E115BC 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGenKey + D8                                                   77E115E9 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateKey + 30                                             77E11631 172 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateKey + DD                                             77E116DE 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateKey + 105                                            77E11706 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetKeyParam + 4D                                              77E11766 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetKeyParam + 6C                                              77E11785 81 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetKeyParam + BE                                              77E117D7 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetUserKey + 3A                                               77E11823 101 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetUserKey + A0                                               77E11889 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetUserKey + C6                                               77E118AF 127 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptExportKey + 70                                                77E11931 123 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptExportKey + EC                                                77E119AD 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateHash + 34                                            77E119F5 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateHash + 64                                            77E11A25 144 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateHash + F5                                            77E11AB6 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptDuplicateHash + 117                                           77E11AD8 126 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashSessionKey + 70                                           77E11B59 105 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashSessionKey + DA                                           77E11BC3 156 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashSessionKey + 177                                          77E11C60 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashSessionKey + 185                                          77E11C6E 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptHashSessionKey + 19A                                          77E11C83 194 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSignHashA + 9D                                                77E11D46 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetHashParam + 4D                                             77E11DA6 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetHashParam + 6C                                             77E11DC5 81 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetHashParam + BE                                             77E11E17 95 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderA + 4F                                             77E11E78 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderA + 56                                             77E11E7F 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderA + 5C                                             77E11E85 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderA + 64                                             77E11E8D 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderA + A2                                             77E11ECB 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExA + 52                                           77E12043 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExA + 59                                           77E1204A 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExA + 5F                                           77E12050 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExA + 67                                           77E12058 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExA + 70                                           77E12061 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderA + 58                                      77E12401 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderA + 5F                                      77E12408 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderA + 65                                      77E1240E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderA + 6E                                      77E12417 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderA + 7C                                      77E12425 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesW + 4B                                       77E126B4 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesW + 6C                                       77E126D5 127 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesW + EE                                       77E12757 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesW + FF                                       77E12768 76 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProviderTypesW + 14C                                      77E127B5 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersW + 4                                            77E127CD 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersW + 43                                           77E1280C 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersW + 75                                           77E1283E 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersW + 9F                                           77E12868 112 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptEnumProvidersW + 110                                          77E128D9 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderW + 10                                             77E12921 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderW + 14                                             77E12925 105 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderW + 7E                                             77E1298F 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExW + 10                                           77E129B1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExW + 14                                           77E129B5 111 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptSetProviderExW + 84                                           77E12A25 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderW + 9                                       77E12A42 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderW + 40                                      77E12A79 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderW + 6F                                      77E12AA8 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderW + 99                                      77E12AD2 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CryptGetDefaultProviderW + C0                                      77E12AF9 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileW + C                                                   77E12FE0 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileW + 3A                                                  77E1300E 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileW + C                                                   77E1301F 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileW + 3E                                                  77E13051 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusW + C                                          77E13062 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusW + 1B                                         77E13071 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawW + C                                          77E1308E 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawW + 21                                         77E130A3 94 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryUsersOnEncryptedFile + C                                      77E13102 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryUsersOnEncryptedFile + 1B                                     77E13111 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryUsersOnEncryptedFile + 21                                     77E13117 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryUsersOnEncryptedFile + 36                                     77E1312C 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FreeEncryptionCertificateHashList + 9                              77E1313A 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FreeEncryptionCertificateHashList + 1B                             77E1314C 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryRecoveryAgentsOnEncryptedFile + C                             77E1315D 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryRecoveryAgentsOnEncryptedFile + 1B                            77E1316C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryRecoveryAgentsOnEncryptedFile + 21                            77E13172 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryRecoveryAgentsOnEncryptedFile + 36                            77E13187 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveUsersFromEncryptedFile + C                                   77E13198 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveUsersFromEncryptedFile + 1B                                  77E131A7 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveUsersFromEncryptedFile + 21                                  77E131AD 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveUsersFromEncryptedFile + 36                                  77E131C2 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddUsersToEncryptedFile + C                                        77E131D3 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddUsersToEncryptedFile + 1B                                       77E131E2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddUsersToEncryptedFile + 21                                       77E131E8 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AddUsersToEncryptedFile + 36                                       77E131FD 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetUserFileEncryptionKey + C                                       77E1320E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetUserFileEncryptionKey + 1B                                      77E1321D 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateEncryptionInfoFile + C                                    77E1323A 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateEncryptionInfoFile + 1B                                   77E13249 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateEncryptionInfoFile + 21                                   77E1324F 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DuplicateEncryptionInfoFile + 36                                   77E13264 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptionDisable + C                                              77E13275 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptionDisable + 1B                                             77E13284 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptedFileKeyInfo + C                                           77E132A1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptedFileKeyInfo + 1B                                          77E132B0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptedFileKeyInfo + 21                                          77E132B6 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptedFileKeyInfo + 36                                          77E132CB 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FreeEncryptedFileKeyInfo + 9                                       77E132D9 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FreeEncryptedFileKeyInfo + 1B                                      77E132EB 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileA + B                                                   77E132FB 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileA + 18                                                  77E13308 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileA + 43                                                  77E13333 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileA + 5F                                                  77E1334F 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EncryptFileA + 67                                                  77E13357 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileA + B                                                   77E13390 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileA + 18                                                  77E1339D 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileA + 43                                                  77E133C8 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileA + 5F                                                  77E133E4 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DecryptFileA + 67                                                  77E133EC 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusA + B                                          77E13428 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusA + 18                                         77E13435 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusA + 47                                         77E13464 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusA + 63                                         77E13480 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FileEncryptionStatusA + 6B                                         77E13488 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawA + B                                          77E134C3 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawA + 18                                         77E134D0 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawA + 47                                         77E134FF 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawA + 63                                         77E1351B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenEncryptedFileRawA + 6B                                         77E13523 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 9                                 77E14570 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 10                                77E14577 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 1D                                77E14584 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 2C                                77E14593 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainW + 4E                                77E145B5 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainW + 9                                 77E145C3 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainW + 10                                77E145CA 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainW + 16                                77E145D0 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainW + 23                                77E145DD 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainW + 36                                77E145F0 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDDomainW + 40                                    77E14652 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDDomainW + 72                                    77E14684 103 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorW + 64          77E146ED 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorW + 92          77E1471B 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + C                                 77E1472C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + 12                                77E14732 77 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + 60                                77E14780 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDRootDomainA + 79                                77E14799 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 1C                                77E147BA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + 25                                77E147C3 179 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSDToStringSDRootDomainA + D9                                77E14877 163 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSDToSDDomainA + 9F                                    77E1491B 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidA + C                                         77E1492C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidA + 12                                        77E14932 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidA + 57                                        77E14977 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSidToSidA + 70                                        77E14990 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + C           77E149A1 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 12          77E149A7 74 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 5D          77E149F2 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA + 76          77E14A0B 159 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 9B          77E14AAB 67 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + DF          77E14AEF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + E3          77E14AF3 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 130         77E14B40 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToStringSecurityDescriptorA + 136         77E14B46 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword + 2F                                       77E15062 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword + 38                                       77E1506B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword + 41                                       77E15074 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword + 4A                                       77E1507D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword + 53                                       77E15086 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword2 + 16                                      77E1537A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword2 + 1F                                      77E15383 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword2 + 28                                      77E1538C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword2 + 31                                      77E15395 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!MSChapSrvChangePassword2 + 3A                                      77E1539E 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessWithLogonW + 5                                        77E15D02 205 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessWithLogonW + D4                                       77E15DD1 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessWithLogonW + E3                                       77E15DE0 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessWithLogonW + FB                                       77E15DF8 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateProcessWithLogonW + 113                                      77E15E10 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessIdleTasks + 10                                              77E16D39 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessIdleTasks + 12                                              77E16D3B 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessIdleTasks + 17                                              77E16D40 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessIdleTasks + 26                                              77E16D4F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessIdleTasks + 28                                              77E16D51 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterIdleTask + 19                                            77E16DD2 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterIdleTask + 40                                            77E16DF9 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterIdleTask + 67                                            77E16E20 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterIdleTask + 9B                                            77E16E54 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnregisterIdleTask + 9D                                            77E16E56 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction012 + 35                                             77E16ED6 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction013 + 35                                             77E16F10 66 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction016 + 31                                             77E16F53 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction017 + 31                                             77E16F89 113 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction024 + 53                                             77E16FFB 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction032 + B                                              77E17028 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction032 + 17                                             77E17034 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction032 + 50                                             77E1706D 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction032 + 67                                             77E17084 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SystemFunction032 + A5                                             77E170C2 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpEncodeCredential + 63                                         77E1716E 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpDecodeCredential + 36                                         77E171A9 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpDecodeCredential + 62                                         77E171D5 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpDecodeCredential + 78                                         77E171EB 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpDecodeCredential + 9F                                         77E17212 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpDecodeCredential + B9                                         77E1722C 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertCredential + 3F                                        77E1767F 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertCredential + 80                                        77E176C0 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertCredential + 8F                                        77E176CF 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertTargetInfo + 12                                        77E176F3 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertTargetInfo + 21                                        77E17702 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertTargetInfo + 25                                        77E17706 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertTargetInfo + 2C                                        77E1770D 117 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredpConvertTargetInfo + A4                                        77E17785 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteA + 36                                                    77E17AFF 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteA + 50                                                    77E17B19 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteA + 52                                                    77E17B1B 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteA + 8D                                                    77E17B56 71 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteW + 36                                                    77E17B9F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteW + 50                                                    77E17BB9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteW + 52                                                    77E17BBB 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteW + 8D                                                    77E17BF6 80 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadA + 3F                                                     77E17C48 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadA + 5D                                                     77E17C66 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadA + 5F                                                     77E17C68 99 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadA + C3                                                     77E17CCC 82 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadW + 3F                                                     77E17D20 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadW + 5D                                                     77E17D3E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadW + 5F                                                     77E17D40 99 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadW + C3                                                     77E17DA4 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateA + 4A                                                77E17E03 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateA + 68                                                77E17E21 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateA + 6A                                                77E17E23 114 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateA + DD                                                77E17E96 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateW + 4A                                                77E17EF3 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateW + 68                                                77E17F11 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateW + 6A                                                77E17F13 114 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredEnumerateW + DD                                                77E17F86 97 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsA + 50                                   77E17FE9 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsA + 6E                                   77E18007 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsA + 70                                   77E18009 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsA + BF                                   77E18058 95 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsW + 50                                   77E180B9 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsW + 6E                                   77E180D7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsW + 70                                   77E180D9 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredWriteDomainCredentialsW + BF                                   77E18128 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsA + 9                                     77E18142 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsA + 49                                    77E18182 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsA + 67                                    77E181A0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsA + 69                                    77E181A2 114 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsA + DC                                    77E18215 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsW + 49                                    77E18272 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsW + 67                                    77E18290 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsW + 69                                    77E18292 114 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredReadDomainCredentialsW + DC                                    77E18305 74 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteA + 38                                                   77E18351 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteA + 52                                                   77E1836B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteA + 54                                                   77E1836D 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteA + 71                                                   77E1838A 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteA + 95                                                   77E183AE 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteW + 38                                                   77E183F9 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteW + 52                                                   77E18413 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteW + 54                                                   77E18415 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteW + 71                                                   77E18432 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredDeleteW + 95                                                   77E18456 100 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameA + 53                                                   77E184BC 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameA + 71                                                   77E184DA 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameA + 73                                                   77E184DC 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameA + C2                                                   77E1852B 103 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameW + 53                                                   77E18594 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameW + 71                                                   77E185B2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameW + 73                                                   77E185B4 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredRenameW + C2                                                   77E18603 80 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoA + 3C                                            77E18655 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoA + 5A                                            77E18673 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoA + 5C                                            77E18675 98 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoA + BF                                            77E186D8 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoW + 3C                                            77E18725 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoW + 5A                                            77E18743 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoW + 5C                                            77E18745 98 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetTargetInfoW + BF                                            77E187A8 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetSessionTypes + 10                                           77E187C9 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetSessionTypes + 18                                           77E187D1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetSessionTypes + 1D                                           77E187D6 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetSessionTypes + 35                                           77E187EE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredGetSessionTypes + 37                                           77E187F0 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialW + 25                                        77E18BFB 98 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialW + 88                                        77E18C5E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialW + 8A                                        77E18C60 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialW + C4                                        77E18C9A 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialW + D3                                        77E18CA9 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialW + 29                                    77E18CD7 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialA + 20                                        77E18CFC 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredMarshalCredentialA + 46                                        77E18D22 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialA + A                                       77E18D31 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialA + 11                                      77E18D38 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialA + 43                                      77E18D6A 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredUnmarshalCredentialA + 64                                      77E18D8B 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialA + 29                                    77E18DB9 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialA + 5C                                    77E18DEC 71 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialA + A4                                    77E18E34 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialA + A8                                    77E18E38 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CredIsMarshaledCredentialA + AA                                    77E18E3A 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 2A                                     77E19362 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 30                                     77E19368 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 45                                     77E1937D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 56                                     77E1938E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfo + 58                                     77E19390 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInformation + 21                                77E195C6 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInformation + 29                                77E195CE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInformation + 30                                77E195D5 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInformation + 36                                77E195DB 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInformation + 60                                77E19605 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDeleteTrustedDomain + 10                                        77E19785 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDeleteTrustedDomain + 1B                                        77E19790 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDeleteTrustedDomain + 2A                                        77E1979F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDeleteTrustedDomain + 2C                                        77E197A1 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDeleteTrustedDomain + 54                                        77E197C9 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 1C                               77E19B13 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 23                               77E19B1A 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 34                               77E19B2B 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 43                               77E19B3A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryTrustedDomainInfoByName + 45                               77E19B3C 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 4                                  77E19DA6 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 10                                 77E19DB2 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 37                                 77E19DD9 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 3C                                 77E19DDE 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetTrustedDomainInfoByName + 51                                 77E19DF3 92 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 1F                                  77E19F3C 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 37                                  77E19F54 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 53                                  77E19F70 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 55                                  77E19F72 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomainsEx + 6B                                  77E19F88 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomainEx + 10                                      77E19FD1 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomainEx + 29                                      77E19FEA 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomainEx + 2D                                      77E19FEE 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomainEx + 41                                      77E1A002 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomainEx + 52                                      77E1A013 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 10                               77E1A0E5 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 14                               77E1A0E9 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 23                               77E1A0F8 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 3A                               77E1A10F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryDomainInformationPolicy + 3C                               77E1A111 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetDomainInformationPolicy + 16                                 77E1A167 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetDomainInformationPolicy + 1C                                 77E1A16D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetDomainInformationPolicy + 23                                 77E1A174 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetDomainInformationPolicy + 31                                 77E1A182 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetDomainInformationPolicy + 40                                 77E1A191 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomainByName + 10                                    77E1A1E1 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomainByName + 21                                    77E1A1F2 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomainByName + 30                                    77E1A201 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomainByName + 32                                    77E1A203 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomainByName + 5F                                    77E1A230 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryForestTrustInformation + 10                                77E1A251 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryForestTrustInformation + 20                                77E1A261 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryForestTrustInformation + 2F                                77E1A270 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryForestTrustInformation + 31                                77E1A272 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryForestTrustInformation + 5E                                77E1A29F 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetForestTrustInformation + 10                                  77E1A2C1 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetForestTrustInformation + 26                                  77E1A2D7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetForestTrustInformation + 35                                  77E1A2E6 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetForestTrustInformation + 37                                  77E1A2E8 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetForestTrustInformation + 64                                  77E1A315 89 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 26                             77E1A96F 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 45                             77E1A98E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 47                             77E1A990 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 5D                             77E1A9A6 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccountsWithUserRight + 7D                             77E1A9C6 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddAccountRights + 1C                                           77E1AA1D 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddAccountRights + 2B                                           77E1AA2C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddAccountRights + 3A                                           77E1AA3B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddAccountRights + 3C                                           77E1AA3D 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddAccountRights + 64                                           77E1AA65 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemoveAccountRights + 1C                                        77E1AABD 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemoveAccountRights + 2E                                        77E1AACF 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemoveAccountRights + 3D                                        77E1AADE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemoveAccountRights + 3F                                        77E1AAE0 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemoveAccountRights + 67                                        77E1AB08 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicySce + 70                                              77E1AD20 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicySce + 7E                                              77E1AD2E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicySce + 85                                              77E1AD35 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicySce + 95                                              77E1AD45 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenPolicySce + A6                                              77E1AD56 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationPolicy + 16                                       77E1ADCF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationPolicy + 1C                                       77E1ADD5 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationPolicy + 20                                       77E1ADD9 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationPolicy + 3A                                       77E1ADF3 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationPolicy + 4A                                       77E1AE03 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClearAuditLog + 10                                              77E1AE89 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClearAuditLog + 18                                              77E1AE91 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClearAuditLog + 27                                              77E1AEA0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClearAuditLog + 29                                              77E1AEA2 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaClearAuditLog + 56                                              77E1AECF 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeName + 10                                        77E1AEF1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeName + 14                                        77E1AEF5 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeName + 23                                        77E1AF04 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeName + 3A                                        77E1AF1B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeName + 3C                                        77E1AF1D 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 4                                  77E1AF6D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 10                                 77E1AF79 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 14                                 77E1AF7D 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 1A                                 77E1AF83 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupPrivilegeDisplayName + 24                                 77E1AF8D 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDelete + 10                                                     77E1B021 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDelete + 19                                                     77E1B02A 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDelete + 28                                                     77E1B039 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDelete + 2A                                                     77E1B03B 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaDelete + 52                                                     77E1B063 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecurityObject + 2C                                        77E1B109 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecurityObject + 4B                                        77E1B128 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecurityObject + 4D                                        77E1B12A 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecurityObject + 7A                                        77E1B157 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecurityObject + 2E                                          77E1B197 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecurityObject + 35                                          77E1B19E 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecurityObject + 47                                          77E1B1B0 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecurityObject + 74                                          77E1B1DD 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecurityObject + 85                                          77E1B1EE 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateAccount + 10                                              77E1B251 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateAccount + 21                                              77E1B262 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateAccount + 30                                              77E1B271 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateAccount + 32                                              77E1B273 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateAccount + 5F                                              77E1B2A0 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccounts + 29                                          77E1B2DA 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccounts + 48                                          77E1B2F9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccounts + 4A                                          77E1B2FB 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccounts + 60                                          77E1B311 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateAccounts + 85                                          77E1B336 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomain + 12                                        77E1B35B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomain + 16                                        77E1B35F 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomain + 25                                        77E1B36E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomain + 34                                        77E1B37D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateTrustedDomain + 36                                        77E1B37F 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomain + 10                                          77E1B3D1 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomain + 21                                          77E1B3E2 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomain + 30                                          77E1B3F1 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomain + 32                                          77E1B3F3 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenTrustedDomain + 5F                                          77E1B420 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 10                                     77E1B441 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 20                                     77E1B451 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 27                                     77E1B458 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 36                                     77E1B467 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQueryInfoTrustedDomain + 4D                                     77E1B47E 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationTrustedDomain + 10                                77E1B4E1 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationTrustedDomain + 26                                77E1B4F7 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationTrustedDomain + 3B                                77E1B50C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationTrustedDomain + 44                                77E1B515 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetInformationTrustedDomain + 48                                77E1B519 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomains + 1F                                    77E1B684 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomains + 37                                    77E1B69C 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomains + 53                                    77E1B6B8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomains + 55                                    77E1B6BA 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumerateTrustedDomains + 6B                                    77E1B6D0 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivileges + 29                                        77E1B732 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivileges + 48                                        77E1B751 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivileges + 4A                                        77E1B753 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivileges + 60                                        77E1B769 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivileges + 85                                        77E1B78E 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateSecret + 3D                                               77E1B7DE 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateSecret + 43                                               77E1B7E4 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateSecret + 53                                               77E1B7F4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateSecret + 55                                               77E1B7F6 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaCreateSecret + 82                                               77E1B823 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenAccount + 9                                                 77E1B842 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenAccount + 10                                                77E1B849 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenAccount + 21                                                77E1B85A 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenAccount + 30                                                77E1B869 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenAccount + 32                                                77E1B86B 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 10                               77E1B8B9 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 16                               77E1B8BF 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 1F                               77E1B8C8 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 2E                               77E1B8D7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaEnumeratePrivilegesOfAccount + 30                               77E1B8D9 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddPrivilegesToAccount + 10                                     77E1B929 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddPrivilegesToAccount + 1B                                     77E1B934 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddPrivilegesToAccount + 2A                                     77E1B943 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddPrivilegesToAccount + 2C                                     77E1B945 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaAddPrivilegesToAccount + 59                                     77E1B972 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 10                                77E1B999 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 1E                                77E1B9A7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 2D                                77E1B9B6 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 2F                                77E1B9B8 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaRemovePrivilegesFromAccount + 5C                                77E1B9E5 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetQuotasForAccount + 10                                        77E1BA09 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetQuotasForAccount + 1B                                        77E1BA14 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetQuotasForAccount + 2A                                        77E1BA23 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetQuotasForAccount + 2C                                        77E1BA25 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetQuotasForAccount + 59                                        77E1BA52 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetQuotasForAccount + 10                                        77E1BA79 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetQuotasForAccount + 1B                                        77E1BA84 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetQuotasForAccount + 2A                                        77E1BA93 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetQuotasForAccount + 2C                                        77E1BA95 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetQuotasForAccount + 59                                        77E1BAC2 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetSystemAccessAccount + 10                                     77E1BAE9 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetSystemAccessAccount + 16                                     77E1BAEF 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetSystemAccessAccount + 1D                                     77E1BAF6 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetSystemAccessAccount + 28                                     77E1BB01 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetSystemAccessAccount + 37                                     77E1BB10 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSystemAccessAccount + 10                                     77E1BB61 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSystemAccessAccount + 16                                     77E1BB67 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSystemAccessAccount + 1D                                     77E1BB6E 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSystemAccessAccount + 28                                     77E1BB79 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSystemAccessAccount + 37                                     77E1BB88 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenSecret + 10                                                 77E1BBD9 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenSecret + 21                                                 77E1BBEA 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenSecret + 30                                                 77E1BBF9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenSecret + 32                                                 77E1BBFB 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaOpenSecret + 5F                                                 77E1BC28 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecret + 9                                                   77E1BC42 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecret + 53                                                  77E1BC8C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecret + 55                                                  77E1BC8E 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecret + 86                                                  77E1BCBF 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaSetSecret + C3                                                  77E1BCFC 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecret + 36                                                77E1BDD3 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecret + 4B                                                77E1BDE8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecret + 4D                                                77E1BDEA 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecret + 7E                                                77E1BE1B 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaQuerySecret + 85                                                77E1BE22 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetRemoteUserName + 9F                                          77E1C004 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetRemoteUserName + AC                                          77E1C011 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetRemoteUserName + AE                                          77E1C013 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaGetRemoteUserName + 10A                                         77E1C06F 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNamesWithCreds + 4                                      77E1C085 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNamesWithCreds + 23                                     77E1C0A4 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNamesWithCreds + 2E                                     77E1C0AF 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNamesWithCreds + 39                                     77E1C0BA 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupNamesWithCreds + 44                                     77E1C0C5 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSidsWithCreds + 23                                      77E1C234 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSidsWithCreds + 2E                                      77E1C23F 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSidsWithCreds + 39                                      77E1C24A 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSidsWithCreds + 44                                      77E1C255 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaICLookupSidsWithCreds + 4F                                      77E1C260 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames + 1C                                                77E1C415 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames + 27                                                77E1C420 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames + 56                                                77E1C44F 86 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames + AD                                                77E1C4A6 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LsaLookupNames + B9                                                77E1C4B2 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UninstallApplication + A                                           77E1CF6E 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UninstallApplication + 1F                                          77E1CF83 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UninstallApplication + 23                                          77E1CF87 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UninstallApplication + 35                                          77E1CF99 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UninstallApplication + 49                                          77E1CFAD 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplications + B                                    77E1CFBD 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplications + 30                                   77E1CFE2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplications + 32                                   77E1CFE4 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplications + 46                                   77E1CFF8 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplications + 4F                                   77E1D001 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplicationData + B                                 77E1D1EE 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplicationData + 40                                77E1D223 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplicationData + 42                                77E1D225 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplicationData + 71                                77E1D254 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetLocalManagedApplicationData + 7A                                77E1D25D 85 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplications + 13                                        77E1D41A 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplications + 1D                                        77E1D424 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplications + 2A                                        77E1D431 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplications + 4C                                        77E1D453 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplications + 66                                        77E1D46D 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplicationCategories + B                                77E1D4CA 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplicationCategories + 22                               77E1D4E1 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplicationCategories + 36                               77E1D4F5 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetManagedApplicationCategories + 4B                               77E1D50A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InstallApplication + B                                             77E1D51A 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InstallApplication + 20                                            77E1D52F 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InstallApplication + 2D                                            77E1D53C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InstallApplication + 34                                            77E1D543 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InstallApplication + 47                                            77E1D556 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateCodeAuthzLevel + C                                           77E1E729 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateCodeAuthzLevel + 13                                          77E1E730 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateCodeAuthzLevel + 21                                          77E1E73E 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateCodeAuthzLevel + 25                                          77E1E742 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateCodeAuthzLevel + 2B                                          77E1E748 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenUntrusted + 40                                              77E1E99C 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenUntrusted + 58                                              77E1E9B4 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenUntrusted + 72                                              77E1E9CE 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenUntrusted + 82                                              77E1E9DE 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!IsTokenUntrusted + 92                                              77E1E9EE 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetPolicyInformation + 2B                                     77E1F0C7 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetPolicyInformation + 5A                                     77E1F0F6 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetPolicyInformation + 9A                                     77E1F136 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetPolicyInformation + 9E                                     77E1F13A 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetPolicyInformation + A2                                     77E1F13E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferRecordEventLogEntry + D                                       77E1F45A 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferRecordEventLogEntry + 2C                                      77E1F479 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferRecordEventLogEntry + 5D                                      77E1F4AA 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferRecordEventLogEntry + 7A                                      77E1F4C7 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferRecordEventLogEntry + B3                                      77E1F500 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetLevelInformation + C                                       77E20219 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetLevelInformation + 13                                      77E20220 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetLevelInformation + 21                                      77E2022E 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetLevelInformation + 57                                      77E20264 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferSetLevelInformation + 5F                                      77E2026C 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiChangeRegistryScope + 7                                      77E2064C 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiChangeRegistryScope + 27                                     77E2066C 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiChangeRegistryScope + 40                                     77E20685 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiChangeRegistryScope + 55                                     77E2069A 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SaferiChangeRegistryScope + 71                                     77E206B6 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoA + 12                                         77E215B6 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoA + 47                                         77E215EB 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoA + 12                                         77E21602 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoA + 44                                         77E21634 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAclA + C                                               77E21645 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAclA + 1A                                              77E21653 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAclA + 38                                              77E21671 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAclA + 3C                                              77E21675 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAclA + 44                                              77E2167D 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclW + 1B                                    77E21812 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclW + 3B                                    77E21832 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclW + 47                                    77E2183E 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclW + 5B                                    77E21852 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclA + 20                                    77E21877 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetEffectiveRightsFromAclA + 47                                    77E2189E 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetExplicitEntriesFromAclW + 19                                    77E218BC 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 1B                                 77E218E9 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 3A                                 77E21908 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 45                                 77E21913 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclW + 4C                                 77E2191A 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclA + 17                                 77E21936 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAuditedPermissionsFromAclA + 41                                 77E21960 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorW + E                                       77E21973 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorW + 33                                      77E21998 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorW + 3B                                      77E219A0 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorW + 5B                                      77E219C0 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorW + 60                                      77E219C5 96 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorA + 24                                      77E21BC4 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorA + 3D                                      77E21BDD 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorA + 58                                      77E21BF8 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorA + 73                                      77E21C13 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildSecurityDescriptorA + 88                                      77E21C28 99 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsW + 2D                                77E21CBE 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsW + 6A                                77E21CFB 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsW + 9F                                77E21D30 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsW + EA                                77E21D7B 191 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsW + 1AA                               77E21E3B 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsA + 2D                                77E21E6D 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsA + 5D                                77E21E9D 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsA + 6D                                77E21EAD 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsA + 79                                77E21EB9 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LookupSecurityDescriptorPartsA + 8E                                77E21ECE 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildExplicitAccessWithNameA + 15                                  77E22049 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildExplicitAccessWithNameA + 2B                                  77E2205F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildImpersonateExplicitAccessWithNameA + 16                       77E2207A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildImpersonateExplicitAccessWithNameA + 1F                       77E22083 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildImpersonateExplicitAccessWithNameA + 36                       77E2209A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoW + 9                                    77E220A8 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoW + 2D                                   77E220CC 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoW + 3F                                   77E220DE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoW + 47                                   77E220E6 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoW + 7D                                   77E2211C 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TreeResetNamedSecurityInfoA + 6                                    77E22127 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInheritanceSourceW + 7                                          77E22133 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInheritanceSourceW + 36                                         77E22162 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetInheritanceSourceA + 6                                          77E2216D 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FreeInheritedFromArray + 1F                                        77E22191 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithNameA + 1C                                         77E221B2 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithNameA + 23                                         77E221B9 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildImpersonateTrusteeA + 14                                      77E221D2 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildImpersonateTrusteeA + 18                                      77E221D6 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithSidA + 1F                                          77E221FA 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndSidA + 3E                                77E2223D 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndSidA + 6B                                77E2226A 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndSidA + 96                                77E22295 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndNameA + 19                               77E222B3 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndNameA + 3A                               77E222D4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndNameA + 3E                               77E222D8 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!BuildTrusteeWithObjectsAndNameA + 50                               77E222EA 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTrusteeNameA + F                                                77E222FE 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTrusteeTypeA + 17                                               77E2231A 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTrusteeFormA + 18                                               77E22337 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetMultipleTrusteeOperationA + 17                                  77E22353 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetMultipleTrusteeA + E                                            77E22366 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetMultipleTrusteeA + 16                                           77E2236E 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExW + E                                        77E22381 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExW + 17                                       77E2238A 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExW + 23                                       77E22396 66 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExW + 67                                       77E223DA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExW + 7A                                       77E223ED 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExA + B                                        77E2254C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExA + 13                                       77E22554 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExA + 1D                                       77E2255E 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExA + 31                                       77E22572 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetNamedSecurityInfoExA + 41                                       77E22582 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExW + E                                             77E226FD 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExW + 17                                            77E22706 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExW + 23                                            77E22712 70 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExW + 6B                                            77E2275A 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExW + 7E                                            77E2276D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExA + B                                             77E228FD 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExA + 13                                            77E22905 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExA + 1D                                            77E2290F 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExA + 31                                            77E22923 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetSecurityInfoExA + 41                                            77E22933 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorW + 7                             77E22A8C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorW + F                             77E22A94 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorW + 30                            77E22AB5 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorA + B                             77E22ACC 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorA + 13                            77E22AD4 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorA + 1D                            77E22ADE 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorA + 3A                            77E22AFB 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertAccessToSecurityDescriptorA + 65                            77E22B26 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessNamedW + 20                       77E22D9A 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessA + 20                            77E22DBF 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessA + 2C                            77E22DCB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessA + 34                            77E22DD3 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessA + 80                            77E22E1F 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ConvertSecurityDescriptorToAccessA + 90                            77E22E2F 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAccessListW + 34                                       77E22F8F 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAccessListA + 34                                       77E22FC8 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAuditListW + 22                                        77E22FEF 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetEntriesInAuditListA + 22                                        77E23016 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectW + E                                         77E23029 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectW + 17                                        77E23032 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectW + 21                                        77E2303C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectW + 2A                                        77E23045 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectW + 33                                        77E2304E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectA + E                                         77E23107 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectA + 17                                        77E23110 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectA + 21                                        77E2311A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectA + 2A                                        77E23123 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TrusteeAccessToObjectA + 33                                        77E2312C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOverlappedAccessResults + E                                     77E232BF 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOverlappedAccessResults + 16                                    77E232C7 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOverlappedAccessResults + 21                                    77E232D2 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOverlappedAccessResults + 2C                                    77E232DD 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetOverlappedAccessResults + 37                                    77E232E8 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CancelOverlappedAccess + E                                         77E233D7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CancelOverlappedAccess + 16                                        77E233DF 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CancelOverlappedAccess + 30                                        77E233F9 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CancelOverlappedAccess + 60                                        77E23429 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectW + E                                 77E2344F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectW + 17                                77E23458 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectW + 21                                77E23462 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectW + 2A                                77E2346B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectW + 33                                77E23474 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectA + 14                                77E2353D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectA + 1D                                77E23546 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectA + 2F                                77E23558 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectA + 3A                                77E23563 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetAccessPermissionsForObjectA + 46                                77E2356F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExW + E                                        77E2366C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExW + 17                                       77E23675 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExW + 23                                       77E23681 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExW + 4C                                       77E236AA 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExW + 72                                       77E236D0 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExA + 5                                        77E2385E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExA + 7                                        77E23860 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExA + 11                                       77E2386A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExA + 1A                                       77E23873 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetNamedSecurityInfoExA + 26                                       77E2387F 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExW + E                                             77E23B1F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExW + 17                                            77E23B28 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExW + 23                                            77E23B34 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExW + 56                                            77E23B67 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExW + 7C                                            77E23B8D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExA + 5                                             77E23D1E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExA + 11                                            77E23D2A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExA + 1A                                            77E23D33 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExA + 26                                            77E23D3F 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetSecurityInfoExA + 59                                            77E23D72 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTraceCallback + 21                                              77E25E95 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTraceCallback + 33                                              77E25EA7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTraceCallback + 3B                                              77E25EAF 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTraceCallback + 44                                              77E25EB8 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetTraceCallback + 48                                              77E25EBC 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveTraceCallback + 2C                                           77E2601D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveTraceCallback + 38                                           77E26029 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveTraceCallback + 50                                           77E26041 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveTraceCallback + 89                                           77E2607A 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RemoveTraceCallback + 99                                           77E2608A 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseTrace + C                                                     77E26A9C 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseTrace + 3A                                                    77E26ACA 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseTrace + 4B                                                    77E26ADB 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CloseTrace + 75                                                    77E26B05 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetFirstTraceOffset + 1D                                        77E26B27 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetFirstTraceOffset + 5C                                        77E26B66 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetFirstTraceOffset + 8D                                        77E26B97 75 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetFirstTraceOffset + D9                                        77E26BE3 137 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetFirstTraceOffset + 163                                       77E26C6D 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetTraceHeader + 10                                             77E26C82 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetTraceHeader + 37                                             77E26CA9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetTraceHeader + 39                                             77E26CAB 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetTraceHeader + 6C                                             77E26CDE 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetTraceHeader + 96                                             77E26D08 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiCloseTraceWithCursor + 48                                       77E27579 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiConvertTimestamp + E                                            77E2758C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiConvertTimestamp + 1D                                           77E2759B 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetNextEvent + 1B                                               77E275BB 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetNextEvent + 1F                                               77E275BF 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetNextEvent + 27                                               77E275C7 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetNextEvent + 2D                                               77E275CD 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiGetNextEvent + 50                                               77E275F0 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceA + 4                                                     77E281FE 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceA + 2A                                                    77E28224 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceA + 30                                                    77E2822A 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceA + 46                                                    77E28240 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceA + 4C                                                    77E28246 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceW + 2A                                                    77E2833B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceW + 30                                                    77E28341 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceW + 46                                                    77E28357 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceW + 4C                                                    77E2835D 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!OpenTraceW + 5B                                                    77E2836C 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiParseTraceEvent + 16                                            77E284EE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiParseTraceEvent + 1F                                            77E284F7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiParseTraceEvent + 2F                                            77E28507 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiParseTraceEvent + 48                                            77E28520 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiParseTraceEvent + 5B                                            77E28533 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenTraceWithCursor + 13                                        77E286CB 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenTraceWithCursor + 38                                        77E286F0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenTraceWithCursor + 44                                        77E286FC 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenTraceWithCursor + 4A                                        77E28702 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiOpenTraceWithCursor + 60                                        77E28718 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessTrace + 5                                                   77E28B49 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessTrace + 16                                                  77E28B5A 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessTrace + 28                                                  77E28B6C 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessTrace + 33                                                  77E28B77 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ProcessTrace + 41                                                  77E28B85 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceA + 1E                                                   77E291D9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceA + 21                                                   77E291DC 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceA + 37                                                   77E291F2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceA + 40                                                   77E291FB 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceA + 56                                                   77E29211 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceW + 1E                                                   77E2973F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceW + 21                                                   77E29742 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceW + 3A                                                   77E2975B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceW + 43                                                   77E29764 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartTraceW + 59                                                   77E2977A 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceA + 19                                                 77E29D02 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceA + 1C                                                 77E29D05 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceA + 40                                                 77E29D29 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceA + 45                                                 77E29D2E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ControlTraceA + 56                                                 77E29D3F 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnableTrace + 1E                                                   77E2A2B3 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnableTrace + 35                                                   77E2A2CA 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnableTrace + 3C                                                   77E2A2D1 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnableTrace + 42                                                   77E2A2D7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnableTrace + 52                                                   77E2A2E7 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEvent + 10                                                    77E2A5D1 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEvent + 17                                                    77E2A5D8 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEvent + 33                                                    77E2A5F4 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEvent + 46                                                    77E2A607 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEvent + 48                                                    77E2A609 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEventInstance + 13                                            77E2A6D4 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEventInstance + 25                                            77E2A6E6 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEventInstance + 30                                            77E2A6F1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEventInstance + 34                                            77E2A6F5 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceEventInstance + 46                                            77E2A707 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesA + 5                                                77E2AA3B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesA + C                                                77E2AA42 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesA + 3A                                               77E2AA70 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesA + 44                                               77E2AA7A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryAllTracesA + 4C                                               77E2AA82 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceLoggerHandle + 13                                          77E2ABA4 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceLoggerHandle + 2F                                          77E2ABC0 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceLoggerHandle + 51                                          77E2ABE2 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceLoggerHandle + 89                                          77E2AC1A 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceLoggerHandle + A1                                          77E2AC32 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceEnableLevel + C                                            77E2AC55 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceEnableLevel + 40                                           77E2AC89 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceEnableFlags + C                                            77E2AC9A 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetTraceEnableFlags + 40                                           77E2ACCE 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateTraceInstanceId + 13                                         77E2ACE6 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateTraceInstanceId + 2C                                         77E2ACFF 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateTraceInstanceId + 3B                                         77E2AD0E 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateTraceInstanceId + 60                                         77E2AD33 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateTraceInstanceId + 62                                         77E2AD35 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumerateTraceGuids + 4D                                           77E2ADD6 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumerateTraceGuids + 5F                                           77E2ADE8 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumerateTraceGuids + 6A                                           77E2ADF3 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumerateTraceGuids + 71                                           77E2ADFA 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumerateTraceGuids + 9E                                           77E2AE27 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryTraceA + 7                                                    77E2AF04 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryTraceA + 1C                                                   77E2AF19 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryTraceW + 7                                                    77E2AF25 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryTraceW + 1C                                                   77E2AF3A 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StopTraceA + 1C                                                    77E2AF5B 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StopTraceW + 1C                                                    77E2AF7C 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UpdateTraceA + 1C                                                  77E2AF9D 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UpdateTraceW + 1C                                                  77E2AFBE 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceA + 1C                                                   77E2AFDF 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceW + 1C                                                   77E2B000 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceW + 31                                                   77E2B015 80 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceW + 83                                                   77E2B067 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceW + 8F                                                   77E2B073 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!FlushTraceW + A0                                                   77E2B084 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessage + 13                                                  77E2B270 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessage + 1E                                                  77E2B27B 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessage + 48                                                  77E2B2A5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessage + 4A                                                  77E2B2A7 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessage + 5D                                                  77E2B2BA 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessageVa + 13                                                77E2B304 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessageVa + 1E                                                77E2B30F 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessageVa + 44                                                77E2B335 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessageVa + 46                                                77E2B337 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!TraceMessageVa + 59                                                77E2B34A 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WdmWmiServiceMain + 23                                             77E2B405 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WdmWmiServiceMain + 2D                                             77E2B40F 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WdmWmiServiceMain + 4B                                             77E2B42D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WdmWmiServiceMain + 4D                                             77E2B42F 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WdmWmiServiceMain + 75                                             77E2B457 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleW + 3A                                      77E2B49F 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleW + 3D                                      77E2B4A2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleW + 40                                      77E2B4A5 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleW + 46                                      77E2B4AB 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleW + 4D                                      77E2B4B2 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceW + 24                                       77E2B631 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceW + 2F                                       77E2B63C 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceW + 4F                                       77E2B65C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceW + 56                                       77E2B663 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceW + 93                                       77E2B6A0 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleW + 2D                               77E2B8BA 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleW + 3F                               77E2B8CC 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleW + 42                               77E2B8CF 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleW + 45                               77E2B8D2 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleW + 4B                               77E2B8D8 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleA + D                                77E2BA62 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleA + 21                               77E2BA76 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleA + 23                               77E2BA78 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleA + 26                               77E2BA7B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceMultipleA + 2C                               77E2BA81 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceW + 4                                          77E2BB83 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceW + 24                                         77E2BBA3 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceW + 2D                                         77E2BBAC 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceW + 75                                         77E2BBF4 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceW + 97                                         77E2BC16 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemW + 24                                             77E2BD41 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemW + 2D                                             77E2BD4A 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemW + 72                                             77E2BD8F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemW + 75                                             77E2BD92 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemW + 85                                             77E2BDA2 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodW + 24                                             77E2BEE1 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodW + 32                                             77E2BEEF 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodW + 46                                             77E2BF03 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodW + 57                                             77E2BF14 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodW + 5E                                             77E2BF1B 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationA + C                                   77E2C1E1 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationA + E                                   77E2C1E3 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiNotificationRegistrationA + 23                                  77E2C1F8 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameW + 5                                   77E2C202 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameW + 45                                  77E2C242 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameW + 4A                                  77E2C247 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameW + 74                                  77E2C271 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameW + 88                                  77E2C285 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiEnumerateGuids + 23                                             77E2C3F4 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiEnumerateGuids + 40                                             77E2C411 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiEnumerateGuids + 4A                                             77E2C41B 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiEnumerateGuids + 65                                             77E2C436 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiEnumerateGuids + 73                                             77E2C444 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameA + B                                      77E2C594 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameA + 12                                     77E2C59B 160 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameA + B3                                     77E2C63C 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameA + B7                                     77E2C640 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameW + B                                      77E2C650 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameW + 12                                     77E2C657 128 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiDevInstToInstanceNameW + 93                                     77E2C6D8 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryGuidInformation + 3A                                       77E2C717 56 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryGuidInformation + 74                                       77E2C751 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryGuidInformation + 88                                       77E2C765 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryGuidInformation + 99                                       77E2C776 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsA + 7                                       77E2C790 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsA + 9                                       77E2C792 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiReceiveNotificationsA + 22                                      77E2C7AB 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataA + 1F                                              77E2C7CF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataA + 23                                              77E2C7D3 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleA + C                                       77E2C7E4 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleA + 36                                      77E2C80E 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQueryAllDataMultipleA + 3B                                      77E2C813 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceA + D                                        77E2C825 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceA + 18                                       77E2C830 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceA + 50                                       77E2C868 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceA + 67                                       77E2C87F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiQuerySingleInstanceA + 6F                                       77E2C887 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceA + D                                          77E2C8AC 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceA + 18                                         77E2C8B7 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceA + 43                                         77E2C8E2 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceA + 4C                                         77E2C8EB 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleInstanceA + 5F                                         77E2C8FE 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemA + D                                              77E2C910 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemA + 18                                             77E2C91B 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemA + 46                                             77E2C949 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemA + 4F                                             77E2C952 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiSetSingleItemA + 62                                             77E2C965 115 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiExecuteMethodA + 6F                                             77E2C9D9 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameA + 13                                  77E2C9F1 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameA + 2A                                  77E2CA08 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameA + 52                                  77E2CA30 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameA + 6D                                  77E2CA4B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiFileHandleToInstanceNameA + 75                                  77E2CA53 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesA + 36                                     77E2CC3A 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesA + 52                                     77E2CC56 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesA + 5D                                     77E2CC61 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesA + 69                                     77E2CC6D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!WmiMofEnumerateResourcesA + 74                                     77E2CC78 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownW + 23                                       77E34B7C 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownW + 30                                       77E34B89 66 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownW + 74                                       77E34BCD 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownW + 8F                                       77E34BE8 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExW + 23                                     77E34C10 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExW + 30                                     77E34C1D 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExW + 7A                                     77E34C67 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExW + 95                                     77E34C82 144 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownA + 8C                                       77E34D13 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownA + 96                                       77E34D1D 147 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExA + 8F                                     77E34DB1 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!InitiateSystemShutdownExA + 99                                     77E34DBB 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!AbortSystemShutdownA + 57                                          77E34E17 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOverridePredefKey + 10                                          77E34E2C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOverridePredefKey + 17                                          77E34E33 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOverridePredefKey + 1E                                          77E34E3A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOverridePredefKey + 25                                          77E34E41 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegOverridePredefKey + 2C                                          77E34E48 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegConnectRegistryA + 54                                           77E35072 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyA + B                                                    77E35082 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyA + 17                                                   77E3508E 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyA + 21                                                   77E35098 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyA + 34                                                   77E350AB 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegLoadKeyA + 50                                                   77E350C7 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyA + C                                                  77E351C5 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyA + 12                                                 77E351CB 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyA + 48                                                 77E35201 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyA + 58                                                 77E35211 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyA + 6E                                                 77E35227 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyW + C                                                  77E35266 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyW + 12                                                 77E3526C 63 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyW + 52                                                 77E352AC 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyW + 68                                                 77E352C2 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegUnLoadKeyW + 73                                                 77E352CD 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyA + B                                                 77E352F6 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyA + 1A                                                77E35305 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyA + 24                                                77E3530F 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyA + 3D                                                77E35328 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyA + 5C                                                77E35347 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyW + 11                                                77E354C5 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyW + 1F                                                77E354D3 133 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyW + A6                                                77E3555A 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyW + B1                                                77E35565 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegReplaceKeyW + CA                                                77E3557E 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesA + 2B                                       77E355AE 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesA + 30                                       77E355B3 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesA + 38                                       77E355BB 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesA + 72                                       77E355F5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesA + 7D                                       77E35600 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesW + C                                        77E358F1 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesW + 26                                       77E3590B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesW + 2B                                       77E35910 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesW + 34                                       77E35919 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegQueryMultipleValuesW + 48                                       77E3592D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyA + C                                                 77E35B4D 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyA + 12                                                77E35B53 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyA + 1D                                                77E35B5E 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyA + 3C                                                77E35B7D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyA + 45                                                77E35B86 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyW + C                                                 77E35BFE 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyW + 12                                                77E35C04 63 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyW + 52                                                77E35C44 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyW + 6B                                                77E35C5D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegRestoreKeyW + 76                                                77E35C68 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyA + 11                                                   77E35C97 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyA + 1F                                                   77E35CA5 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyA + 39                                                   77E35CBF 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyA + 3E                                                   77E35CC4 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyA + 45                                                   77E35CCB 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyW + 11                                                   77E35D89 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyW + 1F                                                   77E35D97 103 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyW + 88                                                   77E35E00 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyW + 93                                                   77E35E0B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyW + 9F                                                   77E35E17 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExA + 11                                                 77E35E56 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExA + 1F                                                 77E35E64 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExA + 39                                                 77E35E7E 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExA + 3E                                                 77E35E83 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExA + 45                                                 77E35E8A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExW + 11                                                 77E35F4B 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExW + 1F                                                 77E35F59 106 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExW + 8B                                                 77E35FC5 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExW + 96                                                 77E35FD0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSaveKeyExW + A2                                                 77E35FDC 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueW + F                                                   77E36019 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueW + 1C                                                  77E36026 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueW + 26                                                  77E36030 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueW + 2F                                                  77E36039 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!RegSetValueW + 53                                                  77E3605D 106 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScGetCurrentGroupStateW + 6                                      77E367D5 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScGetCurrentGroupStateW + 2B                                     77E367FA 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScGetCurrentGroupStateW + 3D                                     77E3680C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScGetCurrentGroupStateW + 50                                     77E3681F 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScGetCurrentGroupStateW + 6A                                     77E36839 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExW + A                                          77E3686D 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExW + 1A                                         77E3687D 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExW + 4F                                         77E368B2 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExW + 60                                         77E368C3 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExW + 62                                         77E368C5 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServiceGroupW + 4                                              77E36935 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServiceGroupW + A                                              77E3693B 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServiceGroupW + 25                                             77E36956 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServiceGroupW + 29                                             77E3695A 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServiceGroupW + 44                                             77E36975 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsA + 33                                           77E36A44 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsA + 42                                           77E36A53 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsA + 44                                           77E36A55 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!I_ScSetServiceBitsA + 7E                                           77E36A8F 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceBits + 1C                                                77E36ABD 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceBits + 31                                                77E36AD2 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExA + 1A                                         77E36AF1 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExA + 4F                                         77E36B26 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExA + 60                                         77E36B37 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExA + 62                                         77E36B39 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusExA + 8E                                         77E36B65 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceObjectSecurity + 10                                    77E36BB9 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceObjectSecurity + 24                                    77E36BCD 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceObjectSecurity + 33                                    77E36BDC 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceObjectSecurity + 35                                    77E36BDE 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceObjectSecurity + 6F                                    77E36C18 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceObjectSecurity + 4                                       77E36C2D 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceObjectSecurity + 25                                      77E36C4E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceObjectSecurity + 2F                                      77E36C58 73 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceObjectSecurity + 7A                                      77E36CA3 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!SetServiceObjectSecurity + 8B                                      77E36CB4 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigA + 42                                          77E36D53 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigA + 55                                          77E36D66 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigA + 78                                          77E36D89 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigA + 96                                          77E36DA7 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigA + BA                                          77E36DCB 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigW + 32                                          77E36EDB 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigW + 49                                          77E36EF2 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigW + 56                                          77E36EFF 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigW + 85                                          77E36F2E 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfigW + 9A                                          77E36F43 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2A + 16                                         77E36FBF 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2A + 20                                         77E36FC9 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2A + 2F                                         77E36FD8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2A + 31                                         77E36FDA 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2A + 56                                         77E36FFF 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2W + 16                                         77E37047 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2W + 20                                         77E37051 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2W + 2F                                         77E37060 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2W + 31                                         77E37062 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ChangeServiceConfig2W + 56                                         77E37087 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceA + 45                                                77E370FE 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceA + 58                                                77E37111 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceA + 7B                                                77E37134 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceA + 99                                                77E37152 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceA + C3                                                77E3717C 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceW + 35                                                77E37286 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceW + 4C                                                77E3729D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceW + 59                                                77E372AA 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceW + 92                                                77E372E3 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!CreateServiceW + A7                                                77E372F8 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteService + 10                                                 77E37369 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteService + 18                                                 77E37371 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteService + 27                                                 77E37380 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteService + 29                                                 77E37382 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!DeleteService + 63                                                 77E373BC 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesA + 25                                        77E373F6 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesA + 38                                        77E37409 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesA + 49                                        77E3741A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesA + 4B                                        77E3741C 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesA + 77                                        77E37448 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesW + 25                                        77E374AE 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesW + 38                                        77E374C1 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesW + 49                                        77E374D2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesW + 4B                                        77E374D4 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumDependentServicesW + 77                                        77E37500 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameA + 40                                        77E37581 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameA + 4F                                        77E37590 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameA + 51                                        77E37592 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameA + 8B                                        77E375CC 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameW + 41                                        77E37622 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameW + 50                                        77E37631 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameW + 52                                        77E37633 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceDisplayNameW + 8C                                        77E3766D 82 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameA + 40                                            77E376C1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameA + 4F                                            77E376D0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameA + 51                                            77E376D2 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameA + 8B                                            77E3770C 84 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameW + 41                                            77E37762 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameW + 50                                            77E37771 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameW + 52                                            77E37773 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!GetServiceKeyNameW + 8C                                            77E377AD 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LockServiceDatabase + 10                                           77E377D1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LockServiceDatabase + 14                                           77E377D5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LockServiceDatabase + 20                                           77E377E1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LockServiceDatabase + 2F                                           77E377F0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!LockServiceDatabase + 31                                           77E377F2 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2A + 10                                          77E37851 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2A + 2D                                          77E3786E 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2A + 59                                          77E3789A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2A + 5D                                          77E3789E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2A + 6D                                          77E378AE 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2W + 10                                          77E37969 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2W + 2D                                          77E37986 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2W + 59                                          77E379B2 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2W + 5D                                          77E379B6 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceConfig2W + 6D                                          77E379C6 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusA + 23                                       77E37A94 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusA + 30                                       77E37AA1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusA + 3F                                       77E37AB0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusA + 41                                       77E37AB2 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusA + 7B                                       77E37AEC 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusW + 23                                       77E37B24 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusW + 30                                       77E37B31 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusW + 3F                                       77E37B40 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusW + 41                                       77E37B42 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!QueryServiceLockStatusW + 7B                                       77E37B7C 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnlockServiceDatabase + 10                                         77E37BA1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnlockServiceDatabase + 19                                         77E37BAA 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnlockServiceDatabase + 28                                         77E37BB9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnlockServiceDatabase + 2A                                         77E37BBB 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!UnlockServiceDatabase + 41                                         77E37BD2 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusW + 7                                            77E37C10 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusW + 28                                           77E37C31 76 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusW + 77                                           77E37C80 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusW + 89                                           77E37C92 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!EnumServicesStatusW + 8D                                           77E37C96 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherA + B                                    77E37DBC 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherA + 30                                   77E37DE1 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherA + 55                                   77E37E06 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherA + 81                                   77E37E32 124 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!StartServiceCtrlDispatcherA + FE                                   77E37EAF 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!Wow64Win32ApiEntry + 24                                            77E382EF 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!Wow64Win32ApiEntry + 29                                            77E382F4 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!Wow64Win32ApiEntry + 67                                            77E38332 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!Wow64Win32ApiEntry + 83                                            77E3834E 111 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!Wow64Win32ApiEntry + F3                                            77E383BE 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfChangeNotify + 12                                               77E38509 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfChangeNotify + 1C                                               77E38513 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfChangeNotify + 29                                               77E38520 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfChangeNotify + 38                                               77E3852F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfChangeNotify + 3A                                               77E38531 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogW + 45                                        77E385AE 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogW + 54                                        77E385BD 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogW + 56                                        77E385BF 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogW + 78                                        77E385E1 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogW + 81                                        77E385EA 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileW + 10                                         77E38611 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileW + 1B                                         77E3861C 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileW + 2A                                         77E3862B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileW + 2C                                         77E3862D 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileW + 50                                         77E38651 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileW + 26                                        77E3868F 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileW + 38                                        77E386A1 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileW + 44                                        77E386AD 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileW + 46                                        77E386AF 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileW + 69                                        77E386D2 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogW + 58                                              77E38761 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogW + 67                                              77E38770 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogW + 69                                              77E38772 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogW + 8B                                              77E38794 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfReadEventLogW + 94                                              77E3879D 87 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogA + 45                                        77E387F6 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogA + 54                                        77E38805 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogA + 56                                        77E38807 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogA + 78                                        77E38829 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfOpenBackupEventLogA + 81                                        77E38832 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileA + 10                                         77E38859 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileA + 1B                                         77E38864 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileA + 2A                                         77E38873 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileA + 2C                                         77E38875 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfClearEventLogFileA + 50                                         77E38899 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileA + 26                                        77E388D7 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileA + 38                                        77E388E9 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileA + 44                                        77E388F5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileA + 46                                        77E388F7 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfBackupEventLogFileA + 69                                        77E3891A 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + 10                                              77E38961 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + 18                                              77E38969 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + 27                                              77E38978 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + 29                                              77E3897A 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ADVAPI32.dll!ElfFlushEventLog + 4D                                              77E3899E 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!pfnUnmarshallRoutines + FFF770BD                                     77E71365 179 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!pfnUnmarshallRoutines + FFF77171                                     77E71419 275 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!pfnUnmarshallRoutines + FFF77288                                     77E71530 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!pfnUnmarshallRoutines + FFF7729C                                     77E71544 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!pfnUnmarshallRoutines + FFF772B0                                     77E71558 196 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeAlignment + 5                                              77E7164D 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeAlignment + B8                                             77E71700 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeAlignment + BB                                             77E71703 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeBufferSize + 1                                             77E71709 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeBufferSize + B8                                            77E717C0 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeBufferSize + BB                                            77E717C3 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeMemorySize + 1                                             77E717C9 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeMemorySize + B8                                            77E71880 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeMemorySize + BB                                            77E71883 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeMemorySize + C0                                            77E71888 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!SimpleTypeMemorySize + C4                                            77E7188C 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFlags + 4                                                     77E75D2C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFlags + 8                                                     77E75D30 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFlags + C                                                     77E75D34 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFlags + 10                                                    77E75D38 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFlags + 14                                                    77E75D3C 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreate + 20                                                      77E76264 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreate + 36                                                      77E7627A 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreate + 4A                                                      77E7628E 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreate + 63                                                      77E762A7 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreate + 6A                                                      77E762AE 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheFree + B                                                  77E7668E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheFree + 19                                                 77E7669C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheFree + 22                                                 77E766A5 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheFree + 38                                                 77E766BB 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheFree + 51                                                 77E766D4 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBufferWithObject + F                                         77E789B8 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBufferWithObject + 20                                        77E789C9 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBufferWithObject + 32                                        77E789DB 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBufferWithObject + 38                                        77E789E1 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBufferWithObject + 59                                        77E78A02 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBuffer + 7                                                   77E78A20 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBuffer + 13                                                  77E78A2C 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBuffer + 27                                                  77E78A40 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBuffer + 35                                                  77E78A4E 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcGetBuffer + 39                                                  77E78A52 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitializeNew + 18                                          77E78B77 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitializeNew + 23                                          77E78B82 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitializeNew + 28                                          77E78B87 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitializeNew + 2A                                          77E78B89 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitializeNew + 31                                          77E78B90 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitialize + 1E                                             77E78BB7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitialize + 21                                             77E78BBA 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitialize + 43                                             77E78BDC 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitialize + 71                                             77E78C0A 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientInitialize + 7A                                             77E78C13 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetBuffer + D                                                     77E7903A 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetBuffer + 30                                                    77E7905D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetBuffer + 41                                                    77E7906E 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetBuffer + 64                                                    77E79091 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetBuffer + 6B                                                    77E79098 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFreeBuffer + D                                                    77E790C1 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFreeBuffer + 14                                                   77E790C8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFreeBuffer + 1C                                                   77E790D0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFreeBuffer + 22                                                   77E790D6 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFreeBuffer + 28                                                   77E790DC 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationFree + E                                               77E79119 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationFree + 16                                              77E79121 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationFree + 1A                                              77E79125 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatFree + 12                                          77E7913C 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatFree + 17                                          77E79141 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatFree + 20                                          77E7914A 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatFree + 2D                                          77E79157 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatFree + 50                                          77E7917A 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreeBuffer + 16                                                 77E791A1 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreeBuffer + 30                                                 77E791BB 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreeBuffer + 43                                                 77E791CE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreeBuffer + 4D                                                 77E791D8 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreeBuffer + 56                                                 77E791E1 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetTypeFlags + 14                                                 77E792F0 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetTypeFlags + 30                                                 77E7930C 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetTypeFlags + 40                                                 77E7931C 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetTypeFlags + 5A                                                 77E79336 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetTypeFlags + 77                                                 77E79353 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationInitialize + 11                                        77E79733 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationInitialize + 18                                        77E7973A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationInitialize + 26                                        77E79748 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationInitialize + 36                                        77E79758 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationInitialize + 3C                                        77E7975E 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationPass + 10                                              77E7978D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationPass + 1B                                              77E79798 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationPass + 21                                              77E7979E 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationPass + 49                                              77E797C6 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCorrelationPass + 55                                              77E797D2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CheckVerificationTrailer + 15                                        77E79981 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CheckVerificationTrailer + 23                                        77E7998F 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CheckVerificationTrailer + 37                                        77E799A3 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CheckVerificationTrailer + 40                                        77E799AC 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CheckVerificationTrailer + 7C                                        77E799E8 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitialize + 14                                             77E79AE9 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitialize + 42                                             77E79B17 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitialize + 48                                             77E79B1D 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitialize + 7A                                             77E79B4F 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitialize + 7E                                             77E79B53 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOutInit + 1E                                                      77E79FC5 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOutInit + 28                                                      77E79FCF 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOutInit + 30                                                      77E79FD7 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOutInit + 33                                                      77E79FDA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOutInit + 3B                                                      77E79FE2 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrAllocate + 7                                                      77E7A227 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrAllocate + 16                                                     77E7A236 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrAllocate + 3A                                                     77E7A25A 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrAllocate + 6B                                                     77E7A28B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrAllocate + 71                                                     77E7A291 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSendReceive + 12                                                77E7A315 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSendReceive + 27                                                77E7A32A 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSendReceive + 1B                                                  77E7A34A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSendReceive + 23                                                  77E7A352 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSendReceive + 30                                                  77E7A35F 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSendReceive + 4E                                                  77E7A37D 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSendReceive + 52                                                  77E7A381 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeNew + 24                                          77E7A3AF 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeNew + 29                                          77E7A3B4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeNew + 2B                                          77E7A3B6 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeNew + 31                                          77E7A3BC 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeNew + 3B                                          77E7A3C6 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcImpersonateClient + C                                             77E7A42A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcImpersonateClient + 12                                            77E7A430 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcImpersonateClient + 1F                                            77E7A43D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcImpersonateClient + 31                                            77E7A44F 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcImpersonateClient + 3E                                            77E7A45C 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelfEx + C                                                77E7A4B2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelfEx + 12                                               77E7A4B8 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelfEx + 1E                                               77E7A4C4 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelfEx + 2B                                               77E7A4D1 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelfEx + 36                                               77E7A4DC 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpMemoryIncrement + 14                                             77E7A5F9 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpMemoryIncrement + 1D                                             77E7A602 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpMemoryIncrement + 23                                             77E7A608 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpMemoryIncrement + 2F                                             77E7A614 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpMemoryIncrement + 5F                                             77E7A644 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMarshall + 56                                         77E7AA4B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMarshall + 5C                                         77E7AA51 65 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructUnmarshall + 3D                                       77E7AA93 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructUnmarshall + 45                                       77E7AA9B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructUnmarshall + 49                                       77E7AA9F 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructUnmarshall + 55                                       77E7AAAB 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructUnmarshall + 59                                       77E7AAAF 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerFree + 13                                                  77E7ABBB 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerFree + 19                                                  77E7ABC1 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerFree + 30                                                  77E7ABD8 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerFree + 38                                                  77E7ABE0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerFree + 43                                                  77E7ABEB 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerMarshall + 14                                              77E7ACEA 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerMarshall + 36                                              77E7AD0C 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerBufferSize + 2D                                            77E7AD3E 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerUnmarshall + 18                                            77E7AD5B 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerUnmarshall + 3B                                            77E7AD7E 100 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeMarshall + 3E                                           77E7ADE3 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeMarshall + 43                                           77E7ADE8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeMarshall + 4A                                           77E7ADEF 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeMarshall + 4F                                           77E7ADF4 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeMarshall + 6B                                           77E7AE10 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructBufferSize + 37                                       77E7AF34 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructBufferSize + 3C                                       77E7AF39 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructBufferSize + 51                                       77E7AF4E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructBufferSize + 60                                       77E7AF5D 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructBufferSize + 66                                       77E7AF63 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructFree + 20                                             77E7B157 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructFree + 2F                                             77E7B166 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructFree + 36                                             77E7B16D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructFree + 3E                                             77E7B175 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructFree + 45                                             77E7B17C 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFree + C                                                   77E7B3B0 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFree + 17                                                  77E7B3BB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFree + 1E                                                  77E7B3C2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFree + 24                                                  77E7B3C8 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFree + 2E                                                  77E7B3D2 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRevertToSelf + 2                                                  77E7B455 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFree + 12                                                       77E7B48F 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAllocate + C                                                    77E7B4A0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAllocate + 12                                                   77E7B4A6 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAllocate + 1F                                                   77E7B4B3 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAllocate + 3F                                                   77E7B4D3 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAllocate + 51                                                   77E7B4E5 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleFree + 3F                                                      77E7B644 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleFree + 47                                                      77E7B64C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleFree + 49                                                      77E7B64E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleFree + 4B                                                      77E7B650 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleFree + 4D                                                      77E7B652 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayBufferSize + 27                                    77E7B84B 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMarshall + 2C                                      77E7B87C 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMarshall + 58                                      77E7B8A8 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMarshall + 70                                      77E7B8C0 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMarshall + 9F                                      77E7B8EF 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMarshall + A7                                      77E7B8F7 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayUnmarshall + 2B                                    77E7B971 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayUnmarshall + 2F                                    77E7B975 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayUnmarshall + 59                                    77E7B99F 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayUnmarshall + 64                                    77E7B9AA 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayUnmarshall + 7B                                    77E7B9C1 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayFree + 9                                           77E7B9CF 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayFree + 27                                          77E7B9ED 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayFree + 2D                                          77E7B9F3 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayFree + 31                                          77E7B9F7 108 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayFree + 9E                                          77E7BA64 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqTransportType + C                                     77E7C8E6 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqTransportType + 12                                    77E7C8EC 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqTransportType + 23                                    77E7C8FD 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqTransportType + 32                                    77E7C90C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqTransportType + 39                                    77E7C913 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall2 + 20                                          77E7D0D9 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall2 + 28                                          77E7D0E1 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall2 + 3C                                          77E7D0F5 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall2 + 4A                                          77E7D103 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall2 + 57                                          77E7D110 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextMarshall + 12                                             77E7D46E 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextMarshall + 18                                             77E7D474 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextMarshall + 1C                                             77E7D478 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextMarshall + 27                                             77E7D483 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextMarshall + 2B                                             77E7D487 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewUnmarshall + B                                    77E7D4CC 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewUnmarshall + 30                                   77E7D4F1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewUnmarshall + 38                                   77E7D4F9 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewUnmarshall + 4A                                   77E7D50B 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewUnmarshall + 6C                                   77E7D52D 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextBinding + 10                                              77E7D813 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextBinding + 20                                              77E7D823 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextBinding + 26                                              77E7D829 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextBinding + 2E                                              77E7D831 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextBinding + 4C                                              77E7D84F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextUnmarshall + 15                                           77E7D912 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextUnmarshall + 1B                                           77E7D918 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextUnmarshall + 1F                                           77E7D91C 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextUnmarshall + 2F                                           77E7D92C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRCContextUnmarshall + 41                                           77E7D93E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewMarshall + 2A                                     77E7DA64 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewMarshall + 32                                     77E7DA6C 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewMarshall + 50                                     77E7DA8A 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextNewMarshall + 59                                     77E7DA93 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall2 + 16                                            77E7DAAE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall2 + 1F                                            77E7DAB7 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall2 + 2C                                            77E7DAC4 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall2 + 3D                                            77E7DAD5 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall2 + 4C                                            77E7DAE4 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrContextHandleInitialize + 2A                                      77E7DD29 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrContextHandleInitialize + 32                                      77E7DD31 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrContextHandleInitialize + 3B                                      77E7DD3A 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrContextHandleInitialize + 47                                      77E7DD46 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingCopy + C                                                 77E7DD66 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingCopy + 12                                                77E7DD6C 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingCopy + 19                                                77E7DD73 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingCopy + 1B                                                77E7DD75 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingCopy + 2A                                                77E7DD84 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStatsVectorFree + C                                           77E7E73A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStatsVectorFree + 12                                          77E7E740 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStatsVectorFree + 1E                                          77E7E74C 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStatsVectorFree + 28                                          77E7E756 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStatsVectorFree + 30                                          77E7E75E 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingW + C                                       77E7E944 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingW + 12                                      77E7E94A 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingW + 1B                                      77E7E953 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingW + 2A                                      77E7E962 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingW + 2F                                      77E7E967 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseW + 17                                          77E7E99D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseW + 20                                          77E7E9A6 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseW + 2B                                          77E7E9B1 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseW + 42                                          77E7E9C8 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseW + 5D                                          77E7E9E3 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingW + D                                     77E7EAA2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingW + 15                                    77E7EAAA 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingW + 22                                    77E7EAB7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingW + 31                                    77E7EAC6 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingW + 39                                    77E7EACE 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeW + D                                         77E7ECFE 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeW + 13                                        77E7ED04 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeW + 1F                                        77E7ED10 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeW + 30                                        77E7ED21 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeW + 54                                        77E7ED45 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcParseSecurity + 21                                              77E7EFCE 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcParseSecurity + 3D                                              77E7EFEA 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcParseSecurity + 6D                                              77E7F01A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcParseSecurity + 77                                              77E7F024 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcParseSecurity + 9E                                              77E7F04B 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringBufferSize + F                                    77E7F14C 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringBufferSize + 2C                                   77E7F169 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringBufferSize + 30                                   77E7F16D 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringBufferSize + 5C                                   77E7F199 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringBufferSize + 64                                   77E7F1A1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMarshall + E                                      77E7F1EE 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMarshall + 16                                     77E7F1F6 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMarshall + 34                                     77E7F214 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMarshall + 3A                                     77E7F21A 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMarshall + 5F                                     77E7F23F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringUnmarshall + 13                                   77E7F2D3 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringUnmarshall + 1C                                   77E7F2DC 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringUnmarshall + 2A                                   77E7F2EA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringUnmarshall + 3C                                   77E7F2FC 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringUnmarshall + 54                                   77E7F314 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructBufferSize + 60                                   77E7F559 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructBufferSize + 64                                   77E7F55D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructBufferSize + 6C                                   77E7F565 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructBufferSize + 71                                   77E7F56A 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMarshall + 40                                     77E7F5AF 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMarshall + 49                                     77E7F5B8 88 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMarshall + A2                                     77E7F611 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMarshall + A6                                     77E7F615 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMarshall + AC                                     77E7F61B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructUnmarshall + 19                                   77E7F641 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructUnmarshall + 5F                                   77E7F687 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructUnmarshall + 67                                   77E7F68F 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructUnmarshall + 6E                                   77E7F696 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructUnmarshall + 76                                   77E7F69E 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionAllocatePacket + 17                              77E80612 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransGetThreadEvent + 6                                         77E8061D 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransGetThreadEvent + C                                         77E80623 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransGetThreadEvent + 30                                        77E80647 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransGetThreadEvent + 3B                                        77E80652 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransGetThreadEvent + 56                                        77E8066D 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingServerFromClient + C                                       77E82058 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingServerFromClient + 12                                      77E8205E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingServerFromClient + 1F                                      77E8206B 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingServerFromClient + 31                                      77E8207D 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingServerFromClient + 3E                                      77E8208A 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMemorySize + 40                                       77E822F3 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMemorySize + 48                                       77E822FB 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMemorySize + 6B                                       77E8231E 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMemorySize + A2                                       77E82355 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleStructMemorySize + C5                                       77E82378 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetCancelTimeout + C                                          77E82742 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetCancelTimeout + 12                                         77E82748 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetCancelTimeout + 1F                                         77E82755 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetCancelTimeout + 2B                                         77E82761 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetCancelTimeout + 3F                                         77E82775 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMemorySize + E                                    77E82796 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMemorySize + 16                                   77E8279E 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMemorySize + 36                                   77E827BE 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMemorySize + 3A                                   77E827C2 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStringMemorySize + 62                                   77E827EA 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcMapWin32Status + 17                                             77E8292E 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcMapWin32Status + 22                                             77E82939 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcMapWin32Status + 31                                             77E82948 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcMapWin32Status + 35                                             77E8294C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcMapWin32Status + 37                                             77E8294E 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayFree + 9                                    77E82FEB 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayFree + 33                                   77E83015 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayFree + 3A                                   77E8301C 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayBufferSize + 23                             77E83044 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayBufferSize + 27                             77E83048 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayBufferSize + 64                             77E83085 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayBufferSize + 6F                             77E83090 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayBufferSize + 7A                             77E8309B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMarshall + 26                               77E83114 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMarshall + 2C                               77E8311A 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMarshall + 7C                               77E8316A 90 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMarshall + D7                               77E831C5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMarshall + D9                               77E831C7 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayUnmarshall + 2C                             77E831FE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayUnmarshall + 35                             77E83207 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayUnmarshall + 3B                             77E8320D 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayUnmarshall + 4E                             77E83220 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayUnmarshall + 57                             77E83229 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMemorySize + 20                             77E83430 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMemorySize + 28                             77E83438 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMemorySize + 2D                             77E8343D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMemorySize + 39                             77E83449 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingArrayMemorySize + 3D                             77E8344D 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMemorySize + 2A                                   77E835A7 111 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMemorySize + 9A                                   77E83617 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMemorySize + A2                                   77E8361F 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMemorySize + B3                                   77E83630 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructMemorySize + B7                                   77E83634 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionBufferSize + 3B                               77E83684 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionBufferSize + 41                               77E8368A 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionBufferSize + 9E                               77E836E7 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionBufferSize + A6                               77E836EF 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionBufferSize + BD                               77E83706 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMarshall + 3B                                 77E83796 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMarshall + 43                                 77E8379E 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMarshall + 8D                                 77E837E8 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMarshall + 92                                 77E837ED 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMarshall + 95                                 77E837F0 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionFree + 14                                     77E839A0 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionFree + 32                                     77E839BE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionFree + 38                                     77E839C4 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionFree + 52                                     77E839DE 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionFree + 5C                                     77E839E8 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionUnmarshall + 30                               77E83A86 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionUnmarshall + 3C                               77E83A92 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionUnmarshall + 4D                               77E83AA3 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionUnmarshall + 5B                               77E83AB1 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionUnmarshall + 64                               77E83ABA 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMemorySize + 2B                               77E83C2D 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMemorySize + 2F                               77E83C31 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMemorySize + 4C                               77E83C4E 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMemorySize + 84                               77E83C86 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonEncapsulatedUnionMemorySize + B0                               77E83CB2 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransServerNewConnection + 25                                   77E859EF 26 Bytes  [ FF, 50, C7, 85, DC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransServerNewConnection + 41                                   77E85A0B 4 Bytes  [ 89, B5, EC, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransServerNewConnection + 46                                   77E85A10 37 Bytes  [ FF, 89, B5, F0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransServerNewConnection + 6C                                   77E85A36 204 Bytes  [ 89, 37, EB, EE, 5C, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransServerNewConnection + 139                                  77E85B03 11 Bytes  [ C7, 45, D4, 09, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructBufferSize + 2B                                      77E8628D 131 Bytes  [ 41, F8, 89, 85, D8, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructBufferSize + AF                                      77E86311 120 Bytes  [ 00, 89, 95, 3C, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructBufferSize + 128                                     77E8638A 13 Bytes  [ 43, 10, 85, C0, 0F, 85, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructBufferSize + 136                                     77E86398 9 Bytes  [ 68, 40, E1, 97, 7C, E8, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructBufferSize + 140                                     77E863A2 50 Bytes  [ 83, 65, FC, 00, 8B, 33, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMarshall + 99                                        77E864F1 44 Bytes  [ FF, FF, FF, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMarshall + C6                                        77E8651E 9 Bytes  [ EC, 83, EC, 20, 53, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMarshall + D0                                        77E86528 17 Bytes  [ 08, 83, 4F, 04, FF, 89, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMarshall + E2                                        77E8653A 84 Bytes  [ 00, 00, 8B, 40, 30, 83, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMarshall + 137                                       77E8658F 60 Bytes  [ 84, 9C, 0C, 01, 00, 80, 3D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMemorySize + 50                                      77E867C1 74 Bytes  [ 57, 8B, 7D, 0C, 0F, B6, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMemorySize + 9B                                      77E8680C 116 Bytes  [ 65, EC, 00, 8D, 1C, CF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMemorySize + 111                                     77E86882 2 Bytes  [ C2, 60 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMemorySize + 115                                     77E86886 75 Bytes  [ 8B, 41, 40, 3B, 41, 44, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructMemorySize + 161                                     77E868D2 8 Bytes  [ C0, 75, 05, 39, 45, F8, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructUnmarshall + A                                       77E868F3 38 Bytes  [ 45, F8, 85, C0, 74, 0B, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructUnmarshall + 31                                      77E8691A 214 Bytes  [ 26, FD, FF, FF, EB, AE, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructUnmarshall + 108                                     77E869F1 7 Bytes  [ EB, 98, 50, E8, EE, D6, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructUnmarshall + 110                                     77E869F9 49 Bytes  JMP 77E86974 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructUnmarshall + 142                                     77E86A2B 193 Bytes  [ 3B, 5F, 14, 0F, 87, D5, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeUnmarshall                                              77E86AEE 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeUnmarshall + 4                                          77E86AF2 57 Bytes  [ FF, 55, 8B, EC, 8B, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeUnmarshall + 3E                                         77E86B2C 32 Bytes  [ 57, 8B, B9, 70, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrSimpleTypeUnmarshall + 5F                                         77E86B4D 181 Bytes  JMP BD71B357 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructFree + A0                                            77E86C03 78 Bytes  CALL 77E86BF2 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructFree + EF                                            77E86C52 19 Bytes  [ 4A, 08, 53, 8D, 98, 78, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructFree + 103                                           77E86C66 34 Bytes  [ 23, C1, 8B, 4E, 64, 8D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructFree + 126                                           77E86C89 101 Bytes  [ 8B, 4E, 60, 8B, C7, C1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexStructFree + 18C                                           77E86CEF 32 Bytes  [ BE, 81, 48, 0B, 91, 7C, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingIsClientLocal + C                                        77E87370 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingIsClientLocal + 12                                       77E87376 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingIsClientLocal + 1F                                       77E87383 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingIsClientLocal + 2E                                       77E87392 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingIsClientLocal + 3B                                       77E8739F 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExW + 17                                        77E87A3D 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExW + 39                                        77E87A5F 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExW + 40                                        77E87A66 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExW + 42                                        77E87A68 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExW + 51                                        77E87A77 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionFreePacket + 11                                  77E88725 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcLogEvent + 3                                                    77E8872D 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcLogEvent + 1B                                                   77E88745 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcLogEvent + 2A                                                   77E88754 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcLogEvent + 31                                                   77E8875B 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcLogEvent + 38                                                   77E88762 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayFree + C                                              77E88C25 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayFree + 12                                             77E88C2B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayFree + 1F                                             77E88C38 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayFree + 2B                                             77E88C44 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayFree + 34                                             77E88C4D 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMarshall + 31                                         77E89493 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMarshall + 3A                                         77E8949C 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMarshall + 72                                         77E894D4 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMarshall + AA                                         77E8950C 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMarshall + EB                                         77E8954D 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayBufferSize + 17                                       77E895C8 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayBufferSize + 1D                                       77E895CE 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayBufferSize + 52                                       77E89603 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayBufferSize + 5A                                       77E8960B 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayUnmarshall + 2D                                       77E89648 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayUnmarshall + 35                                       77E89650 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayUnmarshall + 41                                       77E8965C 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayUnmarshall + 63                                       77E8967E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayUnmarshall + 70                                       77E8968B 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMemorySize + 2F                                       77E8972E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMemorySize + 3E                                       77E8973D 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMemorySize + 69                                       77E89768 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMemorySize + 79                                       77E89778 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrComplexArrayMemorySize + 83                                       77E89782 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateStubFromTypeInfo + E                                           77E8A063 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateStubFromTypeInfo + 21                                          77E8A076 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateStubFromTypeInfo + 2C                                          77E8A081 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateStubFromTypeInfo + 40                                          77E8A095 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateStubFromTypeInfo + 49                                          77E8A09E 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleAllocate + 16                                                  77E8A4D3 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrOleAllocate + 1A                                                  77E8A4D7 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqObject + C                                              77E8A4F0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqObject + 12                                             77E8A4F6 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqObject + 1E                                             77E8A502 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqObject + 23                                             77E8A507 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqObject + 32                                             77E8A516 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqLocalClientPID + C                                    77E8A577 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqLocalClientPID + 12                                   77E8A57D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqLocalClientPID + 1E                                   77E8A589 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqLocalClientPID + 20                                   77E8A58B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqLocalClientPID + 23                                   77E8A58E 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetObject + C                                              77E8A7B2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetObject + 12                                             77E8A7B8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetObject + 18                                             77E8A7BE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetObject + 1A                                             77E8A7C0 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetObject + 27                                             77E8A7CD 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExW + C                                       77E8A8CA 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExW + 12                                      77E8A8D0 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExW + 1E                                      77E8A8DC 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExW + 23                                      77E8A8E1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExW + 32                                      77E8A8F0 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientW + 7                                         77E8A963 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientW + 22                                        77E8A97E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientW + 2A                                        77E8A986 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientW + 3C                                        77E8A998 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientW + 51                                        77E8A9AD 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSend + 12                                                       77E8AA48 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSend + 2D                                                       77E8AA63 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSend + 4B                                                       77E8AA81 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSend + 60                                                       77E8AA96 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncSetHandle + 10                                             77E8AAAB 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncSetHandle + 1F                                             77E8AABA 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncSetHandle + 38                                             77E8AAD3 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncSetHandle + 43                                             77E8AADE 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncSetHandle + 81                                             77E8AB1C 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcReceive + 12                                                    77E8B113 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcReceive + 38                                                    77E8B139 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcReceive + 44                                                    77E8B145 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcReceive + 4A                                                    77E8B14B 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcReceive + 58                                                    77E8B159 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheAllocate + 12                                             77E8B93B 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheAllocate + 2C                                             77E8B955 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheAllocate + 32                                             77E8B95B 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheAllocate + 39                                             77E8B962 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBCacheAllocate + 3D                                             77E8B966 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf2 + C                                             77E8D52E 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf2 + 12                                            77E8D534 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf2 + 4F                                            77E8D571 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf2 + 65                                            77E8D587 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf2 + 7F                                            77E8D5A1 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcRequestMutex + 15                                               77E8D98A 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcRequestMutex + 24                                               77E8D999 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcClearMutex + 1D                                                 77E8D9BB 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcClearMutex + 48                                                 77E8D9E6 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcClearMutex + 65                                                 77E8DA03 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcClearMutex + 79                                                 77E8DA17 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcClearMutex + 92                                                 77E8DA30 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2W + C                                        77E8DCDE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2W + 12                                       77E8DCE4 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2W + 1E                                       77E8DCF0 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2W + 42                                       77E8DD14 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2W + 5E                                       77E8DD30 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpExW + 16                                        77E8DD57 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpExW + 1F                                        77E8DD60 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpW + C                                           77E8DD71 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpW + 10                                          77E8DD75 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpW + 1E                                          77E8DD83 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpW + 30                                          77E8DD95 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpW + 46                                          77E8DDAB 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIfEx + C                                            77E8E04F 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIfEx + 12                                           77E8E055 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIfEx + 1C                                           77E8E05F 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIfEx + 43                                           77E8E086 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIfEx + 4F                                           77E8E092 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayFree + 9                                                77E8E1F2 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayFree + 1F                                               77E8E208 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayFree + 23                                               77E8E20C 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMarshall + 54                                           77E8E26A 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMarshall + 5B                                           77E8E271 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayUnmarshall + 27                                         77E8E2A6 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayUnmarshall + 45                                         77E8E2C4 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayUnmarshall + 4D                                         77E8E2CC 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayUnmarshall + 51                                         77E8E2D0 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayUnmarshall + 5D                                         77E8E2DC 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateProxyFromTypeInfo + B                                          77E8EA34 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateProxyFromTypeInfo + 11                                         77E8EA3A 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateProxyFromTypeInfo + 25                                         77E8EA4E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateProxyFromTypeInfo + 2F                                         77E8EA58 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!CreateProxyFromTypeInfo + 43                                         77E8EA6C 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalFree + 3E                                              77E8EC2A 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetUserMarshalInfo + 18                                           77E8EC58 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetUserMarshalInfo + 1C                                           77E8EC5C 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetUserMarshalInfo + 27                                           77E8EC67 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetUserMarshalInfo + 87                                           77E8ECC7 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetUserMarshalInfo + A0                                           77E8ECE0 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalBufferSize + 2F                                        77E8ED30 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalBufferSize + 3A                                        77E8ED3B 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalBufferSize + 59                                        77E8ED5A 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalBufferSize + 67                                        77E8ED68 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalBufferSize + 71                                        77E8ED72 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMarshall + 34                                          77E8EE1C 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMarshall + 3F                                          77E8EE27 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMarshall + 41                                          77E8EE29 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMarshall + 57                                          77E8EE3F 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMarshall + 62                                          77E8EE4A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalUnmarshall + 34                                        77E8EF2E 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalUnmarshall + 4A                                        77E8EF44 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalUnmarshall + 55                                        77E8EF4F 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalUnmarshall + 69                                        77E8EF63 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalUnmarshall + 74                                        77E8EF6E 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetOption + C                                              77E8FB3B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetOption + 12                                             77E8FB41 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetOption + 1C                                             77E8FB4B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetOption + 22                                             77E8FB51 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetOption + 24                                             77E8FB53 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesHandleFree + 13                                                   77E901F3 37 Bytes  [ FF, C9, C3, 83, 8D, F8, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesHandleFree + 39                                                   77E90219 5 Bytes  [ 00, 09, B5, F8, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesHandleFree + 40                                                   77E90220 17 Bytes  JMP 77E90905 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesHandleFree + 52                                                   77E90232 33 Bytes  [ 8B, 40, FC, 85, C0, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesHandleFree + 75                                                   77E90255 23 Bytes  [ 83, 85, F4, FB, FF, FF, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesBufferHandleReset + 5D                                            77E90381 16 Bytes  [ 00, FF, 35, 10, E2, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesBufferHandleReset + 6E                                            77E90392 30 Bytes  [ FF, FF, 50, 8D, 85, FC, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesBufferHandleReset + 8D                                            77E903B1 10 Bytes  [ 01, 00, 89, B5, C0, FB, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesBufferHandleReset + 98                                            77E903BC 37 Bytes  [ 01, 00, 8B, 8D, F4, FB, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesBufferHandleReset + BF                                            77E903E3 44 Bytes  [ A1, F8, 0E, 98, 7C, 89, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeFixedBufferHandleCreate + 1D                                77E90519 17 Bytes  [ D0, FB, FF, FF, 30, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeFixedBufferHandleCreate + 2F                                77E9052B 5 Bytes  [ FF, E9, 84, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeFixedBufferHandleCreate + 35                                77E90531 6 Bytes  [ F6, 85, F8, FB, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeFixedBufferHandleCreate + 3C                                77E90538 20 Bytes  [ C7, 85, EC, FB, FF, FF, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeFixedBufferHandleCreate + 52                                77E9054E 24 Bytes  JMP 77E906B4 C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode2 + 6                                                77E9060E 32 Bytes  [ 54, 01, 00, 00, FF, B5, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode2 + 27                                               77E9062F 41 Bytes  [ B8, 91, 7C, 22, B9, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode2 + 52                                               77E9065A 14 Bytes  CALL 936D15C8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode2 + 61                                               77E90669 15 Bytes  [ FE, FF, FF, 48, 0F, 84, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode2 + 72                                               77E9067A 18 Bytes  CALL A06D1582 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize2 + 2                                             77E90699 37 Bytes  [ FF, 27, 00, 00, 00, F6, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize2 + 29                                            77E906C0 6 Bytes  [ 85, DE, 0F, 85, F6, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize2 + 31                                            77E906C8 5 Bytes  [ 83, 85, F4, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize2 + 37                                            77E906CE 15 Bytes  [ 04, F6, C3, 20, 8B, 85, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize2 + 47                                            77E906DE 41 Bytes  [ F6, C3, 40, 8B, 40, FC, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize + 25                                             77E90708 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize + 27                                             77E9070A 64 Bytes  [ 0F, 8D, D3, 53, 00, 00, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize + 68                                             77E9074B 32 Bytes  [ BD, C0, FB, FF, FF, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeAlignSize + 89                                             77E9076C 56 Bytes  [ 2B, 9D, E0, FB, FF, FF, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode + 9                                                 77E907A5 29 Bytes  [ 59, 74, 1B, F6, 85, F8, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode + 27                                                77E907C3 5 Bytes  [ 83, BD, D8, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode + 2D                                                77E907C9 35 Bytes  [ 00, 0F, 85, BE, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode + 51                                                77E907ED 3 Bytes  [ E2, 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeEncode + 55                                                77E907F1 14 Bytes  [ 8D, C4, FB, FF, FF, 8D, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesDecodeBufferHandleCreate + 26                                     77E90949 24 Bytes  [ 89, 85, D8, FB, FF, FF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesDecodeBufferHandleCreate + 3F                                     77E90962 17 Bytes  [ F0, 8B, D9, 74, 0A, 83, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesDecodeBufferHandleCreate + 51                                     77E90974 12 Bytes  [ 00, 7E, 18, FF, 4D, 08, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesDecodeBufferHandleCreate + 5E                                     77E90981 22 Bytes  CALL 77E90997 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesDecodeBufferHandleCreate + 75                                     77E90998 13 Bytes  [ 8B, FF, 55, 8B, EC, F6, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode + A                                                 77E909A6 10 Bytes  [ 00, 74, 15, 50, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode + 15                                                77E909B1 114 Bytes  [ 00, 66, 83, F8, FF, 59, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode + 88                                                77E90A24 77 Bytes  JMP 77E9077D C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode + D6                                                77E90A72 48 Bytes  [ 45, E0, C6, 00, 00, FF, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode2 + C                                                77E90AA4 42 Bytes  JMP 77E90835 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode2 + 37                                               77E90ACF 36 Bytes  [ 8B, 40, FC, 89, 85, E8, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode2 + 5D                                               77E90AF5 17 Bytes  JMP 77E90737 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode2 + 6F                                               77E90B07 19 Bytes  [ 0F, 84, E3, 06, 00, 00, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesTypeDecode2 + 84                                               77E90B1C 10 Bytes  [ FF, 50, 8D, 45, C4, 50, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetServerStackSize + 49                                       77E90FD8 56 Bytes  [ 89, 45, E4, 85, C0, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetServerStackSize + 82                                       77E91011 118 Bytes  CALL 77E85342 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetServerStackSize + F9                                       77E91088 139 Bytes  [ 00, 00, 00, 00, 95, C0, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetServerStackSize + 185                                      77E91114 142 Bytes  [ 00, 8B, D1, C1, EA, 03, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetServerStackSize + 214                                      77E911A3 40 Bytes  [ 00, 00, 8B, 45, E0, 89, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreateSequential + 18                                            77E926AB 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreateSequential + 2C                                            77E926BF 130 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreateSequential + AF                                            77E92742 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreateSequential + C2                                            77E92755 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCreateSequential + CE                                            77E92761 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryPointer + 11                                      77E933D8 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryPointer + 1D                                      77E933E4 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryPointer + 36                                      77E933FD 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryPointer + 45                                      77E9340C 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryPointer + 59                                      77E93420 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatInit + 1B                                          77E934A1 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatInit + 26                                          77E934AC 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatInit + 28                                          77E934AE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatInit + 2B                                          77E934B1 151 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerXlatInit + C5                                          77E9354B 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerConstruct + 21                                                  77E93C11 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerConstruct + 58                                                  77E93C48 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerConstruct + 6F                                                  77E93C5F 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerConstruct + 7B                                                  77E93C6B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerConstruct + 81                                                  77E93C71 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetComTimeout + C                                             77E93DD0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetComTimeout + 12                                            77E93DD6 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetComTimeout + 18                                            77E93DDC 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetComTimeout + 1A                                            77E93DDE 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetComTimeout + 27                                            77E93DEB 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerCheckClientRestriction + C                                77E93EE2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerCheckClientRestriction + 12                               77E93EE8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerCheckClientRestriction + 18                               77E93EEE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerCheckClientRestriction + 1B                               77E93EF1 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerCheckClientRestriction + 2A                               77E93F00 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerExplode + 12                                                    77E93FC5 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerExplode + 24                                                    77E93FD7 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerExplode + 39                                                    77E93FEC 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerExplode + 43                                                    77E93FF6 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!TowerExplode + 50                                                    77E94003 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryRefId + 19                                        77E94218 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryRefId + 2C                                        77E9422B 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryRefId + 35                                        77E94234 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryRefId + 5E                                        77E9425D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerQueryRefId + 6C                                        77E9426B 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerFree + 11                                              77E9428E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerFree + 1D                                              77E9429A 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerFree + 36                                              77E942B3 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerFree + 3F                                              77E942BC 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerFree + 4B                                              77E942C8 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerInsertRefId + 13                                       77E94307 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerInsertRefId + 33                                       77E94327 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerInsertRefId + 3A                                       77E9432E 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerInsertRefId + 5D                                       77E94351 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFullPointerInsertRefId + 8E                                       77E94382 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoW + C                                       77E94614 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoW + 12                                      77E9461A 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoW + 39                                      77E94641 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoW + 4D                                      77E94655 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoW + 6C                                      77E94674 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqBindings + C                                             77E94751 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqBindings + 12                                            77E94757 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqBindings + 18                                            77E9475D 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqBindings + 24                                            77E94769 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqBindings + 28                                            77E9476D 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingVectorFree + D                                             77E948E7 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingVectorFree + 13                                            77E948ED 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingVectorFree + 17                                            77E948F1 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingVectorFree + 2B                                            77E94905 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingVectorFree + 4C                                            77E94926 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMapCommAndFaultStatus + 18                                        77E94A29 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMapCommAndFaultStatus + 3B                                        77E94A4C 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMapCommAndFaultStatus + 46                                        77E94A57 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMapCommAndFaultStatus + 53                                        77E94A64 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMapCommAndFaultStatus + 56                                        77E94A67 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcIfInqId + C                                                       77E94AEE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcIfInqId + 12                                                      77E94AF4 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcIfInqId + 3B                                                      77E94B1D 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcIfInqTransferSyntaxes + 16                                      77E94B3E 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcIfInqTransferSyntaxes + 3F                                      77E94B67 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointW + C                                  77E94B78 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointW + 12                                 77E94B7E 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointW + 19                                 77E94B85 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointW + 1B                                 77E94B87 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointW + 2A                                 77E94B96 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingA + B                                       77E94BBB 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingA + 22                                      77E94BD2 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingA + 2A                                      77E94BDA 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingA + 34                                      77E94BE4 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingToStringBindingA + 38                                      77E94BE8 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringBufferSize + 26                                77E94C95 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringBufferSize + 2E                                77E94C9D 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringBufferSize + 53                                77E94CC2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringBufferSize + 5B                                77E94CCA 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringBufferSize + 64                                77E94CD3 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMarshall + 24                                  77E94D05 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMarshall + 2C                                  77E94D0D 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMarshall + 44                                  77E94D25 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMarshall + 73                                  77E94D54 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMemorySize + 25                                77E94D7E 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMemorySize + 2B                                77E94D84 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMemorySize + 49                                77E94DA2 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMemorySize + 55                                77E94DAE 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringMemorySize + 5C                                77E94DB5 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringUnmarshall + 23                                77E94E17 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringUnmarshall + 2B                                77E94E1F 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringUnmarshall + 5B                                77E94E4F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringUnmarshall + 64                                77E94E58 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNonConformantStringUnmarshall + 85                                77E94E79 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterA + 2E                                                  77E94F1C 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterA + 4A                                                  77E94F38 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterA + 4E                                                  77E94F3C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterA + 54                                                  77E94F42 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterA + 5C                                                  77E94F4A 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseA + 38                                          77E95418 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseA + 5F                                          77E9543F 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseA + 86                                          77E95466 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseA + 91                                          77E95471 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingParseA + 9E                                          77E9547E 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingToStaticStringBindingW + C                               77E956BC 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingToStaticStringBindingW + 12                              77E956C2 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingToStaticStringBindingW + 19                              77E956C9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingToStaticStringBindingW + 1B                              77E956CB 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingToStaticStringBindingW + 2A                              77E956DA 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2W + C                                          77E9584D 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2W + 12                                         77E95853 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2W + 1F                                         77E95860 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2W + 31                                         77E95872 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2W + 42                                         77E95883 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoA + 10                                      77E95EEA 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoA + 4D                                      77E95F27 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoA + 65                                      77E95F3F 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoA + 7D                                      77E95F57 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterAuthInfoA + 99                                      77E95F73 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqDefaultPrincNameW + 38                                   77E9626C 20 Bytes  [ 89, 7A, 04, 0B, FF, 74, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqDefaultPrincNameW + 4D                                   77E96281 222 Bytes  [ 00, 76, 05, B9, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqDefaultPrincNameW + 12C                                  77E96360 7 Bytes  [ 83, 3D, AC, E0, 97, 7C, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqDefaultPrincNameW + 135                                  77E96369 1 Byte  [ 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqDefaultPrincNameW + 137                                  77E9636B 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterW + 56                                                  77E969F4 22 Bytes  [ 7C, 66, 0F, 28, C8, 66, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqW + 15                                            77E96A0B 12 Bytes  [ 1B, 90, 7C, 66, 0F, FA, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqW + 22                                            77E96A18 1 Byte  [ 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqW + 24                                            77E96A1A 4 Bytes  [ 00, 74, 4C, 3D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqW + 29                                            77E96A1F 28 Bytes  [ 0B, 00, 00, 7C, 7D, 66, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqW + 46                                            77E96A3C 34 Bytes  [ 2E, FF, 7B, 24, BA, EC, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExW + 11                                          77E96A5F 1 Byte  [ 07 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExW + 13                                          77E96A61 47 Bytes  [ 83, C4, 10, DD, 44, 24, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExW + 43                                          77E96A91 36 Bytes  [ 7C, F2, 0F, 58, C8, 66, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExW + 68                                          77E96AB6 14 Bytes  [ 1A, 90, 7C, 66, 0F, D6, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExW + 79                                          77E96AC7 12 Bytes  [ 90, 90, 90, 90, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpExA + 16                                        77E978C5 25 Bytes  [ 01, 01, 81, 74, DE, 84, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2A + C                                        77E978DF 33 Bytes  [ FF, 75, C6, 89, 17, EB, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseqEp2A + 2E                                       77E97901 167 Bytes  [ 33, C0, 49, 74, 0A, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidToStringW + 1B                                                   77E979A9 30 Bytes  [ 74, 07, 46, 0F, A3, 04, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidToStringW + 3A                                                   77E979C8 9 Bytes  [ 00, 00, 83, C4, 0C, C3, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidToStringW + 44                                                   77E979D2 173 Bytes  CALL 77EA3276 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqEpA + 75                                          77E97A80 100 Bytes  [ CB, F0, 0F, C7, 4D, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfW + 2C                                          77E97AE6 63 Bytes  [ 01, 00, 03, 4C, 24, 10, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExW + 37                                        77E97B26 227 Bytes  [ A4, 24, 00, 00, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExW + 11B                                       77E97C0A 8 Bytes  [ 00, 8D, A4, 24, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExW + 124                                       77E97C13 19 Bytes  [ 56, 57, 8B, 4C, 24, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExW + 138                                       77E97C27 22 Bytes  [ 89, 06, 8B, 44, 24, 18, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExW + 152                                       77E97C41 23 Bytes  [ 8B, FF, 57, 8B, 7C, 24, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEnableIdleCleanup + 37                                        77E980AA 12 Bytes  [ 55, 8B, EC, 83, EC, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEnableIdleCleanup + 44                                        77E980B7 14 Bytes  [ 00, 00, 80, 74, 0A, F7, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEnableIdleCleanup + 53                                        77E980C6 19 Bytes  [ 8B, 45, 10, F7, 65, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtIsServerListening + 3                                         77E980DA 89 Bytes  [ F4, 8B, 45, 14, F7, 65, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtIsServerListening + 5D                                        77E98134 68 Bytes  [ 5D, C2, 14, 00, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIf + C                                        77E98179 41 Bytes  [ 00, 80, 74, 07, F7, D8, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIfEx + 4                                      77E981A3 26 Bytes  [ 54, 24, 08, 0F, A5, C2, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIfEx + 1F                                     77E981BE 97 Bytes  [ 83, E1, 3F, 83, F9, 20, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIfEx + 81                                     77E98220 30 Bytes  [ 8B, FF, 8B, 44, 24, 04, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIfEx + A0                                     77E9823F 33 Bytes  [ 44, 24, 04, 33, D2, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsIfEx + C3                                     77E98262 3 Bytes  [ 74, 24, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerSetAddressChangeFn + 13                                   77E98BB4 43 Bytes  [ FD, 20, 03, 00, 43, 2B, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSystemFunction001 + 27                                          77E98BE0 23 Bytes  [ 89, 81, 03, 00, 5E, 99, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSystemFunction001 + 3F                                          77E98BF8 47 Bytes  [ 06, DA, 05, 00, C9, D8, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSystemFunction001 + 6F                                          77E98C28 47 Bytes  [ 62, 36, 02, 00, 2E, 55, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSystemFunction001 + 9F                                          77E98C58 24 Bytes  [ EE, F3, 05, 00, 4A, 8B, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSystemFunction001 + B8                                          77E98C71 21 Bytes  [ 33, 01, 00, 59, A7, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerRegisterForwardFunction + C                               77E98C87 4 Bytes  [ 00, 31, 18, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerRegisterForwardFunction + 11                              77E98C8C 74 Bytes  [ FF, 3C, 06, 00, E2, 06, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerRegisterForwardFunction + 5C                              77E98CD7 12 Bytes  [ 00, D3, 2B, 00, 00, 43, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerRegisterForwardFunction + 69                              77E98CE4 27 Bytes  [ DC, 7D, 02, 00, 09, 4E, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerRegisterForwardFunction + 86                              77E98D01 54 Bytes  [ 01, 06, 00, 81, FD, 05, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqAddressChangeFn + 1A                                   77E991E8 15 Bytes  [ 96, FC, 01, 00, C7, E0, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqAddressChangeFn + 2A                                   77E991F8 31 Bytes  [ 21, EC, 02, 00, A4, 79, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqAddressChangeFn + 4A                                   77E99218 22 Bytes  [ 70, F4, 05, 00, 4B, F4, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqAddressChangeFn + 61                                   77E9922F 20 Bytes  [ 00, 7E, CE, 00, 00, 8E, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqAddressChangeFn + 76                                   77E99244 15 Bytes  [ CE, CE, 00, 00, DE, CE, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate + 1C                                      77E9A1F4 7 Bytes  [ 79, 98, 00, 00, 92, 98, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate + 24                                      77E9A1FC 43 Bytes  [ A3, 98, 00, 00, C0, 98, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate + 50                                      77E9A228 19 Bytes  [ C7, 99, 00, 00, E1, 99, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate + 64                                      77E9A23C 90 Bytes  [ 37, 9A, 00, 00, 4E, 9A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate + BF                                      77E9A297 8 Bytes  [ 00, 32, 9C, 00, 00, 49, 9C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetDcomProtocolVersion + D                                        77E9A5C7 7 Bytes  [ 00, 39, AF, 00, 00, 56, AF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetDcomProtocolVersion + 15                                       77E9A5CF 4 Bytes  [ 00, 71, AF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetDcomProtocolVersion + 1A                                       77E9A5D4 3 Bytes  [ 8E, AF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetDcomProtocolVersion + 1E                                       77E9A5D8 62 Bytes  [ B1, AF, 00, 00, CB, AF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrGetDcomProtocolVersion + 5D                                       77E9A617 11 Bytes  [ 00, 28, B1, 00, 00, 4A, B1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingA + 10                                    77E9A870 54 Bytes  [ CE, BC, 00, 00, E0, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingFromStringBindingA + 47                                    77E9A8A7 24 Bytes  [ 00, C8, BD, 00, 00, D6, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeA + 14                                        77E9A8C0 44 Bytes  [ 35, BE, 00, 00, 42, BE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeA + 41                                        77E9A8ED 5 Bytes  [ BF, 00, 00, 1E, BF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeA + 47                                        77E9A8F3 7 Bytes  [ 00, 34, BF, 00, 00, 47, BF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeA + 50                                        77E9A8FC 50 Bytes  [ 5F, BF, 00, 00, 74, BF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcStringBindingComposeA + 83                                        77E9A92F 3 Bytes  [ 00, 82, C0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2A + 102                                        77E9B3CE 104 Bytes  [ 45, 03, 44, 03, 46, 03, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2A + 16B                                        77E9B437 620 Bytes  [ 03, 78, 03, 79, 03, 7A, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2A + 3D8                                        77E9B6A4 296 Bytes  [ AE, 04, AF, 04, B0, 04, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2A + 501                                        77E9B7CD 264 Bytes  [ 43, 73, 72, 43, 61, 70, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerUseProtseq2A + 60A                                        77E9B8D6 50 Bytes  [ 43, 73, 72, 53, 65, 74, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeFormatString + 29                                     77E9C094 96 Bytes  [ 4E, 74, 43, 6C, 65, 61, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeFormatString + 8A                                     77E9C0F5 38 Bytes  [ 4E, 74, 43, 6F, 6D, 70, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeFormatString + B1                                     77E9C11C 57 Bytes  [ 4E, 74, 43, 72, 65, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeFormatString + EB                                     77E9C156 17 Bytes  [ 4E, 74, 43, 72, 65, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeFormatString + FD                                     77E9C168 33 Bytes  [ 4E, 74, 43, 72, 65, 61, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpGetTypeFormatString + 1F                                         77E9D86E 24 Bytes  [ 52, 74, 6C, 41, 72, 65, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpGetTypeGenCookie + 14                                            77E9D887 230 Bytes  [ 52, 74, 6C, 41, 72, 65, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeGenCookie + 19                                        77E9D96E 363 Bytes  [ 52, 74, 6C, 43, 6C, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeGenCookie + 185                                       77E9DADA 128 Bytes  [ 56, 61, 72, 69, 61, 6E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeGenCookie + 206                                       77E9DB5B 69 Bytes  [ 52, 74, 6C, 43, 6F, 6E, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeGenCookie + 24C                                       77E9DBA1 61 Bytes  [ 52, 74, 6C, 43, 6F, 70, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpReleaseTypeGenCookie + 28A                                       77E9DBDF 120 Bytes  [ 4F, 66, 50, 72, 6F, 63, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExW + 13                                        77E9EB80 93 Bytes  [ 52, 74, 6C, 49, 6D, 61, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExW + 71                                        77E9EBDE 83 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingCopy + 12                                                  77E9EC32 85 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingCopy + 68                                                  77E9EC88 72 Bytes  [ 78, 74, 00, 52, 74, 6C, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingCopy + B1                                                  77E9ECD1 79 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingCopy + 101                                                 77E9ED21 269 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingCopy + 20F                                                 77E9EE2F 33 Bytes  [ 65, 72, 6C, 6F, 63, 6B, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientA + 1C                                        77E9EF40 73 Bytes  [ 52, 74, 6C, 49, 70, 76, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExA + 3F                                      77E9EF8A 25 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExA + 59                                      77E9EFA4 149 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExA + EF                                      77E9F03A 156 Bytes  [ 52, 74, 6C, 49, 73, 41, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExA + 18C                                     77E9F0D7 90 Bytes  [ 65, 00, 52, 74, 6C, 49, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthClientExA + 1E7                                     77E9F132 48 Bytes  [ 52, 74, 6C, 4C, 61, 72, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoW + 7                                           77E9F4E4 4 Bytes  [ 52, 74, 6C, 4E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoW + C                                           77E9F4E9 230 Bytes  [ 6D, 62, 65, 72, 4F, 66, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrByteCountPointerBufferSize + 12                                   77E9F5D0 535 Bytes  [ 52, 74, 6C, 50, 75, 73, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerListen + 73                                                 77E9F7E8 9 Bytes  [ 52, 74, 6C, 52, 61, 6E, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerListen + 7D                                                 77E9F7F2 172 Bytes  [ 52, 74, 6C, 52, 61, 6E, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf + 39                                             77E9F89F 48 Bytes  [ 6C, 52, 65, 6C, 65, 61, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf + 6A                                             77E9F8D0 17 Bytes  [ 52, 74, 6C, 52, 65, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf + 7C                                             77E9F8E2 18 Bytes  [ 52, 74, 6C, 52, 65, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf + 8F                                             77E9F8F5 13 Bytes  [ 52, 74, 6C, 52, 65, 6D, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerRegisterIf + 9D                                             77E9F903 57 Bytes  [ 52, 74, 6C, 52, 65, 6D, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSsDefaultAllocate + 3                                          77EA0170 71 Bytes  [ 6E, 69, 63, 6F, 64, 65, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSsDefaultAllocate + 4B                                         77EA01B8 288 Bytes  [ 6C, 55, 70, 70, 65, 72, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSsDefaultAllocate + 16C                                        77EA02D9 221 Bytes  [ 52, 74, 6C, 5A, 65, 72, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSsDefaultAllocate + 24A                                        77EA03B7 125 Bytes  [ 52, 74, 6C, 70, 4E, 74, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRaiseException + 4F                                               77EA0435 27 Bytes  [ 52, 74, 6C, 78, 55, 6E, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRaiseException + 6B                                               77EA0451 26 Bytes  [ 52, 74, 6C, 78, 55, 6E, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRaiseException + 86                                               77EA046C 80 Bytes  [ 56, 65, 72, 53, 65, 74, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRaiseException + D7                                               77EA04BD 265 Bytes  [ 5A, 77, 41, 63, 63, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcRaiseException + 1E1                                              77EA05C7 277 Bytes  [ 5A, 77, 41, 6C, 65, 72, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcExceptionFilter + 84                                            77EA095D 114 Bytes  [ 5A, 77, 44, 65, 6C, 65, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcExceptionFilter + F7                                            77EA09D0 40 Bytes  [ 5A, 77, 45, 6E, 75, 6D, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcExceptionFilter + 120                                           77EA09F9 36 Bytes  [ 6E, 75, 6D, 65, 72, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcExceptionFilter + 145                                           77EA0A1E 11 Bytes  [ 6E, 75, 6D, 65, 72, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcExceptionFilter + 151                                           77EA0A2A 88 Bytes  [ 65, 4B, 65, 79, 00, 5A, 77, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockExclusive + 3B                                       77EA0C34 37 Bytes  [ 5A, 77, 4C, 6F, 63, 6B, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockExclusive + 61                                       77EA0C5A 161 Bytes  [ 5A, 77, 4D, 61, 6B, 65, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockExclusive + 103                                      77EA0CFC 140 Bytes  [ 5A, 77, 4E, 6F, 74, 69, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockExclusive + 190                                      77EA0D89 9 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockExclusive + 19A                                      77EA0D93 29 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidEqual + E                                                        77EA1426 130 Bytes  [ 5A, 77, 52, 65, 71, 75, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidEqual + 91                                                       77EA14A9 241 Bytes  [ 5A, 77, 53, 61, 76, 65, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidEqual + 183                                                      77EA159B 72 Bytes  [ 5A, 77, 53, 65, 74, 48, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidEqual + 1CC                                                      77EA15E4 158 Bytes  [ 5A, 77, 53, 65, 74, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidEqual + 26B                                                      77EA1683 175 Bytes  [ 5A, 77, 53, 65, 74, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUnregisterIf + 29                                           77EA1733 277 Bytes  [ 65, 74, 53, 79, 73, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUnregisterIf + 13F                                          77EA1849 136 Bytes  [ 5A, 77, 53, 75, 73, 70, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsDestroyClientContext + 21                                       77EA18D2 58 Bytes  [ 5A, 77, 54, 72, 61, 6E, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsDestroyClientContext + 5C                                       77EA190D 196 Bytes  [ 78, 00, 5A, 77, 55, 6E, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsDestroyClientContext + 121                                      77EA19D2 11 Bytes  [ 5A, 77, 57, 72, 69, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsDestroyClientContext + 12D                                      77EA19DE 215 Bytes  [ 5A, 77, 57, 72, 69, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsDestroyClientContext + 205                                      77EA1AB6 56 Bytes  [ 6F, 69, 36, 34, 00, 5F, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMemorySize                                         77EA2CFE 30 Bytes  [ B8, EA, 00, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMemorySize + 1F                                    77EA2D1D 7 Bytes  [ 90, B8, EC, 00, 00, 00, BA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMemorySize + 27                                    77EA2D25 39 Bytes  [ 03, FE, 7F, FF, 12, C2, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMemorySize + 4F                                    77EA2D4D 35 Bytes  [ 90, B8, EF, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantArrayMemorySize + 73                                    77EA2D71 105 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRangeUnmarshall + 54                                              77EA2E65 15 Bytes  [ 03, FE, 7F, FF, 12, C2, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRangeUnmarshall + 64                                              77EA2E75 69 Bytes  [ 03, FE, 7F, FF, 12, C2, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRangeUnmarshall + AC                                              77EA2EBD 53 Bytes  [ 90, B8, 06, 01, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRangeUnmarshall + E2                                              77EA2EF3 46 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRangeUnmarshall + 111                                             77EA2F22 34 Bytes  [ 00, BA, 00, 03, FE, 7F, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructFree + 41                                         77EA389D 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructFree + 47                                         77EA38A3 96 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructFree + A9                                         77EA3905 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructFree + AE                                         77EA390A 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantStructFree + C7                                         77EA3923 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionReallocPacket + 4E                               77EA3A30 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionReallocPacket + 62                               77EA3A44 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionReallocPacket + 73                               77EA3A55 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionReallocPacket + 79                               77EA3A5B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransConnectionReallocPacket + 7F                               77EA3A61 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayFree + 9                                              77EA3ED8 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayFree + 1B                                             77EA3EEA 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayFree + 30                                             77EA3EFF 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayFree + 36                                             77EA3F05 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayBufferSize + 3A                                       77EA3F44 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayBufferSize + 45                                       77EA3F4F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayBufferSize + 4F                                       77EA3F59 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayBufferSize + 88                                       77EA3F92 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayBufferSize + 8E                                       77EA3F98 177 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMarshall + 9F                                         77EA404A 55 Bytes  [ 0F, 85, 68, 1D, 02, 00, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayUnmarshall + 25                                       77EA4082 8 Bytes  CALL 77E8540D C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayUnmarshall + 2E                                       77EA408B 8 Bytes  [ 00, 00, 8B, 40, 30, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayUnmarshall + 37                                       77EA4094 10 Bytes  [ 70, 48, 3B, F3, 0F, 84, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayUnmarshall + 42                                       77EA409F 213 Bytes  [ 5D, FC, C7, 45, FC, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayUnmarshall + 119                                      77EA4176 38 Bytes  [ C0, 0F, 85, 8C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMemorySize + 2                                        77EA41FA 121 Bytes  CALL 77E84F2B C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMemorySize + 7C                                       77EA4274 151 Bytes  [ EC, 56, 8B, 75, 0C, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMemorySize + 115                                      77EA430D 54 Bytes  [ C0, 0F, 84, F1, DB, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMemorySize + 14C                                      77EA4344 179 Bytes  [ 04, 31, 83, 46, 0C, 02, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrVaryingArrayMemorySize + 200                                      77EA43F8 31 Bytes  [ 75, FC, 39, 35, 5C, E2, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtWaitServerListen + 29                                         77EA4873 36 Bytes  [ 3B, FB, 76, 40, 03, 5D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtWaitServerListen + 4E                                         77EA4898 41 Bytes  [ 55, 14, 83, C4, 08, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStopServerListening + 23                                      77EA48C2 9 Bytes  [ CB, 57, 53, FF, 55, 14, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStopServerListening + 2E                                      77EA48CD 2 Bytes  [ 7F, BF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStopServerListening + 31                                      77EA48D0 174 Bytes  [ E6, 03, 75, 10, 3B, FE, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStopServerListening + E0                                      77EA497F 53 Bytes  JMP 77E94BEA C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtStopServerListening + 116                                     77EA49B5 9 Bytes  [ 49, 04, 8D, 4C, 41, FE, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMemorySize + 59                                        77EA4A99 18 Bytes  [ 00, 3B, C7, 89, 45, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalMemorySize + 6C                                        77EA4AAC 113 Bytes  [ 00, 00, 40, 8D, 45, DC, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMemorySize + 24                                         77EA4B1E 46 Bytes  [ 00, 00, 33, D2, 3B, C2, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMemorySize + 53                                         77EA4B4D 49 Bytes  [ 6A, 01, 8D, 45, E4, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMemorySize + 85                                         77EA4B7F 32 Bytes  [ 75, 18, 8D, 45, F8, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMemorySize + A6                                         77EA4BA0 33 Bytes  [ 85, C0, 0F, 8C, 30, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrFixedArrayMemorySize + C9                                         77EA4BC3 29 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorStartEnumeration + C                                         77EA4D19 91 Bytes  [ FF, 55, 8B, EC, 81, EC, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorStartEnumeration + 68                                        77EA4D75 19 Bytes  CALL DEEA4D77 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorStartEnumeration + 7C                                        77EA4D89 4 Bytes  [ 84, 38, D0, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorStartEnumeration + 81                                        77EA4D8E 28 Bytes  [ FF, 34, B5, 08, DA, 92, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorStartEnumeration + 9E                                        77EA4DAB 202 Bytes  [ 68, 38, FE, 92, 7C, 8D, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!GlobalMutexClearExternal + 21                                        77EB58D7 159 Bytes  [ 8D, 45, 88, 50, 8D, 45, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!GlobalMutexClearExternal + C1                                        77EB5977 2 Bytes  [ 40, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!GlobalMutexClearExternal + C4                                        77EB597A 97 Bytes  [ 40, 64, 48, C1, E0, 0A, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!GlobalMutexClearExternal + 126                                       77EB59DC 29 Bytes  [ 85, C0, 89, 45, 08, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!GlobalMutexClearExternal + 144                                       77EB59FA 8 Bytes  [ F8, 33, DB, 3B, FB, 0F, 8C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcNsInterfaceExported + 1F                                        77EB64A6 351 Bytes  [ 83, F9, 20, 72, 0B, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqComTimeout + 44                                            77EB6606 43 Bytes  CALL 77EB7146 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcConnectionInqSockBuffSize + 2A                                  77EB6632 114 Bytes  CALL 77EB9CC6 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcPauseExecution + 16                                             77EB66A5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcPauseExecution + 18                                             77EB66A7 2 Bytes  [ 7D, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcPauseExecution + 1B                                             77EB66AA 37 Bytes  CALL A85366B0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncAbortCall + 1C                                             77EB66D0 14 Bytes  [ 5E, FF, FF, FF, 08, 02, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcAsyncAbortCall + 2B                                             77EB66DF 41 Bytes  [ FF, FF, 50, 8D, 85, 5C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpResolveBinding + 2                                              77EB6709 17 Bytes  CALL 77E96293 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpResolveBinding + 14                                             77EB671B 6 Bytes  [ 10, FF, FF, FF, 8D, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpResolveBinding + 1B                                             77EB6722 44 Bytes  [ FF, FF, FF, 50, 6A, 03, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNsBindingInqEntryNameW + 2                                        77EB674F 45 Bytes  CALL 77EA256E C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNsBindingInqEntryNameW + 30                                       77EB677D 5 Bytes  [ FF, 89, 85, 10, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNsBindingInqEntryNameW + 36                                       77EB6783 59 Bytes  [ FF, 8D, 85, 08, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcNsBindingSetEntryNameW + 1F                                     77EB67BF 92 Bytes  [ 56, 68, 40, F4, 97, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqSecurityContext + 36                                  77EB681C 91 Bytes  [ 47, 34, A3, 04, 00, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingReset + 3A                                                 77EB6878 5 Bytes  [ 8B, 43, 0C, 89, 38 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoW + 1                                           77EB687E 34 Bytes  [ 43, 0C, C6, 40, 04, 01, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoW + 24                                          77EB68A1 60 Bytes  [ 89, 40, 04, 89, 00, 8B, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoW + 61                                          77EB68DE 23 Bytes  [ 89, 47, 24, 8B, 85, 6C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoW + 79                                          77EB68F6 24 Bytes  [ 00, 40, 00, 89, 47, 34, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoW + 92                                          77EB690F 4 Bytes  [ 10, 40, 40, 66 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeMarshall + 15                                     77EB69E9 14 Bytes  CALL 77EB5696 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeMarshall + 24                                     77EB69F8 48 Bytes  [ 80, 7D, 87, 00, 0F, 84, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeMarshall + 55                                     77EB6A29 15 Bytes  [ FF, FF, FF, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeMarshall + 65                                     77EB6A39 15 Bytes  [ 8B, 40, 30, 51, 8B, 0D, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeMarshall + 75                                     77EB6A49 1 Byte  [ 51 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingHandleToAsyncHandle + 1                                  77EB6E3F 31 Bytes  [ 07, 89, 45, F0, 8D, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingHandleToAsyncHandle + 21                                 77EB6E5F 12 Bytes  [ FF, 83, 7D, F4, 00, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingHandleToAsyncHandle + 2E                                 77EB6E6C 54 Bytes  [ F0, 74, 05, 8B, 7D, F0, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingHandleToAsyncHandle + 66                                 77EB6EA4 21 Bytes  [ 00, 8B, 40, 30, 8B, 78, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingHandleToAsyncHandle + 7C                                 77EB6EBA 1 Byte  [ FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransIoCancelled + 9                                            77EB76E3 126 Bytes  [ 89, 5D, B4, 89, 5D, BC, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransIoCancelled + 88                                           77EB7762 18 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransIoCancelled + 9B                                           77EB7775 144 Bytes  [ 00, 00, 8B, 40, 30, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransIoCancelled + 12C                                          77EB7806 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransIoCancelled + 12E                                          77EB7808 47 Bytes  [ 6F, 00, 72, 00, 74, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqOption + 31                                             77EB8AA5 1 Byte  [ 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqOption + 33                                             77EB8AA7 24 Bytes  [ E3, 0F, 03, F3, 0F, B7, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqOption + 4D                                             77EB8AC1 10 Bytes  [ 0F, B7, 55, 18, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqConnId + 1                                            77EB8ACC 88 Bytes  [ F2, C1, EE, 08, 0F, B7, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqConnId + 5B                                           77EB8B26 101 Bytes  [ 00, 0F, B7, 55, 18, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqConnId + C1                                           77EB8B8C 50 Bytes  [ 00, 0F, B7, 55, 18, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqConnId + F4                                           77EB8BBF 14 Bytes  [ 00, 85, DB, 8B, 7D, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqConnId + 103                                          77EB8BCE 3 Bytes  [ 83, 7D, 0C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNetworkInqProtseqsW + 4                                           77EB8BF1 41 Bytes  [ 0C, 4D, 00, F1, 97, 7C, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcObjectInqType + 4                                                 77EB8C1B 74 Bytes  [ F0, 66, 83, FE, 61, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcObjectSetInqFn + 1                                                77EB8C66 56 Bytes  [ 7D, 08, 0F, B7, C6, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcObjectSetType + 15                                                77EB8CA0 288 Bytes  [ 0F, 84, E4, 00, 00, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqStats + 37                                                 77EB8DC1 55 Bytes  [ 18, 0F, B7, 4D, 18, 8A, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqStats + 6F                                                 77EB8DF9 102 Bytes  [ 00, 00, 89, 4D, 18, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqStats + D6                                                 77EB8E60 112 Bytes  [ 0F, 83, 1F, D6, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqStats + 147                                                77EB8ED1 149 Bytes  [ 7A, 0F, 87, 4F, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqStats + 1DD                                                77EB8F67 158 Bytes  [ 14, 3B, C1, 0F, 85, AD, A0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcGetAuthorizationContextForClient + 83                             77EB916B 60 Bytes  [ 55, 08, 88, 4A, F4, EB, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcGetAuthorizationContextForClient + C0                             77EB91A8 176 Bytes  [ 39, 35, CC, E1, 97, 7C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcIfIdVectorFree + 33                                               77EB9259 38 Bytes  [ FF, 35, B8, FF, 97, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameW + 2                                       77EB9280 40 Bytes  CALL 77EAE155 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameW + 2B                                      77EB92A9 21 Bytes  CALL 77EAF755 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameW + 42                                      77EB92C0 12 Bytes  [ 75, F4, A3, B4, FF, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameW + 4F                                      77EB92CD 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameW + 51                                      77EB92CF 23 Bytes  [ A3, E0, E3, 97, 7C, E8, 80, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsEx + A8                                       77EB94A9 123 Bytes  [ 3D, 10, E2, 97, 7C, 01, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsEx + 124                                      77EB9525 31 Bytes  [ FF, 2B, C6, 0F, 84, FC, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqsEx + 144                                      77EB9545 49 Bytes  [ FF, 83, 8D, F8, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseAllProtseqs + 2                                          77EB9577 121 Bytes  CALL 77EB9586 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesW + 4D                                     77EB95F1 50 Bytes  JMP 906722F8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesW + 80                                     77EB9624 6 Bytes  [ C6, 33, C0, E9, 5A, C6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesW + 87                                     77EB962B 19 Bytes  [ FF, 56, 57, 8B, 10, 39, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSessionStrictContextHandle + 6                                  77EB963F 4 Bytes  [ BC, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSessionStrictContextHandle + B                                  77EB9644 2 Bytes  [ 48, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSessionStrictContextHandle + E                                  77EB9647 242 Bytes  [ C9, 89, 4A, 08, 0F, 85, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSessionStrictContextHandle + 101                                77EB973A 26 Bytes  [ 70, 04, 85, F6, 89, 72, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcSessionStrictContextHandle + 11D                                77EB9756 161 Bytes  [ 31, 3B, F1, 0F, 85, 3F, A3, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcEnableWmiTrace + 85                                             77EBA6C3 135 Bytes  [ 83, 24, 81, 00, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcEnableWmiTrace + 10D                                            77EBA74B 134 Bytes  [ EC, 8B, 55, 0C, 8B, 4D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcEnableWmiTrace + 194                                            77EBA7D2 50 Bytes  [ 0C, 4A, 46, 66, 8B, D1, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcFreePipeBuffer + 16                                             77EBA805 202 Bytes  [ 2B, 45, 08, 89, 01, E9, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqTransportType + 2B                                     77EBA8D0 129 Bytes  [ 88, 59, 02, 0F, B7, 58, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqTransportType + AD                                     77EBA952 3 Bytes  [ 48, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqTransportType + B1                                     77EBA956 12 Bytes  [ 5B, 8B, 45, 18, 39, 45, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqTransportType + BF                                     77EBA964 59 Bytes  [ 80, 5E, 5D, C2, 14, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerInqTransportType + FB                                     77EBA9A0 29 Bytes  [ 38, 5D, 10, 56, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerYield + A                                                   77EBA9BE 17 Bytes  [ B7, 07, 50, FF, 77, 04, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerYield + 1C                                                  77EBA9D0 3 Bytes  [ 80, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerYield + 20                                                  77EBA9D4 108 Bytes  [ 8B, F8, 3B, FB, 0F, 8C, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerTestCancel + 4D                                             77EBAA41 159 Bytes  [ 4D, 18, EB, 10, 8B, 35, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCancelThreadEx + 9                                                77EBAAE1 16 Bytes  [ FF, 8B, 7D, 18, 3B, F7, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCancelThreadEx + 1A                                               77EBAAF2 329 Bytes  [ 74, 05, 8D, 0C, 3F, 89, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCancelThreadEx + 164                                              77EBAC3C 6 Bytes  [ FF, 77, 04, 8D, 45, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCancelThreadEx + 16B                                              77EBAC43 50 Bytes  [ 0F, B7, 06, 50, FF, 76, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCancelThreadEx + 19E                                              77EBAC76 23 Bytes  [ 20, 00, 20, 00, 20, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerAllocateIpPort + 4                                        77EBBA36 151 Bytes  [ 45, E4, 8B, D0, 03, 46, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcServerAllocateIpPort + 9C                                       77EBBACE 102 Bytes  [ 40, 40, 89, 45, 80, EB, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcProtseqVectorFreeA + 1                                            77EBBB35 5 Bytes  [ C1, EB, F1, 8B, C8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcProtseqVectorFreeA + 7                                            77EBBB3B 2 Bytes  [ 7E, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqExA + 5                                           77EBBB49 64 Bytes  [ 83, 7D, 10, 00, 0F, 84, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExA + 25                                        77EBBB8A 1 Byte  [ 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExA + 27                                        77EBBB8C 9 Bytes  [ 0C, 66, 8B, 06, 57, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfExA + 31                                        77EBBB96 46 Bytes  [ 3C, 54, 02, 00, 66, 3B, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerUseProtseqIfA + B                                           77EBBBC5 77 Bytes  [ 7A, 0F, 87, 37, 54, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNsBindingInqEntryNameA + 25                                       77EBBC14 112 Bytes  [ 0F, 85, 49, 60, 00, 00, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNsBindingInqEntryNameA + 96                                       77EBBC85 82 Bytes  [ 00, 00, C7, 45, D4, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidToStringA + 4E                                                   77EBBCD8 16 Bytes  [ D6, 83, 4D, FC, FF, E8, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesA + 8                                      77EBBCE9 72 Bytes  [ 00, 90, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesA + 51                                     77EBBD32 69 Bytes  [ A9, 0A, 00, 00, 57, E8, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesA + 97                                     77EBBD78 68 Bytes  [ C7, 41, F0, 0F, C1, 08, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesA + DC                                     77EBBDBD 96 Bytes  CALL 77EBBE08 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcServerInqCallAttributesA + 13D                                    77EBBE1E 34 Bytes  [ 84, C0, 74, 1A, 83, 65, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExA + 16                                        77EBBE6A 32 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExA + 37                                        77EBBE8B 15 Bytes  [ 75, 10, 8D, 45, FC, 50, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExA + 48                                        77EBBE9C 9 Bytes  [ FF, 8B, D8, 85, DB, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExA + 52                                        77EBBEA6 17 Bytes  [ 00, F7, DE, 1B, F6, 23, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingInqAuthInfoExA + 64                                        77EBBEB8 2 Bytes  [ 0F, 85 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExA + 3D                                        77EBBF13 132 Bytes  [ 3B, C2, 0F, 83, F1, 5D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExA + C2                                        77EBBF98 57 Bytes  [ FF, 55, 8B, EC, 56, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExA + FC                                        77EBBFD2 44 Bytes  [ 7D, 14, 00, 8D, 7E, 0C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExA + 129                                       77EBBFFF 2 Bytes  [ 46, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoExA + 12C                                       77EBC002 28 Bytes  [ 88, 3A, 72, 00, 00, 33, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameA + 25                                      77EBC09B 2 Bytes  [ F9, A0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtInqServerPrincNameA + 29                                      77EBC09F 70 Bytes  [ 83, 65, FC, 00, FF, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameA + B                                    77EBC0E6 135 Bytes  [ 00, 0F, 85, 7A, 8F, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNetworkInqProtseqsA + 2E                                          77EBC16E 34 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcNetworkInqProtseqsA + 51                                          77EBC191 62 Bytes  [ 00, 80, 3B, F8, 0F, 83, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidFromStringA + 2F                                                 77EBC1D0 7 Bytes  [ 97, 7C, 6A, FF, 68, F0, D8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidFromStringA + 37                                                 77EBC1D8 22 Bytes  CALL 77E965C1 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidFromStringA + 4E                                                 77EBC1EF 283 Bytes  [ 53, F7, D6, 81, E6, 0D, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoA + 88                                          77EBC30B 58 Bytes  [ 89, 00, F6, 46, 10, 08, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoA + C3                                          77EBC346 23 Bytes  [ FF, 3B, C3, 0F, 8C, C7, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoA + DB                                          77EBC35E 44 Bytes  [ C1, 75, 9A, 5F, 5E, 5B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoA + 108                                         77EBC38B 9 Bytes  [ 45, FC, 89, 45, F8, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcBindingSetAuthInfoA + 113                                         77EBC396 8 Bytes  [ 33, D2, 39, 13, 75, 65, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncRegisterInfo + 1E                                            77EBC687 40 Bytes  [ 66, A1, CC, E0, 97, 7C, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncRegisterInfo + 47                                            77EBC6B0 8 Bytes  [ 95, C0, C3, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncRegisterInfo + 50                                            77EBC6B9 178 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncRegisterInfo + 103                                           77EBC76C 43 Bytes  [ 8B, 7D, A4, 83, C7, FE, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncRegisterInfo + 12F                                           77EBC798 128 Bytes  [ FF, FF, 3D, 23, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate2 + 7                                      77EBCBF9 141 Bytes  [ 10, 3B, C7, 74, 07, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate2 + 95                                     77EBCC87 121 Bytes  [ 70, 0C, 89, 75, E0, 3B, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate2 + 10F                                    77EBCD01 102 Bytes  [ 00, 00, 8B, 40, 30, 56, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate2 + 178                                    77EBCD6A 162 Bytes  [ 8B, 4F, 0C, 2B, 4F, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramAllocate2 + 21C                                    77EBCE0E 9 Bytes  [ 0C, FF, 75, 14, 89, 5D, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramFree + 36                                          77EBD61C 43 Bytes  [ 83, 01, 04, 80, 7D, B7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramFree + 62                                          77EBD648 24 Bytes  [ 0B, 66, 83, F9, 21, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramFree + 7B                                          77EBD661 114 Bytes  [ 83, 5D, 6D, 00, 00, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramFree + F1                                          77EBD6D7 107 Bytes  [ 90, 6A, 1C, 68, 60, 87, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcTransDatagramFree + 15D                                         77EBD743 86 Bytes  [ C3, 0F, 8C, 61, 78, 02, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidHash + 1F                                                        77EBEE8F 44 Bytes  [ 8B, 4D, 08, 89, 1C, 88, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_UuidCreate + 2                                                     77EBEEBC 3 Bytes  [ 83, 4E, 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_UuidCreate + 6                                                     77EBEEC0 142 Bytes  JMP 77EB2FC1 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!UuidCompare + 72                                                     77EBEF4F 37 Bytes  CALL 77E960DE C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncGetCallStatus + 2                                            77EBEF75 29 Bytes  [ F6, 40, 36, 20, 0F, 85, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncGetCallStatus + 20                                           77EBEF93 55 Bytes  [ FF, FF, 0F, B7, 45, A2, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncGetCallStatus + 58                                           77EBEFCB 20 Bytes  CALL B9087936 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncCancelCall + 1                                               77EBEFE0 60 Bytes  [ C8, 81, E1, FF, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncCancelCall + 3E                                              77EBF01D 5 Bytes  [ 81, E2, FF, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncCancelCall + 44                                              77EBF023 29 Bytes  [ 74, E6, 0F, BE, 82, 48, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncCancelCall + 62                                              77EBF041 95 Bytes  [ C3, 77, FE, FF, 8B, 5F, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcAsyncCancelCall + C2                                              77EBF0A1 30 Bytes  [ 8D, 70, F8, 89, 75, A0, 8A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameW + 25                                   77EBFA88 52 Bytes  [ FF, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameW + 5B                                   77EBFABE 99 Bytes  JMP 77EA73EA C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameW + BF                                   77EBFB22 69 Bytes  [ F3, A5, 8B, C8, 83, E1, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameW + 105                                  77EBFB68 24 Bytes  JMP 77EAADE4 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcCertGeneratePrincipalNameW + 11E                                  77EBFB81 31 Bytes  [ 6A, FF, 8D, 45, F0, 50, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterNoReplaceA + E                                          77EBFE67 73 Bytes  [ 45, 08, 66, 83, 38, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterNoReplaceA + 58                                         77EBFEB1 61 Bytes  [ 25, FF, FF, FF, 7F, 03, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterNoReplaceA + 97                                         77EBFEF0 62 Bytes  [ D0, C1, EA, 10, 81, E2, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpRegisterNoReplaceW + 2C                                         77EBFF2F 217 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpUnregister + AE                                                 77EC0009 49 Bytes  [ 0E, 0F, B7, 02, 0F, B7, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpUnregister + E0                                                 77EC003B 10 Bytes  [ C3, 9D, FF, FF, 81, 7D, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpUnregister + EB                                                 77EC0046 91 Bytes  [ 0F, 87, 7E, 9D, FF, FF, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpUnregister + 147                                                77EC00A2 56 Bytes  [ FF, 81, C1, E0, FF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcEpUnregister + 180                                                77EC00DB 2 Bytes  [ FF, EB ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorGetNextRecord                                                77EC0837 23 Bytes  [ 90, 8B, FF, 55, 8B, EC, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorGetNextRecord + 18                                           77EC084F 13 Bytes  [ 55, 0C, 8D, 4C, 40, FD, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorGetNextRecord + 26                                           77EC085D 32 Bytes  [ 83, E0, 07, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorResetEnumeration + 2                                         77EC087E 58 Bytes  CALL FA701789 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorGetNumberOfRecords + 17                                      77EC08B9 35 Bytes  [ 2F, 01, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorSaveErrorInfo + 8                                            77EC08DD 3 Bytes  [ 80, 73, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorSaveErrorInfo + C                                            77EC08E1 24 Bytes  [ 83, 7D, E0, 02, 0F, 84, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorSaveErrorInfo + 25                                           77EC08FA 127 Bytes  [ CC, 3B, C7, 74, 6C, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorSaveErrorInfo + A5                                           77EC097A 10 Bytes  [ FF, FF, 87, FB, 94, 7C, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorSaveErrorInfo + B0                                           77EC0985 60 Bytes  [ FF, FF, FF, EB, FB, 94, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorLoadErrorInfo + 14                                           77EC0F42 38 Bytes  [ FF, 89, 45, AC, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorLoadErrorInfo + 3B                                           77EC0F69 53 Bytes  [ 7D, B8, 85, FF, 74, 3A, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorLoadErrorInfo + 71                                           77EC0F9F 7 Bytes  [ 8B, 4D, B8, 66, 83, 24, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorLoadErrorInfo + 79                                           77EC0FA7 6 Bytes  [ 89, 13, 83, 4D, FC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorLoadErrorInfo + 80                                           77EC0FAE 54 Bytes  CALL 77EBCA7C C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorAddRecord + 2F                                               77EC148E 14 Bytes  [ F8, 8B, 45, 9C, 8B, 4D, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorAddRecord + 3E                                               77EC149D 51 Bytes  [ C0, 0F, 85, C2, 63, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorAddRecord + 73                                               77EC14D2 40 Bytes  [ FF, 0F, B7, 09, D1, E9, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorClearInformation + 10                                        77EC14FB 20 Bytes  JMP 77EAF4D7 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorClearInformation + 25                                        77EC1510 86 Bytes  [ FF, 59, 47, 85, C0, 59, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorClearInformation + 7C                                        77EC1567 79 Bytes  [ 4D, 18, 73, 15, 89, 4D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorClearInformation + CC                                        77EC15B7 22 Bytes  [ FF, 83, 60, 34, FB, E9, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcErrorClearInformation + E3                                        77EC15CE 6 Bytes  [ 40, 38, E9, 14, 96, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqBegin + A9                                            77EC1811 45 Bytes  [ 0F, 85, 53, 0F, 00, 00, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqBegin + D7                                            77EC183F 70 Bytes  [ BD, 47, FD, FF, 33, C9, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqBegin + 11F                                           77EC1887 108 Bytes  [ 8B, F8, EB, D7, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqBegin + 18C                                           77EC18F4 151 Bytes  [ FC, 3B, C7, 0F, 85, 36, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqDone + 32                                             77EC198C 3 Bytes  [ B6, A8, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqDone + 36                                             77EC1990 118 Bytes  [ 8B, 75, 08, 8D, 7E, 10, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextA + 61                                            77EC1A07 29 Bytes  [ C1, 08, 0F, 84, E6, FD, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextA + 7F                                            77EC1A25 75 Bytes  [ 8B, 46, 38, 85, C0, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextA + CB                                            77EC1A71 27 Bytes  [ FF, 55, 8B, EC, 53, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextA + E7                                            77EC1A8D 98 Bytes  [ 00, 8D, 4D, 08, 51, 03, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextA + 14B                                           77EC1AF1 28 Bytes  [ 08, FF, 35, 7C, E4, 97, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpUnregister + 1C                                             77EC1C5D 25 Bytes  JMP 77EC7A7C C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpUnregister + 36                                             77EC1C77 3 Bytes  [ F3, 09, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpUnregister + 3A                                             77EC1C7B 142 Bytes  [ 85, C0, 0F, 8C, 99, 9F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpUnregister + C9                                             77EC1D0A 4 Bytes  [ 00, 00, 83, CF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpUnregister + CF                                             77EC1D10 27 Bytes  [ 15, A2, FF, FF, 83, C9, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextW + 1F                                            77EC1EB0 29 Bytes  [ 8D, 86, 70, 02, 00, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextW + 3D                                            77EC1ECE 25 Bytes  [ 0F, 8F, 9D, FB, 01, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtEpEltInqNextW + 57                                            77EC1EE8 54 Bytes  [ FC, 89, 45, F8, 8D, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetAuthorizationFn + 21                                       77EC1F1F 17 Bytes  [ 00, 89, 76, 04, 89, 36, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetAuthorizationFn + 33                                       77EC1F31 42 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetAuthorizationFn + 61                                       77EC1F5F 36 Bytes  [ 90, 8B, FF, 55, 8B, EC, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetAuthorizationFn + 86                                       77EC1F84 40 Bytes  [ C7, 04, C1, FF, 02, 80, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcMgmtSetAuthorizationFn + AF                                       77EC1FAD 28 Bytes  [ FA, 00, 00, 00, 8B, 7D, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointA + 30                                 77EC42C8 18 Bytes  [ 00, 00, 52, 54, 4C, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointA + 43                                 77EC42DB 91 Bytes  [ 6C, 5C, 67, 65, 6E, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointA + 9F                                 77EC4337 146 Bytes  [ 33, C0, 40, C3, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointA + 132                                77EC43CA 168 Bytes  [ 8D, 45, F8, 50, 53, 56, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcBindingInqDynamicEndpointA + 1DB                                77EC4473 23 Bytes  CALL 77E87EB7 C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockShared + 6B                                          77ECF748 55 Bytes  JMP 3EAEEAD8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockShared + A5                                          77ECF782 39 Bytes  [ 03, FE, 8B, F3, 23, F1, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockShared + CD                                          77ECF7AA 65 Bytes  [ 03, D6, 8B, F0, 23, F3, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsContextLockShared + 10F                                         77ECF7EC 161 Bytes  [ 05, 0B, EF, 03, DE, 23, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextMarshall + 16                                             77ECF88E 43 Bytes  [ 03, CE, 23, EB, 8B, B4, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NDRSContextUnmarshall + 19                                           77ECF8BA 83 Bytes  CALL 7AECF8BF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MIDL_wchar_strcpy + 4                                                77ECF90E 310 Bytes  [ B4, 24, F0, 00, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsGetContextBinding + 7E                                          77ECFA45 72 Bytes  JMP 6320C04D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsGetContextBinding + C7                                          77ECFA8E 73 Bytes  [ 8B, F2, C1, C6, 05, D1, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_from_ndr + E                                                    77ECFAD8 25 Bytes  [ C6, D1, C9, 8B, B4, 24, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_from_ndr + 28                                                   77ECFAF2 32 Bytes  [ F0, C1, C6, 05, D1, CB, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_from_ndr + 49                                                   77ECFB13 100 Bytes  [ F7, C1, C6, 05, D1, C8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_from_ndr + AE                                                   77ECFB78 85 Bytes  [ C6, 05, D1, C9, 03, C6, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_from_ndr + 105                                                  77ECFBCF 46 Bytes  [ 00, 00, 8B, FF, 56, 57, 53, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_size_ndr + 60                                                   77ECFF66 228 Bytes  [ EF, C1, C5, 05, 8D, 94, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_size_ndr + 145                                                  77ED004B 8 Bytes  [ 55, 8B, EC, 81, EC, 80, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_size_ndr + 14E                                                  77ED0054 28 Bytes  [ A1, C8, E0, 97, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_size_ndr + 16B                                                  77ED0071 6 Bytes  [ 7D, 24, 89, 85, 98, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_size_ndr + 172                                                  77ED0078 26 Bytes  [ FF, 89, 85, 9C, FE, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_size_ndr + 64                                                   77ED0123 20 Bytes  [ B3, 95, 7C, 8D, 85, 80, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_size_ndr + 79                                                   77ED0138 70 Bytes  [ 50, 33, F6, 56, 8D, 85, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_size_ndr + C0                                                   77ED017F 45 Bytes  [ FF, 50, 68, 00, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_size_ndr + EE                                                   77ED01AD 72 Bytes  [ A0, FE, FF, FF, 07, 75, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_size_ndr + 137                                                  77ED01F6 4 Bytes  [ FF, 8B, B5, A0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_peek_ndr + 8                                                    77ED0260 215 Bytes  [ FE, FF, FF, 50, FF, B5, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_peek_ndr + E0                                                   77ED0338 31 Bytes  [ 67, 00, 69, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_peek_ndr + 100                                                  77ED0358 31 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_peek_ndr + 120                                                  77ED0378 9 Bytes  [ 74, 00, 72, 00, 6F, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_peek_ndr + 12A                                                  77ED0382 9 Bytes  [ 65, 00, 74, 00, 5C, 00, 43, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_into_ndr + 15                                                   77ED041E 192 Bytes  CALL 77ECF313 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_into_ndr + D6                                                   77ED04DF 91 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_into_ndr + 132                                                  77ED053B 252 Bytes  [ B6, 58, 0F, 66, 8B, 1C, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!data_into_ndr + 22F                                                  77ED0638 84 Bytes  [ 74, 1E, 83, 7D, 1C, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_into_ndr + 51                                                   77ED068E 148 Bytes  [ 80, 5B, 5D, C2, 18, 00, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_into_ndr + E6                                                   77ED0723 183 Bytes  [ 0F, 77, 07, FF, 24, BD, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_into_ndr + 19E                                                  77ED07DB 72 Bytes  [ FF, 5B, EB, 51, 85, D2, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!tree_into_ndr + 1E7                                                  77ED0824 226 Bytes  [ 8B, 45, 14, 85, C0, 74, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!float_array_from_ndr + 8                                             77ED0907 42 Bytes  [ 81, C2, E0, FF, 00, 00, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!float_array_from_ndr + 33                                            77ED0932 8 Bytes  [ 7D, 18, 83, E7, 0F, 03, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!float_array_from_ndr + 3C                                            77ED093B 73 Bytes  [ 14, 5A, 66, 01, 55, 1C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!float_array_from_ndr + 86                                            77ED0985 106 Bytes  [ DF, C1, EB, 08, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!double_from_ndr + 2B                                                 77ED09F0 100 Bytes  [ DF, C1, EB, 08, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!double_array_from_ndr + D                                            77ED0A55 99 Bytes  [ 15, E0, E0, 97, 7C, 8B, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!double_array_from_ndr + 71                                           77ED0AB9 152 Bytes  [ EB, EC, 0F, B7, 7D, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!short_array_from_ndr + 8                                             77ED0B52 141 Bytes  [ 14, 5A, 66, 01, 55, 1C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!short_from_ndr_temp + 28                                             77ED0BE0 38 Bytes  [ 83, FA, 61, 89, 55, 1C, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_from_ndr + 16                                                   77ED0C07 13 Bytes  [ DF, C1, EB, 08, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_from_ndr + 24                                                   77ED0C15 18 Bytes  [ 83, E7, 0F, 03, DF, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_array_from_ndr + 6                                              77ED0C28 43 Bytes  [ 14, 5A, 66, 01, 55, 1C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_array_from_ndr + 32                                             77ED0C54 2 Bytes  [ 55, 1C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_array_from_ndr + 35                                             77ED0C57 26 Bytes  [ 41, 66, 83, 7D, 1C, 7A, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!long_array_from_ndr + 50                                             77ED0C72 121 Bytes  [ DF, C1, EB, 08, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!enum_from_ndr + 2D                                                   77ED0CEC 74 Bytes  [ E7, 0F, 03, DF, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!enum_from_ndr + 78                                                   77ED0D37 10 Bytes  [ E0, FF, 00, 00, EB, EC, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!enum_from_ndr + 83                                                   77ED0D42 157 Bytes  [ 15, E0, E0, 97, 7C, 8B, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!enum_from_ndr + 121                                                  77ED0DE0 122 Bytes  [ 02, 8B, 7D, 0C, 88, 57, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!enum_from_ndr + 19C                                                  77ED0E5B 18 Bytes  [ 7E, 1C, 0F, B7, 14, 57, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCreateServerInterfaceFromStub + 2A                                77ED20CE 21 Bytes  [ 75, 25, 89, B5, 5C, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCreateServerInterfaceFromStub + 40                                77ED20E4 15 Bytes  [ 85, C4, FE, FF, FF, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCreateServerInterfaceFromStub + 50                                77ED20F4 102 Bytes  [ 03, 0F, B7, C0, 89, 85, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCreateServerInterfaceFromStub + B7                                77ED215B 206 Bytes  JMP 77ECBA47 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrCreateServerInterfaceFromStub + 186                               77ED222A 33 Bytes  [ 4D, A8, 89, 88, F4, 0B, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllGetClassObject + C                                                77ED248D 59 Bytes  CALL 77EA462C C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllGetClassObject + 48                                               77ED24C9 33 Bytes  [ 89, 5D, C0, 89, 5D, C4, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllGetClassObject + 6A                                               77ED24EB 123 Bytes  [ CB, 0F, 84, 6E, 34, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllGetClassObject + E6                                               77ED2567 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllGetClassObject + E8                                               77ED2569 24 Bytes  [ B9, 0D, 00, 00, C0, 89, 88, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllRegisterServer + 38                                               77ED2EE1 5 Bytes  [ 74, 05, 88, 5D, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllRegisterServer + 3E                                               77ED2EE7 103 Bytes  CALL 77EA8CFC C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!DllRegisterServer + A6                                               77ED2F4F 76 Bytes  [ 75, 05, EB, 06, 8B, 5D, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllRegisterProxy + 3B                                             77ED2F9C 18 Bytes  [ 40, 89, 43, 04, 33, C0, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllRegisterProxy + 4E                                             77ED2FAF 49 Bytes  [ 90, 90, 90, 90, 90, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllRegisterProxy + 80                                             77ED2FE1 14 Bytes  [ 76, 0D, 8B, 4F, 04, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllRegisterProxy + 8F                                             77ED2FF0 8 Bytes  [ 83, FE, 01, 0F, 86, B0, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllRegisterProxy + 98                                             77ED2FF9 40 Bytes  [ 8B, 4F, 04, 66, 83, 79, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllUnregisterProxy + 18                                           77ED31F9 215 Bytes  [ F1, 2B, CF, D1, F9, F7, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllUnregisterProxy + F0                                           77ED32D1 7 Bytes  [ EB, D3, 66, 89, 85, EE, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllUnregisterProxy + F8                                           77ED32D9 18 Bytes  [ FF, 0F, B7, C0, 50, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllUnregisterProxy + 10B                                          77ED32EC 5 Bytes  [ 0F, 85, BD, C9, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrDllUnregisterProxy + 111                                          77ED32F2 2 Bytes  [ EB, 6B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesIncrementalHandleReset + 10                                       77ED33A2 22 Bytes  [ B8, 0D, 00, 00, C0, E9, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesIncrementalHandleReset + 28                                       77ED33BA 38 Bytes  JMP 77EB607C C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesIncrementalHandleReset + 4F                                       77ED33E1 12 Bytes  [ 8B, 06, C6, 00, 00, E9, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesIncrementalHandleReset + 5D                                       77ED33EF 80 Bytes  JMP 77EB4E78 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesIncrementalHandleReset + AF                                       77ED3441 4 Bytes  [ 00, 0F, B7, 0E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode + 60                                          77ED36C7 1 Byte  [ 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode + 62                                          77ED36C9 101 Bytes  [ 74, 20, 65, 78, 63, 65, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode + C8                                          77ED372F 31 Bytes  CALL 77E984B7 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode + E8                                          77ED374F 294 Bytes  [ 61, 64, 65, 64, 4E, 6F, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode + 20F                                         77ED3876 146 Bytes  [ 75, E4, 80, 3D, C1, E1, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode2 + 54                                         77ED39EC 57 Bytes  [ FE, FF, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode2 + 8F                                         77ED3A27 94 Bytes  JMP 77EAB096 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode2 + EE                                         77ED3A86 44 Bytes  [ 40, 38, 6A, 01, FF, 75, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode2 + 11B                                        77ED3AB3 80 Bytes  [ 00, 00, 00, 4C, 44, 52, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesProcEncodeDecode2 + 16D                                        77ED3B05 10 Bytes  JMP 77EABD45 C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeAlignSize + 1D                                       77ED3C5D 61 Bytes  [ 75, 0E, 80, 3D, 80, 0B, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeEncode + 1F                                          77ED3C9B 458 Bytes  [ 44, 52, 3A, 20, 55, 4E, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeDecode + 148                                         77ED3E66 2 Bytes  [ 5D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeDecode + 14B                                         77ED3E69 55 Bytes  [ 85, C8, FD, FF, FF, 8B, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeDecode + 183                                         77ED3EA1 16 Bytes  [ 40, 0C, 83, C0, 1C, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrMesSimpleTypeDecode + 194                                         77ED3EB2 2 Bytes  [ FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeIncrementalHandleCreate + 2                                 77ED3EB5 48 Bytes  [ 89, 01, 89, 51, 04, 89, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeIncrementalHandleCreate + 33                                77ED3EE6 202 Bytes  JMP 77ECD341 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesEncodeDynBufferHandleCreate + 3A                                  77ED3FB2 67 Bytes  [ 00, 00, 00, 00, 4C, 44, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesInqProcEncodingId + 1C                                            77ED3FF6 87 Bytes  [ 4C, 44, 52, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesInqProcEncodingId + 74                                            77ED404E 5 Bytes  [ FF, 50, 53, E8, B5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesInqProcEncodingId + 7C                                            77ED4056 47 Bytes  [ 8B, F8, 3B, FB, 0F, 8C, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesInqProcEncodingId + AC                                            77ED4086 105 Bytes  [ 53, 58, 53, 3A, 20, 41, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!MesInqProcEncodingId + 116                                           77ED40F0 28 Bytes  [ 77, 5A, 20, 61, 74, 20, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializePartial + 45                                      77ED42CE 25 Bytes  [ 89, 85, E4, FD, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializePartial + 5F                                      77ED42E8 23 Bytes  [ FF, 8B, 85, C4, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializePartial + 77                                      77ED4300 104 Bytes  [ FF, 8D, 85, 6C, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializePartial + E0                                      77ED4369 56 Bytes  [ 02, 00, 8B, 85, CC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsGetBuffer + 4                                                   77ED43A2 34 Bytes  [ 8D, D0, FD, FF, FF, 89, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsGetBuffer + 27                                                  77ED43C5 50 Bytes  [ FF, 8B, 09, 83, C0, 02, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsSendReceive + E                                                 77ED43FA 18 Bytes  [ 40, 30, 6A, 00, FF, 70, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsSendReceive + 21                                                77ED440D 132 Bytes  [ 74, 12, 8D, 85, F4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsSendReceive + A6                                                77ED4492 1 Byte  [ 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsSendReceive + A8                                                77ED4494 14 Bytes  [ 69, 00, 6E, 00, 53, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrNsSendReceive + B8                                                77ED44A4 40 Bytes  [ 33, C0, 89, 85, D8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeUnmarshall + 2                                    77ED44CD 79 Bytes  [ BF, 20, F5, 91, 7C, 50, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeUnmarshall + 55                                   77ED4520 35 Bytes  [ B6, 00, B8, 00, 28, F5, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerInitializeUnmarshall + 79                                   77ED4544 77 Bytes  [ 69, 00, 6E, 00, 65, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcUserFree + 49                                                     77ED4592 3 Bytes  [ 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcUserFree + 4D                                                     77ED4596 7 Bytes  [ 73, 00, 69, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcUserFree + 55                                                     77ED459E 29 Bytes  [ 5C, 00, 53, 00, 69, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcUserFree + 73                                                     77ED45BC 3 Bytes  [ 65, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcUserFree + 77                                                     77ED45C0 5 Bytes  [ 62, 00, 6C, 00, 79 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeSize + 12                                                     77ED4859 147 Bytes  [ FE, FF, FF, 3B, B5, 9C, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsBufferSize + C                                         77ED48ED 23 Bytes  JMP 77ED485B C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsBufferSize + 26                                        77ED4907 186 Bytes  [ 00, 00, 00, 00, 00, E6, 2F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsBufferSize + E1                                        77ED49C2 20 Bytes  [ 83, FF, FF, 89, 46, 20, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsBufferSize + F6                                        77ED49D7 20 Bytes  [ 4E, 0C, 0F, 84, A1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsBufferSize + 10B                                       77ED49EC 3 Bytes  [ 0F, 8C, 9E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientBufferSize + 86                                77ED4AF3 66 Bytes  [ 75, 08, 68, 04, FB, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientBufferSize + C9                                77ED4B36 91 Bytes  JMP 77ED06B1 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientBufferSize + 125                               77ED4B92 25 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientBufferSize + 13F                               77ED4BAC 31 Bytes  [ 57, 8B, 7D, 10, 85, FF, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientBufferSize + 15F                               77ED4BCC 85 Bytes  [ C6, 2B, C3, 33, D2, F7, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionBufferSize + 1                                   77ED4C22 4 Bytes  [ 75, FC, 3B, F7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionBufferSize + 6                                   77ED4C27 15 Bytes  [ D9, 77, 1F, 8D, 24, 24, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionBufferSize + 16                                  77ED4C37 87 Bytes  [ 7E, 02, 8B, DE, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionBufferSize + 6E                                  77ED4C8F 58 Bytes  [ EB, BE, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructBufferSize + 6                             77ED4CCA 9 Bytes  [ 57, FF, 55, 14, 3B, C7, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructBufferSize + 10                            77ED4CD4 79 Bytes  [ FC, 03, C0, 3B, DF, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructBufferSize + 60                            77ED4D24 56 Bytes  [ 75, 10, FF, 75, 0C, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructBufferSize + 9A                            77ED4D5E 8 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructBufferSize + A3                            77ED4D67 104 Bytes  [ 45, 08, 8D, 48, 04, 33, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeFree + 32                                                     77ED4E26 266 Bytes  [ 37, 3B, F1, 75, 2F, 33, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerFree + A1                                         77ED4F31 105 Bytes  [ 00, 00, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionFree + A                                         77ED4F9B 16 Bytes  [ B7, 37, 8B, 4D, 0C, D1, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionFree + 1B                                        77ED4FAC 37 Bytes  [ 84, 8A, 00, 00, 00, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionFree + 43                                        77ED4FD4 71 Bytes  CALL 20BE46E2 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionFree + 8B                                        77ED501C 111 Bytes  [ 33, C0, 8D, 8D, 68, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionFree + FB                                        77ED508C 72 Bytes  JMP 77EB6968 C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructFree + 3D                                  77ED512E 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructFree + 40                                  77ED5131 5 Bytes  [ FF, 8B, 85, 40, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructFree + 46                                  77ED5137 10 Bytes  [ FF, 89, 85, 74, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructFree + 51                                  77ED5142 45 Bytes  CALL 77EB5695 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrTypeMarshall + 16                                                 77ED5170 119 Bytes  [ FF, 51, 68, C6, 09, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMarshall + 2B                                          77ED51E8 51 Bytes  CALL 77EA4F2A C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMarshall + 5F                                          77ED521C 21 Bytes  CALL 77EA5335 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMarshall + 75                                          77ED5232 74 Bytes  [ 74, 2B, 01, 00, B8, 7B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMarshall + C0                                          77ED527D 68 Bytes  JMP 77EB5F4B C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMarshall + 105                                         77ED52C2 1 Byte  [ FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMarshall + 2F                                     77ED531F 112 Bytes  [ FF, FF, 7D, 2F, 80, 3D, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerContextMarshall + 26                                        77ED5390 20 Bytes  [ FF, FF, 68, 1E, 0C, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientMarshall + 1                                   77ED53A5 10 Bytes  [ 85, 78, FF, FF, FF, E9, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreClientMarshall + C                                   77ED53B0 200 Bytes  [ BD, 20, FF, FF, FF, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMarshall + 5A                              77ED5479 83 Bytes  [ 8D, 45, 94, 50, 6A, 22, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMarshall + AE                              77ED54CD 28 Bytes  [ 75, 05, 6A, 03, 58, EB, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMarshall + CB                              77ED54EA 81 Bytes  [ C6, EB, 31, FF, D3, E9, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMarshall + 11E                             77ED553D 301 Bytes  [ 00, 4C, 44, 52, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMarshall + 24D                             77ED566C 24 Bytes  [ 00, 00, 4C, 64, 72, 70, 49, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructUnmarshall + 10                            77ED57A0 217 Bytes  [ 6E, 74, 20, 77, 6F, 72, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructUnmarshall + EA                            77ED587A 256 Bytes  [ 00, 00, 00, 00, 4C, 64, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructUnmarshall + 1EB                           77ED597B 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructUnmarshall + 1F1                           77ED5981 117 Bytes  [ 00, 4C, 44, 52, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructUnmarshall + 267                           77ED59F7 991 Bytes  [ 65, 74, 20, 63, 75, 72, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsUnmarshall + 1C2                                       77ED5DD7 158 Bytes  [ 20, 73, 74, 61, 74, 75, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerUnmarshall + 35                                   77ED5E76 81 Bytes  [ 50, 68, A4, 0F, 94, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrClientContextUnmarshall + 36                                      77ED5EC8 129 Bytes  [ 10, 94, 7C, 68, 24, 10, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPartialIgnoreServerUnmarshall + 19                                77ED5F4A 65 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionUnmarshall + F                                   77ED5F8C 443 Bytes  CALL 77EFB641 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMemorySize + 93                                        77ED6148 17 Bytes  [ 53, FF, 77, 04, 50, E8, 9F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMemorySize + A5                                        77ED615A 27 Bytes  [ 00, 00, 8D, 46, 02, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMemorySize + C1                                        77ED6176 153 Bytes  JMP 77EAA94F C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMemorySize + 15B                                       77ED6210 28 Bytes  JMP 77EAEA21 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrXmitOrRepAsMemorySize + 178                                       77ED622D 314 Bytes  [ FF, FF, 80, 3D, C1, E1, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMemorySize + 47                                   77ED6368 376 Bytes  [ 4C, 44, 52, 3A, 20, 4C, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMemorySize + 1C0                                  77ED64E1 71 Bytes  [ 64, 44, 6C, 6C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMemorySize + 208                                  77ED6529 28 Bytes  JMP 77ECD84F C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMemorySize + 225                                  77ED6546 4 Bytes  [ C7, 45, FC, 7B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrInterfacePointerMemorySize + 22A                                  77ED654B 69 Bytes  JMP 77ECD84E C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrPointerMemorySize + 2                                             77ED65A3 53 Bytes  [ 3B, FB, 0F, 8C, 25, 1B, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrEncapsulatedUnionMemorySize + 2                                   77ED65D9 88 Bytes  CALL 77EA296D C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMemorySize + 27                            77ED6632 78 Bytes  [ FD, FF, 85, C0, 0F, 8C, 2A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMemorySize + 76                            77ED6681 84 Bytes  [ 8C, D5, 00, 00, 00, 39, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMemorySize + CB                            77ED66D6 292 Bytes  [ 45, 08, 8B, 40, 04, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMemorySize + 1F1                           77ED67FC 172 Bytes  [ 05, 70, 1D, 98, 7C, E9, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConformantVaryingStructMemorySize + 29E                           77ED68A9 46 Bytes  [ FF, 66, 83, 4E, 38, FF, C7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalSimpleTypeConvert + 34                                 77ED707A 38 Bytes  [ 38, 1D, C1, E1, 97, 7C, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalSimpleTypeConvert + 5B                                 77ED70A1 96 Bytes  JMP 77EB1664 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalSimpleTypeConvert + BC                                 77ED7102 161 Bytes  [ 69, 74, 68, 20, 73, 74, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrUserMarshalSimpleTypeConvert + 15E                                77ED71A4 159 Bytes  [ 6C, 44, 6F, 73, 53, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert2 + A                                                      77ED7244 9 Bytes  [ 20, 62, 79, 74, 65, 73, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert2 + 15                                                     77ED724F 66 Bytes  [ 00, 4C, 64, 72, 70, 52, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert2 + 58                                                     77ED7292 340 Bytes  [ 6C, 6C, 20, 64, 6C, 6C, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert + 10F                                                     77ED73E7 148 Bytes  [ 74, 72, 69, 6E, 67, 20, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert + 1A4                                                     77ED747C 64 Bytes  [ C0, 0F, 84, AF, 96, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert + 1E5                                                     77ED74BD 30 Bytes  [ FF, 89, 85, 64, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert + 204                                                     77ED74DC 208 Bytes  [ 98, 7C, 50, 8D, 85, 48, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrConvert + 2D5                                                     77ED75AD 47 Bytes  [ FF, 38, 1D, C1, E1, 97, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpSetRpcSsDefaults + 56                                            77ED8264 347 Bytes  [ CC, CC, CC, CC, CC, CC, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpSetRpcSsDefaults + 1B2                                           77ED83C0 143 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrpSetRpcSsDefaults + 242                                           77ED8450 256 Bytes  CALL 77E9620C C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmClientFree + 9E                                              77ED8551 25 Bytes  JMP 77EB5277 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmClientFree + B8                                              77ED856B 45 Bytes  [ 6A, FF, 68, 80, 69, 67, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsAllocate + 24                                                   77ED8599 13 Bytes  [ FB, 02, 76, 51, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsAllocate + 32                                                   77ED85A7 199 Bytes  CALL 77EA5337 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsFree + 5                                                        77ED8670 1 Byte  [ 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsFree + 7                                                        77ED8672 61 Bytes  CALL 77E96439 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsSetClientAllocFree + 2                                          77ED86B0 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsSetClientAllocFree + 4                                          77ED86B2 26 Bytes  [ 40, 5C, 66, 83, F8, 03, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsSetClientAllocFree + 1F                                         77ED86CD 69 Bytes  [ AC, 94, 01, 00, C0, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsSetThreadHandle + 30                                            77ED8713 149 Bytes  [ 69, 72, 65, 20, 45, 78, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSsSwapClientAllocFree + 3F                                        77ED87A9 98 Bytes  [ 8B, 46, 34, FF, 46, 24, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmAllocate + 5E                                                   77ED880C 73 Bytes  [ 66, 8B, 40, 5C, 66, 83, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmClientFree + 3D                                                 77ED8856 11 Bytes  [ 59, 53, 6A, 00, FF, 76, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmClientFree + 49                                                 77ED8862 86 Bytes  [ 3B, C7, 0F, 84, 53, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmDisableAllocate + 48                                            77ED88B9 128 Bytes  JMP 77EC2294 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmGetThreadHandle + 19                                            77ED893A 60 Bytes  [ FF, 85, C0, 0F, 8D, 88, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmGetThreadHandle + 57                                            77ED8978 37 Bytes  [ 90, 90, 90, 8B, 5D, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmSetClientAllocFree + 15                                         77ED899E 61 Bytes  [ 3B, 35, 38, 17, 98, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmSetClientAllocFree + 53                                         77ED89DC 5 Bytes  [ 66, 8B, 55, EC, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmSetClientAllocFree + 59                                         77ED89E2 78 Bytes  [ 51, 04, 8D, 41, 10, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmSetThreadHandle + 48                                            77ED8A31 69 Bytes  [ 83, C4, 10, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmSwapClientAllocFree + 36                                        77ED8A77 220 Bytes  CALL 77EA5335 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmSetClientToOsf + 85                                          77ED8B54 56 Bytes  [ 6F, 75, 6E, 74, 20, 3D, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmSetClientToOsf + BE                                          77ED8B8D 49 Bytes  JMP 77EADB89 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmSetClientToOsf + F0                                          77ED8BBF 43 Bytes  [ 3B, C6, 0F, 8C, DD, 51, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmSetClientToOsf + 11C                                         77ED8BEB 20 Bytes  [ F8, 89, 75, DC, 8B, 7E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrRpcSmSetClientToOsf + 131                                         77ED8C00 37 Bytes  [ 00, 81, FF, 78, E1, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!RpcSmEnableAllocate + 14                                             77ED8C26 148 Bytes  [ 0F, 84, 03, 01, 00, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerUnmarshall + 2C                                             77ED8CBB 130 Bytes  CALL 77EF9FE7 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerUnmarshall + AF                                             77ED8D3E 111 Bytes  JMP 77EADDA3 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerUnmarshall + 11F                                            77ED8DAE 130 Bytes  [ 6F, 20, 61, 64, 64, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerUnmarshall + 1A2                                            77ED8E31 209 Bytes  [ 20, 6E, 6F, 6E, 2D, 4E, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerUnmarshall + 274                                            77ED8F03 152 Bytes  [ 64, 64, 73, 20, 74, 6F, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerMarshall + 30                                               77ED9109 22 Bytes  [ 78, 81, FE, 78, E1, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerMarshall + 47                                               77ED9120 9 Bytes  CALL 77EF9FE4 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerMarshall + 51                                               77ED912A 2 Bytes  [ 45, D8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerMarshall + 54                                               77ED912D 89 Bytes  [ 4D, 10, 85, C9, 75, 26, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!NdrServerMarshall + AE                                               77ED9187 52 Bytes  [ FF, FF, 83, 4D, FC, FF, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcProxyNewConnection + AF                                         77EE3A05 66 Bytes  JMP 77EEA799 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcProxyNewConnection + F2                                         77EE3A48 66 Bytes  [ 00, 83, C4, 18, 8D, 75, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcProxyNewConnection + 135                                        77EE3A8B 36 Bytes  [ CC, CC, CC, CC, CC, 8B, CB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcProxyNewConnection + 15A                                        77EE3AB0 8 Bytes  [ 66, 83, FE, 7A, 0F, 86, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] RPCRT4.dll!I_RpcProxyNewConnection + 163                                        77EE3AB9 80 Bytes  JMP 77EE124F C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + FFFA3854                                                7E4114E5 68 Bytes  [ 3B, F3, 74, 3A, 0F, B7, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + FFFA389B                                                7E41152C 10 Bytes  CALL 7E3BE903 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + FFFA38A6                                                7E411537 24 Bytes  [ 90, 90, 90, 90, 90, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + FFFA38C0                                                7E411551 11 Bytes  CALL 7E3B10E0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + FFFA38CF                                                7E411560 64 Bytes  [ 3C, 15, 96, 7C, 00, 00, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReleaseDC + F                                                        7E4186AC 64 Bytes  [ 00, 8B, 55, FC, 8B, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDC + 26                                                           7E4186ED 48 Bytes  [ 8D, 0C, 30, FF, 75, E4, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDC + 57                                                           7E41871E 3 Bytes  [ 89, 4B, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDC + 5B                                                           7E418722 17 Bytes  [ 45, F4, 8B, 45, F4, 83, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDC + 6D                                                           7E418734 77 Bytes  [ 0F, 82, 3E, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDC + BB                                                           7E418782 133 Bytes  [ 4E, 6F, 20, 68, 6F, 6F, 6B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongW + 7D                                                  7E418923 9 Bytes  [ 55, FC, 74, 05, 3B, 55, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongW + 87                                                  7E41892D 154 Bytes  [ 48, F8, 89, 48, F4, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongW + 122                                                 7E4189C8 184 Bytes  [ 46, 61, 69, 6C, 65, 64, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowThreadProcessId + 1                                         7E418A81 62 Bytes  [ D9, 75, D6, 5F, 8B, D6, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowThreadProcessId + 40                                        7E418AC0 91 Bytes  [ 83, F8, 1C, 72, 3B, 6A, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowThreadProcessId + 9C                                        7E418B1C 14 Bytes  [ BE, 00, 03, 00, 00, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowThreadProcessId + AB                                        7E418B2B 38 Bytes  [ 0F, 84, A3, 00, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowThreadProcessId + D2                                        7E418B52 20 Bytes  CALL 7E4179B1 C:\WINDOWS\system32\USER32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateMessage + 8                                                 7E418BFE 52 Bytes  [ 72, 65, 20, 28, 50, 45, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTimer + 5                                                         7E418C33 40 Bytes  [ 00, 75, 40, 8B, 75, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!KillTimer + 1A                                                       7E418C5C 112 Bytes  [ 4E, 18, 8B, 51, 38, 3B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageW + 2                                                     7E418CCD 77 Bytes  [ EB, 39, 68, 3A, 8D, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationW + 5                                        7E418D1C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationW + 7                                        7E418D1E 21 Bytes  [ 48, 4F, 54, 50, 5F, 49, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperA + 9                                                       7E418D34 138 Bytes  [ 72, 65, 00, 00, 00, 00, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperA + 94                                                      7E418DBF 25 Bytes  [ 77, 28, 8B, 46, 18, 89, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperA + AE                                                      7E418DD9 15 Bytes  [ FF, 55, 8B, EC, 51, 51, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperA + BE                                                      7E418DE9 19 Bytes  [ 8B, F0, 85, F6, 75, 07, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperA + D2                                                      7E418DFD 69 Bytes  [ FE, F3, AB, 8B, 45, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClipboardFormatA + 1B                                        7E418E43 13 Bytes  [ 7C, 07, 8B, 45, 08, 89, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClipboardFormatA + 2A                                        7E418E52 14 Bytes  [ 8B, C7, 5F, 5E, C9, C2, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClipboardFormatA + 39                                        7E418E61 21 Bytes  [ 55, 8B, EC, FF, 75, 08, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSysColor                                                          7E418E78 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSysColor + 4                                                      7E418E7C 43 Bytes  [ FF, 55, 8B, EC, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSysColorBrush                                                     7E418EAB 78 Bytes  [ 90, 8B, FF, 55, 8B, EC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAppCompatFlags2 + 24                                              7E418EFA 26 Bytes  [ 10, 00, 00, 89, 45, E4, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAppCompatFlags2 + 40                                              7E418F16 150 Bytes  [ 90, 90, 90, 33, C0, 40, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSystemMetrics + 11                                                7E418FAD 132 Bytes  [ 55, 8B, EC, 8B, 4D, 08, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowDC + 11                                                     7E419032 9 Bytes  [ 96, 7C, EB, 0C, B8, CA, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowDC + 1C                                                     7E41903D 2 Bytes  [ B8, E2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowDC + 1F                                                     7E419040 5 Bytes  [ 96, 7C, 5D, C2, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowDC + 25                                                     7E419046 61 Bytes  [ 50, 41, 47, 45, 5F, 57, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollInfo + 2E                                                   7E419084 92 Bytes  [ 00, 00, 55, 4E, 4B, 4E, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperW + F                                                       7E4190E1 18 Bytes  [ 00, 50, 41, 47, 45, 5F, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperW + 22                                                      7E4190F4 14 Bytes  [ CC, CC, CC, CC, CC, CC, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperW + 31                                                      7E419103 54 Bytes  [ EC, 83, EC, 48, A1, C8, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperW + 68                                                      7E41913A 276 Bytes  JMP 7E4191C1 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetShellWindow                                                       7E419252 14 Bytes  [ 90, 8B, FF, 55, 8B, EC, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetShellWindow + F                                                   7E419261 103 Bytes  [ 10, 00, 00, 8D, 45, 08, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageW + 2E                                                    7E4192C9 36 Bytes  [ F0, FF, FF, 8B, D9, 8D, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageW + 53                                                    7E4192EE 217 Bytes  [ 8D, 45, 08, 50, 6A, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageW + 12D                                                   7E4193C8 8 Bytes  [ 89, 45, 08, 73, 5C, 56, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageW + 136                                                   7E4193D1 6 Bytes  [ 95, 7C, 68, 00, 40, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageW + 13D                                                   7E4193D8 18 Bytes  [ 8D, 45, 0C, 50, 8D, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAcceleratorW + 21                                           7E41943F 18 Bytes  [ 50, 85, C0, 74, 11, 39, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAcceleratorW + 34                                           7E419452 7 Bytes  [ FF, 49, 58, 5D, C2, 04, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongA                                                       7E41945D 12 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongA + E                                                   7E41946B 28 Bytes  [ 0C, 89, 11, 83, 78, 50, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongA + 2B                                                  7E419488 64 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowLongA + 6C                                                  7E4194C9 38 Bytes  [ 75, 03, 89, 50, 40, 39, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCapture + 19                                                      7E4194F3 44 Bytes  [ 8B, FF, 55, 8B, EC, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastInputInfo + 2C                                                7E419520 9 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastInputInfo + 36                                                7E41952A 2 Bytes  [ 4D, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastInputInfo + 39                                                7E41952D 24 Bytes  [ 45, 08, 39, 48, 30, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastInputInfo + 52                                                7E419546 17 Bytes  [ D2, 74, 02, 89, 32, FF, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastInputInfo + 64                                                7E419558 76 Bytes  [ 5E, 5D, C2, 0C, 00, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DispatchMessageA + 8                                                 7E4196C0 51 Bytes  [ 85, C0, 7D, 07, B8, 2C, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DispatchMessageA + 3C                                                7E4196F4 15 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DispatchMessageA + 4C                                                7E419704 10 Bytes  [ 8B, 46, 40, 57, 8B, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsChild + 1                                                          7E41970F 23 Bytes  [ 4F, 04, 01, 56, 4C, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsChild + 19                                                         7E419727 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsChild + 1B                                                         7E419729 35 Bytes  [ 39, 4A, 04, 73, 0B, 8B, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsChild + 40                                                         7E41974E 46 Bytes  [ 84, C0, 74, 23, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsChild + 6F                                                         7E41977D 30 Bytes  [ 3B, EB, 05, 89, 07, 89, 7E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetThreadDesktop + 1                                                 7E419A52 17 Bytes  [ 5D, 0C, 81, C3, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetThreadDesktop + 13                                                7E419A64 1 Byte  [ 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetThreadDesktop + 15                                                7E419A66 22 Bytes  [ 3B, DF, 76, 02, 8B, FB, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetThreadDesktop + 2C                                                7E419A7D 29 Bytes  [ 10, 00, 73, 0E, 53, 8B, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetThreadDesktop + 4A                                                7E419A9B 31 Bytes  [ 75, F8, FF, 75, 08, E8, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassW + 17                                                7E419ABB 171 Bytes  [ 8B, 45, F8, 50, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassW + C4                                                7E419B68 55 Bytes  [ 00, 00, 45, 78, 63, 65, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassW + FC                                                7E419BA0 16 Bytes  [ 00, 00, 45, 78, 63, 65, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassW + 10D                                               7E419BB1 350 Bytes  [ 00, 48, 65, 61, 70, 20, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassW + 26D                                               7E419D11 43 Bytes  [ B0, 01, 5D, C2, 04, 00, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorW                                                          7E419D69 11 Bytes  [ 90, 8B, FF, 55, 8B, EC, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorW + C                                                      7E419D75 78 Bytes  [ 56, BE, 04, 27, 98, 7C, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorW + 5B                                                     7E419DC4 195 Bytes  [ 85, C0, 7D, 07, 32, C0, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffW + 31                                                  7E419E88 12 Bytes  [ FF, 70, 20, 68, 2E, 9F, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffW + 3E                                                  7E419E95 220 Bytes  [ 59, 59, 33, C0, 87, 06, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SystemParametersInfoW + 6D                                           7E419F73 183 Bytes  [ 6A, 1C, 68, 40, A0, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientThreadSetup + 21                                               7E41A02B 72 Bytes  [ 33, DB, 38, 5D, E7, 0F, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientThreadSetup + 6B                                               7E41A075 33 Bytes  [ 80, 3B, 4D, 08, 74, 0A, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientThreadSetup + 8D                                               7E41A097 40 Bytes  [ 81, 7E, E0, A9, AA, CD, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientThreadSetup + B6                                               7E41A0C0 147 Bytes  [ 03, CE, 89, 4D, DC, 8D, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientThreadSetup + 14A                                              7E41A154 35 Bytes  [ C6, 45, E7, 01, 81, 7A, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassW + 21                                                  7E41A3BB 34 Bytes  [ 3B, C1, 89, 02, 73, 02, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassW + 44                                                  7E41A3DE 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassW + 46                                                  7E41A3E0 22 Bytes  [ EC, 83, EC, 44, 8D, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassW + 5D                                                  7E41A3F7 32 Bytes  [ FF, 0F, B7, C8, 85, C9, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassW + 7E                                                  7E41A418 102 Bytes  [ D8, 1B, C0, 23, 45, 08, EB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfA + CE                                                      7E41A6DE 3 Bytes  [ 82, AA, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfA + D3                                                      7E41A6E3 35 Bytes  [ A1, 40, 26, 98, 7C, BA, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfA + F7                                                      7E41A707 48 Bytes  [ FF, 70, 20, 68, 94, A7, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfA + 128                                                     7E41A738 68 Bytes  [ F8, A3, BC, 26, 98, 7C, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfA + 16D                                                     7E41A77D 120 Bytes  [ 04, B5, 20, 27, 98, 7C, B0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wsprintfA + 2                                                        7E41A8AF 356 Bytes  CALL 7E3B0FFE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfW + 43                                                      7E41AA14 13 Bytes  [ FF, FF, 75, 10, 53, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfW + 51                                                      7E41AA22 24 Bytes  [ FF, 74, D6, 85, FF, 75, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfW + 6A                                                      7E41AA3B 43 Bytes  CALL 7E419600 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfW + 96                                                      7E41AA67 46 Bytes  [ 85, FF, 74, 1A, F6, 86, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!wvsprintfW + C5                                                      7E41AA96 3 Bytes  [ 8B, EC, 83 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MBToWCSEx + 11                                                       7E41ADBE 40 Bytes  [ 65, 61, 70, 3A, 20, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MBToWCSEx + 3A                                                       7E41ADE7 67 Bytes  [ CC, CC, CC, CC, CC, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MBToWCSEx + 7F                                                       7E41AE2C 1 Byte  [ FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MBToWCSEx + 81                                                       7E41AE2E 18 Bytes  [ 6A, 00, FF, 75, 10, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperBuffA + 2                                                   7E41AE41 32 Bytes  CALL 7E41A27D C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperBuffA + 23                                                  7E41AE62 4 Bytes  [ 8B, 09, 6A, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperBuffA + 28                                                  7E41AE67 67 Bytes  CALL 7E419AD7 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperBuffA + 6D                                                  7E41AEAC 14 Bytes  [ 5D, AE, 96, 7C, 76, AE, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharUpperBuffA + 7C                                                  7E41AEBB 4 Bytes  [ 55, 8B, EC, 56 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClipboardFormatW + A                                         7E41AF3E 53 Bytes  CALL 7E41A2C6 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClipboardFormatW + 40                                        7E41AF74 54 Bytes  [ 33, DB, 8B, 75, E0, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExW + 2C                                                7E41AFAB 33 Bytes  [ 55, 8B, EC, FF, 75, 08, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExW + 4E                                                7E41AFCD 91 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExW + AA                                                7E41B029 15 Bytes  [ C0, EB, 77, 6A, 40, 5A, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExW + BA                                                7E41B039 16 Bytes  [ 00, C0, EB, 66, 6A, 10, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExW + CB                                                7E41B04A 35 Bytes  CALL 7E41A7D3 C:\WINDOWS\system32\USER32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollDC + 4A                                                        7E41B227 60 Bytes  CALL 7E4066DD 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollDC + 87                                                        7E41B264 414 Bytes  [ FE, FF, F6, 45, 14, 80, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcW + C7                                                  7E41B403 38 Bytes  [ 68, FC, B6, 96, 7C, F6, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcW + EE                                                  7E41B42A 8 Bytes  [ D8, 34, FA, FF, C2, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcW + FB                                                  7E41B437 1 Byte  [ 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcW + FD                                                  7E41B439 26 Bytes  [ FF, FF, FF, C6, B1, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcW + 118                                                 7E41B454 69 Bytes  [ 48, 65, 61, 70, 20, 62, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetRect + B                                                          7E41B5D1 30 Bytes  [ 65, 72, 6E, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetRect + 2A                                                         7E41B5F0 11 Bytes  [ 48, 65, 61, 70, 20, 68, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InvalidateRect + 7                                                   7E41B5FC 27 Bytes  [ 63, 6F, 72, 72, 75, 70, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BeginPaint + F                                                       7E41B618 132 Bytes  [ 43, 6F, 72, 72, 75, 70, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OffsetRect + 6C                                                      7E41B69D 192 Bytes  [ 70, 74, 65, 64, 20, 65, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetParent + 2F                                                       7E41B75E 93 Bytes  [ 00, 81, E1, 00, F0, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetParent + 8D                                                       7E41B7BC 158 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetParent + 12C                                                      7E41B85B 47 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetParent + 15D                                                      7E41B88C 59 Bytes  [ 08, 68, 10, B9, 96, 7C, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageW + F                                                     7E41B8C9 41 Bytes  [ FF, F6, 45, 0C, 08, 75, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageW + 3A                                                    7E41B8F4 48 Bytes  [ 53, 69, 7A, 65, 20, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageW + 6B                                                    7E41B925 9 Bytes  [ CC, CC, CC, CC, CC, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageW + 75                                                    7E41B92F 59 Bytes  [ 8B, FF, 55, 8B, EC, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindow + 38                                                        7E41B96B 2 Bytes  [ B7, 88 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindow + 3B                                                        7E41B96E 5 Bytes  [ 00, 00, E8, 48, 59 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindow + 41                                                        7E41B974 8 Bytes  [ FF, 5F, 5E, 5D, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindow + 4D                                                        7E41B980 6 Bytes  [ 8B, FF, 55, 8B, EC, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindow + 54                                                        7E41B987 7 Bytes  [ 75, 10, 57, 8B, 7D, 08, 6A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetPropW + 18                                                        7E41BAF3 116 Bytes  [ FC, FF, 8B, 5D, E0, E9, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapWindowPoints + 39                                                 7E41BB68 3 Bytes  [ FF, 84, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapWindowPoints + 3D                                                 7E41BB6C 215 Bytes  [ 0E, FF, 75, E4, 57, 6A, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowTextW + E                                                   7E41BC44 13 Bytes  [ FF, 8B, D8, 89, 5D, D4, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowTextW + 1C                                                  7E41BC52 59 Bytes  JMP 7E41BEC6 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindow + 11                                                       7E41BC8E 4 Bytes  [ C0, 75, 12, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindow + 18                                                       7E41BC95 1 Byte  [ 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindow + 1A                                                       7E41BC97 52 Bytes  [ C5, FB, FF, FF, 89, 45, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindow + 50                                                       7E41BCCD 63 Bytes  [ 81, E7, 00, F0, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindow + 90                                                       7E41BD0D 52 Bytes  [ FF, 76, 34, 8B, 4B, 04, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PtInRect + 1                                                         7E41BD42 2 Bytes  [ 45, DC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PtInRect + 4                                                         7E41BD45 24 Bytes  [ 8B, 80, 00, 00, 00, F6, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PtInRect + 1D                                                        7E41BD5E 25 Bytes  [ D6, FF, FF, 8B, 45, D8, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorPos + 2                                                     7E41BD78 58 Bytes  [ 8B, F0, 89, 75, CC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowEnabled + 11                                                 7E41BDB3 45 Bytes  [ 8B, 4D, 10, 89, 4E, 14, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScreenToClient + 19                                                  7E41BDE1 7 Bytes  [ 8B, 45, 0C, 25, 00, 0E, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScreenToClient + 21                                                  7E41BDE9 18 Bytes  [ 89, 46, 20, F6, 83, 80, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScreenToClient + 34                                                  7E41BDFC 68 Bytes  [ 89, 46, 24, 85, C0, 74, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsIconic + 1A                                                        7E41BE41 55 Bytes  [ 8B, 4D, 10, 8B, D1, C1, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableWindow + 8                                                     7E41BE79 20 Bytes  [ 83, 4D, FC, FF, EB, 28, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableWindow + 1D                                                    7E41BE8E 78 Bytes  CALL 7E419AD7 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableWindow + 6C                                                    7E41BEDD 218 Bytes  [ 00, 00, 00, 53, 69, 7A, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMessagePos + 24                                                   7E41BFB8 26 Bytes  CALL 7E418EDC C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMessagePos + 3F                                                   7E41BFD3 7 Bytes  [ FF, 89, 5D, FC, 8B, 86, 88 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMessagePos + 47                                                   7E41BFDB 13 Bytes  [ 00, 00, 89, 45, DC, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMessagePos + 55                                                   7E41BFE9 76 Bytes  [ 20, 89, 7D, E4, 3B, FB, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPos + 1B                                                    7E41C036 29 Bytes  [ 39, 5E, 74, 74, 0B, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPos + 39                                                    7E41C054 103 Bytes  [ 46, 70, 8B, 4E, 74, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPos + A1                                                    7E41C0BC 135 Bytes  CALL 7E4066DA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassLongW + 33                                                   7E41C144 77 Bytes  [ 00, 00, 00, 00, 75, 6E, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientToScreen + A                                                   7E41C192 4 Bytes  [ F3, 75, 04, 32 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientToScreen + F                                                   7E41C197 4 Bytes  [ EB, 74, 8B, 7D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientToScreen + 14                                                  7E41C19C 33 Bytes  [ 0B, 7E, 04, 57, 56, E8, 2F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientToScreen + 36                                                  7E41C1BE 62 Bytes  CALL 7E41B97C C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ClientToScreen + 75                                                  7E41C1FD 84 Bytes  [ 83, 4D, FC, FF, 8B, 75, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutList + F                                            7E41C252 76 Bytes  [ 8B, 75, 0C, 0B, 77, 04, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FillRect + 48                                                        7E41C29F 14 Bytes  [ 01, C6, 45, E7, 01, 83, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FillRect + 58                                                        7E41C2AF 3 Bytes  [ 8B, 45, EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsZoomed + 1                                                         7E41C2B3 102 Bytes  [ 08, 8B, 09, 6A, 00, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetRectEmpty + 38                                                    7E41C31A 33 Bytes  JMP 7E41C3A1 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameW + 2                                                    7E41C33C 91 Bytes  [ 89, 45, DC, 3B, C3, 75, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameW + 5F                                                   7E41C399 41 Bytes  CALL 7E418E90 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameW + 89                                                   7E41C3C3 46 Bytes  [ 55, 8B, EC, 53, 8B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameW + B8                                                   7E41C3F2 2 Bytes  [ 8D, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameW + BC                                                   7E41C3F6 122 Bytes  [ 6A, 00, FF, 76, 08, 57, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowVisible + C                                                  7E41C471 87 Bytes  [ FF, 84, C0, 74, 0B, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EqualRect + 21                                                       7E41C4CA 19 Bytes  [ EB, 69, 53, 8B, 5D, 10, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EqualRect + 36                                                       7E41C4DF 17 Bytes  [ 84, C0, 75, 12, FF, 75, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EqualRect + 48                                                       7E41C4F1 72 Bytes  [ 33, C0, EB, 3F, 57, 56, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyState + 35                                                     7E41C53A 18 Bytes  [ 00, 00, 00, 00, 53, 69, 7A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyState + 49                                                     7E41C54E 224 Bytes  [ 48, 65, 61, 70, 20, 68, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowUnicode + 91                                                 7E41C62F 3 Bytes  [ FF, 84, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowUnicode + 95                                                 7E41C633 11 Bytes  [ 0C, FF, 75, DC, 53, 6A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowUnicode + A1                                                 7E41C63F 21 Bytes  [ FF, 83, 7E, 0C, 00, 76, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcW + B                                                  7E41C655 13 Bytes  [ 48, 1C, 6A, 01, FF, 76, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcW + 1B                                                 7E41C665 9 Bytes  CALL 7E4195C0 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyRect + 1                                                         7E41C66F 63 Bytes  [ 87, 80, 00, 00, 00, A8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyRect + 41                                                        7E41C6AF 28 Bytes  [ 76, 03, FF, 48, 0C, 8B, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyRect + 5F                                                        7E41C6CD 246 Bytes  CALL 7E41A3DA C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnionRect + A8                                                       7E41C7C5 61 Bytes  [ 8B, 5D, 0C, 53, 56, E8, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnionRect + E7                                                       7E41C804 21 Bytes  [ 00, 04, 0F, 84, 0B, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnionRect + FD                                                       7E41C81A 26 Bytes  [ 00, 8D, 45, D4, 50, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnionRect + 118                                                      7E41C835 5 Bytes  [ F6, 86, 80, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnionRect + 11E                                                      7E41C83B 50 Bytes  [ 10, 75, 21, 6A, 01, 8D, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageA + 16                                                    7E41C982 2 Bytes  [ 84, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageA + 1B                                                    7E41C987 18 Bytes  [ 8B, 43, 0C, 85, C0, 76, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageA + 2F                                                    7E41C99B 2 Bytes  [ 80, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageA + 34                                                    7E41C9A0 4 Bytes  [ 10, 75, 0F, A8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PeekMessageA + 39                                                    7E41C9A5 169 Bytes  [ 74, 0B, FF, 73, 0C, FF, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageA + 26                                                    7E41CBAB 27 Bytes  [ 3B, 48, 24, 72, B0, B0, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageA + 42                                                    7E41CBC7 18 Bytes  [ 08, 33, DB, 80, BE, 86, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageA + 55                                                    7E41CBDA 12 Bytes  [ EB, 02, 33, C0, 3B, C3, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageA + 62                                                    7E41CBE7 8 Bytes  [ 00, 88, 9E, 86, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostMessageA + 6B                                                    7E41CBF0 5 Bytes  [ C7, 45, 08, 80, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindows + B                                                      7E41CDA2 78 Bytes  [ 4A, 68, 30, 04, 00, 00, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextW + 3B                                                  7E41CDF1 2 Bytes  [ 75, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextW + 3F                                                  7E41CDF5 20 Bytes  CALL 7E41CCF3 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextW + 54                                                  7E41CE0A 52 Bytes  [ 5F, 5E, 5B, 5D, C2, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextW + 89                                                  7E41CE3F 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextW + 8B                                                  7E41CE41 96 Bytes  [ EB, 27, 3B, 71, 08, 77, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromWindow + 41                                               7E41CEA2 171 Bytes  [ 10, 00, 00, 74, 19, 8B, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMonitorInfoW + 8D                                                 7E41CF4E 10 Bytes  [ 53, 68, 80, 1D, 98, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMonitorInfoW + 98                                                 7E41CF59 146 Bytes  [ 85, C0, 74, 0E, 50, 68, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayMonitors + 89                                             7E41CFEC 28 Bytes  [ 39, 35, 18, 17, 98, 7C, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayMonitors + A6                                             7E41D009 37 Bytes  [ B4, 21, 98, 7C, C7, 01, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayMonitors + CC                                             7E41D02F 265 Bytes  [ 3B, 35, 18, 17, 98, 7C, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayMonitors + 1D6                                            7E41D139 8 Bytes  [ 00, 83, F8, 06, 0F, 85, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayMonitors + 1DF                                            7E41D142 105 Bytes  [ 00, 0F, B7, 06, 56, 8D, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetPropW + 66                                                        7E41D48F 205 Bytes  [ C2, 14, EB, E4, 8D, 54, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcA + 72                                                  7E41D560 2 Bytes  [ 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcA + 75                                                  7E41D563 151 Bytes  [ 55, 8B, EC, 53, 8A, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcA + 10D                                                 7E41D5FB 12 Bytes  [ 61, 6C, 20, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefWindowProcA + 11A                                                 7E41D608 24 Bytes  [ 00, 00, 75, 73, 65, 72, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowLongA + 14                                                  7E41D621 93 Bytes  [ 55, 8B, EC, 56, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetActiveWindow + 29                                                 7E41D681 36 Bytes  [ 00, 0A, 00, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetActiveWindow + 4E                                                 7E41D6A6 211 Bytes  [ C7, 8B, 3F, 89, 45, FC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretBlinkTime + 25                                               7E41D77B 14 Bytes  [ 00, 56, 6A, 1C, 8D, 45, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretBlinkTime + 34                                               7E41D78A 18 Bytes  [ FA, FF, 89, 45, E0, 3B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretBlinkTime + 47                                               7E41D79D 7 Bytes  [ F6, 45, BD, 10, 0F, 84, 96 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretBlinkTime + 4F                                               7E41D7A5 45 Bytes  [ 00, 00, 53, 68, 80, 1D, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextW + 11                                                       7E41D7D3 27 Bytes  [ F0, 89, 75, D8, 85, F6, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextW + 2D                                                       7E41D7EF 66 Bytes  [ 75, 29, 8B, 06, 89, 45, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateWindow + 3A                                                    7E41D833 40 Bytes  [ 90, 90, 90, 8B, 65, E8, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateWindow + 63                                                    7E41D85C 8 Bytes  [ 2D, D8, 96, 7C, 36, D8, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgCtrlID + 5                                                     7E41D86E 68 Bytes  [ 51, 80, 3D, 2C, 17, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowWindow + F                                                       7E41D8B3 40 Bytes  [ C6, 45, 0C, 01, 80, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDeferWindowPos + 1                                                7E41D8DC 46 Bytes  [ C8, 83, E1, 03, F3, A4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BeginDeferWindowPos + 4                                              7E41D90B 16 Bytes  [ 0B, FF, 34, 39, 8D, 04, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BeginDeferWindowPos + 15                                             7E41D91C 3 Bytes  [ CD, 28, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BeginDeferWindowPos + 19                                             7E41D920 32 Bytes  [ 33, C0, 83, C4, 1C, 39, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeferWindowPos + 18                                                  7E41D941 27 Bytes  [ 3C, C5, 74, D9, 96, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeferWindowPos + 34                                                  7E41D95D 14 Bytes  [ 59, 59, 32, C0, EB, 02, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeferWindowPos + 43                                                  7E41D96C 14 Bytes  [ 90, 90, 90, 90, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeferWindowPos + 53                                                  7E41D97C 5 Bytes  [ 10, 17, 95, 7C, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeferWindowPos + 59                                                  7E41D982 41 Bytes  [ 00, 00, 08, 17, 95, 7C, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!HideCaret + 7                                                        7E41D9DB 7 Bytes  [ 00, 20, 16, 95, 7C, 38, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!HideCaret + F                                                        7E41D9E3 8 Bytes  [ 00, 08, 16, 95, 7C, 3A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowCaret + 4                                                        7E41D9EC 110 Bytes  [ F8, 15, 95, 7C, 3C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumChildWindows + 1D                                                7E41DA5B 8 Bytes  [ 00, 08, 15, 95, 7C, 80, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetFocus + 4                                                         7E41DA64 39 Bytes  [ F8, 14, 95, 7C, 84, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowInDestroy + 1A                                               7E41DA8E 66 Bytes  [ 00, 00, 48, 45, 41, 50, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsWindowInDestroy + 5D                                               7E41DAD1 116 Bytes  [ 00, 00, 00, 20, 20, 20, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextW + 48                                                       7E41DB46 21 Bytes  [ 45, 1C, 89, 30, 74, 09, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextW + 5E                                                       7E41DB5C 48 Bytes  [ 00, 00, 8B, 45, 1C, 89, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSystemMenu + 1D                                                   7E41DB8D 13 Bytes  [ 74, 5A, A8, 02, 74, 0F, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerW + 1                                                       7E41DB9B 2 Bytes  [ 40, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerW + 4                                                       7E41DB9E 34 Bytes  [ 4D, F4, EB, 12, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerW + 27                                                      7E41DBC1 64 Bytes  [ 00, 66, 3D, 81, 00, 73, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MoveWindow + 16                                                      7E41DC02 2 Bytes  [ 00, 0F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MoveWindow + 19                                                      7E41DC05 57 Bytes  [ 16, 8B, 45, 18, 01, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MoveWindow + 53                                                      7E41DC3F 153 Bytes  [ 3B, 45, 0C, 89, 45, EC, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetParent + 7                                                        7E41DCD9 44 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TrackMouseEvent + 21                                                 7E41DD07 3 Bytes  [ 64, A1, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TrackMouseEvent + 25                                                 7E41DD0B 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TrackMouseEvent + 28                                                 7E41DD0E 146 Bytes  [ 40, 30, 8B, 40, 0C, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExW + 22                                                     7E41DDA1 8 Bytes  [ 00, 00, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExW + 2B                                                     7E41DDAA 5 Bytes  [ 40, 30, 8B, 40, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExW + 31                                                     7E41DDB0 1 Byte  [ 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExW + 33                                                     7E41DDB2 14 Bytes  [ 83, C0, 2C, 50, 68, B8, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExW + 42                                                     7E41DDC1 21 Bytes  [ B6, 45, 10, 50, 56, 68, C4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkPSMTextOut + 50                                               7E41E5CF 14 Bytes  [ 48, 48, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkPSMTextOut + 5F                                               7E41E5DE 55 Bytes  [ 40, 28, 68, 00, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkPSMTextOut + 97                                               7E41E616 43 Bytes  JMP 7E3F0BB6 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkPSMTextOut + C3                                               7E41E642 5 Bytes  [ 74, 1D, 8B, C7, 2B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkPSMTextOut + C9                                               7E41E648 189 Bytes  [ E4, D1, F8, 89, 45, C4, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowInfo + C                                                    7E41E788 18 Bytes  [ FF, 0F, 00, 81, E1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowInfo + 20                                                   7E41E79C 48 Bytes  CALL 7E43333F C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowInfo + 51                                                   7E41E7CD 23 Bytes  [ FF, B5, 10, FD, FF, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowInfo + 69                                                   7E41E7E5 6 Bytes  [ FD, FF, C7, 45, DC, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowInfo + 70                                                   7E41E7EC 47 Bytes  JMP 7E3F2F53 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CalcMenuBar + 15                                                     7E41E8D9 166 Bytes  [ 37, 51, FF, 75, 1C, E8, BB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CalcMenuBar + BC                                                     7E41E980 63 Bytes  [ 5C, 00, 57, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CalcMenuBar + FC                                                     7E41E9C0 9 Bytes  [ 8B, 07, 3B, 03, 0F, 83, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CalcMenuBar + 106                                                    7E41E9CA 57 Bytes  JMP 7E402261 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromRect + 11                                                 7E41EA04 13 Bytes  [ 8F, 3C, 38, FE, FF, 7C, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromRect + 20                                                 7E41EA13 47 Bytes  [ 66, 8B, 45, F0, C6, 45, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromRect + 50                                                 7E41EA43 20 Bytes  [ 89, 30, 8B, 31, 8D, 7E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromRect + 65                                                 7E41EA58 13 Bytes  JMP 7E3F466F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromRect + 73                                                 7E41EA66 66 Bytes  JMP 7E3F4697 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIconEx + 6D                                                      7E41EBBB 104 Bytes  [ EB, 0A, 8D, 45, F8, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIconEx + D6                                                      7E41EC24 4 Bytes  [ 64, A1, 18, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIconEx + DC                                                      7E41EC2A 20 Bytes  [ FF, 75, 0C, 8B, 40, 30, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIconEx + F1                                                      7E41EC3F 19 Bytes  [ 83, C8, FF, F0, 0F, C1, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIconEx + 105                                                     7E41EC53 23 Bytes  [ 3D, A2, FD, FF, 3D, BF, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageTimeoutW + B                                              7E41ED7D 52 Bytes  JMP 7E3FDCD7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAppCompatFlags + 16                                               7E41EDB2 62 Bytes  JMP 7E3FC7BE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLayeredWindowAttributes + 17                                      7E41EDF1 23 Bytes  [ 68, 00, 00, 10, 32, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLayeredWindowAttributes + 2F                                      7E41EE09 104 Bytes  CALL 7E3E0544 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLayeredWindowAttributes + 98                                      7E41EE72 77 Bytes  CALL 7E3DDC0B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLayeredWindowAttributes + E6                                      7E41EEC0 48 Bytes  [ 0F, 84, 60, 2B, FE, FF, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDesktopWindow + 1C                                                7E41EEF1 66 Bytes  [ B7, C0, 8D, 3C, BF, 03, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardState + B                                                 7E41EF34 79 Bytes  [ 66, 83, F8, 39, 0F, 87, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorA + 1B                                                     7E41EF84 15 Bytes  CALL 7E3EBA2F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorA + 2B                                                     7E41EF94 13 Bytes  [ 66, 8B, 50, FC, 66, 83, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorA + 39                                                     7E41EFA2 68 Bytes  [ 66, 83, FA, 77, 0F, 84, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyMenu + 1F                                                     7E41EFE7 32 Bytes  [ FF, 42, 83, C0, 04, 89, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyMenu + 40                                                     7E41F008 16 Bytes  [ 6F, 00, 74, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyMenu + 51                                                     7E41F019 4 Bytes  [ 00, 6E, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyMenu + 56                                                     7E41F01E 7 Bytes  [ 20, 00, 69, 00, 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyMenu + 5E                                                     7E41F026 13 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetIconInfo + 1A                                                     7E41F06C 23 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WCSToMBEx + 13                                                       7E41F084 33 Bytes  [ 73, 00, 6F, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WCSToMBEx + 35                                                       7E41F0A6 7 Bytes  [ 74, 00, 20, 00, 62, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WCSToMBEx + 3D                                                       7E41F0AE 5 Bytes  [ 20, 00, 66, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WCSToMBEx + 43                                                       7E41F0B4 3 Bytes  [ 75, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WCSToMBEx + 47                                                       7E41F0B8 193 Bytes  [ 64, 00, 20, 00, 69, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHookEx + 4                                              7E41F222 52 Bytes  [ 6F, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevW + 25                                                       7E41F257 10 Bytes  [ 00, 2E, 00, 0D, 00, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevW + 30                                                       7E41F262 33 Bytes  [ 01, 00, 7B, 00, 45, 00, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageW + A                                               7E41F284 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageW + C                                               7E41F286 7 Bytes  [ 74, 00, 69, 00, 6E, 00, 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageW + 14                                              7E41F28E 1 Byte  [ 2D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageW + 16                                              7E41F290 15 Bytes  [ 70, 00, 6F, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageW + 26                                              7E41F2A0 55 Bytes  [ 76, 00, 61, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaW + 2A                                                    7E41F2D8 21 Bytes  [ 54, 00, 49, 00, 4F, 00, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaW + 40                                                    7E41F2EE 47 Bytes  [ 74, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageCallbackW + 18                                            7E41F31E 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageCallbackW + 1A                                            7E41F320 7 Bytes  [ 7B, 00, 45, 00, 58, 00, 43 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageCallbackW + 22                                            7E41F328 37 Bytes  [ 45, 00, 50, 00, 54, 00, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageCallbackW + 48                                            7E41F34E 15 Bytes  [ 6F, 00, 69, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageCallbackW + 58                                            7E41F35E 1 Byte  [ 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAsyncKeyState + B                                                 7E41F3BE 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAsyncKeyState + D                                                 7E41F3C0 3 Bytes  [ 6C, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAsyncKeyState + 11                                                7E41F3C4 5 Bytes  [ 77, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAsyncKeyState + 17                                                7E41F3CA 11 Bytes  [ 0A, 00, 00, 00, 00, 00, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAsyncKeyState + 23                                                7E41F3D6 17 Bytes  [ 45, 00, 58, 00, 43, 00, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMonitorInfoA + 2E                                                 7E41F49C 11 Bytes  [ 67, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMonitorInfoA + 3A                                                 7E41F4A8 63 Bytes  [ 73, 00, 74, 00, 72, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMonitorInfoA + 7A                                                 7E41F4E8 39 Bytes  [ 61, 00, 64, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromPoint + 23                                                7E41F510 67 Bytes  [ 70, 00, 61, 00, 67, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromPoint + 67                                                7E41F554 9 Bytes  [ 72, 00, 74, 00, 73, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromPoint + 71                                                7E41F55E 87 Bytes  [ 0A, 00, 00, 00, 00, 00, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromPoint + C9                                                7E41F5B6 39 Bytes  [ 6C, 00, 79, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MonitorFromPoint + F1                                                7E41F5DE 17 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateLayeredWindow + 5                                              7E41F5F0 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateLayeredWindow + 7                                              7E41F5F2 7 Bytes  [ 64, 00, 20, 00, 66, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateLayeredWindow + F                                              7E41F5FA 9 Bytes  [ 6C, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateLayeredWindow + 19                                             7E41F604 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdateLayeredWindow + 1B                                             7E41F606 7 Bytes  [ 6E, 00, 6F, 00, 20, 00, 6C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateCaret + 5                                                      7E41F618 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateCaret + 7                                                      7E41F61A 7 Bytes  [ 76, 00, 61, 00, 6C, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateCaret + F                                                      7E41F622 79 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcA + 30                                                 7E41F672 5 Bytes  [ 64, 00, 20, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcA + 36                                                 7E41F678 17 Bytes  [ 6F, 00, 72, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcA + 48                                                 7E41F68A 11 Bytes  [ 20, 00, 75, 00, 70, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcA + 54                                                 7E41F696 11 Bytes  [ 65, 00, 73, 00, 2C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallWindowProcA + 60                                                 7E41F6A2 9 Bytes  [ 63, 00, 68, 00, 20, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableMenuItem + 1B                                                  7E41F7A2 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableMenuItem + 1D                                                  7E41F7A4 99 Bytes  [ 61, 00, 6D, 00, 6F, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableMenuItem + 81                                                  7E41F808 27 Bytes  [ 20, 00, 6D, 00, 61, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableMenuItem + 9D                                                  7E41F824 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableMenuItem + 9F                                                  7E41F826 13 Bytes  [ 76, 00, 65, 00, 20, 00, 62, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallNextHookEx + 9                                                   7E41F864 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallNextHookEx + B                                                   7E41F866 3 Bytes  [ 73, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallNextHookEx + F                                                   7E41F86A 5 Bytes  [ 65, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallNextHookEx + 15                                                  7E41F870 7 Bytes  [ 77, 00, 68, 00, 69, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallNextHookEx + 1D                                                  7E41F878 7 Bytes  [ 68, 00, 20, 00, 68, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeleteMenu + 5                                                       7E41FA5A 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeleteMenu + 7                                                       7E41FA5C 7 Bytes  [ 6E, 00, 74, 00, 20, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeleteMenu + F                                                       7E41FA64 15 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeleteMenu + 1F                                                      7E41FA74 19 Bytes  [ 73, 00, 6F, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeleteMenu + 33                                                      7E41FA88 9 Bytes  [ 69, 00, 73, 00, 74, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgnBox + 35                                                 7E41FBBE 65 Bytes  [ 0D, 00, 0A, 00, 00, 00, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgnBox + 77                                                 7E41FC00 13 Bytes  [ 0A, 00, 00, 00, F4, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgnBox + 85                                                 7E41FC0E 17 Bytes  [ 74, 00, 75, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgnBox + 97                                                 7E41FC20 11 Bytes  [ 72, 00, 79, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExW + 7                                                  7E41FC2C 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExW + 9                                                  7E41FC2E 41 Bytes  [ 6F, 00, 74, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExW + 33                                                 7E41FC58 3 Bytes  [ 64, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExW + 37                                                 7E41FC5C 9 Bytes  [ 72, 00, 65, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExW + 41                                                 7E41FC66 15 Bytes  [ 69, 00, 73, 00, 20, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExA + 9                                                  7E41FF3C 69 Bytes  [ 65, 00, 20, 00, 25, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExA + 4F                                                 7E41FF82 31 Bytes  [ 52, 00, 65, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowExA + 6F                                                 7E41FFA2 39 Bytes  [ 65, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowRgn + 18                                                    7E41FFCA 9 Bytes  [ 73, 00, 65, 00, 3B, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowRgn + 22                                                    7E41FFD4 11 Bytes  [ 74, 00, 73, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowRgn + 2E                                                    7E41FFE0 25 Bytes  [ 72, 00, 20, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowRgn + 48                                                    7E41FFFA 270 Bytes  [ 2E, 00, 0D, 00, 0A, 00, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowRgn + 157                                                   7E420109 6 Bytes  [ 90, 03, 00, 4C, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRectEx + 23F                                             7E4204B1 27 Bytes  [ 3F, 63, 3F, 70, 3F, 86, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyImage + 9                                                        7E4204CD 351 Bytes  [ 20, 04, 00, B8, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyImage + 169                                                      7E42062D 168 Bytes  [ 31, 34, 31, 3C, 31, 42, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyImage + 212                                                      7E4206D6 58 Bytes  [ 00, 00, 59, 31, CA, 31, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyImage + 24D                                                      7E420711 101 Bytes  [ 70, 04, 00, 60, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SystemParametersInfoA + 15                                           7E420777 78 Bytes  [ 00, 5E, 32, B0, 32, BA, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SystemParametersInfoA + 66                                           7E4207C8 29 Bytes  [ A8, 31, AE, 31, 95, 32, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SystemParametersInfoA + 85                                           7E4207E7 181 Bytes  [ 00, 91, 30, 4C, 31, 8D, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadIconW + 9                                                        7E42089D 2 Bytes  [ D0, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadIconW + C                                                        7E4208A0 1 Byte  [ 34 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadIconW + E                                                        7E4208A2 158 Bytes  [ 00, 00, 4C, 31, E5, 31, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadIconA + 73                                                       7E420941 113 Bytes  [ 3E, F4, 3E, 0D, 3F, 64, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadIconA + E5                                                       7E4209B3 193 Bytes  [ 00, 00, 20, 05, 00, C0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassA + 3F                                                  7E420A75 29 Bytes  [ 30, 05, 00, 38, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassA + 5D                                                  7E420A93 30 Bytes  [ 35, 41, 35, 27, 37, 34, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassA + 7C                                                  7E420AB2 646 Bytes  [ 00, 00, F7, 30, CC, 31, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetSubMenu + AD                                                      7E420D39 73 Bytes  [ 3F, 15, 3F, 1E, 3F, 29, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollBarInfo + F                                                 7E420D83 115 Bytes  [ 00, 00, 90, 05, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollInfo + 55                                                   7E420DF7 6 Bytes  [ 3F, 00, A0, 05, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollInfo + 5E                                                   7E420E00 109 Bytes  [ E5, 32, F1, 32, 17, 33, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollInfo + CC                                                   7E420E6E 198 Bytes  [ 00, 00, 55, 30, 22, 31, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollInfo + 193                                                  7E420F35 117 Bytes  [ D0, 05, 00, 0C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollInfo + 209                                                  7E420FAB 98 Bytes  [ 36, B1, 38, 39, 39, 5C, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuW + 5C                                                       7E42100E 1 Byte  [ 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuW + 5E                                                       7E421010 19 Bytes  [ 6F, 00, 72, 00, 6B, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuW + 72                                                       7E421024 59 Bytes  [ 79, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuIndirectA + 37                                               7E421060 7 Bytes  [ 78, 00, 69, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuIndirectA + 3F                                               7E421068 109 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuIndirectA + AD                                               7E4210D6 15 Bytes  [ 0A, 00, 00, 00, 00, 00, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuIndirectA + BD                                               7E4210E6 19 Bytes  [ 49, 00, 2F, 00, 4F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuIndirectA + D1                                               7E4210FA 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsW + 22                                               7E421302 20 Bytes  [ 20, 00, 73, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsW + 38                                               7E421318 31 Bytes  [ 60, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsW + 58                                               7E421338 3 Bytes  [ 70, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsW + 5C                                               7E42133C 3 Bytes  [ 69, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsW + 60                                               7E421340 1 Byte  [ 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemCount + 1E                                                7E4213A4 15 Bytes  [ 20, 00, 64, 00, 65, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemCount + 2E                                                7E4213B4 17 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemCount + 40                                                7E4213C6 23 Bytes  [ 77, 00, 6F, 00, 72, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemCount + 58                                                7E4213DE 67 Bytes  [ 69, 00, 73, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemCount + 9C                                                7E421422 7 Bytes  [ 52, 00, 65, 00, 73, 00, 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoA + 31                                                7E421548 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoA + 33                                                7E42154A 7 Bytes  [ 6E, 00, 64, 00, 7D, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoA + 3B                                                7E421552 37 Bytes  [ 0A, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoA + 61                                                7E421578 25 Bytes  [ 65, 00, 20, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoA + 7B                                                7E421592 5 Bytes  [ 20, 00, 62, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassA + A                                                 7E421660 49 Bytes  [ 65, 00, 65, 00, 64, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassA + 3C                                                7E421692 1 Byte  [ 49 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassA + 3E                                                7E421694 33 Bytes  [ 4F, 00, 53, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassA + 60                                                7E4216B6 47 Bytes  [ 77, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterClassA + 90                                                7E4216E6 11 Bytes  [ 73, 00, 68, 00, 61, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesA + B                                              7E421732 61 Bytes  [ 00, 00, 28, 01, 01, 00, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesA + 49                                             7E421770 5 Bytes  [ 61, 00, 64, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesA + 4F                                             7E421776 31 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesA + 6F                                             7E421796 43 Bytes  [ 63, 00, 6F, 00, 6D, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesA + 9B                                             7E4217C2 1 Byte  [ 62 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconIndirect + 22                                              7E4222DE 41 Bytes  [ C4, 41, 75, 15, 83, F9, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconIndirect + 4C                                              7E422308 306 Bytes  [ F9, 01, 75, 08, DD, 05, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconIndirect + 17F                                             7E42243B 36 Bytes  [ 00, C7, 45, E0, F0, 25, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconIndirect + 1A4                                             7E422460 98 Bytes  JMP 7E4225A3 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconIndirect + 208                                             7E4224C4 9 Bytes  CALL 67BEBBEE 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectoryEx + B                                      7E4229C0 9 Bytes  [ 00, 59, 83, E6, FB, E9, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectoryEx + 15                                     7E4229CA 10 Bytes  [ 84, C3, 0F, 84, D8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectoryEx + 20                                     7E4229D5 36 Bytes  [ 08, 0F, 84, CE, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectoryEx + 46                                     7E4229FB 163 Bytes  [ 3D, 00, 08, 00, 00, 74, 2A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectoryEx + EA                                     7E422A9F 45 Bytes  [ F0, DD, 19, 83, E6, FE, E9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadImageW + 32                                                      7E422D30 29 Bytes  [ 00, A1, C8, E0, 97, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadImageW + 50                                                      7E422D4E 1 Byte  [ 22 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadImageW + 52                                                      7E422D50 40 Bytes  [ 65, C0, FE, 8D, 43, 18, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadImageA + A                                                       7E422D79 16 Bytes  [ 83, C4, 04, 83, 3D, 44, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadImageA + 1B                                                      7E422D8A 57 Bytes  [ 73, 20, DD, 43, 18, 83, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterClassExA + 24                                                7E422DC4 33 Bytes  [ 00, DD, 43, 18, 59, 59, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsW + 1D                                            7E422DE6 3 Bytes  [ 45, 10, DD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsW + 21                                            7E422DEA 1 Byte  [ 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsW + 23                                            7E422DEC 64 Bytes  [ 4D, 0E, DD, 5D, F8, 05, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsW + 64                                            7E422E2D 20 Bytes  [ 00, F0, FF, 75, 09, 39, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsW + 7A                                            7E422E43 21 Bytes  [ 23, C8, 66, 3B, C8, 75, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResourceEx + 2                                         7E423426 44 Bytes  [ 89, 85, 68, FE, FF, FF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResourceEx + 2F                                        7E423453 30 Bytes  [ 63, 0F, 84, BE, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResourceEx + 4E                                        7E423472 49 Bytes  [ 69, 74, 21, 83, FF, 6E, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExW + 11                                           7E4234A4 19 Bytes  [ 83, FB, 2D, 0F, 85, E0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExW + 26                                           7E4234B9 13 Bytes  [ 8B, 9D, 68, FE, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExW + 34                                           7E4234C7 69 Bytes  [ FF, 75, 0E, 88, 9D, 7C, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExW + 7A                                           7E42350D 6 Bytes  [ 74, 0C, 81, BD, 70, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExW + 81                                           7E423514 74 Bytes  [ FF, 5D, 01, 00, 00, 7E, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcW + C                                                      7E4237A6 30 Bytes  [ 73, 75, 13, 83, FB, 09, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcW + 2B                                                     7E4237C5 22 Bytes  [ 0F, BE, 95, 43, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcW + 42                                                     7E4237DC 8 Bytes  [ BE, 4C, 0D, DC, 33, CA, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcW + 4B                                                     7E4237E5 22 Bytes  [ 84, BB, 02, 00, 00, 80, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcW + 62                                                     7E4237FC 51 Bytes  [ FF, 00, 0F, 84, 88, 02, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemTextW + 6                                                  7E423D6B 18 Bytes  [ 8B, D8, 89, 9D, 68, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemTextW + 19                                                 7E423D7E 10 Bytes  [ FF, 00, 8D, 74, 1E, D0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemTextW + 24                                                 7E423D89 49 Bytes  [ FF, 74, 08, FF, 8D, 70, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemTextW + 56                                                 7E423DBB 37 Bytes  CALL 7E42310F C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItem + 13                                                      7E423DE1 6 Bytes  [ FF, 00, 83, BD, 58, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItem + 1B                                                      7E423DE9 6 Bytes  [ 00, 0F, 84, 1A, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItem + 22                                                      7E423DF0 49 Bytes  [ 80, BD, 6D, FE, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItem + 54                                                      7E423E22 17 Bytes  [ 89, 48, 04, EB, 16, 80, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItem + 66                                                      7E423E34 21 Bytes  [ 74, 04, 89, 01, EB, 03, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetActiveWindow + 9                                                  7E423E8E 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetActiveWindow + B                                                  7E423E90 39 Bytes  CALL 7E4230F6 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthW + 1F                                            7E423EB8 2 Bytes  [ 56, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthW + 22                                            7E423EBB 69 Bytes  [ 4C, FE, FF, FF, 80, 78, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthW + 68                                            7E423F01 7 Bytes  [ 83, C4, 10, 8B, 9D, 68, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthW + 70                                            7E423F09 54 Bytes  [ FF, 83, FB, FF, 75, 17, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthW + A7                                            7E423F40 15 Bytes  [ 53, 8B, DC, 51, 51, 83, E4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamAorW + D                                    7E4246DE 15 Bytes  [ 17, 98, 7C, 75, 0D, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamAorW + 1D                                   7E4246EE 7 Bytes  [ 00, 00, 56, E8, 23, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamAorW + 25                                   7E4246F6 26 Bytes  [ A1, 44, 17, 98, 7C, 8B, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamAorW + 40                                   7E424711 24 Bytes  [ 00, A1, 44, 17, 98, 7C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamAorW + 59                                   7E42472A 73 Bytes  [ F9, FF, 89, 3D, 44, 17, 98, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessage + 1E                                                   7E42517A 7 Bytes  [ 8D, 45, A4, 50, 8D, 45, A8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessage + 27                                                   7E425183 3 Bytes  [ 45, CC, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessage + 2B                                                   7E425187 2 Bytes  [ 75, C4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessage + 2E                                                   7E42518A 49 Bytes  [ 1E, 55, 00, 00, 84, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessage + 60                                                   7E4251BC 15 Bytes  [ 75, B8, FF, 55, AC, 89, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextW + 2B                                                 7E42525D 53 Bytes  [ 00, 10, 00, 00, 8B, 86, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageW + 1                                              7E425293 2 Bytes  [ 45, DC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageW + 4                                              7E425296 49 Bytes  [ 8E, A0, 00, 00, 00, 8D, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageW + 36                                             7E4252C8 13 Bytes  [ 00, 00, 8A, 47, 40, 24, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageW + 45                                             7E4252D7 20 Bytes  [ 1B, C0, F7, D8, 05, 01, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageW + 5B                                             7E4252ED 43 Bytes  [ 86, A4, 00, 00, 00, 89, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadBitmapA + 27                                                     7E425517 117 Bytes  [ 00, 00, 83, C3, 18, FF, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamW + 2E                                                 7E42558D 2 Bytes  [ 35, 9C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamW + 31                                                 7E425590 6 Bytes  [ 97, 7C, E8, 96, A9, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamW + 38                                                 7E425597 6 Bytes  [ 89, 7E, 4C, 89, BE, D4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamW + 3F                                                 7E42559E 6 Bytes  [ 00, 00, 6A, 0E, 58, EB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamW + 46                                                 7E4255A5 2 Bytes  [ 90, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorFrameInfo + 5                                               7E4255B1 80 Bytes  [ 0C, 8B, 45, 08, 8B, 90, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorFrameInfo + 56                                              7E425602 7 Bytes  [ 00, 75, 0C, C7, 45, 0C, 22 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorFrameInfo + 5E                                              7E42560A 5 Bytes  [ 00, 80, E9, EE, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorFrameInfo + 64                                              7E425610 136 Bytes  [ 00, 8B, 45, 08, 83, 65, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCursorFrameInfo + ED                                              7E425699 47 Bytes  [ 30, 89, 96, 8C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateW + 49                                                      7E425796 181 Bytes  [ 7D, 08, 0A, 7C, 06, 89, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateW + FF                                                      7E42584C 48 Bytes  CALL 7E428023 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateW + 130                                                     7E42587D 33 Bytes  [ 9E, A4, 00, 00, 00, 85, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateW + 152                                                     7E42589F 8 Bytes  [ 57, 89, 10, 56, 89, 42, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateW + 15B                                                     7E4258A8 39 Bytes  [ FC, FF, FF, 8D, 4F, 18, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamAorW + E                                       7E425959 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamAorW + 10                                      7E42595B 25 Bytes  [ 75, FC, 8D, 45, BC, 53, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamAorW + 2A                                      7E425975 5 Bytes  [ 75, 83, 7D, EC, 38 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamAorW + 30                                      7E42597B 18 Bytes  [ 11, F6, 43, 2C, 20, 74, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamAorW + 43                                      7E42598E 95 Bytes  [ 45, 14, 89, 45, F4, 33, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDialog + 25                                                       7E4259EE 12 Bytes  [ 35, 9C, FF, 97, 7C, E8, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDialog + 32                                                       7E4259FB 73 Bytes  [ FF, FF, C7, 45, 08, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDialog + 7D                                                       7E425A46 9 Bytes  CALL 7E3B10DE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDialog + 87                                                       7E425A50 96 Bytes  [ C3, 5B, C3, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndDialog + E8                                                       7E425AB1 41 Bytes  CALL 7E427376 C:\WINDOWS\system32\USER32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDlgButtonChecked + 51                                              7E425DC6 13 Bytes  [ 0E, 01, 00, 00, 8D, 7E, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDlgButtonChecked + 5F                                              7E425DD4 75 Bytes  [ 00, 00, 00, 53, 89, 46, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDlgButtonChecked + AB                                              7E425E20 29 Bytes  [ 75, 07, C7, 47, 2C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDlgButtonChecked + CA                                              7E425E3F 98 Bytes  [ 0B, 86, 94, 00, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDlgButtonChecked + 12D                                             7E425EA2 51 Bytes  [ 74, 32, FF, 76, 08, E8, 42, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExW + 40                                                 7E426FE8 7 Bytes  [ 1D, C0, 16, 98, 7C, 74, 0F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExW + 48                                                 7E426FF0 10 Bytes  [ 76, 0C, 68, E0, 71, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExW + 54                                                 7E426FFC 67 Bytes  CALL 7E3F2AAC 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExW + 98                                                 7E427040 84 Bytes  [ 00, 83, C3, 48, 8B, CB, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExW + ED                                                 7E427095 80 Bytes  [ 81, FE, 00, 01, 00, 00, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesW + 25                                             7E42714D 13 Bytes  [ 5D, E4, 85, C0, 0F, 84, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesW + 33                                             7E42715B 3 Bytes  [ 7D, AC, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesW + 37                                             7E42715F 34 Bytes  [ 0F, 84, 51, 9B, 01, 00, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplayDevicesW + 5A                                             7E427182 123 Bytes  [ FF, FF, FF, 30, 56, 8B, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterShellHookWindow + E                                          7E4271FE 77 Bytes  [ 8B, 45, 9C, 8B, 58, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongW + 15                                                   7E42724C 10 Bytes  [ 00, 8B, F0, C1, EE, 0D, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongW + 20                                                   7E427257 25 Bytes  [ 00, 03, F1, 89, B5, 4C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongW + 3A                                                   7E427271 213 Bytes  [ 25, FF, FF, 00, 00, 0B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongW + 111                                                  7E427348 3 Bytes  [ DC, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongW + 115                                                  7E42734C 120 Bytes  [ 0F, B6, 46, 17, 8B, 4D, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgn + 4C                                                    7E42757B 42 Bytes  [ 8B, F8, 8B, C2, F0, 0F, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgn + 77                                                    7E4275A6 46 Bytes  [ 8B, 0A, 85, C9, 74, 35, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgn + A6                                                    7E4275D5 87 Bytes  JMP 7E427503 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgn + FF                                                    7E42762E 12 Bytes  [ 89, 45, E0, 83, 4D, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowRgn + 10D                                                   7E42763C 3 Bytes  [ D4, 04, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenuItemInfoW + F                                                 7E427851 5 Bytes  [ FF, FF, C6, 46, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenuItemInfoW + 15                                                7E427857 13 Bytes  JMP 7E400F75 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenuItemInfoW + 23                                                7E427865 43 Bytes  [ 8B, 87, 80, 05, 00, 00, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuW + 16                                                     7E427891 22 Bytes  [ 8B, D8, 66, 81, 65, 0E, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuW + 2E                                                     7E4278A9 66 Bytes  CALL 7E4000C0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuW + 71                                                     7E4278EC 36 Bytes  [ 02, FE, 7F, 02, 0F, 85, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuW + 96                                                     7E427911 55 Bytes  JMP 7E4272B3 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowWindowAsync + B                                                  7E427949 10 Bytes  [ 66, 83, 7E, 08, 00, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExA + 2                                           7E427954 52 Bytes  JMP 7E440B01 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExA + 37                                          7E427989 35 Bytes  [ 00, 57, 89, 45, FC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExA + 5B                                          7E4279AD 22 Bytes  [ 00, 8B, C3, F0, 0F, B1, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExA + 72                                          7E4279C4 25 Bytes  [ FF, 8B, 4D, 14, 2B, CB, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExA + 8C                                          7E4279DE 211 Bytes  JMP 7E4278D9 C:\WINDOWS\system32\USER32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsA + 1                                             7E427AC7 81 Bytes  [ C1, F0, 0F, B1, 13, 3B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemW + 29                                                      7E427B19 88 Bytes  [ 8C, B7, B4, 00, 00, 00, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemW + 82                                                      7E427B72 10 Bytes  CALL 7E4000C2 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemW + 8D                                                      7E427B7D 62 Bytes  [ AB, 89, 01, 00, 8D, 4E, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuW + 13                                                     7E427BBC 80 Bytes  JMP B20DAEC4 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuW + 65                                                     7E427C0E 105 Bytes  [ 00, 89, 7D, F0, 8B, 47, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuW + CF                                                     7E427C78 27 Bytes  [ 01, 00, 8D, 51, 1C, 8B, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadRemoteFonts + 6                                                  7E427C94 50 Bytes  [ 85, 6A, F8, FF, FF, 83, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadRemoteFonts + 39                                                 7E427CC7 6 Bytes  [ 76, 24, E8, 5F, 82, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadRemoteFonts + 40                                                 7E427CCE 33 Bytes  [ 83, 65, E4, 00, 83, 65, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadRemoteFonts + 62                                                 7E427CF0 110 Bytes  CALL 7E3FFF2B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamW + 10                                              7E427D5F 42 Bytes  [ FF, 0F, 84, 3E, 07, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamW + 3B                                              7E427D8A 149 Bytes  [ 08, A3, 60, 09, 98, 7C, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamW + D2                                              7E427E21 1 Byte  [ 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamW + D4                                              7E427E23 3 Bytes  [ D9, 68, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamW + D8                                              7E427E27 68 Bytes  CALL 7E4000C1 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterHotKey + 15                                                  7E427EDC 12 Bytes  JMP 7E4271F4 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterHotKey + 23                                                  7E427EEA 5 Bytes  [ 8B, F8, 89, 7D, CC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterHotKey + 29                                                  7E427EF0 71 Bytes  [ B6, 78, 05, 00, 00, E8, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterHotKey + 71                                                  7E427F38 74 Bytes  CALL 7E427F4D C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterHotKey + BC                                                  7E427F83 28 Bytes  [ C6, 45, E7, 00, 33, FF, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterUserApiHook + 34                                           7E428044 5 Bytes  [ 61, 00, 67, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterUserApiHook + 3C                                           7E42804C 3 Bytes  [ 56, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterUserApiHook + 40                                           7E428050 7 Bytes  [ 72, 00, 69, 00, 66, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterUserApiHook + 48                                           7E428058 5 Bytes  [ 65, 00, 72, 00, 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterUserApiHook + 4E                                           7E42805E 13 Bytes  [ 65, 00, 62, 00, 75, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExW + 39                                          7E428833 104 Bytes  [ 00, 52, 74, 6C, 70, 43, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDisplaySettingsExW + A2                                          7E42889C 174 Bytes  [ 65, 72, 20, 64, 61, 74, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CsrBroadcastSystemMessageExW + 39                                    7E42894B 141 Bytes  [ 73, 65, 72, 20, 64, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CsrBroadcastSystemMessageExW + C7                                    7E4289D9 18 Bytes  [ EC, 83, EC, 0C, 53, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CsrBroadcastSystemMessageExW + DA                                    7E4289EC 25 Bytes  [ 00, C0, 89, 5D, FC, 74, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CsrBroadcastSystemMessageExW + F4                                    7E428A06 72 Bytes  [ 03, C6, 3B, D1, 76, 21, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CsrBroadcastSystemMessageExW + 13D                                   7E428A4F 11 Bytes  [ F8, 50, 8D, 45, FC, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgTabItem + 1                                                7E428A5B 69 Bytes  [ 45, FC, 48, 48, 0F, 84, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgTabItem + 47                                               7E428AA1 35 Bytes  [ 89, 55, 08, 3B, 55, 14, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrintWindow + 1E                                                     7E428AC5 35 Bytes  [ 7B, 10, 89, 7E, 08, 8B, 7B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsExA + 4                                         7E428AE9 79 Bytes  [ 7B, 30, 89, 7E, 20, 8B, 7B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsExA + 55                                        7E428B3A 31 Bytes  JMP 723B1641 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsExA + 75                                        7E428B5A 15 Bytes  [ 40, 40, 8B, 4B, 14, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsExA + 85                                        7E428B6A 366 Bytes  JMP 723B1671 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuDefaultItem + 4A                                              7E428CD9 2 Bytes  [ 4D, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuDefaultItem + 4D                                              7E428CDC 275 Bytes  [ 41, 18, 8B, 5D, 0C, 8B, 13, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoW + 9E                                                7E428DF0 82 Bytes  [ 8B, 4B, 04, 89, 0E, 8B, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoW + F1                                                7E428E43 27 Bytes  [ 85, C9, 74, 5B, 6B, C9, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoW + 10D                                               7E428E5F 57 Bytes  [ 76, 3D, 8B, 4D, 18, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoW + 147                                               7E428E99 60 Bytes  [ 3B, 4B, 0C, 72, C3, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemInfoW + 184                                               7E428ED6 73 Bytes  [ 69, 76, 61, 74, 69, 6F, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuState + C7                                                    7E429056 9 Bytes  [ 75, 08, FF, 75, 0C, E8, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuState + D1                                                    7E429060 80 Bytes  [ 8B, 46, 30, 43, 81, C7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuState + 122                                                   7E4290B1 75 Bytes  [ 0A, B8, 17, 00, 00, C0, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuState + 16E                                                   7E4290FD 71 Bytes  [ 00, EB, C2, 39, 7D, FC, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuState + 1B6                                                   7E429145 188 Bytes  [ 7D, E4, 89, 75, C4, 89, 7D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterMessagePumpHook + 64                                       7E429494 40 Bytes  [ 8B, FF, 55, 8B, EC, 81, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchDesktop + 28                                                   7E4294BE 49 Bytes  [ F3, AB, 89, B5, 20, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchDesktop + 5A                                                   7E4294F0 22 Bytes  CALL 7E426679 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchDesktop + 71                                                   7E429507 47 Bytes  [ 00, 8B, 43, 64, 89, 45, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchDesktop + A1                                                   7E429537 55 Bytes  JMP 7E429990 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchDesktop + D9                                                   7E42956F 27 Bytes  [ 00, 00, 8D, 7A, 18, 8D, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindowEx + 41                                                7E4295FB 6 Bytes  [ FF, 89, 85, 18, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindowEx + 48                                                7E429602 46 Bytes  [ 8B, 85, F0, FE, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindowEx + 79                                                7E429633 9 Bytes  [ 90, 00, 00, 00, 89, B5, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindowEx + 83                                                7E42963D 19 Bytes  [ 89, 85, 04, FF, FF, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindowEx + 97                                                7E429651 17 Bytes  [ FF, B5, 0C, FF, FF, FF, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SubtractRect + 2C                                                    7E42978C 10 Bytes  [ 89, 85, 18, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SubtractRect + 38                                                    7E429798 159 Bytes  [ 6A, 0E, 89, 85, 1C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SubtractRect + D9                                                    7E429839 15 Bytes  CALL 7E3BDF7D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SubtractRect + E9                                                    7E429849 5 Bytes  [ 50, FF, B5, 2C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SubtractRect + F0                                                    7E429850 4 Bytes  CALL 7E3BD32E 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadBitmapW + B                                                      7E429865 8 Bytes  [ FF, 50, 57, C7, 85, 18, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadBitmapW + 14                                                     7E42986E 22 Bytes  [ 8C, 00, 00, 00, 89, B5, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTaskmanWindow + D                                                 7E429885 66 Bytes  [ 56, 56, 6A, 04, 8D, 45, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTaskmanWindow + 51                                                7E4298C9 21 Bytes  [ FF, 8B, 45, D8, 6A, 0E, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTaskmanWindow + 67                                                7E4298DF 62 Bytes  [ FF, FF, 50, 57, C7, 85, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTaskmanWindow + A6                                                7E42991E 5 Bytes  [ 50, FF, B5, 2C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetTaskmanWindow + AC                                                7E429924 13 Bytes  CALL 7E3BD32D 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleW + 16                                          7E429A75 127 Bytes  [ 7B, 7C, 89, BD, D8, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleW + 96                                          7E429AF5 21 Bytes  [ 35, 9C, FF, 97, 7C, E8, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleW + AC                                          7E429B0B 24 Bytes  [ FF, 50, 68, 78, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleW + C5                                          7E429B24 99 Bytes  [ FF, 78, 01, 00, 00, 73, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleW + 129                                         7E429B88 164 Bytes  [ 8D, 85, E4, FC, FF, FF, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeW + 3C                                                  7E429D2B 78 Bytes  [ 75, 0C, 8B, 85, 00, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeW + 8B                                                  7E429D7A 18 Bytes  [ 8B, 85, F8, FC, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeW + 9E                                                  7E429D8D 22 Bytes  [ 00, 56, 6A, 00, FF, 35, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeW + B5                                                  7E429DA4 27 Bytes  [ 0F, 84, 48, 06, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeW + D1                                                  7E429DC0 61 Bytes  [ 32, 8B, 43, 08, 89, 42, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeNameService + 2                                                   7E429E78 29 Bytes  [ FF, DB, 85, F4, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeNameService + 20                                                  7E429E96 21 Bytes  [ 17, 95, 7C, D9, ED, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeNameService + 36                                                  7E429EAC 12 Bytes  [ 33, D2, 42, 8B, C8, D3, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeNameService + 43                                                  7E429EB9 20 Bytes  [ 76, 08, FF, B5, F8, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeNameService + 58                                                  7E429ECE 39 Bytes  [ FD, FF, FF, 8B, 85, A8, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AnimateWindow + 27                                                   7E42A04B 102 Bytes  [ C7, 86, 08, 01, 00, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AnimateWindow + 8E                                                   7E42A0B2 36 Bytes  [ FD, FF, FF, 89, 06, 8A, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AnimateWindow + B3                                                   7E42A0D7 26 Bytes  [ 89, 46, 08, C7, 46, 28, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AnimateWindow + CF                                                   7E42A0F3 19 Bytes  [ 89, 46, 0C, 8B, 43, 40, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AnimateWindow + E3                                                   7E42A107 56 Bytes  [ 00, 01, 00, 74, 05, 89, 4E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterLogonProcess + 1                                             7E42AA42 75 Bytes  [ 75, 08, FF, 75, 08, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterLogonProcess + 4D                                            7E42AA8E 116 Bytes  [ 55, 8B, EC, 80, 7D, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterLogonProcess + C2                                            7E42AB03 43 Bytes  [ 83, 65, FC, 00, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterLogonProcess + EE                                            7E42AB2F 29 Bytes  [ 90, FF, FF, FF, FF, 17, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterLogonProcess + 10D                                           7E42AB4E 1 Byte  [ 08 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetUserObjectSecurity + 1E                                           7E42B882 47 Bytes  [ 79, 00, 20, 00, 64, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationW + 24                                            7E42B8B2 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationW + 26                                            7E42B8B4 3 Bytes  [ 45, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationW + 2A                                            7E42B8B8 12 Bytes  [ 65, 00, 6E, 00, 74, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationW + 37                                            7E42B8C5 2 Bytes  [ 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationW + 3A                                            7E42B8C8 11 Bytes  [ 6F, 00, 67, 00, 20, 00, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopW + 41                                                  7E42BB1C 25 Bytes  [ 74, 00, 74, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopW + 5B                                                  7E42BB36 21 Bytes  [ 64, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopW + 71                                                  7E42BB4C 5 Bytes  [ 2C, 00, 20, 00, 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopW + 77                                                  7E42BB52 17 Bytes  [ 75, 00, 74, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopW + 89                                                  7E42BB64 25 Bytes  [ 74, 00, 6C, 00, 6F, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdatePerUserSystemParameters + 1B                                   7E42BC4C 31 Bytes  [ A0, 01, 01, 00, 4D, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdatePerUserSystemParameters + 3B                                   7E42BC6C 17 Bytes  [ 63, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdatePerUserSystemParameters + 4D                                   7E42BC7E 15 Bytes  [ 20, 00, 61, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdatePerUserSystemParameters + 5D                                   7E42BC8E 9 Bytes  [ 72, 00, 20, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UpdatePerUserSystemParameters + 67                                   7E42BC98 5 Bytes  [ 73, 00, 68, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowStationUser + 2B                                            7E42BFAA 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowStationUser + 2D                                            7E42BFAC 7 Bytes  [ 63, 00, 63, 00, 6F, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowStationUser + 35                                            7E42BFB4 27 Bytes  [ 6E, 00, 74, 00, 2E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowStationUser + 51                                            7E42BFD0 13 Bytes  [ 6C, 00, 6F, 00, 62, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowStationUser + 5F                                            7E42BFDE 49 Bytes  [ 73, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowStation + 5                                                7E42C010 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowStation + 7                                                7E42C012 7 Bytes  [ 61, 00, 63, 00, 63, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowStation + F                                                7E42C01A 3 Bytes  [ 75, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowStation + 13                                               7E42C01E 59 Bytes  [ 74, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowStation + 4F                                               7E42C05A 25 Bytes  [ 68, 00, 65, 00, 20, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericW + 4F                                             7E42C148 17 Bytes  [ 65, 00, 20, 00, 61, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericW + 61                                             7E42C15A 43 Bytes  [ 20, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterDeviceNotificationA + 14                                     7E42C186 9 Bytes  [ 73, 00, 74, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterDeviceNotificationA + 1E                                     7E42C190 11 Bytes  [ 63, 00, 6F, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterDeviceNotificationA + 2A                                     7E42C19C 43 Bytes  [ 20, 00, 55, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookW + 7                                                  7E42C1C8 41 Bytes  [ 61, 00, 63, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHook + 16                                               7E42C1F2 15 Bytes  [ 20, 00, 61, 00, 63, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHook + 26                                               7E42C202 27 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHook + 42                                               7E42C21E 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHook + 44                                               7E42C220 21 Bytes  [ 20, 00, 73, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWindowsHook + 5B                                               7E42C237 70 Bytes  [ 00, D0, 00, 01, 00, 54, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterUserApiHook + A                                              7E42C340 21 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterUserApiHook + 20                                             7E42C356 69 Bytes  [ 61, 00, 20, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterUserApiHook + 66                                             7E42C39C 23 Bytes  [ 61, 00, 74, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterUserApiHook + 7E                                             7E42C3B4 33 Bytes  [ 65, 00, 74, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterUserApiHook + A0                                             7E42C3D6 51 Bytes  [ 00, 00, 84, 00, 01, 00, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AllowSetForegroundWindow + 13                                        7E42C48A 19 Bytes  [ 6F, 00, 6E, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AllowSetForegroundWindow + 27                                        7E42C49E 57 Bytes  [ 6E, 00, 20, 00, 64, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AllowSetForegroundWindow + 61                                        7E42C4D8 33 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AllowSetForegroundWindow + 83                                        7E42C4FA 7 Bytes  [ 65, 00, 20, 00, 6C, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AllowSetForegroundWindow + 8B                                        7E42C502 33 Bytes  [ 6E, 00, 67, 00, 75, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterMessagePumpHook + C                                          7E42C524 25 Bytes  [ 62, 00, 65, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterMessagePumpHook + 26                                         7E42C53E 48 Bytes  [ 68, 00, 65, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterMessagePumpHook + 57                                         7E42C56F 108 Bytes  [ 00, 66, 00, 66, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterServicesProcess + 12                                         7E42C5DC 41 Bytes  [ 74, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterServicesProcess + 3C                                         7E42C606 9 Bytes  [ 68, 00, 65, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLogonNotifyWindow + 5                                             7E42C610 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLogonNotifyWindow + 7                                             7E42C612 7 Bytes  [ 66, 00, 65, 00, 72, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLogonNotifyWindow + F                                             7E42C61A 43 Bytes  [ 69, 00, 73, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLogonNotifyWindow + 3B                                            7E42C646 9 Bytes  [ 63, 00, 69, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLogonNotifyWindow + 45                                            7E42C650 5 Bytes  [ 64, 00, 20, 00, 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageW + 7                                          7E42CD64 1 Byte  [ 7A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageW + 9                                          7E42CD66 23 Bytes  [ 65, 00, 64, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageW + 21                                         7E42CD7E 69 Bytes  [ 61, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageW + 67                                         7E42CDC4 21 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageW + 7D                                         7E42CDDA 9 Bytes  [ 72, 00, 61, 00, 6E, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterDeviceNotificationW + 7                                      7E42CFB8 17 Bytes  [ 20, 00, 73, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterDeviceNotificationW + 19                                     7E42CFCA 21 Bytes  [ 0D, 00, 0A, 00, 00, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterDeviceNotification + 11                                    7E42CFE0 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterDeviceNotification + 13                                    7E42CFE2 95 Bytes  [ 72, 00, 79, 00, 20, 00, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterDeviceNotification + 75                                    7E42D044 41 Bytes  [ 8B, FF, 55, 8B, EC, 83, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterDeviceNotification + A0                                    7E42D06F 13 Bytes  [ B0, 77, 03, 83, C3, 40, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterDeviceNotification + AE                                    7E42D07D 126 Bytes  [ 33, C0, 8D, 7D, B4, F3, AB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDesktopWindows + 1C                                              7E42D1ED 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDesktopsW + 7                                                    7E42D1F9 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDesktopsW + 19                                                   7E42D20B 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopW + 2A                                                    7E42D23A 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopW + 37                                                    7E42D247 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopW + 43                                                    7E42D253 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopW + 51                                                    7E42D261 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopW + 58                                                    7E42D268 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PaintDesktop + 5                                                     7E42D307 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PaintDesktop + 7                                                     7E42D309 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PaintDesktop + F                                                     7E42D311 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetConsoleReserveKeys + 5                                            7E42D31B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetConsoleReserveKeys + 7                                            7E42D31D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetConsoleReserveKeys + F                                            7E42D325 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ActivateKeyboardLayout + 5                                           7E42D32F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ActivateKeyboardLayout + 7                                           7E42D331 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ActivateKeyboardLayout + F                                           7E42D339 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ActivateKeyboardLayout + 19                                          7E42D343 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ActivateKeyboardLayout + 1B                                          7E42D345 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReplyMessage + 13                                                    7E42D3B5 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableW + 5                                          7E42D3C6 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableW + 7                                          7E42D3C8 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableW + F                                          7E42D3D0 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableW + 36                                         7E42D3F7 71 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableW + 7E                                         7E42D43F 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnlockWindowStation + 5                                              7E42D6E4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnlockWindowStation + 7                                              7E42D6E6 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnlockWindowStation + F                                              7E42D6EE 121 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExA + B                                                  7E42D769 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExA + 17                                                 7E42D775 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExA + 2A                                                 7E42D788 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExA + 41                                                 7E42D79F 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoExA + 44                                                 7E42D7A2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPlacement + 5                                               7E42D851 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPlacement + 7                                               7E42D853 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowPlacement + F                                               7E42D85B 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockSetForegroundWindow + 13                                         7E42D873 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyIcon + 36                                                        7E42D8AE 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyIcon + 45                                                        7E42D8BD 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessageW + 17                                                7E42D8D9 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessageW + 2C                                                7E42D8EE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessageW + 35                                                7E42D8F7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessageW + 38                                                7E42D8FA 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessageW + 47                                                7E42D909 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilterW + F                                                   7E42D9BB 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilterW + 13                                                  7E42D9BF 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilterW + 19                                                  7E42D9C5 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilterW + 1F                                                  7E42D9CB 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilterW + 25                                                  7E42D9D1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseDesktop + 5                                                     7E42DCDA 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseDesktop + 7                                                     7E42DCDC 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseDesktop + F                                                     7E42DCE4 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseDesktop + 12                                                    7E42DCE7 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseDesktop + 33                                                    7E42DD08 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExW + 7                                                7E42DDBC 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExW + 1C                                               7E42DDD1 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExW + 46                                               7E42DDFB 89 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExW + A0                                               7E42DE55 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExW + A9                                               7E42DE5E 65 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowA + 19                                                     7E42DEA0 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowA + 3A                                                     7E42DEC1 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowA + 4A                                                     7E42DED1 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowA + 5E                                                     7E42DEE5 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowA + 6E                                                     7E42DEF5 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextA + 8                                                        7E42DF58 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextA + 18                                                       7E42DF68 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextA + 1B                                                       7E42DF6B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharNextA + 25                                                       7E42DF75 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevA + 13                                                       7E42DF8D 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevA + 1F                                                       7E42DF99 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevA + 29                                                       7E42DFA3 67 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadStringA + 3F                                                     7E42DFE7 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadStringA + 4E                                                     7E42DFF6 190 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostThreadMessageA + 19                                              7E42E0B5 252 Bytes  [ C0, EB, 4B, B8, E5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowW + 78                                                     7E42E1B2 22 Bytes  [ 57, 6A, 02, 5F, 57, FF, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowW + 8F                                                     7E42E1C9 9 Bytes  [ FF, 01, 89, 7D, F8, E8, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostQuitMessage + 2                                                  7E42E1D3 16 Bytes  [ 8B, 4D, 30, B8, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostQuitMessage + 13                                                 7E42E1E4 93 Bytes  [ BE, 23, 00, 00, C0, 74, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostQuitMessage + 71                                                 7E42E242 133 Bytes  [ 00, 00, 85, 45, 0C, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PostQuitMessage + F7                                                 7E42E2C8 170 Bytes  [ 33, C0, 3B, C3, 0F, 8C, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGUIThreadInfo + 14                                                7E42E373 56 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGUIThreadInfo + 4D                                                7E42E3AC 49 Bytes  [ 3B, C3, 89, 06, 74, 4B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGUIThreadInfo + 7F                                                7E42E3DE 11 Bytes  [ 36, 53, FF, 75, F4, E8, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGUIThreadInfo + 8B                                                7E42E3EA 31 Bytes  [ 23, 00, 00, C0, 89, 1E, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGUIThreadInfo + AB                                                7E42E40A 212 Bytes  [ 36, 53, FF, 75, F4, E8, 19, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerA + 2                                                       7E42E5C4 20 Bytes  [ 85, C0, 0F, 8C, 15, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerA + 17                                                      7E42E5D9 21 Bytes  [ 84, C0, 0F, 84, 00, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerA + 2D                                                      7E42E5EF 62 Bytes  [ FF, FF, 39, 45, EC, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerA + 6D                                                      7E42E62F 151 Bytes  [ 00, A1, C8, E0, 97, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerA + 105                                                     7E42E6C7 35 Bytes  CALL 7E3E9C4C 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffA + 26                                                  7E42E716 37 Bytes  [ 50, 33, C9, 8D, 45, CF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffA + 4D                                                  7E42E73D 13 Bytes  [ FF, 51, 8D, 8D, 38, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffA + 5B                                                  7E42E74B 7 Bytes  [ FF, 51, 8D, 8D, 38, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffA + 63                                                  7E42E753 4 Bytes  [ 51, 50, 6A, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharLowerBuffA + 68                                                  7E42E758 4 Bytes  [ 75, 14, 50, 50 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessageEx + F                                                  7E42E7EE 39 Bytes  [ 16, 3C, 06, 74, 12, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessageEx + 37                                                 7E42E816 65 Bytes  [ 83, E0, 03, 83, E1, 08, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessageEx + 79                                                 7E42E858 50 Bytes  [ B7, 43, 02, FF, 45, E8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InSendMessageEx + AC                                                 7E42E88B 76 Bytes  CALL 450C6D90 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetThreadDesktop + 7                                                 7E42E8D8 26 Bytes  [ 00, 8B, 45, EC, 8A, 18, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetProcessWindowStation + E                                          7E42E8F3 15 Bytes  [ 8B, 75, D4, 89, 45, F0, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetProcessWindowStation + 1E                                         7E42E903 165 Bytes  [ 84, DB, 74, 1E, 80, FB, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserClientDllInitialize + 43                                         7E42E9A9 53 Bytes  [ 84, C0, 74, 2E, 8B, 46, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserClientDllInitialize + 79                                         7E42E9DF 3 Bytes  [ B7, 40, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserClientDllInitialize + 7D                                         7E42E9E3 25 Bytes  [ 45, DC, 0F, B7, 47, 04, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserClientDllInitialize + 97                                         7E42E9FD 5 Bytes  [ 45, EC, 0F, B7, 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserClientDllInitialize + 9D                                         7E42EA03 164 Bytes  [ 01, 45, EC, 8B, 45, C0, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendInput + 9                                                        7E42F10A 12 Bytes  [ FF, 53, 53, 8D, 45, C8, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendInput + 16                                                       7E42F117 115 Bytes  CALL 7E403BEB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExW + E                                                     7E42F18B 1 Byte  [ FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExW + 10                                                    7E42F18D 67 Bytes  [ 85, C0, 0F, 8C, 66, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExW + 54                                                    7E42F1D1 4 Bytes  [ 8C, 25, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExW + 59                                                    7E42F1D6 1 Byte  [ 39 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExW + 5B                                                    7E42F1D8 4 Bytes  [ DC, 0F, 84, B3 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTopWindow + 39                                                    7E42F255 125 Bytes  [ 00, 39, 75, DC, 74, 37, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMenu + C                                                       7E42F2D3 28 Bytes  CALL 7E3FD6EB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMenu + 29                                                      7E42F2F0 32 Bytes  [ 8D, 45, E4, 50, 6A, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMenu + 4A                                                      7E42F311 15 Bytes  CALL 7E3FFF2B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMenu + 5A                                                      7E42F321 6 Bytes  [ C7, 45, F8, 20, 6C, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMenu + 61                                                      7E42F328 7 Bytes  [ EB, 0B, 8D, 45, F8, 50, 6A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageA + 25                                                    7E42F3A8 6 Bytes  [ FF, C7, 45, 0C, 17, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageA + 2C                                                    7E42F3AF 5 Bytes  [ C0, E9, 72, 74, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageA + 32                                                    7E42F3B5 72 Bytes  [ 39, 7D, 14, 0F, 84, CE, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageA + 7B                                                    7E42F3FE 162 Bytes  [ 00, C0, EB, 4B, FF, 75, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassNameA + 81                                                   7E42F4A1 74 Bytes  JMP 7E428764 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassLongA + 3B                                                   7E42F4EC 56 Bytes  [ FF, 85, C0, 7C, 1A, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumThreadWindows + 2C                                               7E42F525 189 Bytes  [ 97, 7C, 57, 68, 5E, F6, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUpdateRgn + 37                                                    7E42F5E3 48 Bytes  CALL 7E403E8F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputState + 6                                                    7E42F614 5 Bytes  [ 78, 00, 65, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputState + C                                                    7E42F61A 2 Bytes  [ 75, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputState + F                                                    7E42F61D 14 Bytes  [ 00, 65, 00, 4F, 00, 70, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputState + 1E                                                   7E42F62C 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputState + 20                                                   7E42F62E 37 Bytes  [ 00, 00, 00, 00, 44, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ValidateRgn + 16                                                     7E42F654 17 Bytes  [ 69, 00, 64, 00, 65, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretPos + 5                                                      7E42F666 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretPos + 7                                                      7E42F668 7 Bytes  [ 6F, 00, 77, 00, 6E, 00, 46 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretPos + F                                                      7E42F670 5 Bytes  [ 6C, 00, 61, 00, 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretPos + 15                                                     7E42F676 9 Bytes  [ 73, 00, 00, 00, 4D, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetCaretPos + 1F                                                     7E42F680 5 Bytes  [ 69, 00, 6D, 00, 75 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollPos + 14                                                    7E42F6D8 10 Bytes  [ 5F, 00, 48, 00, 45, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollPos + 20                                                    7E42F6E4 65 Bytes  [ CC, CC, CC, CC, CC, CC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollPos + 16                                                    7E42F726 32 Bytes  JMP 7E413740 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollRange                                                       7E42F747 78 Bytes  [ 90, 90, 90, 90, 8B, 5D, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollRange + 50                                                  7E42F797 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollRange + 54                                                  7E42F79B 28 Bytes  JMP 7E408D2B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollRange + 71                                                  7E42F7B8 25 Bytes  [ 50, 6A, 0C, 8D, 85, 78, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetScrollRange + 8B                                                  7E42F7D2 51 Bytes  [ 00, 80, 0F, 85, FA, 3C, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FrameRect + 2                                                        7E42F8EC 18 Bytes  [ FF, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FrameRect + 15                                                       7E42F8FF 5 Bytes  [ 8B, B5, C0, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FrameRect + 1B                                                       7E42F905 50 Bytes  [ 8B, 9D, CC, FE, FF, FF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFocusRect + 2A                                                   7E42F939 6 Bytes  [ 00, C7, 45, FC, 02, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFocusRect + 31                                                   7E42F940 9 Bytes  [ 00, 8B, 47, 04, 89, 85, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFocusRect + 3B                                                   7E42F94A 32 Bytes  [ 8D, 4F, 08, 89, 8D, 90, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollRange + 10                                                  7E42F96B 26 Bytes  [ 76, 06, 89, 85, D4, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollRange + 2B                                                  7E42F986 73 Bytes  [ EB, 07, 83, A5, A8, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollRange + 75                                                  7E42F9D0 4 Bytes  [ 83, BD, D0, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollRange + 7B                                                  7E42F9D6 11 Bytes  [ 00, 0F, 8C, 1B, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetScrollRange + 88                                                  7E42F9E3 4 Bytes  [ 39, 85, D4, FE ]
