.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRealizePalette + 1                                               7E42FA17 13 Bytes  [ 85, C8, FE, FF, FF, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRealizePalette + F                                               7E42FA25 86 Bytes  CALL 7E3F20F3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowCursor + 4E                                                      7E42FA7C 30 Bytes  [ 00, 66, 8B, 48, 14, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAccelerator + 17                                            7E42FA9B 9 Bytes  [ 78, 1E, 66, 0B, FA, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAccelerator + 21                                            7E42FAA5 25 Bytes  [ 18, 89, 8E, B0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAccelerator + 3B                                            7E42FABF 15 Bytes  [ 83, C0, 02, 66, 89, 86, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TranslateAccelerator + 4B                                            7E42FACF 114 Bytes  CALL 7E4000C1 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageTimeoutA + 17                                             7E42FB42 17 Bytes  [ 50, 8D, 85, DC, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageTimeoutA + 2A                                             7E42FB55 12 Bytes  [ 8D, 85, D8, FE, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendMessageTimeoutA + 37                                             7E42FB62 31 Bytes  CALL 7E442D03 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ValidateRect + 5                                                     7E42FB82 9 Bytes  [ 8B, D8, C1, E3, 08, 8D, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ValidateRect + F                                                     7E42FB8C 8 Bytes  [ 00, 66, 89, 1F, 8D, 85, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ValidateRect + 19                                                    7E42FB96 69 Bytes  [ 50, 8D, 85, DC, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawEdge + 26                                                        7E42FBDC 65 Bytes  [ 8B, D8, 85, DB, 0F, 84, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawEdge + 68                                                        7E42FC1E 7 Bytes  [ 6C, 00, 69, 00, 63, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawEdge + 70                                                        7E42FC26 33 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawEdge + 92                                                        7E42FC48 13 Bytes  [ 69, 00, 6F, 00, 6E, 00, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawEdge + A0                                                        7E42FC56 26 Bytes  [ 00, 00, 4C, 64, 72, 51, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongA + 1E                                                   7E42FE4F 77 Bytes  [ FF, 75, 98, 56, FF, 75, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongA + 6D                                                   7E42FE9E 2 Bytes  [ FF, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassLongA + 70                                                   7E42FEA1 107 Bytes  [ 78, 17, FE, FF, 80, 3D, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindow + 14                                                    7E42FF0D 293 Bytes  [ 3D, B8, E3, 97, 7C, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetPropA + 32                                                        7E430034 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetPropA + 34                                                        7E430036 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetPropA + 40                                                        7E430042 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RemovePropA + D                                                      7E430061 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RemovePropA + 17                                                     7E43006B 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RemovePropA + 35                                                     7E430089 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RemovePropA + 3E                                                     7E430092 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharA + 1B                                                      7E4300B2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharA + 24                                                      7E4300BB 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharA + 36                                                      7E4300CD 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharBuffA + 23                                                  7E4300F9 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharBuffA + 2C                                                  7E430102 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharBuffA + 3C                                                  7E430112 68 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindowEx + 10                                                  7E430157 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindowEx + 2F                                                  7E430176 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindowEx + 4B                                                  7E430192 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindowEx + 4E                                                  7E430195 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollWindowEx + 67                                                  7E4301AE 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExcludeUpdateRgn + 5                                                 7E430216 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExcludeUpdateRgn + 7                                                 7E430218 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExcludeUpdateRgn + F                                                 7E430220 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseClipboard + 5                                                   7E43022A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CloseClipboard + 7                                                   7E43022C 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenClipboard + 12                                                   7E430249 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenClipboard + 16                                                   7E43024D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenClipboard + 1E                                                   7E430255 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenClipboard + 25                                                   7E43025C 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenClipboard + 2F                                                   7E430266 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetKeyboardState + 5                                                 7E43027A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetKeyboardState + 7                                                 7E43027C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetKeyboardState + F                                                 7E430284 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetKeyboardState + 16                                                7E43028B 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetKeyboardState + 24                                                7E430299 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowWord + 15                                                   7E4302E1 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowWord + 1F                                                   7E4302EB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowWord + 28                                                   7E4302F4 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowWord + 2C                                                   7E4302F8 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowWord + 4C                                                   7E430318 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BringWindowToTop + 1A                                                7E430382 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowPlacement + 5                                               7E43038C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowPlacement + 7                                               7E43038E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowPlacement + F                                               7E430396 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowWord + 5                                                    7E4303A0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowWord + 7                                                    7E4303A2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowWord + F                                                    7E4303AA 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowWord + 27                                                   7E4303C2 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowWord + 33                                                   7E4303CE 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardViewer + 5                                               7E430438 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardViewer + 7                                               7E43043A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardViewer + F                                               7E430442 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeClipboardChain + 5                                             7E43044C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeClipboardChain + 7                                             7E43044E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeClipboardChain + F                                             7E430456 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeClipboardChain + 27                                            7E43046E 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeClipboardChain + 36                                            7E43047D 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcW + 7                                                    7E4307FA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcW + 1B                                                   7E43080E 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcW + 1F                                                   7E430812 53 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcW + 56                                                   7E430849 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcW + 62                                                   7E430855 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcW + 4                                                 7E430A0B 111 Bytes  [ 7F, 23, BF, 9E, 08, 2A, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcW + 74                                                7E430A7B 238 Bytes  [ 61, 97, BE, 3F, 43, 8E, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcW + 163                                               7E430B6A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcW + 166                                               7E430B6D 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcW + 17A                                               7E430B81 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardData + B4                                                7E430E2E 76 Bytes  [ 6D, 1F, 67, FD, 7C, 30, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardData + 101                                               7E430E7B 77 Bytes  [ 4F, 11, 99, B9, 78, 44, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardData + 14F                                               7E430EC9 27 Bytes  [ 00, 00, 00, 00, 00, F0, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardData + 16C                                               7E430EE6 9 Bytes  [ FF, FF, 0D, 40, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardData + 176                                               7E430EF0 25 Bytes  [ E0, 3F, 00, 00, 2E, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardData + BE                                                7E43101C 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardData + C1                                                7E43101F 5 Bytes  [ 00, 00, 00, 00, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardData + C7                                                7E431025 82 Bytes  [ 30, 00, 00, 3F, 17, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardData + 11A                                               7E431078 9 Bytes  [ 73, A0, 93, 7C, D3, AB, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClipboardData + 124                                               7E431082 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRect + B                                                 7E43110B 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRect + F                                                 7E43110F 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRect + 15                                                7E431115 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRect + 17                                                7E431117 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AdjustWindowRect + 29                                                7E431129 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetCaretBlinkTime + 13                                               7E431147 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetCaretBlinkTime + 18                                               7E43114C 59 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetCaretBlinkTime + 54                                               7E431188 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetCaretBlinkTime + 58                                               7E43118C 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardType + E                                                  7E4311A9 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardType + 1D                                                 7E4311B8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardType + 23                                                 7E4311BE 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardType + 31                                                 7E4311CC 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExA + 1C                                               7E4311ED 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExA + 26                                               7E4311F7 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExA + 35                                               7E431206 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExA + 43                                               7E431214 13 Bytes  [ 20, 00, 00, 80, 10, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookExA + 52                                               7E431223 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardFormatNameA + 10                                         7E431260 20 Bytes  [ 09, 04, 00, 00, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardFormatNameA + 26                                         7E431276 8 Bytes  [ 01, 00, 09, 04, 00, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardFormatNameA + 2F                                         7E43127F 9 Bytes  [ 00, 20, 34, 08, 00, 58, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardFormatNameA + 39                                         7E431289 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardFormatNameA + 47                                         7E431297 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationA + E                                        7E4312CE 53 Bytes  [ 01, 00, 01, 00, 05, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationA + 44                                       7E431304 9 Bytes  [ 74, 00, 72, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationA + 4E                                       7E43130E 20 Bytes  [ 46, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectInformationA + 63                                       7E431323 68 Bytes  [ 00, 01, 00, 30, 00, 34, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsMenu + 40                                                          7E431368 7 Bytes  [ 74, 00, 20, 00, 43, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsMenu + 48                                                          7E431370 15 Bytes  [ 72, 00, 70, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsMenu + 58                                                          7E431380 19 Bytes  [ 6E, 00, 00, 00, 42, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsMenu + 6C                                                          7E431394 11 Bytes  [ 65, 00, 73, 00, 63, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsMenu + 78                                                          7E4313A0 19 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadKeyboardLayoutW + 18                                             7E43143C 27 Bytes  [ 34, 00, 0A, 00, 01, 00, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameW + 17                                          7E431458 2 Bytes  [ 65, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameW + 1B                                          7E43145C 13 Bytes  [ 6E, 00, 74, 00, 64, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameW + 29                                          7E43146A 26 Bytes  [ 6C, 00, 6C, 00, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenu + B                                                          7E431485 54 Bytes  [ 00, 79, 00, 72, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenu + 42                                                         7E4314BC 13 Bytes  [ 69, 00, 6F, 00, 6E, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenu + 50                                                         7E4314CA 12 Bytes  [ 6C, 00, 20, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenu + 5D                                                         7E4314D7 10 Bytes  [ 00, 73, 00, 20, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PaintMenuBar + 4                                                     7E4314E2 35 Bytes  [ 65, 00, 72, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PaintMenuBar + 28                                                    7E431506 19 Bytes  [ 46, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadAcceleratorsA + 7                                                7E43151A 53 Bytes  [ 74, 00, 64, 00, 6C, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastActivePopup + 16                                              7E431550 31 Bytes  [ 63, 00, 72, 00, 6F, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastActivePopup + 36                                              7E431570 1 Byte  [ AE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastActivePopup + 38                                              7E431572 7 Bytes  [ 20, 00, 4F, 00, 70, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastActivePopup + 40                                              7E43157A 3 Bytes  [ 72, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetLastActivePopup + 44                                              7E43157E 57 Bytes  [ 74, 00, 69, 00, 6E, 00, 67, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffA + 2C                                                  7E431612 15 Bytes  [ 6E, 00, 00, 00, 00, 00, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffA + 3C                                                  7E431622 12 Bytes  [ 00, 00, 00, 00, 00, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffA + 4A                                                  7E431630 1 Byte  [ 3F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffA + 4C                                                  7E431632 16 Bytes  [ 00, 00, 3F, 00, 00, 00, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CountClipboardFormats + 5                                            7E431644 16 Bytes  [ C8, 03, 00, 00, BF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetOpenClipboardWindow + 4                                           7E431655 2 Bytes  [ 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetOpenClipboardWindow + 7                                           7E431658 26 Bytes  [ 0E, 01, 00, 00, 64, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetOpenClipboardWindow + 22                                          7E431673 15 Bytes  [ 00, D8, 14, 00, 00, 67, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetOpenClipboardWindow + 32                                          7E431683 6 Bytes  [ 00, 01, 00, 01, 00, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetOpenClipboardWindow + 39                                          7E43168A 17 Bytes  [ 01, 00, 4C, 18, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateSystemThreads + B                                              7E4316B3 30 Bytes  [ 00, 01, 00, 01, 40, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateSystemThreads + 2A                                             7E4316D2 36 Bytes  [ 02, 40, 90, 44, 00, 00, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateSystemThreads + 4F                                             7E4316F7 51 Bytes  [ 80, D4, 46, 00, 00, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateSystemThreads + 83                                             7E43172B 3 Bytes  [ 00, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateSystemThreads + 87                                             7E43172F 50 Bytes  [ 80, 05, 00, 13, 80, BC, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWinEventHook + 3C                                                 7E4317F3 124 Bytes  [ C0, 7C, 47, 02, 00, 80, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWinEvent + 4                                                   7E431870 47 Bytes  [ 01, 00, 03, C0, 0C, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWinEvent + 34                                                  7E4318A0 1 Byte  [ 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWinEvent + 36                                                  7E4318A2 35 Bytes  [ 0A, C0, 10, 00, 0A, C0, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWinEvent + 5A                                                  7E4318C6 11 Bytes  [ 0A, C0, 24, 00, 0A, C0, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnhookWinEvent + 66                                                  7E4318D2 33 Bytes  [ 0A, C0, 28, 00, 0A, C0, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuItem + 17                                                   7E431A94 7 Bytes  [ 5F, 00, 4B, 00, 45, 00, 52 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuItem + 1F                                                   7E431A9C 1 Byte  [ 4E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuItem + 21                                                   7E431A9E 17 Bytes  [ 45, 00, 4C, 00, 5F, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuItem + 33                                                   7E431AB0 19 Bytes  [ 28, 00, 01, 00, 53, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuItem + 47                                                   7E431AC4 51 Bytes  [ 4C, 00, 45, 00, 52, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuA + 2A                                                     7E431AF8 13 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuA + 38                                                     7E431B06 9 Bytes  [ 68, 00, 65, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuA + 42                                                     7E431B10 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuA + 44                                                     7E431B12 13 Bytes  [ 72, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AppendMenuA + 52                                                     7E431B20 19 Bytes  [ 74, 00, 68, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AttachThreadInput + 4                                                7E431E16 23 Bytes  [ 77, 00, 69, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AttachThreadInput + 1C                                               7E431E2E 55 Bytes  [ 6E, 00, 67, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AttachThreadInput + 54                                               7E431E66 13 Bytes  [ 76, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AttachThreadInput + 62                                               7E431E74 91 Bytes  [ 20, 00, 61, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AttachThreadInput + BE                                               7E431ED0 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBeep + 13                                                     7E431F4E 5 Bytes  [ 61, 00, 74, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBeep + 19                                                     7E431F54 61 Bytes  [ 6F, 00, 6E, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBeep + 57                                                     7E431F92 6 Bytes  [ 65, 00, 61, 00, 6B, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBeep + 5E                                                     7E431F99 32 Bytes  [ 00, 69, 00, 73, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBeep + 7F                                                     7E431FBA 13 Bytes  [ 01, 00, 41, 00, 20, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamW + 26                                         7E432058 23 Bytes  [ 69, 00, 6E, 00, 64, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamW + 3E                                         7E432070 13 Bytes  [ 61, 00, 74, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamW + 4C                                         7E43207E 17 Bytes  [ 74, 00, 72, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamW + 5E                                         7E432090 15 Bytes  [ 6F, 00, 6E, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamW + 6E                                         7E4320A0 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FindWindowExA + 1C                                                   7E432126 29 Bytes  [ 6F, 00, 6D, 00, 6D, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextA + 19                                                  7E432144 7 Bytes  [ 6F, 00, 75, 00, 73, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextA + 21                                                  7E43214C 25 Bytes  [ 79, 00, 20, 00, 61, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextA + 3B                                                  7E432166 23 Bytes  [ 68, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextA + 53                                                  7E43217E 77 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationA + 2B                                              7E4321CC 19 Bytes  [ 65, 00, 73, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationA + 3F                                              7E4321E0 43 Bytes  [ 6E, 00, 6F, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationA + 6B                                              7E43220C 9 Bytes  [ 68, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationA + 75                                              7E432216 27 Bytes  [ 65, 00, 65, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationA + 91                                              7E432232 19 Bytes  [ 64, 00, 75, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsA + 18                                             7E432306 29 Bytes  [ 65, 00, 71, 00, 75, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumDesktopsA + 19                                                   7E432324 113 Bytes  [ 20, 00, 63, 00, 6F, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopA + 6D                                                    7E432396 5 Bytes  [ 20, 00, 69, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopA + 73                                                    7E43239C 51 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopA + A7                                                    7E4323D0 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopA + A9                                                    7E4323D2 12 Bytes  [ 63, 00, 61, 00, 6C, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenDesktopA + B6                                                    7E4323DF 8 Bytes  [ 00, 6E, 00, 6F, 00, 77, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrame + 13                                                       7E43299E 29 Bytes  [ 66, 00, 6F, 00, 72, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrame + 31                                                       7E4329BC 51 Bytes  [ 62, 00, 6A, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrame + 65                                                       7E4329F0 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrame + 67                                                       7E4329F2 5 Bytes  [ 65, 00, 20, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrame + 6D                                                       7E4329F8 11 Bytes  [ 66, 00, 20, 00, 74, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EditWndProc + 19                                                     7E432FE0 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EditWndProc + 24                                                     7E432FEB 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EditWndProc + 2F                                                     7E432FF6 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EditWndProc + 35                                                     7E432FFC 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EditWndProc + 42                                                     7E433009 8 Bytes  [ 00, 00, 00, 00, 00, 02, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WINNLSGetIMEHotkey + 22                                              7E43376E 22 Bytes  [ 5F, 00, 31, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WINNLSGetIMEHotkey + 39                                              7E433785 54 Bytes  [ 00, 53, 00, 5F, 00, 57, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WINNLSGetIMEHotkey + 70                                              7E4337BC 1 Byte  [ 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WINNLSGetIMEHotkey + 72                                              7E4337BE 10 Bytes  [ 00, 00, 28, 00, 01, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WINNLSGetIMEHotkey + 7D                                              7E4337C9 8 Bytes  [ 00, 54, 00, 55, 00, 53, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperA + 1D                                                    7E437062 61 Bytes  [ 63, 00, 6F, 00, 6E, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperA + 5B                                                    7E4370A0 35 Bytes  [ 20, 00, 63, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperA + 7F                                                    7E4370C4 2 Bytes  [ 72, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperA + 82                                                    7E4370C7 14 Bytes  [ 00, 6E, 00, 20, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperA + 91                                                    7E4370D6 113 Bytes  [ 72, 00, 64, 00, 42, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowUpdate + 4                                                 7E439602 17 Bytes  [ 69, 00, 73, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowUpdate + 16                                                7E439614 13 Bytes  [ 79, 00, 20, 00, 75, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowUpdate + 25                                                7E439623 22 Bytes  [ 00, 4C, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowUpdate + 3C                                                7E43963A 19 Bytes  [ 65, 00, 72, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LockWindowUpdate + 50                                                7E43964E 9 Bytes  [ 20, 00, 61, 00, 6C, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamA + 38                                      7E439B28 25 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamA + 52                                      7E439B42 59 Bytes  [ 74, 00, 72, 00, 75, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamA + 8E                                      7E439B7E 19 Bytes  [ 65, 00, 64, 00, 20, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamA + A2                                      7E439B92 61 Bytes  [ 61, 00, 74, 00, 20, 00, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamA + E0                                      7E439BD0 69 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectA + 24                                             7E43A06E 73 Bytes  [ 65, 00, 20, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectA + 6E                                             7E43A0B8 17 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectA + 80                                             7E43A0CA 7 Bytes  [ 73, 00, 74, 00, 20, 00, 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectA + 88                                             7E43A0D2 51 Bytes  [ 61, 00, 73, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectA + BC                                             7E43A106 19 Bytes  [ 6F, 00, 74, 00, 20, 00, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SoftModalMessageBox + B                                              7E43A2B2 51 Bytes  [ 0D, 00, 0A, 00, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SoftModalMessageBox + 3F                                             7E43A2E6 9 Bytes  [ 72, 00, 6F, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SoftModalMessageBox + 49                                             7E43A2F0 5 Bytes  [ 76, 00, 6F, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SoftModalMessageBox + 4F                                             7E43A2F6 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SoftModalMessageBox + 51                                             7E43A2F8 11 Bytes  [ 6D, 00, 65, 00, 20, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamA + C                                                  7E43B118 107 Bytes  [ 00, 00, 00, 00, 98, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamA + 78                                                 7E43B184 5 Bytes  [ 6E, 00, 20, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamA + 7E                                                 7E43B18A 13 Bytes  [ 78, 00, 63, 00, 65, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamA + 8C                                                 7E43B198 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxParamA + 8E                                                 7E43B19A 23 Bytes  [ 20, 00, 68, 00, 61, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerA + 1D                                                    7E43B86E 57 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerA + 57                                                    7E43B8A8 11 Bytes  [ 73, 00, 61, 00, 62, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerA + 63                                                    7E43B8B4 3 Bytes  [ 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerA + 67                                                    7E43B8B8 9 Bytes  [ 50, 00, 6C, 00, 65, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerA + 71                                                    7E43B8C2 11 Bytes  [ 65, 00, 20, 00, 72, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageA + 11                                             7E43C2C0 45 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageA + 3F                                             7E43C2EE 61 Bytes  [ 75, 00, 67, 00, 50, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageA + 7D                                             7E43C32C 45 Bytes  [ 65, 00, 2C, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageA + AB                                             7E43C35A 19 Bytes  [ 78, 00, 69, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendDlgItemMessageA + BF                                             7E43C36E 5 Bytes  [ 68, 00, 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessage + 1B                                                 7E43C66C 7 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessage + 23                                                 7E43C674 9 Bytes  [ 77, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessage + 2D                                                 7E43C67E 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessage + 2F                                                 7E43C680 5 Bytes  [ 65, 00, 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsDialogMessage + 35                                                 7E43C686 7 Bytes  [ 65, 00, 64, 00, 20, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextA + 1A                                                       7E43C6E4 17 Bytes  [ 61, 00, 6C, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextA + 2C                                                       7E43C6F6 1 Byte  [ 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextA + 2E                                                       7E43C6F8 3 Bytes  [ 69, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextA + 32                                                       7E43C6FC 67 Bytes  [ 74, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExA + 3F                                                     7E43C740 7 Bytes  [ 69, 00, 6C, 00, 65, 00, 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExA + 47                                                     7E43C748 1 Byte  [ 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExA + 49                                                     7E43C74A 4 Bytes  [ 0A, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExA + 4F                                                     7E43C750 41 Bytes  [ D4, 00, 01, 00, 41, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawTextExA + 79                                                     7E43C77A 13 Bytes  [ 20, 00, 73, 00, 70, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamA + 65                                              7E43C808 117 Bytes  [ 72, 00, 6F, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamA + DB                                              7E43C87E 27 Bytes  [ 68, 00, 65, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamA + F7                                              7E43C89A 95 Bytes  [ 20, 00, 64, 00, 6F, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamA + 157                                             7E43C8FA 33 Bytes  [ 64, 00, 20, 00, 62, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogParamA + 179                                             7E43C91C 97 Bytes  [ 69, 00, 73, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextA + 44                                                 7E43C97E 5 Bytes  [ 74, 00, 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextA + 4A                                                 7E43C984 85 Bytes  [ 20, 00, 6E, 00, 61, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextA + A0                                                 7E43C9DA 51 Bytes  [ 66, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextA + D4                                                 7E43CA0E 25 Bytes  [ 65, 00, 64, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemTextA + EE                                                 7E43CA28 9 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIcon + 22                                                        7E43D056 7 Bytes  [ 00, 00, F8, 00, 01, 00, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIcon + 2A                                                        7E43D05E 3 Bytes  [ 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIcon + 2E                                                        7E43D062 11 Bytes  [ 61, 00, 74, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIcon + 3A                                                        7E43D06E 41 Bytes  [ 74, 00, 20, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawIcon + 64                                                        7E43D098 17 Bytes  [ 65, 00, 72, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!User32InitializeImmEntryTable + B                                    7E43D368 39 Bytes  [ 76, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!User32InitializeImmEntryTable + 33                                   7E43D390 1 Byte  [ 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!User32InitializeImmEntryTable + 35                                   7E43D392 27 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!User32InitializeImmEntryTable + 52                                   7E43D3AF 56 Bytes  [ 00, 7C, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!User32InitializeImmEntryTable + 8B                                   7E43D3E8 31 Bytes  [ 20, 00, 70, 00, 72, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanW + 7                                                       7E43E1C5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanW + 9                                                       7E43E1C7 145 Bytes  [ 8B, 40, 30, 8B, 40, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanW + 9B                                                      7E43E259 27 Bytes  [ FF, 33, C0, EB, 3B, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanW + B7                                                      7E43E275 326 Bytes  [ FB, FF, 8B, F0, 3B, F7, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanW + 1FE                                                     7E43E3BC 60 Bytes  [ 48, 45, 41, 50, 5B, 25, 77, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefDlgProcA + 22                                                     7E43E561 79 Bytes  [ 55, 8B, EC, 83, EC, 18, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaA + 4                                                     7E43E5B1 15 Bytes  [ F1, 0F, 94, C2, 33, DB, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaA + 14                                                    7E43E5C1 4 Bytes  [ B4, 3E, 58, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaA + 19                                                    7E43E5C6 77 Bytes  [ 00, 8A, 0E, 89, 75, F8, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaA + 67                                                    7E43E614 46 Bytes  [ 09, 89, 75, F8, 0F, 85, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaA + 96                                                    7E43E643 14 Bytes  [ 82, FA, 00, 00, 00, 66, 3B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrameControl + 1A                                                7E43E921 6 Bytes  [ 00, 64, A1, 18, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrameControl + 21                                                7E43E928 9 Bytes  [ 8B, 40, 30, 8B, 40, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrameControl + 2B                                                7E43E932 12 Bytes  [ C0, 2C, 50, 68, 38, EC, 96, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrameControl + 38                                                7E43E93F 87 Bytes  [ 8B, 4D, FC, 0F, B7, C3, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawFrameControl + 90                                                7E43E997 5 Bytes  [ 75, F8, E8, 13, F7 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassInfoA + 10E                                                  7E43ECD5 36 Bytes  [ 8B, 40, 30, 8B, 40, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuA + C                                                      7E43ECFA 65 Bytes  [ EB, 1B, 68, 78, ED, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookA + B                                                  7E43ED3C 114 Bytes  [ B0, 01, 5E, C9, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookA + 7E                                                 7E43EDAF 26 Bytes  [ 01, 74, 11, FF, 75, 10, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowsHookA + 99                                                 7E43EDCA 246 Bytes  [ 5D, FC, 68, 58, F0, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpA + 9C                                                        7E43EEC1 38 Bytes  [ 89, 45, C4, 8B, 40, 30, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpA + C3                                                        7E43EEE8 47 Bytes  [ 97, 7C, 68, 74, F0, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpA + F3                                                        7E43EF18 3 Bytes  [ 85, EA, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpA + F8                                                        7E43EF1D 168 Bytes  [ 66, 8B, 46, 30, 66, 3B, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpA + 1A1                                                       7E43EFC6 42 Bytes  [ C9, 3D, 17, 00, 00, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamW + A                                       7E43EFF1 20 Bytes  [ 00, 00, 00, 8B, F0, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamW + 1F                                      7E43F006 274 Bytes  [ 00, 00, C0, 31, EE, 31, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamW + 132                                     7E43F119 289 Bytes  [ 30, 00, 00, 0C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamW + 255                                     7E43F23C 14 Bytes  [ 00, 10, 01, 00, 58, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDialogIndirectParamW + 264                                     7E43F24B 355 Bytes  [ 34, 0C, 34, 16, 34, 31, 34, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowW + 8F                                                7E43F867 158 Bytes  [ 00, 02, 30, 28, 30, 44, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowW + 130                                               7E43F908 140 Bytes  [ 3F, 30, 78, 30, B6, 30, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowW + 1BD                                               7E43F995 208 Bytes  [ 3C, C4, 3C, C8, 3C, CC, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemMenu + BB                                                   7E43FA66 126 Bytes  [ 00, 00, 8D, 30, FC, 30, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemMenu + 13A                                                  7E43FAE5 257 Bytes  [ 3A, FB, 3B, 93, 3E, D5, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemMenu + 23C                                                  7E43FBE7 20 Bytes  [ 3D, 76, 3D, 9E, 3D, C6, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemMenu + 251                                                  7E43FBFC 173 Bytes  [ 38, 00, 00, 00, 03, 30, 19, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemMenu + 2FF                                                  7E43FCAA 407 Bytes  [ 00, 00, 87, 30, 71, 35, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetWindowContextHelpId + A1                                          7E43FE42 248 Bytes  [ 03, 00, 30, 00, 00, 00, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyAcceleratorTable + E6                                         7E43FF3B 50 Bytes  [ 3C, ED, 3C, F1, 3C, F5, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyAcceleratorTable + 119                                        7E43FF6E 57 Bytes  [ 00, 00, 2D, 30, 69, 30, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyAcceleratorTable + 153                                        7E43FFA8 119 Bytes  [ 40, 00, 00, 00, E6, 33, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyAcceleratorTable + 1CB                                        7E440020 49 Bytes  [ D6, 5C, 24, 04, DD, 44, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyAcceleratorTable + 1FD                                        7E440052 10 Bytes  [ 00, 00, 00, 00, F0, BF, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeregisterShellHookWindow + 1F                                       7E4402A7 68 Bytes  [ 24, 95, 00, 1F, 90, 7C, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeregisterShellHookWindow + 64                                       7E4402EC 31 Bytes  [ 89, 44, 8F, F0, 8B, 44, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeregisterShellHookWindow + 84                                       7E44030C 43 Bytes  [ 00, 00, 00, 03, F0, 03, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeregisterShellHookWindow + B0                                       7E440338 78 Bytes  [ 8A, 06, 88, 07, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeregisterShellHookWindow + FF                                       7E440387 15 Bytes  [ F9, 08, 72, 0D, FD, F3, A5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateA + 4F                                                      7E44EEEF 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateA + 63                                                      7E44EF03 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawStateA + 78                                                      7E44EF18 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthA + 20                                            7E44EF4B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthA + 22                                            7E44EF4D 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWindowTextLengthA + 38                                            7E44EF63 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemID + 30                                                   7E44EF98 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuItemID + 3E                                                   7E44EFA6 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuA + 27                                                     7E44EFD2 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuA + 2A                                                     7E44EFD5 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuA + 2D                                                     7E44EFD8 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ModifyMenuA + 3E                                                     7E44EFE9 145 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeMenuA + 43                                                     7E44F07B 45 Bytes  [ 8B, C8, 03, 45, 18, 2B, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeMenuA + 71                                                     7E44F0A9 4 Bytes  [ 33, DB, 80, 7D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeMenuA + 76                                                     7E44F0AE 18 Bytes  [ 00, 74, 0D, FF, 75, F0, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeMenuA + 89                                                     7E44F0C1 43 Bytes  [ 00, 74, 0D, FF, 75, F8, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempW + 14                                                7E44F0ED 7 Bytes  [ 75, 08, 68, 10, F1, 95, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempW + 1C                                                7E44F0F5 3 Bytes  [ F4, 10, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempW + 20                                                7E44F0F9 11 Bytes  CALL 7E3FFF19 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempW + 2C                                                7E44F105 10 Bytes  CALL 7E3F120C 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempW + 37                                                7E44F110 109 Bytes  [ 48, 65, 61, 70, 20, 63, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerW + 2C                                                    7E44F17E 18 Bytes  [ B1, 78, 05, 00, 00, E8, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharLowerW + 3F                                                    7E44F191 32 Bytes  [ 00, 00, 89, 75, DC, 83, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenu + 1C                                                         7E44F1B2 33 Bytes  [ 5F, 30, 89, 5D, D0, 8B, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenu + 3E                                                         7E44F1D4 2 Bytes  [ 75, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenu + 41                                                         7E44F1D7 81 Bytes  [ 55, D8, F6, 42, 0C, 40, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericA + 20                                             7E44F229 39 Bytes  JMP 7E44F195 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericA + 49                                             7E44F252 1 Byte  [ FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericA + 4B                                             7E44F254 46 Bytes  CALL 7E44F269 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericA + 7E                                             7E44F287 1 Byte  [ 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharAlphaNumericA + 80                                             7E44F289 12 Bytes  [ FF, FF, FF, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuItemA + 3A                                                 7E44F4EA 2 Bytes  [ 17, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuItemA + 3D                                                 7E44F4ED 144 Bytes  [ C0, EB, 4A, 66, 3B, 4E, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuItemA + CE                                                 7E44F57E 48 Bytes  JMP 7E44F60F C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuItemA + FF                                                 7E44F5AF 56 Bytes  [ 14, B8, 17, 00, 00, C0, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InsertMenuItemA + 138                                                7E44F5E8 22 Bytes  [ 84, C0, 75, 05, BB, 62, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefFrameProcA + 49                                                   7E44F74E 66 Bytes  CALL 7E4183F1 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcA + 3D                                                7E44F791 67 Bytes  [ 8B, FF, 55, 8B, EC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcA + 81                                                7E44F7D5 8 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefMDIChildProcA + 8A                                                7E44F7DE 102 Bytes  [ EC, 8B, 45, 0C, 85, C0, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadMenuA + 22                                                       7E44F845 165 Bytes  [ 74, 35, 8B, 75, 08, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WaitForInputIdle + 56                                                7E44F8EB 19 Bytes  CALL 769281F3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WaitForInputIdle + 6A                                                7E44F8FF 106 Bytes  CALL 81437C07 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WaitForInputIdle + D5                                                7E44F96A 24 Bytes  [ 48, 0B, 91, 7C, 03, C3, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WaitForInputIdle + EE                                                7E44F983 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WaitForInputIdle + F2                                                7E44F987 20 Bytes  [ EC, 0F, BE, 80, 98, 51, 92, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InvertRect + D5                                                      7E44FAE7 29 Bytes  [ 45, F4, EB, 0D, 8B, 45, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InvertRect + F3                                                      7E44FB05 37 Bytes  [ FF, FF, 8A, 0F, 88, 4D, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InvertRect + 119                                                     7E44FB2B 69 Bytes  [ FF, FF, FF, 8B, C1, E9, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowA + 11                                                7E44FB71 62 Bytes  [ 33, F6, 3B, D7, 89, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowA + 51                                                7E44FBB1 40 Bytes  [ 0F, B6, F3, 0F, BE, 8E, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowA + 7A                                                7E44FBDA 196 Bytes  [ 74, 21, 8D, 4C, D0, 08, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowA + 13F                                               7E44FC9F 64 Bytes  [ F5, 8B, 75, FC, 3B, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateMDIWindowA + 180                                               7E44FCE0 36 Bytes  [ 75, F4, 89, 51, 0C, 8B, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowStartGlass + 3A                                                  7E44FEDB 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowStartGlass + 46                                                  7E44FEE7 11 Bytes  [ 53, 8B, 5D, 08, 8B, 0B, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowStartGlass + 52                                                  7E44FEF3 49 Bytes  [ 10, 8B, 4D, 0C, 89, 08, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowStartGlass + 84                                                  7E44FF25 3 Bytes  [ 8B, 04, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowStartGlass + 88                                                  7E44FF29 53 Bytes  [ 13, 95, 7C, 0B, 02, 83, F8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemKeyScan + 5                                                       7E44FFE1 48 Bytes  [ 8B, 4D, 08, 83, 39, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemKeyScan + 36                                                      7E450012 9 Bytes  [ 61, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemKeyScan + 40                                                      7E45001C 15 Bytes  [ 67, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemKeyScan + 50                                                      7E45002C 1 Byte  [ 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemKeyScan + 52                                                      7E45002E 39 Bytes  [ 6F, 00, 72, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapVirtualKeyW + 18                                                  7E450056 13 Bytes  [ 6F, 00, 66, 00, 20, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharBuffW + 9                                                   7E450064 47 Bytes  [ 20, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OemToCharBuffW + 39                                                  7E450094 17 Bytes  [ 6C, 00, 6C, 00, 6F, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuCheckMarkDimensions + D                                       7E4500A6 5 Bytes  [ 74, 00, 6F, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuCheckMarkDimensions + 13                                      7E4500AC 33 Bytes  [ 63, 00, 68, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuCheckMarkDimensions + 35                                      7E4500CE 71 Bytes  [ 74, 00, 6F, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuCheckMarkDimensions + 7D                                      7E450116 1 Byte  [ 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuCheckMarkDimensions + 7F                                      7E450118 51 Bytes  [ 65, 00, 6E, 00, 74, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxA + C                                                      7E450596 5 Bytes  [ 63, 00, 69, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxA + 12                                                     7E45059C 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxA + 14                                                     7E45059E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxA + 16                                                     7E4505A0 20 Bytes  [ 64, 00, 20, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxA + 2B                                                     7E4505B5 4 Bytes  [ 00, 70, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxExA + 50                                                   7E45064C 15 Bytes  [ 20, 00, 64, 00, 65, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxExA + 60                                                   7E45065C 5 Bytes  [ 70, 00, 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxExA + 66                                                   7E450662 25 Bytes  [ 68, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxExA + 80                                                   7E45067C 33 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxExA + A2                                                   7E45069E 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableA + 47                                         7E45327E 27 Bytes  [ 20, 00, 72, 00, 65, 00, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableA + 63                                         7E45329A 9 Bytes  [ 72, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableA + 6D                                         7E4532A4 25 Bytes  [ 72, 00, 79, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableA + 87                                         7E4532BE 19 Bytes  [ 6E, 00, 64, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateAcceleratorTableA + 9B                                         7E4532D2 1 Byte  [ 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameA + B                                           7E4533DC 1 Byte  [ 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameA + D                                           7E4533DE 5 Bytes  [ 20, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameA + 13                                          7E4533E4 13 Bytes  [ 6C, 00, 79, 00, 20, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameA + 21                                          7E4533F2 25 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyboardLayoutNameA + 3B                                          7E45340C 121 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTaskmanWindow + 5                                                 7E4534B2 21 Bytes  [ 61, 00, 74, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTaskmanWindow + 1B                                                7E4534C8 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTaskmanWindow + 1D                                                7E4534CA 5 Bytes  [ 74, 00, 72, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTaskmanWindow + 23                                                7E4534D0 11 Bytes  [ 70, 00, 73, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTaskmanWindow + 2F                                                7E4534DC 2 Bytes  [ 44, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRegisterWowHandlers + 1F                                         7E453507 115 Bytes  [ 00, 72, 00, 65, 00, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRegisterWowHandlers + 93                                         7E45357B 98 Bytes  [ 00, 0A, 00, 00, 00, 5C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRegisterWowHandlers + F6                                         7E4535DE 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRegisterWowHandlers + F8                                         7E4535E0 151 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserRegisterWowHandlers + 190                                        7E453678 5 Bytes  [ 69, 00, 6D, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageA + A                                               7E4536F2 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageA + C                                               7E4536F4 7 Bytes  [ 72, 00, 20, 00, 25, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageA + 14                                              7E4536FC 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageA + 16                                              7E4536FE 67 Bytes  [ 20, 00, 64, 00, 6F, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendNotifyMessageA + 5A                                              7E453742 45 Bytes  [ 64, 00, 61, 00, 74, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileW + 1A                                             7E453A66 13 Bytes  [ 61, 00, 20, 00, 69, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileA + 9                                              7E453A74 41 Bytes  [ 6F, 00, 72, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileA + 33                                             7E453A9E 169 Bytes  [ 6F, 00, 74, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileA + DD                                             7E453B48 17 Bytes  [ 6D, 00, 6F, 00, 72, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileA + EF                                             7E453B5A 38 Bytes  [ 64, 00, 6F, 00, 77, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadCursorFromFileA + 116                                            7E453B81 18 Bytes  [ 00, 68, 00, 65, 00, 20, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeEnableCallback + 30                                               7E454FE2 5 Bytes  [ 65, 00, 20, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeEnableCallback + 36                                               7E454FE8 3 Bytes  [ 65, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeEnableCallback + 3A                                               7E454FEC 29 Bytes  [ 61, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeEnableCallback + 58                                               7E45500A 5 Bytes  [ 6F, 00, 6E, 00, 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeEnableCallback + 5E                                               7E455010 3 Bytes  [ 0D, 00, 0A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassWord + 24                                                    7E455120 9 Bytes  [ 6F, 00, 75, 00, 70, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassWord + 2E                                                    7E45512A 35 Bytes  [ 69, 00, 6E, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassWord + 52                                                    7E45514E 5 Bytes  [ 2E, 00, 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassWord + 59                                                    7E455155 25 Bytes  [ 00, 00, 00, 90, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClassWord + 73                                                    7E45516F 4 Bytes  [ 00, 63, 00, 75 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumPropsA + 7                                                       7E455380 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumPropsA + 9                                                       7E455382 43 Bytes  [ 65, 00, 73, 00, 65, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumPropsW + 18                                                      7E4553AE 29 Bytes  [ 01, 00, 53, 00, 54, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumPropsExA + 19                                                    7E4553CC 29 Bytes  [ 45, 00, 5F, 00, 46, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumPropsExW + 19                                                    7E4553EA 11 Bytes  [ 4F, 00, 4E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsW + 7                                              7E4553F6 7 Bytes  [ 01, 00, 54, 00, 68, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsW + F                                              7E4553FE 59 Bytes  [ 73, 00, 20, 00, 6F, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsW + 4B                                             7E45543A 51 Bytes  [ 65, 00, 64, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsW + 7F                                             7E45546E 21 Bytes  [ 0A, 00, 00, 00, 00, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnumWindowStationsW + 95                                             7E455484 27 Bytes  [ 72, 00, 65, 00, 63, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDeskWallpaper + 17                                                7E4554BC 33 Bytes  [ 65, 00, 61, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToAscii + 1D                                                         7E4554DE 137 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToAsciiEx + 4A                                                       7E455568 10 Bytes  [ 6C, 00, 64, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToAsciiEx + 55                                                       7E455573 20 Bytes  [ 00, 20, 00, 73, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToAsciiEx + 6A                                                       7E455588 11 Bytes  [ 61, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToAsciiEx + 76                                                       7E455594 61 Bytes  [ 66, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchToThisWindow + 16                                              7E4555D2 121 Bytes  [ 72, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchToThisWindow + 90                                              7E45564C 12 Bytes  [ 75, 00, 20, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchToThisWindow + 9D                                              7E455659 74 Bytes  [ 00, 73, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchToThisWindow + E8                                              7E4556A4 140 Bytes  [ 68, 00, 65, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwitchToThisWindow + 175                                             7E455731 134 Bytes  [ 00, 20, 00, 62, 00, 65, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GrayStringA + 2B                                                     7E4558D0 11 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GrayStringW + 7                                                      7E4558DC 35 Bytes  [ 6E, 00, 74, 00, 65, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GrayStringW + 2B                                                     7E455900 53 Bytes  [ 64, 00, 2E, 00, 20, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetUserObjectSecurity + 31                                           7E455936 23 Bytes  [ 67, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWinStationInfo + 13                                               7E45594E 15 Bytes  [ 0D, 00, 0A, 00, 00, 00, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWinStationInfo + 23                                               7E45595E 75 Bytes  [ 20, 00, 63, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWinStationInfo + 6F                                               7E4559AA 1 Byte  [ 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWinStationInfo + 71                                               7E4559AC 15 Bytes  [ 74, 00, 20, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetWinStationInfo + 81                                               7E4559BC 15 Bytes  [ 65, 00, 20, 00, 73, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenWindowStationW + 27                                              7E455BD2 69 Bytes  [ 69, 00, 61, 00, 6C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopA + 41                                                  7E455C18 107 Bytes  [ 6E, 00, 74, 00, 65, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopA + AD                                                  7E455C84 27 Bytes  [ 69, 00, 6E, 00, 76, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopA + C9                                                  7E455CA0 9 Bytes  [ 65, 00, 20, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopA + D3                                                  7E455CAA 3 Bytes  [ 65, 00, 71 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateDesktopA + D7                                                  7E455CAE 99 Bytes  [ 75, 00, 69, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeChildWindows + 14                                             7E455D12 7 Bytes  [ 61, 00, 78, 00, 69, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeChildWindows + 1C                                             7E455D1A 113 Bytes  [ 75, 00, 6D, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindow + 28                                                     7E455D8C 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindow + 2A                                                     7E455D8E 5 Bytes  [ 6E, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindow + 30                                                     7E455D94 5 Bytes  [ 6D, 00, 75, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindow + 36                                                     7E455D9A 3 Bytes  [ 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindow + 3A                                                     7E455D9E 17 Bytes  [ 62, 00, 65, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDialogBaseUnits + D                                               7E455DB0 5 Bytes  [ 65, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDialogBaseUnits + 13                                              7E455DB6 35 Bytes  [ 73, 00, 20, 00, 4B, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputDesktop + 18                                                 7E455DDA 15 Bytes  [ 72, 00, 6F, 00, 6C, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputDesktop + 28                                                 7E455DEA 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputDesktop + 2A                                                 7E455DEC 13 Bytes  [ 6E, 00, 64, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputDesktop + 38                                                 7E455DFA 23 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetInputDesktop + 50                                                 7E455E12 17 Bytes  [ 68, 00, 65, 00, 20, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!KillSystemTimer + 16                                                 7E455E82 26 Bytes  [ 6F, 00, 6E, 00, 67, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!OpenIcon + 16                                                        7E455E9D 42 Bytes  [ 00, 20, 00, 69, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetShellWindow + 14                                                  7E455EC8 9 Bytes  [ 6F, 00, 6E, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetProgmanWindow + 5                                                 7E455ED2 21 Bytes  [ 65, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetProgmanWindow + 1B                                                7E455EE8 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetProgmanWindow + 1D                                                7E455EEA 5 Bytes  [ 69, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetProgmanWindow + 23                                                7E455EF0 11 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetProgmanWindow + 2F                                                7E455EFC 81 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterSystemThread + 16                                            7E455F4E 77 Bytes  [ 6E, 00, 63, 00, 69, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ShowOwnedPopups + 16                                                 7E455F9C 23 Bytes  [ 74, 00, 61, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SwapMouseButton + 13                                                 7E455FB4 25 Bytes  [ 74, 00, 20, 00, 6F, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TileChildWindows + 15                                                7E455FCE 61 Bytes  [ 70, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadKeyboardLayoutA + A                                              7E45600C 7 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadKeyboardLayoutA + 12                                             7E456014 6 Bytes  [ AC, 00, 01, 00, 54, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadKeyboardLayoutA + 19                                             7E45601B 2 Bytes  [ 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LoadKeyboardLayoutA + 1C                                             7E45601E 103 Bytes  [ 20, 00, 63, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnloadKeyboardLayout + 26                                            7E456086 7 Bytes  [ 74, 00, 68, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDebugErrorLevel + 3                                               7E45608E 15 Bytes  [ 4B, 00, 44, 00, 43, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDebugErrorLevel + 13                                              7E45609E 35 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDebugErrorLevel + 37                                              7E4560C2 5 Bytes  [ 01, 00, 53, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDebugErrorLevel + 3D                                              7E4560C8 69 Bytes  [ 61, 00, 72, 00, 74, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDebugErrorLevel + 83                                              7E45610E 45 Bytes  [ 6F, 00, 74, 00, 20, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationA + 42                                            7E456210 13 Bytes  [ 80, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationA + 50                                            7E45621E 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateWindowStationA + 52                                            7E456220 121 Bytes  [ 63, 00, 72, 00, 79, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuStringW + 16                                                  7E45629A 21 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuStringW + 2C                                                  7E4562B0 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuStringW + 2E                                                  7E4562B2 23 Bytes  [ 77, 00, 6E, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuStringW + 46                                                  7E4562CA 83 Bytes  [ 67, 00, 72, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoW + 26                                          7E45631E 25 Bytes  [ 64, 00, 6F, 00, 77, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoW + 40                                          7E456338 9 Bytes  [ 69, 00, 73, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoW + 4A                                          7E456342 13 Bytes  [ 65, 00, 72, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoW + 58                                          7E456350 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoW + 5A                                          7E456352 25 Bytes  [ 69, 00, 73, 00, 20, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeLpkHooks + 5A                                              7E456440 11 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeLpkHooks + 66                                              7E45644C 115 Bytes  [ 68, 00, 65, 00, 20, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeLpkHooks + DA                                              7E4564C0 57 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuInfo + 35                                                     7E4564FA 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuInfo + 37                                                     7E4564FC 46 Bytes  [ 6E, 00, 61, 00, 62, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuInfo + 66                                                     7E45652B 8 Bytes  [ 00, 69, 00, 6C, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuInfo + 6F                                                     7E456534 19 Bytes  [ 54, 00, 61, 00, 62, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuInfo + 83                                                     7E456548 1 Byte  [ 68 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcW + A                                                  7E4565E2 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcW + C                                                  7E4565E4 7 Bytes  [ 69, 00, 6C, 00, 75, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcW + 14                                                 7E4565EC 43 Bytes  [ 65, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcW + 40                                                 7E456618 17 Bytes  [ 6E, 00, 20, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcA + D                                                  7E45662A 5 Bytes  [ 20, 00, 44, 00, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuWindowProcA + 13                                                 7E456630 81 Bytes  [ 44, 00, 20, 00, 43, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMessageExtraInfo + 13                                             7E456682 23 Bytes  [ 6F, 00, 74, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefRawInputProc + 13                                                 7E45669A 17 Bytes  [ 6F, 00, 72, 00, 20, 00, 2D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefRawInputProc + 25                                                 7E4566AC 7 Bytes  [ 67, 00, 69, 00, 76, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefRawInputProc + 2D                                                 7E4566B4 29 Bytes  [ 6E, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefRawInputProc + 4B                                                 7E4566D2 7 Bytes  [ 6F, 00, 74, 00, 20, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DefRawInputProc + 53                                                 7E4566DA 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyAcceleratorTableA + 31                                           7E456A6A 31 Bytes  [ 68, 00, 65, 00, 20, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyAcceleratorTableA + 51                                           7E456A8A 67 Bytes  [ 6F, 00, 63, 00, 6F, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyAcceleratorTableA + 95                                           7E456ACE 19 Bytes  [ 74, 00, 65, 00, 6D, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyAcceleratorTableA + A9                                           7E456AE2 67 Bytes  [ 6F, 00, 20, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CopyAcceleratorTableA + ED                                           7E456B26 113 Bytes  [ 0D, 00, 0A, 00, 00, 00, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamA + 48                                         7E456B98 27 Bytes  [ 63, 00, 72, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamA + 65                                         7E456BB5 20 Bytes  [ 00, 00, 00, 7C, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamA + 7A                                         7E456BCA 35 Bytes  [ 6E, 00, 73, 00, 70, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamA + 9E                                         7E456BEE 27 Bytes  [ 74, 00, 68, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DialogBoxIndirectParamA + BA                                         7E456C0A 27 Bytes  [ 65, 00, 20, 00, 73, 00, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateCursor + 2B                                                    7E456E57 50 Bytes  [ 00, 77, 00, 61, 00, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateCursor + 5E                                                    7E456E8A 89 Bytes  [ 64, 00, 20, 00, 77, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIcon + 55                                                      7E456EE4 29 Bytes  [ 6F, 00, 70, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!LookupIconIdFromDirectory + 19                                       7E456F02 13 Bytes  [ 64, 00, 65, 00, 62, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResource + 9                                           7E456F10 25 Bytes  [ 6F, 00, 72, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResource + 23                                          7E456F2A 89 Bytes  [ 63, 00, 61, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResource + 7D                                          7E456F84 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResource + 7F                                          7E456F86 3 Bytes  [ 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CreateIconFromResource + 83                                          7E456F8A 27 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExW + 22                                         7E457338 7 Bytes  [ 65, 00, 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExW + 2A                                         7E457340 9 Bytes  [ 65, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExW + 34                                         7E45734A 23 Bytes  [ 72, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExW + 4C                                         7E457362 88 Bytes  [ 20, 00, 69, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListComboBoxA + 50                                             7E4573BC 24 Bytes  [ 78, 00, 01, 00, 43, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListComboBoxA + 69                                             7E4573D5 30 Bytes  [ 00, 70, 00, 70, 00, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListComboBoxA + 88                                             7E4573F4 23 Bytes  [ 6E, 00, 6E, 00, 65, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListComboBoxW + 13                                             7E45740C 19 Bytes  [ 73, 00, 20, 00, 77, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListComboBoxW + 27                                             7E457420 42 Bytes  [ 6F, 00, 72, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExA + 21                                         7E45744B 28 Bytes  [ 00, 27, 00, 73, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExA + 3E                                         7E457468 7 Bytes  [ 20, 00, 65, 00, 78, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExA + 46                                         7E457470 41 Bytes  [ 69, 00, 72, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExA + 70                                         7E45749A 19 Bytes  [ 75, 00, 73, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectComboBoxExA + 84                                         7E4574AE 19 Bytes  [ 65, 00, 6E, 00, 74, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryNextServer + 36                                              7E4577B2 11 Bytes  [ 62, 00, 65, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryNextServer + 42                                              7E4577BE 5 Bytes  [ 65, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryNextServer + 48                                              7E4577C4 65 Bytes  [ 72, 00, 69, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryNextServer + 8A                                              7E457806 7 Bytes  [ 6F, 00, 63, 00, 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryNextServer + 92                                              7E45780E 107 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnect + 75                                                      7E458008 5 Bytes  [ 61, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnect + 7B                                                      7E45800E 39 Bytes  [ 65, 00, 78, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnect + A3                                                      7E458036 37 Bytes  [ 0A, 00, 00, 00, 00, 00, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeReconnect + 21                                                    7E45805C 11 Bytes  [ 20, 00, 6C, 00, 69, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeReconnect + 2D                                                    7E458068 3 Bytes  [ 72, 00, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeReconnect + 31                                                    7E45806C 3 Bytes  [ 20, 00, 28 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeReconnect + 35                                                    7E458070 1 Byte  [ 44 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeReconnect + 37                                                    7E458072 23 Bytes  [ 4C, 00, 4C, 00, 29, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnect + 42                                                   7E4581D6 7 Bytes  [ 77, 00, 61, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnect + 4A                                                   7E4581DE 5 Bytes  [ 70, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnect + 50                                                   7E4581E4 11 Bytes  [ 73, 00, 65, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnect + 5C                                                   7E4581F0 21 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnect + 72                                                   7E458206 51 Bytes  [ 72, 00, 74, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnectList + 2F                                               7E45823A 7 Bytes  [ 20, 00, 61, 00, 76, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnectList + 37                                               7E458242 5 Bytes  [ 69, 00, 6C, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnectList + 3D                                               7E458248 17 Bytes  [ 62, 00, 6C, 00, 65, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnectList + 4F                                               7E45825A 49 Bytes  [ 68, 00, 65, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeDisconnectList + 81                                               7E45828C 94 Bytes  [ 72, 00, 20, 00, 64, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnectList + 3D                                                  7E4582EB 12 Bytes  [ 00, 65, 00, 73, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnectList + 4A                                                  7E4582F8 49 Bytes  [ 63, 00, 65, 00, 72, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnectList + 7C                                                  7E45832A 5 Bytes  [ 74, 00, 20, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnectList + 82                                                  7E458330 7 Bytes  [ 6E, 00, 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeConnectList + 8A                                                  7E458338 25 Bytes  [ 65, 00, 20, 00, 73, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKeyNameTextW + B                                                  7E45936A 29 Bytes  [ 50, 00, 43, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapVirtualKeyExW + 19                                                7E459388 101 Bytes  [ 61, 00, 76, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RealGetWindowClassW + 28                                             7E4593EE 61 Bytes  [ 65, 00, 74, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsW + 39                                          7E45942C 25 Bytes  [ 74, 00, 77, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsW + 53                                          7E459446 17 Bytes  [ 20, 00, 61, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsW + 65                                          7E459458 5 Bytes  [ 6C, 00, 69, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsW + 6B                                          7E45945E 53 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsW + A1                                          7E459494 13 Bytes  [ 70, 00, 72, 00, 6F, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RecordShutdownReason + 5                                             7E4594D2 43 Bytes  [ 74, 00, 68, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RecordShutdownReason + 31                                            7E4594FE 31 Bytes  [ 65, 00, 20, 00, 70, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RecordShutdownReason + 51                                            7E45951E 11 Bytes  [ 20, 00, 66, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RecordShutdownReason + 5D                                            7E45952A 9 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RecordShutdownReason + 67                                            7E459534 15 Bytes  [ 74, 00, 01, 00, 54, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DisplayExitWindowsWarnings + B                                       7E459D6C 17 Bytes  [ 20, 00, 62, 00, 65, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DisplayExitWindowsWarnings + 1D                                      7E459D7E 16 Bytes  [ 6F, 00, 72, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DisplayExitWindowsWarnings + 2F                                      7E459D90 43 Bytes  [ 44, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DisplayExitWindowsWarnings + 5B                                      7E459DBC 11 Bytes  [ 63, 00, 6F, 00, 6D, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DisplayExitWindowsWarnings + 67                                      7E459DC8 23 Bytes  [ 74, 00, 65, 00, 2E, 00, 0D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndTask + 1D                                                         7E459E92 13 Bytes  [ 6F, 00, 72, 00, 74, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndTask + 2B                                                         7E459EA0 5 Bytes  [ 44, 00, 01, 00, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EndTask + 31                                                         7E459EA6 97 Bytes  [ 68, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeviceEventWorker + 40                                               7E459F08 22 Bytes  [ 79, 00, 20, 00, 65, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeviceEventWorker + 57                                               7E459F1F 26 Bytes  [ 00, 38, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeviceEventWorker + 72                                               7E459F3A 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeviceEventWorker + 74                                               7E459F3C 31 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DeviceEventWorker + 94                                               7E459F5C 23 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExitWindowsEx + 15                                                   7E45A05A 9 Bytes  [ 01, 00, 4E, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExitWindowsEx + 1F                                                   7E45A064 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExitWindowsEx + 21                                                   7E45A066 13 Bytes  [ 63, 00, 75, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExitWindowsEx + 2F                                                   7E45A074 9 Bytes  [ 63, 00, 6F, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ExitWindowsEx + 39                                                   7E45A07E 1 Byte  [ 78 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkTabbedTextOut + 69                                            7E45A234 113 Bytes  [ 20, 00, 61, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkTabbedTextOut + DB                                            7E45A2A6 5 Bytes  [ 67, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkTabbedTextOut + E1                                            7E45A2AC 5 Bytes  [ 6F, 00, 69, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkTabbedTextOut + E7                                            7E45A2B2 111 Bytes  [ 74, 00, 20, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserLpkTabbedTextOut + 157                                           7E45A322 140 Bytes  [ 70, 00, 6F, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TabbedTextOutW + 2A                                                  7E45A3B0 141 Bytes  [ 69, 00, 73, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!TabbedTextOutA + 89                                                  7E45A43E 24 Bytes  [ 0D, 00, 0A, 00, 00, 00, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTabbedTextExtentW + 10                                            7E45A457 20 Bytes  [ 00, 70, 00, 20, 00, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTabbedTextExtentW + 25                                            7E45A46C 110 Bytes  [ 61, 00, 73, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetTabbedTextExtentA + 6A                                            7E45A4DB 78 Bytes  [ 00, 6C, 00, 64, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUninitialize + 28                                                 7E45A52A 5 Bytes  [ 20, 00, 69, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUninitialize + 2E                                                 7E45A530 3 Bytes  [ 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUninitialize + 32                                                 7E45A534 9 Bytes  [ 68, 00, 65, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUninitialize + 3C                                                 7E45A53E 9 Bytes  [ 6C, 00, 20, 00, 55, 00, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUninitialize + 46                                                 7E45A548 12 Bytes  [ 44, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetLastError + 23                                                 7E45A646 9 Bytes  [ 69, 00, 6E, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetLastError + 2D                                                 7E45A650 67 Bytes  [ 6C, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeImpersonateClient + 30                                            7E45A694 7 Bytes  [ 75, 00, 6E, 00, 69, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeImpersonateClient + 38                                            7E45A69C 5 Bytes  [ 61, 00, 74, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeImpersonateClient + 3E                                            7E45A6A2 51 Bytes  [ 6F, 00, 6E, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeA + 10                                                  7E45A6D6 3 Bytes  [ 67, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeA + 14                                                  7E45A6DA 17 Bytes  [ 61, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeA + 26                                                  7E45A6EC 27 Bytes  [ 70, 00, 72, 00, 6F, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeA + 42                                                  7E45A708 13 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeInitializeA + 50                                                  7E45A716 11 Bytes  [ 68, 00, 65, 00, 20, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PackDDElParam + D                                                    7E45B73E 5 Bytes  [ 6F, 00, 64, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PackDDElParam + 13                                                   7E45B744 7 Bytes  [ 6D, 00, 20, 00, 64, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PackDDElParam + 1B                                                   7E45B74C 5 Bytes  [ 64, 00, 20, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PackDDElParam + 21                                                   7E45B752 7 Bytes  [ 6F, 00, 74, 00, 20, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PackDDElParam + 29                                                   7E45B75A 25 Bytes  [ 63, 00, 63, 00, 65, 00, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnpackDDElParam + D                                                  7E45B7A2 5 Bytes  [ 79, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnpackDDElParam + 13                                                 7E45B7A8 7 Bytes  [ 68, 00, 65, 00, 20, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnpackDDElParam + 1B                                                 7E45B7B0 5 Bytes  [ 6F, 00, 6E, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnpackDDElParam + 21                                                 7E45B7B6 7 Bytes  [ 69, 00, 67, 00, 75, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnpackDDElParam + 29                                                 7E45B7BE 11 Bytes  [ 65, 00, 64, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FreeDDElParam + D                                                    7E45B854 7 Bytes  [ 20, 00, 74, 00, 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FreeDDElParam + 15                                                   7E45B85C 5 Bytes  [ 20, 00, 63, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FreeDDElParam + 1B                                                   7E45B862 7 Bytes  [ 6D, 00, 6D, 00, 61, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FreeDDElParam + 23                                                   7E45B86A 9 Bytes  [ 64, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FreeDDElParam + 2D                                                   7E45B874 11 Bytes  [ 74, 00, 20, 00, 74, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReuseDDElParam + F                                                   7E45B8BA 7 Bytes  [ 72, 00, 6C, 00, 79, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReuseDDElParam + 17                                                  7E45B8C2 3 Bytes  [ 63, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReuseDDElParam + 1B                                                  7E45B8C6 5 Bytes  [ 62, 00, 6C, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReuseDDElParam + 21                                                  7E45B8CC 53 Bytes  [ 64, 00, 20, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReuseDDElParam + 57                                                  7E45B902 65 Bytes  [ 65, 00, 72, 00, 20, 00, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemInt + 63                                                   7E45BA3C 25 Bytes  [ 64, 00, 20, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetDlgItemInt + 7D                                                   7E45BA56 13 Bytes  [ 6E, 00, 61, 00, 6C, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemInt + 9                                                    7E45BA64 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemInt + B                                                    7E45BA66 59 Bytes  [ 01, 00, 42, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemInt + 47                                                   7E45BAA2 103 Bytes  [ 65, 00, 20, 00, 73, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemInt + AF                                                   7E45BB0A 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetDlgItemInt + B1                                                   7E45BB0C 81 Bytes  [ 65, 00, 20, 00, 6F, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckRadioButton + 19                                                7E45BBCA 35 Bytes  [ 20, 00, 74, 00, 68, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckRadioButton + 3D                                                7E45BBEE 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckRadioButton + 3F                                                7E45BBF0 13 Bytes  [ 6C, 00, 6F, 00, 67, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckRadioButton + 4D                                                7E45BBFE 67 Bytes  [ 65, 00, 71, 00, 75, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapDialogRect + 26                                                   7E45BC42 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapDialogRect + 28                                                   7E45BC44 25 Bytes  [ 61, 00, 73, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapDialogRect + 42                                                   7E45BC5E 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapDialogRect + 44                                                   7E45BC60 19 Bytes  [ 20, 00, 6C, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MapDialogRect + 58                                                   7E45BC74 21 Bytes  [ 6C, 00, 6F, 00, 67, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgGroupItem + 47                                             7E45BD3E 21 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgGroupItem + 5D                                             7E45BD54 7 Bytes  [ 73, 00, 70, 00, 65, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgGroupItem + 65                                             7E45BD5C 9 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgGroupItem + 6F                                             7E45BD66 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetNextDlgGroupItem + 71                                             7E45BD68 5 Bytes  [ 73, 00, 65, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsA                                                 7E46077F 15 Bytes  [ 90, 90, 8B, FF, 56, BE, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsA + 10                                            7E46078F 32 Bytes  [ 85, C0, 0F, 8C, A7, ED, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsA + 31                                            7E4607B0 13 Bytes  [ 97, 7C, 01, 33, C0, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconsA + 3F                                            7E4607BE 108 Bytes  [ FF, 55, 8B, EC, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExA + 52                                           7E46082B 15 Bytes  [ 71, 0A, 66, 89, 70, 08, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExA + 62                                           7E46083B 32 Bytes  [ 71, 0E, 8D, 78, 0E, A5, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExA + 83                                           7E46085C 252 Bytes  [ 89, 50, 24, 66, 39, 32, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExA + 180                                          7E460959 5 Bytes  [ 03, C8, 89, 4D, C8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!PrivateExtractIconExA + 186                                          7E46095F 29 Bytes  [ 46, 10, 66, 8B, 40, 38, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputBuffer + 9                                                7E460BA6 46 Bytes  [ 8B, 40, 30, 8B, 4D, 90, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputBuffer + 38                                               7E460BD5 41 Bytes  [ 80, 00, 00, A3, F4, F0, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputBuffer + 62                                               7E460BFF 64 Bytes  [ FF, A3, F8, F0, 97, 7C, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputBuffer + A3                                               7E460C40 7 Bytes  [ 00, 00, 43, 00, 41, 00, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputBuffer + AB                                               7E460C48 136 Bytes  [ 54, 00, 55, 00, 52, 00, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAddData + 71                                                      7E460F12 29 Bytes  CALL 7E44BC1D C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAddData + 8F                                                      7E460F30 6 Bytes  [ 5F, 5E, 5B, C9, C2, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAddData + 96                                                      7E460F37 8 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAddData + 9F                                                      7E460F40 9 Bytes  [ EC, 51, 83, 65, FC, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAddData + A9                                                      7E460F4A 26 Bytes  [ 00, 8D, 45, FC, 50, 8D, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetData + 6A                                                      7E46102B 52 Bytes  [ 8D, A4, 24, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetData + 9F                                                      7E461060 12 Bytes  [ 00, 8B, FF, 57, 8B, 7C, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetData + AC                                                      7E46106D 12 Bytes  JMP DDF20374 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeGetData + B9                                                      7E46107A 127 Bytes  [ 8D, A4, 24, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAccessData + 21                                                   7E4610FA 147 Bytes  [ EC, 56, 57, 53, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUnaccessData + 43                                                 7E46118E 127 Bytes  [ 5E, 34, 0F, C3, 47, 30, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUnaccessData + C3                                                 7E46120E 366 Bytes  [ 34, 8B, 46, 38, 8B, 5E, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUnaccessData + 234                                                7E46137F 14 Bytes  [ F3, A5, B9, 10, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUnaccessData + 243                                                7E46138E 95 Bytes  [ A5, 59, 0B, C9, 74, 09, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeUnaccessData + 2A3                                                7E4613EE 82 Bytes  [ B9, 10, 00, 00, 00, F3, A5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateDataHandle + 11                                             7E46154A 6 Bytes  [ F7, DA, F7, D8, 83, DA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateDataHandle + 18                                             7E461551 124 Bytes  [ 5E, 8B, E5, 5D, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateDataHandle + 95                                             7E4615CE 123 Bytes  [ 8B, 54, 24, 04, 33, C0, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateDataHandle + 111                                            7E46164A 54 Bytes  [ 8B, 54, 24, 08, 1B, 54, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateDataHandle + 148                                            7E461681 21 Bytes  [ FF, 74, 24, 20, FF, 74, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeDataHandle + F                                                7E4616C1 66 Bytes  [ 75, 08, 8B, 4D, 18, FF, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeDataHandle + 52                                               7E461704 108 Bytes  [ 4C, 24, 04, F7, 41, 04, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeDataHandle + BF                                               7E461771 35 Bytes  [ B0, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeDataHandle + E3                                               7E461795 10 Bytes  [ 00, 00, C7, 83, A0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeDataHandle + EE                                               7E4617A0 10 Bytes  [ 00, C7, 83, 9C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpW + 3C                                                        7E4619E0 6 Bytes  [ 6E, CF, 00, 00, 7E, CF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpW + 44                                                        7E4619E8 10 Bytes  [ 8E, CF, 00, 00, 9E, CF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpW + 4F                                                        7E4619F3 3 Bytes  [ 00, BE, CF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpW + 54                                                        7E4619F8 10 Bytes  [ CE, CF, 00, 00, DE, CF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!WinHelpW + 60                                                        7E461A04 3 Bytes  [ FE, CF, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCmpStringHandles + 1A                                             7E461B77 15 Bytes  [ 00, AE, D5, 00, 00, BE, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCmpStringHandles + 2A                                             7E461B87 15 Bytes  [ 00, DE, D5, 00, 00, EE, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCmpStringHandles + 3B                                             7E461B98 131 Bytes  [ 1E, D6, 00, 00, 2E, D6, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleA + 9                                           7E461C1C 7 Bytes  [ 2E, D8, 00, 00, 3E, D8, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleA + 11                                          7E461C24 22 Bytes  [ 4E, D8, 00, 00, 5E, D8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleA + 28                                          7E461C3B 11 Bytes  [ 00, AE, D8, 00, 00, 0E, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleA + 34                                          7E461C47 51 Bytes  [ 00, CE, D8, 00, 00, DE, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeCreateStringHandleA + 69                                          7E461C7C 14 Bytes  [ 9E, D9, 00, 00, AE, D9, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeStringHandle + 28                                             7E461D68 23 Bytes  [ 3E, DD, 00, 00, 4E, DD, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeStringHandle + 40                                             7E461D80 6 Bytes  [ 9E, DD, 00, 00, AE, DD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeStringHandle + 47                                             7E461D87 11 Bytes  [ 00, BE, DD, 00, 00, CE, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeStringHandle + 53                                             7E461D93 11 Bytes  [ 00, EE, DD, 00, 00, FE, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeFreeStringHandle + 60                                             7E461DA0 7 Bytes  [ 1E, DE, 00, 00, 2E, DE, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeKeepStringHandle + 42                                             7E461E1C 3 Bytes  [ 17, C1, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeKeepStringHandle + 46                                             7E461E20 31 Bytes  [ 89, 4C, 03, 00, 49, 8A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeKeepStringHandle + 66                                             7E461E40 55 Bytes  [ F3, A1, 01, 00, 79, 8A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringA + 12                                                 7E461E78 19 Bytes  [ 3E, D8, 05, 00, D2, FB, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringW + 9                                                  7E461E8C 7 Bytes  [ 9D, 8A, 02, 00, 43, A2, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringW + 11                                                 7E461E94 27 Bytes  [ 9C, AE, 01, 00, C4, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringW + 2D                                                 7E461EB0 71 Bytes  [ 35, F8, 05, 00, A7, 48, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringW + 75                                                 7E461EF8 51 Bytes  [ 45, 08, 03, 00, 31, 01, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryStringW + A9                                                 7E461F2C 43 Bytes  [ C7, 96, 05, 00, F3, 32, 05, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKBCodePage + 14                                                   7E461F8C 6 Bytes  [ C5, 30, 06, 00, 27, D1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKBCodePage + 1B                                                   7E461F93 56 Bytes  [ 00, C6, 4C, 02, 00, F1, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKBCodePage + 54                                                   7E461FCC 7 Bytes  [ 1A, E6, 02, 00, F5, B4, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKBCodePage + 5C                                                   7E461FD4 7 Bytes  [ FD, 20, 03, 00, 43, 2B, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetKBCodePage + 64                                                   7E461FDC 94 Bytes  [ D7, 71, 01, 00, DD, 11, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListA + 89                                                     7E463738 63 Bytes  [ 5A, 9F, 00, 00, 72, 9F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListW + 3B                                                     7E463778 46 Bytes  [ D9, A0, 00, 00, F8, A0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListW + 6B                                                     7E4637A8 15 Bytes  [ F6, A1, 00, 00, 0B, A2, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListW + 7B                                                     7E4637B8 14 Bytes  [ 4D, A2, 00, 00, 63, A2, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListW + 8A                                                     7E4637C7 120 Bytes  [ 00, 9E, A2, 00, 00, B7, A2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirListW + 103                                                    7E463840 47 Bytes  [ 8E, A5, 00, 00, 9A, A5, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExA + 61                                                 7E46392F 36 Bytes  [ 00, 23, AB, 00, 00, 39, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExW + 20                                                 7E463954 42 Bytes  [ 14, AC, 00, 00, 36, AC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExW + 4B                                                 7E46397F 4 Bytes  [ 00, 03, AD, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExW + 50                                                 7E463984 46 Bytes  [ 0C, AD, 00, 00, 1A, AD, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExW + 7F                                                 7E4639B3 7 Bytes  [ 00, 11, AE, 00, 00, 25, AE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DlgDirSelectExW + 87                                                 7E4639BB 3 Bytes  [ 00, 39, AE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ScrollChildren + 212                                                 7E464DDE 45 Bytes  [ 54, 68, 72, 65, 61, 64, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeWindows + 3                                                   7E464E0C 98 Bytes  [ 69, 52, 65, 6D, 6F, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeWindows + 66                                                  7E464E6F 135 Bytes  [ 4B, 69, 46, 61, 73, 74, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeWindows + EE                                                  7E464EF7 48 Bytes  [ 78, 63, 65, 70, 74, 69, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CascadeWindows + 11F                                                 7E464F28 402 Bytes  [ 4C, 64, 72, 41, 63, 63, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeMenuW + 8D                                                     7E4650BB 163 Bytes  [ 61, 74, 63, 68, 52, 6F, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawMenuBarTemp + 22                                                 7E46515F 44 Bytes  [ 74, 69, 6F, 6E, 4F, 70, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuRadioItem + 1A                                              7E46518C 485 Bytes  [ 4C, 64, 72, 53, 65, 74, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuRadioItem + 200                                             7E465372 32 Bytes  [ 4E, 74, 41, 64, 64, 41, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuRadioItem + 221                                             7E465393 413 Bytes  [ 47, 72, 6F, 75, 70, 73, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuRadioItem + 3BF                                             7E465531 308 Bytes  [ 4E, 74, 43, 6F, 6E, 74, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CheckMenuRadioItem + 4F4                                             7E465666 76 Bytes  [ 4E, 74, 43, 72, 65, 61, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MB_GetString + 9D                                                    7E465BC2 521 Bytes  [ 4E, 74, 4F, 70, 65, 6E, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MB_GetString + 2A7                                                   7E465DCC 202 Bytes  [ 51, 75, 65, 72, 79, 45, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MB_GetString + 372                                                   7E465E97 227 Bytes  [ 65, 72, 79, 49, 6E, 66, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MB_GetString + 456                                                   7E465F7B 138 Bytes  [ 51, 75, 65, 72, 79, 51, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MB_GetString + 4E1                                                   7E466006 11 Bytes  [ 20, 00, 6F, 00, 74, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutW + 43                                              7E46619C 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutW + 45                                              7E46619E 13 Bytes  [ 69, 00, 6D, 00, 61, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutW + 53                                              7E4661AC 27 Bytes  [ 6F, 00, 6B, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutW + 6F                                              7E4661C8 1 Byte  [ 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutW + 71                                              7E4661CA 123 Bytes  [ 65, 00, 20, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutA + 6A                                              7E466246 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutA + 6C                                              7E466248 93 Bytes  [ 65, 00, 6D, 00, 70, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxTimeoutA + CA                                              7E4662A6 49 Bytes  [ 70, 00, 65, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectW + 2D                                             7E4662D8 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectW + 2F                                             7E4662DA 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectW + 31                                             7E4662DC 25 Bytes  [ 72, 00, 65, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectW + 4B                                             7E4662F6 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxIndirectW + 4D                                             7E4662F8 29 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxW + C                                                      7E466316 5 Bytes  [ 70, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxW + 12                                                     7E46631C 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxW + 14                                                     7E46631E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxW + 16                                                     7E466320 25 Bytes  [ 73, 00, 73, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MessageBoxW + 30                                                     7E46633A 1 Byte  [ 0D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColors + 14                                                    7E46636C 35 Bytes  [ 74, 00, 6F, 00, 20, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColors + 38                                                    7E466390 15 Bytes  [ 65, 00, 6E, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColors + 48                                                    7E4663A0 103 Bytes  [ 73, 00, 65, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColors + B0                                                    7E466408 55 Bytes  [ 65, 00, 2E, 00, 20, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColors + E8                                                    7E466440 51 Bytes  [ 72, 00, 69, 00, 6D, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToUnicode + 20                                                       7E46649E 4 Bytes  [ 65, 00, 20, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToUnicode + 25                                                       7E4664A3 6 Bytes  [ 00, 69, 00, 6C, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToUnicode + 2C                                                       7E4664AA 37 Bytes  [ 20, 00, 71, 00, 75, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToUnicodeEx + 21                                                     7E4664D0 11 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ToUnicodeEx + 2D                                                     7E4664DC 29 Bytes  [ 7B, 00, 4F, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemCursor + 19                                                 7E4664FA 17 Bytes  [ 20, 00, 4D, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemCursor + 2B                                                 7E46650C 3 Bytes  [ 0A, 00, 59 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSystemCursor + 2F                                                 7E466510 19 Bytes  [ 6F, 00, 75, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!mouse_event + F                                                      7E466524 3 Bytes  [ 20, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!mouse_event + 13                                                     7E466528 43 Bytes  [ 73, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!mouse_event + 3F                                                     7E466554 19 Bytes  [ 79, 00, 2E, 00, 20, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!keybd_event + F                                                      7E466568 85 Bytes  [ 72, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!keybd_event + 65                                                     7E4665BE 7 Bytes  [ 20, 00, 73, 00, 69, 00, 7A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!keybd_event + 6D                                                     7E4665C6 7 Bytes  [ 65, 00, 20, 00, 6F, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!keybd_event + 75                                                     7E4665CE 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!keybd_event + 77                                                     7E4665D0 27 Bytes  [ 79, 00, 6F, 00, 75, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaption + 15                                                     7E466B8A 11 Bytes  [ 20, 00, 61, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaption + 21                                                     7E466B96 35 Bytes  [ 74, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaption + 45                                                     7E466BBA 27 Bytes  [ 61, 00, 62, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaption + 61                                                     7E466BD6 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaption + 63                                                     7E466BD8 19 Bytes  [ 6F, 00, 77, 00, 73, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffW + 1E                                                  7E466C27 6 Bytes  [ 00, 72, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharToOemBuffW + 25                                                  7E466C2E 135 Bytes  [ 69, 00, 7A, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColorsTemp + 20                                                7E466CB6 31 Bytes  [ 7A, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColorsTemp + 40                                                7E466CD6 37 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColorsTemp + 66                                                7E466CFC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColorsTemp + 68                                                7E466CFE 75 Bytes  [ 4C, 00, 6F, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetSysColorsTemp + B4                                                7E466D4A 25 Bytes  [ 73, 00, 20, 00, 66, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetLastErrorEx + 12                                                  7E466D9A 55 Bytes  [ 75, 00, 6E, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeWin32EntryTable + 33                                       7E466DD2 184 Bytes  [ 63, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeWin32EntryTable + EC                                       7E466E8B 8 Bytes  [ 00, 72, 00, 6E, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeWin32EntryTable + F5                                       7E466E94 3 Bytes  [ 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeWin32EntryTable + F9                                       7E466E98 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!InitializeWin32EntryTable + FB                                       7E466E9A 4 Bytes  [ 20, 00, 61, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnterReaderModeHelper + 1E                                           7E467495 89 Bytes  [ 18, 98, 08, 00, 00, EB, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReasonCodeNeedsBugID + 1                                             7E4674EF 22 Bytes  [ C1, 2B, 85, A0, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReasonCodeNeedsBugID + 18                                            7E467506 41 Bytes  [ 80, 2C, 01, 00, 00, F7, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReasonCodeNeedsBugID + 42                                            7E467530 412 Bytes  [ 01, 00, 00, F7, A5, A0, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReasonCodeNeedsBugID + 1DF                                           7E4676CD 20 Bytes  [ F9, FF, 8B, D8, 89, 5D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ReasonCodeNeedsBugID + 1F4                                           7E4676E2 54 Bytes  [ 6A, FF, 8D, 45, F0, 50, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BuildReasonArray + 2E                                                7E467BFC 13 Bytes  [ 00, 00, 00, 00, E3, 7B, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BuildReasonArray + 3C                                                7E467C0A 21 Bytes  [ FF, 55, 8B, EC, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BuildReasonArray + 52                                                7E467C20 13 Bytes  [ 8B, 84, 88, 10, 0E, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BuildReasonArray + 60                                                7E467C2E 5 Bytes  [ 00, 72, 16, 68, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BuildReasonArray + 67                                                7E467C35 35 Bytes  CALL 7E3FF62C 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyReasons + 9                                                   7E467CB9 2 Bytes  [ 84, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DestroyReasons + C                                                   7E467CBC 100 Bytes  [ 85, C0, 89, 86, 94, 0F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetReasonTitleFromReasonCode + 25                                    7E467D21 56 Bytes  [ 00, 00, 8B, 70, 30, E8, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetReasonTitleFromReasonCode + 5E                                    7E467D5A 154 Bytes  [ 76, 40, 89, 75, E0, 8B, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableScrollBar + 18                                                 7E467DF5 45 Bytes  [ 00, 00, 00, E3, 7D, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableScrollBar + 46                                                 7E467E23 25 Bytes  [ FF, FF, 50, 6A, 2C, E8, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableScrollBar + 60                                                 7E467E3D 7 Bytes  [ 00, 00, 8B, 85, 50, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableScrollBar + 68                                                 7E467E45 51 Bytes  [ 89, 06, 8B, 45, A4, 89, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!EnableScrollBar + 9C                                                 7E467E79 20 Bytes  [ 45, 94, 66, 89, 46, 44, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevExA + 32                                                     7E46968C 279 Bytes  [ 65, 55, 6E, 69, 63, 6F, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevExA + 14A                                                    7E4697A4 307 Bytes  [ 4D, 61, 6B, 65, 54, 65, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevExA + 27E                                                    7E4698D8 194 Bytes  [ 6C, 61, 72, 6D, 00, 5A, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevExA + 341                                                    7E46999B 37 Bytes  [ 64, 64, 42, 6F, 6F, 74, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CharPrevExA + 367                                                    7E4699C1 51 Bytes  [ 73, 74, 50, 72, 69, 76, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsHungAppWindow + CD                                                 7E469B06 134 Bytes  [ 4B, 65, 79, 73, 00, 5A, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsHungAppWindow + 154                                                7E469B8D 56 Bytes  [ 76, 65, 6E, 74, 00, 5A, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsHungAppWindow + 18D                                                7E469BC6 63 Bytes  [ 5A, 77, 43, 72, 65, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsHungAppWindow + 1CD                                                7E469C06 162 Bytes  [ 5A, 77, 43, 72, 65, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsHungAppWindow + 270                                                7E469CA9 19 Bytes  [ 65, 53, 65, 6D, 61, 70, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IsCharUpperW + 15C                                                   7E46A113 176 Bytes  [ 74, 6F, 72, 79, 46, 69, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdePostAdvise + 47                                                   7E46A1C4 577 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdePostAdvise + 289                                                  7E46A406 179 Bytes  [ 74, 65, 73, 46, 69, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeClientTransaction + 40                                            7E46A4BA 24 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeClientTransaction + 59                                            7E46A4D3 91 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeClientTransaction + B5                                            7E46A52F 58 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeClientTransaction + F0                                            7E46A56A 57 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeClientTransaction + 12A                                           7E46A5A4 3 Bytes  [ 5A, 77, 51 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeQueryConvInfo + 61                                                7E46A9DF 332 Bytes  [ 76, 65, 6E, 74, 50, 61, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeSetUserHandle + 2B                                                7E46AB2C 143 Bytes  [ 79, 4F, 62, 6A, 65, 63, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DdeAbandonTransaction + 60                                           7E46ABBC 193 Bytes  [ 69, 6F, 6E, 53, 74, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessageExA + F                                        7E46AC7E 32 Bytes  [ 73, 70, 65, 6E, 64, 54, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BroadcastSystemMessage + 9                                           7E46AC9F 169 Bytes  [ 5A, 77, 54, 65, 72, 6D, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputDeviceInfoA + 64                                          7E46AD49 567 Bytes  [ 61, 6C, 4D, 65, 6D, 6F, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VkKeyScanExA + 1E                                                    7E46AF81 176 Bytes  [ 5F, 73, 74, 72, 69, 63, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilter + 44                                                   7E46B032 80 Bytes  [ 00, 81, FE, 0B, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!CallMsgFilter + 95                                                   7E46B083 139 Bytes  [ 8B, 45, 08, F7, D8, 1B, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempA + 67                                                7E46B10F 5 Bytes  [ FF, 75, FC, E8, B3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempA + 6D                                                7E46B115 2 Bytes  [ FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempA + 71                                                7E46B119 1 Byte  [ FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempA + 73                                                7E46B11B 11 Bytes  JMP 7E4653A6 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawCaptionTempA + 7F                                                7E46B127 29 Bytes  JMP 7E4701E3 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RealGetWindowClass + 2                                               7E46B145 52 Bytes  JMP 7E452290 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RealGetWindowClass + 37                                              7E46B17A 36 Bytes  [ C0, 0F, 85, 60, 59, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RealGetWindowClass + 5C                                              7E46B19F 28 Bytes  [ 8B, 45, A0, 66, 25, 00, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAltTabInfo + 8                                                    7E46B1BC 18 Bytes  [ 85, C0, 0F, 84, 6C, 58, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetAltTabInfo + 1B                                                   7E46B1CF 38 Bytes  JMP 7E450AC7 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsA + 1E                                          7E46B1F6 13 Bytes  JMP 7E465AAF C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ChangeDisplaySettingsA + 2C                                          7E46B204 102 Bytes  CALL 7E44BB6E C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SendIMEMessageExA + 7                                                7E46B26B 50 Bytes  [ 76, 1C, 8B, 46, 18, 83, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPQueryIMEW + 7                                                     7E46B29E 16 Bytes  [ FF, 8D, 85, 60, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPQueryIMEA + 7                                                     7E46B2AF 30 Bytes  [ FF, 3D, 80, 00, 00, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPSetIMEA + 4                                                       7E46B2CE 76 Bytes  [ 75, 08, 8D, 86, 70, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPSetIMEA + 51                                                      7E46B31B 9 Bytes  [ FF, 56, FF, 75, 08, FF, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPSetIMEA + 5C                                                      7E46B326 24 Bytes  CALL 7E465593 C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPSetIMEA + 75                                                      7E46B33F 86 Bytes  [ 00, 89, 76, 04, 89, 36, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!IMPSetIMEA + CC                                                      7E46B396 146 Bytes  [ 0F, 84, 2F, 01, 00, 00, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!BlockInput + 4                                                       7E46C848 126 Bytes  [ 0F, 85, 32, 19, 02, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawAnimatedRects + B                                                7E46C8C7 76 Bytes  [ FF, 8B, F8, 85, FF, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawAnimatedRects + 58                                               7E46C914 6 Bytes  [ 00, 00, 64, A1, 18, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!DrawAnimatedRects + 5F                                               7E46C91B 46 Bytes  [ 00, 8B, 40, 30, FF, 70, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!FlashWindowEx + 5                                                    7E46C94B 19 Bytes  [ 8B, 40, 30, 8B, 80, 08, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetClipboardViewer + 5                                               7E46C95F 106 Bytes  [ 8B, 4D, 0C, 3B, D1, 0F, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetGuiResources + 22                                                 7E46C9CA 72 Bytes  [ 89, 5E, 04, 0F, 86, 7A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetMenuBarInfo + 7                                                   7E46CA13 103 Bytes  [ 00, 8D, 45, F8, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetPriorityClipboardFormat + 1F                                      7E46CA7B 33 Bytes  [ 8D, 85, CC, FC, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputData + 19                                                 7E46CA9D 5 Bytes  [ FF, B5, D4, FC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRawInputData + 1F                                                 7E46CAA3 32 Bytes  [ 53, FF, B5, 0C, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRegisteredRawInputDevices + 5                                     7E46CAC5 25 Bytes  [ 33, DB, 89, 9D, E4, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!GetRegisteredRawInputDevices + 1F                                    7E46CADF 39 Bytes  [ 89, 9D, F4, FC, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ImpersonateDdeClientWindow + B                                       7E46CB07 91 Bytes  [ 03, 1F, 00, 8D, 85, 14, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuItemFromPoint + 2D                                               7E46CB63 23 Bytes  [ 90, 90, 90, 90, 90, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!MenuItemFromPoint + 45                                               7E46CB7B 12 Bytes  [ 55, 8B, EC, 8B, 45, 0C, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!QuerySendMessage + 4                                                 7E46CB88 10 Bytes  [ 83, A0, B4, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!QuerySendMessage + F                                                 7E46CB93 19 Bytes  [ 00, 00, 00, 56, 6A, 04, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!QueryUserCounters + F                                                7E46CBA7 48 Bytes  [ 00, 00, 89, 88, C8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterRawInputDevices + 4                                          7E46CBD8 11 Bytes  [ C7, 80, A8, 00, 00, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterRawInputDevices + 10                                         7E46CBE4 7 Bytes  [ A0, 00, 00, 00, C7, 80, 9C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterTasklist + 5                                                 7E46CBED 9 Bytes  [ 00, 05, 00, 00, 00, C7, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!RegisterTasklist + F                                                 7E46CBF7 8 Bytes  [ 00, 38, 00, 00, 00, C7, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ResolveDesktopForWOW + 5                                             7E46CC01 9 Bytes  [ 00, 18, 00, 00, 00, C7, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!ResolveDesktopForWOW + F                                             7E46CC0B 8 Bytes  [ 00, 00, 02, 00, 00, C7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetClassWord + 4                                                     7E46CC14 146 Bytes  [ 01, 00, 8D, 45, 10, 83, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!SetMenuContextHelpId + 1F                                            7E46CCA7 192 Bytes  [ FF, FF, 70, 04, 56, E8, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UnregisterHotKey + 18                                                7E46CD68 70 Bytes  [ 8B, 4D, 10, 8B, 55, 0C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserHandleGrantAccess + F                                            7E46CDAF 8 Bytes  [ 83, F8, 58, 0F, 8E, E2, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!UserHandleGrantAccess + 18                                           7E46CDB8 39 Bytes  CALL AFCADD17 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!Win32PoolAllocationStats + 19                                        7E46CDE1 2 Bytes  [ 00, E9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!Win32PoolAllocationStats + 1C                                        7E46CDE4 167 Bytes  JMP 7E473E1D C:\WINDOWS\system32\USER32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!Win32PoolAllocationStats + C4                                        7E46CE8C 36 Bytes  [ 1B, 16, 00, 00, 40, 40, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!Win32PoolAllocationStats + E9                                        7E46CEB1 75 Bytes  [ CB, 23, CF, 33, C0, 0B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!Win32PoolAllocationStats + 135                                       7E46CEFD 515 Bytes  [ FE, 7A, 0F, 87, C1, CA, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AlignRects + 1                                                       7E46D2A7 44 Bytes  [ 07, F8, 06, 57, 00, 7A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AlignRects + 2E                                                      7E46D2D4 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AlignRects + 30                                                      7E46D2D6 261 Bytes  [ 57, 00, 18, 00, E6, 03, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AlignRects + 136                                                     7E46D3DC 130 Bytes  [ 21, 00, 00, 00, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!AlignRects + 1B9                                                     7E46D45F 18 Bytes  [ 00, 37, 05, 00, 00, 38, 05, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + 45                                                      7E46DCD6 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + 47                                                      7E46DCD8 7 Bytes  [ 33, 01, 00, C0, 01, 00, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + 4F                                                      7E46DCE0 37 Bytes  [ 35, 01, 00, C0, 01, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + 75                                                      7E46DD06 29 Bytes  [ 01, 00, 4F, 01, 00, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USER32.dll!VRipOutput + 93                                                      7E46DD24 33 Bytes  [ 09, 00, 01, 00, 72, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + FFFBEDF3                                      77F111ED 13 Bytes  [ 89, BD, 9C, FD, FF, FF, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + FFFBEE01                                      77F111FB 30 Bytes  CALL 77F11333 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + FFFBEE20                                      77F1121A 26 Bytes  CALL 77F0B295 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + FFFBEE3B                                      77F11235 7 Bytes  [ 00, 00, 00, 74, AB, 92, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + FFFBEE46                                      77F11240 5 Bytes  [ 90, 68, 84, 02, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiFlush + E                                                          77F15994 31 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiFlush + 2E                                                         77F159B4 66 Bytes  [ 8B, C7, 5F, 5E, 5D, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiReleaseDC + 11                                                     77F159F7 14 Bytes  [ 89, 55, D8, 66, 8B, 12, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiReleaseDC + 20                                                     77F15A06 13 Bytes  JMP 77F0EC3C 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiReleaseDC + 2E                                                     77F15A14 9 Bytes  [ 89, 85, 8C, FD, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiReleaseDC + 38                                                     77F15A1E 104 Bytes  [ 70, 10, 83, C6, 24, 89, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDeviceCaps + 1D                                                    77F15A87 69 Bytes  [ FD, FF, FF, 03, C7, 03, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDeviceCaps + 63                                                    77F15ACD 81 Bytes  [ EC, 8B, 45, 08, 80, 38, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDeviceCaps + B5                                                    77F15B1F 4 Bytes  [ 85, 60, F6, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDeviceCaps + BA                                                    77F15B24 35 Bytes  [ 66, 8B, 48, 02, 84, ED, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDeviceCaps + DE                                                    77F15B48 9 Bytes  [ 66, 89, 48, 02, 0F, 85, E2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectObject + 22                                                     77F15B92 59 Bytes  [ 48, 0F, 85, 73, 71, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectObject + 5E                                                     77F15BCE 4 Bytes  [ 33, DB, 3B, C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectObject + 63                                                     77F15BD3 17 Bytes  [ 18, 5F, 0F, 8C, 35, 34, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectObject + 75                                                     77F15BE5 17 Bytes  [ FF, 75, 08, 89, 7D, DC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectObject + 87                                                     77F15BF7 41 Bytes  [ 00, 89, 5D, EC, 89, 5D, F0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextColor + 13                                                     77F15D8A 5 Bytes  [ 0F, 85, E7, 86, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextColor + 19                                                     77F15D90 1 Byte  [ 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextColor + 1B                                                     77F15D92 45 Bytes  [ 53, 56, FF, 75, F4, E8, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextColor + 49                                                     77F15DC0 147 Bytes  [ FF, 75, E0, 56, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBkColor + 2C                                                       77F15E55 105 Bytes  JMP 77F38710 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBkColor + 96                                                       77F15EBF 75 Bytes  [ 88, 45, DA, F7, C1, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBkMode + 30                                                        77F15F0B 5 Bytes  [ 00, 00, 81, FB, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBkMode + 36                                                        77F15F11 136 Bytes  [ 00, 00, 0F, 83, 32, 6F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBkMode + BF                                                        77F15F9A 93 Bytes  [ 8D, 46, 08, 8B, 38, 89, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleDC + 18                                               77F15FF8 8 Bytes  [ 8B, 4D, E4, 8D, 84, 08, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleDC + 21                                               77F16001 11 Bytes  [ 00, 33, C9, 8A, 08, 33, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleDC + 2D                                               77F1600D 59 Bytes  [ A8, 04, 0F, 85, C5, 08, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleDC + 69                                               77F16049 65 Bytes  [ 0F, 83, 19, 09, 03, 00, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleDC + AB                                               77F1608B 39 Bytes  [ 8D, 34, DF, 89, B5, B0, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateSolidBrush + 2                                                  77F161A7 12 Bytes  [ 8B, F8, 89, BD, 34, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateSolidBrush + F                                                  77F161B4 2 Bytes  [ 83, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateSolidBrush + 13                                                 77F161B8 24 Bytes  [ F6, C4, 08, 0F, 85, 03, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStockObject + 11                                                   77F161D2 15 Bytes  [ 00, 83, 4D, FC, FF, E8, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStockObject + 21                                                   77F161E2 25 Bytes  [ 01, 0F, 85, 11, C8, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmap + F                                                      77F161FE 57 Bytes  [ 0F, 83, F2, 24, 01, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmap + 49                                                     77F16238 12 Bytes  [ FF, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmap + 56                                                     77F16245 8 Bytes  [ 00, 00, 00, 3D, AE, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmap + 60                                                     77F1624F 69 Bytes  [ 00, 5C, BA, 94, 7C, 7B, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmap + A7                                                     77F16296 65 Bytes  JMP 77F16171 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPatBlt + 27                                                       77F162D8 110 Bytes  [ 8B, 01, 89, 45, E4, 8B, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPatBlt + 96                                                       77F16347 31 Bytes  [ 8B, 45, 10, 83, C0, F8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPatBlt + B6                                                       77F16367 32 Bytes  [ 89, 45, D0, 8B, 4D, 14, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPatBlt + D7                                                       77F16388 60 Bytes  [ FF, FF, FF, FF, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPatBlt + 114                                                      77F163C5 20 Bytes  [ 00, 00, 8B, 4D, 14, 89, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiValidateHandle + 11                                                77F1648D 91 Bytes  [ 0F, B7, CB, 8D, 94, C8, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiValidateHandle + 6D                                                77F164E9 13 Bytes  [ 00, 8B, 02, 89, 45, BC, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiValidateHandle + 7B                                                77F164F7 95 Bytes  [ 85, FD, EE, 00, 00, 8B, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiValidateHandle + DB                                                77F16557 30 Bytes  [ 8B, 40, 04, 89, 47, 04, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiValidateHandle + FA                                                77F16576 34 Bytes  [ FF, 81, F9, FF, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiProcessSetup + 2                                                   77F1660E 4 Bytes  CALL 77F0B296 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiProcessSetup + 7                                                   77F16613 235 Bytes  [ FF, C9, C3, 83, 8D, F8, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiProcessSetup + F3                                                  77F166FF 24 Bytes  [ 00, 66, 83, F8, 6F, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiProcessSetup + 10C                                                 77F16718 43 Bytes  [ 0F, 84, 07, 06, 00, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiProcessSetup + 138                                                 77F16744 39 Bytes  JMP 77F1F920 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCodePage + 2                                                    77F169D2 17 Bytes  JMP 77F16B3A C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCodePage + 15                                                   77F169E5 14 Bytes  CALL 03F169E5 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCodePage + 24                                                   77F169F4 60 Bytes  JMP 77F16B62 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCodePage + 61                                                   77F16A31 5 Bytes  [ 00, FF, B5, CC, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCodePage + 67                                                   77F16A37 75 Bytes  [ FF, 8D, 85, E4, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IntersectClipRect + 2D                                                77F16A83 46 Bytes  CALL 6075798D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetClipBox + 12                                                       77F16AB3 5 Bytes  [ 00, C7, 85, BC, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetClipBox + 18                                                       77F16AB9 3 Bytes  [ FF, 27, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetClipBox + 1C                                                       77F16ABD 41 Bytes  [ 00, F6, 85, F8, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetClipRgn + 12                                                       77F16AE8 25 Bytes  [ 83, 85, F4, FB, FF, FF, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetClipRgn + 2C                                                       77F16B02 17 Bytes  [ 40, FC, 0F, 85, A7, 53, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPointW + 7                                               77F16B14 6 Bytes  [ 00, 85, B5, F8, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPointW + E                                               77F16B1B 56 Bytes  [ 8B, D8, 8B, FA, 75, 02, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetLayout + 26                                                        77F16B54 73 Bytes  [ 74, 06, 03, C6, 85, D2, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDrawStream                                                         77F16B9E 75 Bytes  [ 02, 00, 00, FF, B5, E0, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDrawStream + 4C                                                    77F16BEA 38 Bytes  [ 0F, 85, BE, 02, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteObject + 17                                                     77F16C11 58 Bytes  [ 8D, C4, FB, FF, FF, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteObject + 53                                                     77F16C4D 22 Bytes  [ 83, BD, C4, FB, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteObject + 6A                                                     77F16C64 123 Bytes  JMP 77F16A32 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteObject + E6                                                     77F16CE0 29 Bytes  [ BE, 80, 50, B1, 91, 7C, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteObject + 104                                                    77F16CFE 46 Bytes  [ FF, 77, 24, FF, 24, 85, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteDC + CD                                                         77F16F2C 124 Bytes  [ 00, C3, 66, 3B, C3, 75, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BitBlt + 30                                                           77F16FA9 4 Bytes  [ 84, A6, 6A, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BitBlt + 35                                                           77F16FAE 32 Bytes  [ 8D, 45, CC, 50, 6A, 0E, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BitBlt + 58                                                           77F16FD1 13 Bytes  CALL 77F171F6 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BitBlt + 66                                                           77F16FDF 63 Bytes  [ 3B, F3, 0F, 84, A6, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleBitmap + 16                                           77F17020 34 Bytes  [ 89, 46, 2C, 8B, 85, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleBitmap + 3A                                           77F17044 14 Bytes  [ 40, 0F, 94, C0, 50, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleBitmap + 49                                           77F17053 127 Bytes  [ 00, 40, 0F, 84, 6B, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleBitmap + CA                                           77F170D4 3 Bytes  [ 3F, 6C, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateCompatibleBitmap + CE                                           77F170D8 8 Bytes  [ 39, 5D, C8, 0F, 85, 44, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgn + E                                                     77F17794 3 Bytes  [ 85, DE, 9A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgn + 13                                                    77F17799 18 Bytes  CALL 77F177D0 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgn + 26                                                    77F177AC 55 Bytes  [ 90, 90, 90, 90, 90, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgn + 5E                                                    77F177E4 14 Bytes  [ 90, 39, 45, E0, 0F, 85, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgn + 6D                                                    77F177F3 64 Bytes  [ 00, 00, 89, 85, 48, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtSelectClipRgn + 2                                                  77F17876 8 Bytes  [ FF, FF, 50, 8D, 45, C4, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtSelectClipRgn + B                                                  77F1787F 7 Bytes  [ 18, 56, FF, 75, 08, E8, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtSelectClipRgn + 14                                                 77F17888 289 Bytes  [ 00, 8B, F8, 3B, FB, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtSelectClipRgn + 136                                                77F179AA 43 Bytes  [ 00, 66, 39, 5D, A0, 75, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtSelectClipRgn + 162                                                77F179D6 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipRgn + 1                                                     77F17AA1 7 Bytes  [ EC, 83, EC, 10, 53, 56, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipRgn + A                                                     77F17AAA 156 Bytes  [ 33, DB, 3B, F3, 57, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetWindowOrgEx + 8C                                                77F17B47 143 Bytes  [ 00, C0, EB, CC, 66, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportOrgEx + 8B                                                 77F17BD7 20 Bytes  [ 10, 00, 8D, 45, 0C, 50, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportOrgEx + A1                                                 77F17BED 122 Bytes  [ 00, 89, 5D, F0, 89, 5D, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetViewportOrgEx + 67                                                 77F17C68 4 Bytes  [ 8C, B9, 4F, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetViewportOrgEx + 6D                                                 77F17C6E 31 Bytes  CALL 77F0840A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowExtEx + 15                                                   77F17C8E 190 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetViewportExtEx + 5C                                                 77F17D4D 12 Bytes  [ A1, C8, E0, 97, 7C, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetViewportExtEx + 69                                                 77F17D5A 176 Bytes  [ 56, 8B, 75, 08, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsW + 52                                                  77F17E0B 35 Bytes  [ FF, 89, 85, 14, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsW + 76                                                  77F17E2F 54 Bytes  CALL 77F089EA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetHFONT + 10                                                         77F17E66 5 Bytes  [ 65, 00, 5C, 00, 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetHFONT + 16                                                         77F17E6C 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetHFONT + 18                                                         77F17E6E 7 Bytes  [ 66, 00, 74, 00, 77, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetHFONT + 20                                                         77F17E76 43 Bytes  [ 72, 00, 65, 00, 5C, 00, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetHFONT + 4C                                                         77F17EA2 29 Bytes  [ 54, 00, 5C, 00, 43, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutW + 14                                                         77F17EC0 9 Bytes  [ 6E, 00, 5C, 00, 49, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutW + 1E                                                         77F17ECA 7 Bytes  [ 67, 00, 65, 00, 20, 00, 46 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutW + 26                                                         77F17ED2 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutW + 28                                                         77F17ED4 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutW + 2A                                                         77F17ED6 13 Bytes  [ 65, 00, 20, 00, 45, 00, 78, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32W + 9                                             77F17FA6 4 Bytes  CALL 77F17F32 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32W + E                                             77F17FAB 53 Bytes  [ FF, 3C, 01, 6A, 02, 5E, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32W + 44                                            77F17FE1 4 Bytes  [ 00, 00, 84, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32W + 4A                                            77F17FE7 3 Bytes  [ 8F, 49, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32W + 4F                                            77F17FEC 113 Bytes  [ 7D, FC, 00, 0F, 85, C4, 9C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtTextOutW                                                           77F18086 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtTextOutW + 4                                                       77F1808A 160 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtTextOutW + A5                                                      77F1812B 111 Bytes  [ 0F, B7, 47, 06, FF, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectType + 4D                                                    77F1819B 7 Bytes  [ 8B, 75, 0C, 8D, 45, DC, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectType + 55                                                    77F181A3 73 Bytes  [ 0C, 6A, 01, FF, 76, 18, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectType + 9F                                                    77F181ED 20 Bytes  [ 4B, 10, 85, C9, 74, 68, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectType + B4                                                    77F18202 11 Bytes  [ 8B, 0B, 3B, 48, 54, 72, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectType + C0                                                    77F1820E 36 Bytes  [ 8B, 7E, 18, 03, F9, 89, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RectVisible + 18                                                      77F18233 16 Bytes  [ 75, D4, 57, FF, 76, 18, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RectVisible + 29                                                      77F18244 57 Bytes  [ 89, 45, E0, 83, C7, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgnIndirect + 2                                             77F1827E 6 Bytes  [ 8B, 45, E0, E8, A0, 1A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgnIndirect + 9                                             77F18285 13 Bytes  [ FF, C2, 10, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgnIndirect + 18                                            77F18294 50 Bytes  [ EB, C6, 93, 7C, 06, C7, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgnIndirect + 4B                                            77F182C7 38 Bytes  [ 53, 8B, 5D, 18, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateRectRgnIndirect + 72                                            77F182EE 2 Bytes  [ 00, 05 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectPalette + 25                                                    77F1839F 76 Bytes  [ 15, C0, 0F, 85, E4, 5D, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectW + 2D                                                       77F183EC 17 Bytes  CALL 77F18428 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectW + 3F                                                       77F183FE 60 Bytes  [ D8, 89, 30, 80, 3D, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectW + 7C                                                       77F1843B 19 Bytes  [ 00, 85, C0, 74, 19, 8B, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectW + 91                                                       77F18450 127 Bytes  CALL 77F14C84 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharsetInfo + 3C                                               77F184D0 24 Bytes  [ 55, 8B, EC, 8B, 45, 14, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharsetInfo + 55                                               77F184E9 16 Bytes  [ 00, 8D, 45, 14, 50, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharsetInfo + 66                                               77F184FA 79 Bytes  [ 00, 00, 85, C0, 7D, D3, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharsetInfo + B6                                               77F1854A 9 Bytes  [ 73, 18, 56, FF, 75, 0C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharsetInfo + C1                                               77F18555 190 Bytes  [ 85, C0, 89, 45, 10, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PatBlt + 31                                                           77F18614 14 Bytes  [ 75, 08, 8D, 45, EC, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PatBlt + 40                                                           77F18623 61 Bytes  [ 00, 00, 8B, 40, 30, 33, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PatBlt + 7E                                                           77F18661 28 Bytes  [ 15, C0, 0F, 85, C6, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PatBlt + 9B                                                           77F1867E 4 Bytes  [ 87, 87, 48, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PatBlt + A0                                                           77F18683 18 Bytes  [ 50, 8D, 45, F4, 50, E8, F4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBrushOrgEx + 8C                                                    77F187C0 2 Bytes  [ 8B, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBrushOrgEx + 8F                                                    77F187C3 61 Bytes  [ 40, 04, 89, 75, E4, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBrushOrgEx + CD                                                    77F18801 257 Bytes  [ 75, F4, 33, DB, 8B, 72, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBrushOrgEx + 1CF                                                   77F18903 53 Bytes  [ 81, FF, 34, 00, 00, C0, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBrushOrgEx + 205                                                   77F18939 14 Bytes  [ C0, EB, D1, 85, DB, 0F, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RestoreDC + 16                                                        77F18A86 13 Bytes  [ C0, 0F, 85, 9F, 47, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RestoreDC + 24                                                        77F18A94 3 Bytes  [ 11, DD, BA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RestoreDC + 28                                                        77F18A98 33 Bytes  JMP 77F14565 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RestoreDC + 4A                                                        77F18ABA 42 Bytes  JMP 77F0CB32 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RestoreDC + 75                                                        77F18AE5 104 Bytes  [ C6, 45, C2, 01, 8B, 42, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SaveDC + 18                                                           77F18B4E 15 Bytes  [ B8, 64, F8, 97, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SaveDC + 28                                                           77F18B5E 19 Bytes  [ FF, 84, C0, 0F, 85, 1C, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SaveDC + 3C                                                           77F18B72 44 Bytes  [ 14, 53, FF, 75, E4, E8, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SaveDC + 69                                                           77F18B9F 63 Bytes  [ 00, 00, 8B, F8, 89, BD, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextAlign + C                                                      77F18BDF 33 Bytes  [ F8, 81, FF, 18, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextAlign + 2E                                                     77F18C01 24 Bytes  [ 00, 8B, F8, 3B, FB, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextAlign + 47                                                     77F18C1A 31 Bytes  [ 50, 02, 00, 90, 4C, 44, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextAlign + 67                                                     77F18C3A 19 Bytes  [ 6A, 00, FF, 75, 08, E8, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextAlign + 7B                                                     77F18C4E 130 Bytes  [ FF, 55, 8B, EC, 83, EC, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetObjectA + 64                                                       77F18CD1 77 Bytes  [ 75, D1, 8B, 7D, 18, 8B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRegionData + 31                                                    77F18D1F 80 Bytes  [ 00, 00, 03, 4D, 08, C1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowOrgEx + 14                                                   77F18D70 169 Bytes  [ 66, 39, 5E, 06, 0F, B7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowOrgEx + BE                                                   77F18E1A 7 Bytes  [ 94, 88, 5D, C2, 64, A1, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowOrgEx + C6                                                   77F18E22 19 Bytes  [ 00, 00, 8B, 40, 30, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMapMode + 2                                                        77F18E36 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMapMode + 4                                                        77F18E38 1 Byte  [ D1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMapMode + 6                                                        77F18E3A 17 Bytes  [ 09, 8B, 7A, 18, 8B, 5A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMapMode + 18                                                       77F18E4C 1 Byte  [ E2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMapMode + 1A                                                       77F18E4E 63 Bytes  [ 5D, 90, 3B, DF, 73, 56, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextColor + 6                                                      77F18EFD 36 Bytes  [ F0, C1, EE, 1B, 0F, A4, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextColor + 2B                                                     77F18F22 84 Bytes  [ E6, 08, 0B, F2, 8B, 55, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayout + 19                                                        77F18F78 101 Bytes  [ C1, E6, 09, 0B, F2, 8B, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayout + 7F                                                        77F18FDE 16 Bytes  [ FE, 0F, AC, DF, 07, 81, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertAndCheckDC + 4                                              77F18FEF 25 Bytes  [ DA, 8B, FE, 0F, AC, DF, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertAndCheckDC + 1E                                             77F19009 43 Bytes  [ 0B, C7, C1, EA, 15, 8B, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExcludeClipRect + 1                                                   77F19035 104 Bytes  [ 45, 18, 11, 41, 04, E9, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetStretchBltMode + 1F                                                77F1909E 7 Bytes  [ 79, 00, 6E, 00, 61, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetStretchBltMode + 27                                                77F190A6 5 Bytes  [ 69, 00, 63, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetStretchBltMode + 2D                                                77F190AC 7 Bytes  [ 6C, 00, 6C, 00, 79, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetStretchBltMode + 35                                                77F190B4 19 Bytes  [ 41, 00, 6C, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetStretchBltMode + 49                                                77F190C8 11 Bytes  [ 4D, 00, 65, 00, 6D, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAlphaBlend + BF                                                    77F191D9 21 Bytes  [ FF, FF, FF, 1B, E7, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAlphaBlend + D5                                                    77F191EF 96 Bytes  [ 8B, 75, E0, 83, C6, C4, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAlphaBlend + 137                                                   77F19251 33 Bytes  [ 00, 80, 3D, C1, E1, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAlphaBlend + 159                                                   77F19273 32 Bytes  [ 33, C0, 8D, BD, 34, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAlphaBlend + 17A                                                   77F19294 33 Bytes  [ 6A, 00, 6A, 00, 8B, 45, E4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExW + 4B                                            77F193B0 48 Bytes  [ 3B, 35, 24, E2, 97, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExW + 7C                                            77F193E1 18 Bytes  [ 39, 5E, 28, 74, 20, 57, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExW + 8F                                            77F193F4 10 Bytes  [ 5E, 28, 66, 89, 5E, 26, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExW + 9A                                            77F193FF 151 Bytes  [ 5E, 2C, 66, 89, 5E, 2E, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectW + 30                                              77F19497 40 Bytes  [ 55, 8B, EC, 53, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectW + 59                                              77F194C0 35 Bytes  [ 45, 08, 8B, 45, 08, 3B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectW + 80                                              77F194E7 24 Bytes  [ 8B, FF, 55, 8B, EC, F7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapMode + 19                                                       77F19501 2 Bytes  [ 6F, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapMode + 1D                                                       77F19505 61 Bytes  [ 56, 8B, 75, 10, 3B, 73, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapMode + 5B                                                       77F19543 42 Bytes  JMP 0397884A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapMode + 86                                                       77F1956E 22 Bytes  [ 00, 8B, 03, 89, 06, 83, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapMode + 9E                                                       77F19586 43 Bytes  [ 00, 8B, 06, 33, C9, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceW + 1D                                                     77F195B2 65 Bytes  [ 97, 7C, 66, 8B, 4D, 0C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceW + 5F                                                     77F195F4 16 Bytes  [ 68, CC, E0, 97, 7C, E8, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceW + 70                                                     77F19605 120 Bytes  JMP 77F43CB9 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceW + E9                                                     77F1967E 24 Bytes  [ 8B, 45, 18, 89, 85, D0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceW + 102                                                    77F19697 6 Bytes  [ 75, 0C, E8, C0, F4, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBitsToDevice + 65                                                77F198F4 45 Bytes  [ D8, 85, DB, 0F, 8C, 63, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBitsToDevice + 93                                                77F19922 9 Bytes  [ 8B, 4D, D0, 85, C9, 74, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBitsToDevice + 9D                                                77F1992C 11 Bytes  [ 01, 02, 0F, B7, 02, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBitsToDevice + AA                                                77F19939 18 Bytes  [ 0F, 87, 9F, 9A, 02, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBitsToDevice + BD                                                77F1994C 38 Bytes  [ 3B, 46, 10, 0F, 87, 7E, 99, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBSection + 8                                                  77F19AA9 99 Bytes  [ 8B, 50, 30, 0F, 84, DE, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBSection + 6C                                                 77F19B0D 126 Bytes  [ 74, 48, 8B, 45, F4, 3B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBSection + EB                                                 77F19B8C 89 Bytes  [ FF, 8B, 4D, 18, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBSection + 147                                                77F19BE8 43 Bytes  [ 9D, C8, FB, FF, FF, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBSection + 173                                                77F19C14 8 Bytes  [ 00, 83, FA, 01, 0F, 82, 80, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CombineRgn                                                            77F19C2D 38 Bytes  [ 0F, 85, 2B, 02, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CombineRgn + 27                                                       77F19C54 45 Bytes  [ 00, 0F, 87, 0B, 85, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CombineRgn + 55                                                       77F19C82 241 Bytes  [ 8D, BC, FB, FF, FF, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CombineRgn + 147                                                      77F19D74 57 Bytes  [ 66, C7, 85, 9A, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRectRgn + A                                                        77F19DAE 4 Bytes  [ 0F, 85, 68, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRectRgn + 10                                                       77F19DB4 103 Bytes  [ 56, 68, 90, EA, 91, 7C, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRectRgn + 78                                                       77F19E1C 23 Bytes  [ FB, FF, FF, FF, B5, 7C, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRectRgn + 90                                                       77F19E34 34 Bytes  [ FF, 95, 80, FB, FF, FF, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRectRgn + B3                                                       77F19E57 235 Bytes  [ FF, 0F, 85, C2, 87, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetRgn + 16                                                        77F19F43 25 Bytes  [ 00, 00, 8B, F0, 3B, F3, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetRgn + 30                                                        77F19F5D 30 Bytes  [ 33, F6, 3B, F3, 0F, 8D, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetRgn + 4F                                                        77F19F7C 28 Bytes  [ FF, 0F, 84, 08, 8F, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetRgn + 6C                                                        77F19F99 74 Bytes  [ 00, 8B, 47, 24, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetRgn + B7                                                        77F19FE4 43 Bytes  CALL 77F0AFF1 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreateRegion + 2                                                   77F1A03E 28 Bytes  [ AB, 33, F6, 81, FA, 70, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreateRegion + 1F                                                  77F1A05B 5 Bytes  [ 89, B5, E0, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreateRegion + 25                                                  77F1A061 2 Bytes  [ 89, B5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreateRegion + 28                                                  77F1A064 23 Bytes  [ FD, FF, FF, 66, 89, B5, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreateRegion + 40                                                  77F1A07C 13 Bytes  [ 02, 00, 89, 85, F0, FD, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharset + 60                                                   77F1A125 8 Bytes  [ 3B, C6, 74, 08, 8B, 8D, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharset + 69                                                   77F1A12E 143 Bytes  [ FF, 89, 08, 33, DB, 39, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetNearestColor + D                                                   77F1A1BF 39 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBitmapBits + 14                                                    77F1A1E7 7 Bytes  [ 00, 3B, 41, 04, 0F, 87, CE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBitmapBits + 1C                                                    77F1A1EF 163 Bytes  [ 00, 00, 3B, F7, 0F, 84, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TranslateCharsetInfo + 3B                                             77F1A293 111 Bytes  [ 8B, 45, 08, 8B, 40, 08, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBrushOrgEx + 2E                                                    77F1A303 31 Bytes  [ 56, 8B, 75, 10, 57, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBrushOrgEx + 4E                                                    77F1A323 11 Bytes  [ 43, 04, 83, C4, 10, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBrushOrgEx + 5B                                                    77F1A330 150 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBrushOrgEx + F2                                                    77F1A3C7 222 Bytes  [ 75, 05, 66, 83, 63, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBrushOrgEx + 1D1                                                   77F1A4A6 160 Bytes  [ 53, 58, 53, 3A, 20, 41, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBits + 50                                                        77F1A801 15 Bytes  [ FF, 33, F6, 83, BD, E4, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBits + 61                                                        77F1A812 5 Bytes  [ 00, FF, B5, E4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBits + 67                                                        77F1A818 70 Bytes  [ FF, 8B, 40, 30, 6A, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBits + AE                                                        77F1A85F 58 Bytes  [ 83, F8, 01, 0F, 85, 26, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBits + E9                                                        77F1A89A 1 Byte  [ 53 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePatternBrush + 2                                                77F1A8E4 7 Bytes  [ 50, 6A, 08, 8D, 85, D8, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePatternBrush + A                                                77F1A8EC 31 Bytes  [ FF, BF, 20, F5, 91, 7C, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePatternBrush + 2A                                               77F1A90C 5 Bytes  [ FF, E8, DC, E0, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePatternBrush + 30                                               77F1A912 25 Bytes  [ 85, C0, 89, 85, D4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePatternBrush + 4A                                               77F1A92C 4 Bytes  [ FF, 83, 4B, 18 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBitmap                                                        77F1A93D 18 Bytes  [ 90, 90, 90, B6, 00, B8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBitmap + 13                                                   77F1A950 5 Bytes  [ 69, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBitmap + 19                                                   77F1A956 37 Bytes  [ 72, 00, 79, 00, 5C, 00, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBitmap + 3F                                                   77F1A97C 32 Bytes  [ 5C, 00, 4D, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBitmap + 60                                                   77F1A99D 38 Bytes  [ 00, 73, 00, 5C, 00, 43, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBits + 16                                                        77F1AB09 71 Bytes  [ 89, B5, 70, FE, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBits + 5E                                                        77F1AB51 69 Bytes  [ 00, 00, 8D, 85, CC, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBits + A4                                                        77F1AB97 71 Bytes  CALL 77F0B763 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBits + EC                                                        77F1ABDF 71 Bytes  [ 00, 80, 3B, C7, 0F, 84, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBits + 134                                                       77F1AC27 4 Bytes  [ 82, B0, 8E, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBColorTable + 11                                                 77F1AC86 11 Bytes  [ 00, 00, 0F, B7, C1, D1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDIBColorTable + 1D                                                 77F1AC92 74 Bytes  [ FF, 66, 85, C0, 0F, 84, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MaskBlt + 3B                                                          77F1ACDD 35 Bytes  CALL 77F0D61E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MaskBlt + 5F                                                          77F1AD01 5 Bytes  [ FF, 8B, 8D, B8, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MaskBlt + 65                                                          77F1AD07 30 Bytes  [ FF, 89, 8D, A8, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MaskBlt + 85                                                          77F1AD27 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MaskBlt + 87                                                          77F1AD29 63 Bytes  [ 00, 00, 00, E6, 2F, 92, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePen + 34                                                        77F1AD6A 14 Bytes  [ 00, 0F, 85, 27, 26, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePen + 44                                                        77F1AD7A 69 Bytes  [ C0, 6A, FF, 8D, 45, F0, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePen + 8A                                                        77F1ADC0 79 Bytes  [ 41, 3C, 03, 89, 5D, F8, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MoveToEx + 15                                                         77F1AE10 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MoveToEx + 17                                                         77F1AE12 23 Bytes  [ 8D, 45, FC, 50, 53, FF, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MoveToEx + 30                                                         77F1AE2B 79 Bytes  [ 80, 0F, 84, 99, 8B, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MoveToEx + 81                                                         77F1AE7C 17 Bytes  [ 8D, 04, C8, 8D, 0C, 03, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MoveToEx + 93                                                         77F1AE8E 20 Bytes  [ 8B, 06, 03, C2, 66, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCharDimensions + 1                                              77F1AEA3 16 Bytes  [ C7, 5F, 5E, 5B, C9, C2, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCharDimensions + 13                                             77F1AEB5 60 Bytes  [ 00, EB, EA, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCharDimensions + 50                                             77F1AEF2 18 Bytes  [ 83, 66, 1C, 00, 83, 66, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCharDimensions + 63                                             77F1AF05 68 Bytes  [ FF, 55, 8B, EC, FF, 75, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetCharDimensions + A8                                             77F1AF4A 75 Bytes  [ C6, 5E, 5D, C2, 04, 00, C7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontW + 14                                                      77F1AFE6 23 Bytes  [ 5D, F8, 89, 75, F4, 8B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontW + 2C                                                      77F1AFFE 113 Bytes  [ 45, 14, 00, 00, 00, 00, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontW + 9E                                                      77F1B070 27 Bytes  [ 20, 00, 6D, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchDIBits + 15                                                    77F1B08C 5 Bytes  [ 73, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchDIBits + 1B                                                    77F1B092 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchDIBits + 1D                                                    77F1B094 55 Bytes  [ 65, 00, 20, 00, 6D, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchDIBits + 55                                                    77F1B0CC 15 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchDIBits + 65                                                    77F1B0DC 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePalette + 11                                                    77F1B23A 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePalette + 13                                                    77F1B23C 3 Bytes  [ 72, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePalette + 17                                                    77F1B240 9 Bytes  [ 4F, 00, 62, 00, 6A, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePalette + 21                                                    77F1B24A 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePalette + 23                                                    77F1B24C 7 Bytes  [ 20, 00, 66, 00, 61, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCA + 7                                                         77F1B260 15 Bytes  [ 20, 00, 74, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCA + 17                                                        77F1B270 47 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCA + 47                                                        77F1B2A0 5 Bytes  [ 74, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCA + 4D                                                        77F1B2A6 7 Bytes  [ 20, 00, 73, 00, 65, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCA + 55                                                        77F1B2AE 19 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateHalftonePalette + 5                                             77F1B31A 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateHalftonePalette + 7                                             77F1B31C 7 Bytes  [ 6F, 00, 77, 00, 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateHalftonePalette + F                                             77F1B324 15 Bytes  [ 77, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteEntries + B                                           77F1B334 17 Bytes  [ 61, 00, 62, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteEntries + 1D                                          77F1B346 11 Bytes  [ 72, 00, 6F, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteEntries + 29                                          77F1B352 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteEntries + 2B                                          77F1B354 49 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteEntries + 5D                                          77F1B386 47 Bytes  [ 6E, 00, 66, 00, 6F, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthInfo + 5                                                  77F1B3C0 1 Byte  [ 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthInfo + 7                                                  77F1B3C2 7 Bytes  [ 6F, 00, 75, 00, 72, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthInfo + F                                                  77F1B3CA 17 Bytes  [ 53, 00, 79, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!QueryFontAssocStatus + D                                              77F1B3DC 53 Bytes  [ 65, 00, 6E, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!QueryFontAssocStatus + 43                                             77F1B412 41 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!QueryFontAssocStatus + 6D                                             77F1B43C 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!QueryFontAssocStatus + 6F                                             77F1B43E 3 Bytes  [ 74, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!QueryFontAssocStatus + 73                                             77F1B442 17 Bytes  [ 6F, 00, 6E, 00, 20, 00, 62, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixel + 11                                                         77F1B48A 5 Bytes  [ 00, 00, 7C, 00, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixel + 17                                                         77F1B490 1 Byte  [ 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixel + 19                                                         77F1B492 7 Bytes  [ 68, 00, 65, 00, 20, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixel + 21                                                         77F1B49A 51 Bytes  [ 65, 00, 66, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixel + 55                                                         77F1B4CE 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixel + 13                                                         77F1B512 5 Bytes  [ 20, 00, 6D, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixel + 19                                                         77F1B518 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixel + 1B                                                         77F1B51A 13 Bytes  [ 69, 00, 66, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixel + 29                                                         77F1B528 5 Bytes  [ 69, 00, 6C, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixel + 2F                                                         77F1B52E 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelV + E                                                         77F1B5D6 5 Bytes  [ 20, 00, 63, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelV + 14                                                        77F1B5DC 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelV + 16                                                        77F1B5DE 13 Bytes  [ 74, 00, 61, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelV + 24                                                        77F1B5EC 5 Bytes  [ 6E, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelV + 2A                                                        77F1B5F2 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ModifyWorldTransform + 10                                             77F1B83E 1 Byte  [ 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ModifyWorldTransform + 12                                             77F1B840 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ModifyWorldTransform + 14                                             77F1B842 11 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ModifyWorldTransform + 20                                             77F1B84E 7 Bytes  [ 65, 00, 73, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ModifyWorldTransform + 28                                             77F1B856 7 Bytes  [ 64, 00, 20, 00, 61, 00, 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetGraphicsMode + F                                                   77F1B8D2 5 Bytes  [ 2E, 00, 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetGraphicsMode + 16                                                  77F1B8D9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetGraphicsMode + 18                                                  77F1B8DB 6 Bytes  [ 00, E4, 00, 01, 00, 4C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetGraphicsMode + 1F                                                  77F1B8E2 5 Bytes  [ 61, 00, 63, 00, 6B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetGraphicsMode + 25                                                  77F1B8E8 27 Bytes  [ 20, 00, 6F, 00, 66, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWorldTransform + 16                                                77F1B9A4 17 Bytes  [ 20, 00, 65, 00, 78, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWorldTransform + D                                                 77F1B9B6 11 Bytes  [ 6E, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWorldTransform + 19                                                77F1B9C2 21 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolMessage + 5                                                77F1B9D8 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolMessage + 7                                                77F1B9DA 7 Bytes  [ 63, 00, 65, 00, 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolMessage + F                                                77F1B9E2 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolMessage + 11                                               77F1B9E4 31 Bytes  [ 73, 00, 73, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolMessage + 31                                               77F1BA04 65 Bytes  [ 74, 00, 20, 00, 62, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPaletteEntries + 1E                                                77F1BA98 7 Bytes  [ 61, 00, 69, 00, 6C, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPaletteEntries + 26                                                77F1BAA0 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPaletteEntries + 28                                                77F1BAA2 9 Bytes  [ 20, 00, 62, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPaletteEntries + 32                                                77F1BAAC 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPaletteEntries + 34                                                77F1BAAE 39 Bytes  [ 73, 00, 65, 00, 20, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchBlt + 1E                                                       77F1BB18 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchBlt + 20                                                       77F1BB1A 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchBlt + 22                                                       77F1BB1C 7 Bytes  [ 65, 00, 74, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchBlt + 2A                                                       77F1BB24 5 Bytes  [ 0A, 00, 00, 00, AC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StretchBlt + 30                                                       77F1BB2A 11 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiTransparentBlt + 19                                                77F1BB8F 14 Bytes  [ 00, 65, 00, 20, 00, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiTransparentBlt + 28                                                77F1BB9E 7 Bytes  [ 72, 00, 65, 00, 63, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiTransparentBlt + 30                                                77F1BBA6 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiTransparentBlt + 32                                                77F1BBA8 13 Bytes  [ 74, 00, 6C, 00, 79, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiTransparentBlt + 40                                                77F1BBB6 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutA + 10                                                         77F1BC24 37 Bytes  [ 65, 00, 64, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!TextOutA + 36                                                         77F1BC4A 28 Bytes  [ 72, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesExW + D                                               77F1BC67 32 Bytes  [ 00, 68, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesExW + 2E                                              77F1BC88 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesExW + 30                                              77F1BC8A 3 Bytes  [ 6E, 00, 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesExW + 34                                              77F1BC8E 23 Bytes  [ 0D, 00, 0A, 00, 00, 00, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesExW + 4C                                              77F1BCA6 27 Bytes  [ 69, 00, 76, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCW + 7                                                         77F1BEA0 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCW + 1C                                                        77F1BEB5 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCW + 43                                                        77F1BEDC 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCW + 5A                                                        77F1BEF3 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDCW + 5F                                                        77F1BEF8 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FrameRgn + 9                                                          77F1BFF1 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FrameRgn + 12                                                         77F1BFFA 87 Bytes  [ 00, 00, 00, 00, 00, 00, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FrameRgn + 6A                                                         77F1C052 59 Bytes  [ 8B, FF, 55, 8B, EC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetViewportOrgEx + 17                                              77F1C08E 10 Bytes  [ 83, F8, 01, 75, 18, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetViewportOrgEx + 23                                              77F1C09A 3 Bytes  [ 3D, 3A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetViewportOrgEx + 27                                              77F1C09E 95 Bytes  [ 6A, 03, 58, 8B, 4D, 0C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetViewportOrgEx + 87                                              77F1C0FE 21 Bytes  [ 00, 00, 85, DB, 74, 0A, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetViewportOrgEx + 9D                                              77F1C114 5 Bytes  [ 89, 45, 08, 74, 0A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGradientFill + 10                                                  77F1C190 46 Bytes  [ F4, 89, 47, 04, 66, 89, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGradientFill + 3F                                                  77F1C1BF 38 Bytes  [ 00, 00, 5D, C2, 08, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGradientFill + 66                                                  77F1C1E6 59 Bytes  [ 01, 74, 05, 83, F8, 01, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGradientFill + A3                                                  77F1C223 16 Bytes  CALL 77F1C708 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGradientFill + B4                                                  77F1C234 33 Bytes  [ 02, 00, 8B, B6, 08, 02, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCBrushColor + 2                                                   77F1C265 66 Bytes  [ 83, 65, 94, 00, 80, 3D, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCBrushColor + 45                                                  77F1C2A8 23 Bytes  [ 94, 80, 3D, D5, 02, FE, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCBrushColor + 5D                                                  77F1C2C0 132 Bytes  [ 85, 24, FF, FF, FF, F6, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCBrushColor + E2                                                  77F1C345 5 Bytes  [ 97, 7C, E8, 2D, 98 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCBrushColor + E9                                                  77F1C34C 5 Bytes  [ 57, FF, B5, 28, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtEscape + 1E                                                        77F1C44B 11 Bytes  [ B5, 4C, FF, FF, FF, E8, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtEscape + 2A                                                        77F1C457 2 Bytes  [ 50, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtEscape + 2E                                                        77F1C45B 13 Bytes  [ 83, C4, 0C, 6A, 0C, 53, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtEscape + 3C                                                        77F1C469 58 Bytes  CALL 77F0E1AF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtEscape + 77                                                        77F1C4A4 65 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!cGetTTFFromFOT + 29                                                   77F1CBA3 26 Bytes  [ FF, 8D, 85, 08, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!cGetTTFFromFOT + 44                                                   77F1CBBE 9 Bytes  [ FF, FF, 40, 00, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!cGetTTFFromFOT + 4E                                                   77F1CBC8 7 Bytes  [ FF, FF, 89, B5, 1C, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!cGetTTFFromFOT + 56                                                   77F1CBD0 64 Bytes  CALL 77F08A6E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!cGetTTFFromFOT + 97                                                   77F1CC11 33 Bytes  CALL 77F0840D 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bMakePathNameW + 1F                                                   77F1CC90 99 Bytes  [ 43, 0C, 0F, 84, 50, E7, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bMakePathNameW + 83                                                   77F1CCF4 17 Bytes  [ FF, 89, 47, 1C, 8B, 85, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bMakePathNameW + 95                                                   77F1CD06 13 Bytes  [ FF, 89, 47, 28, 8A, 45, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bMakePathNameW + A3                                                   77F1CD14 13 Bytes  [ 25, 00, 00, 40, 00, 89, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bInitSystemAndFontsDirectoriesW + 2                                   77F1CD22 24 Bytes  [ 33, C9, 66, 39, 30, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bInitSystemAndFontsDirectoriesW + 1B                                  77F1CD3B 48 Bytes  [ 00, 66, 39, 30, 75, EC, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bInitSystemAndFontsDirectoriesW + 4E                                  77F1CD6E 4 Bytes  [ B5, 04, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bInitSystemAndFontsDirectoriesW + 53                                  77F1CD73 38 Bytes  CALL 77F171F3 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!bInitSystemAndFontsDirectoriesW + 7B                                  77F1CD9B 129 Bytes  [ 66, 83, 4E, 38, FF, 83, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddFontResourceW + 64                                              77F1CED5 21 Bytes  [ 83, 24, 46, 00, 56, E8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddFontResourceW + 7C                                              77F1CEED 101 Bytes  [ 8B, 40, 30, 56, 6A, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddFontResourceW + E2                                              77F1CF53 34 Bytes  [ C7, 85, 04, FF, FF, FF, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddFontResourceW + 106                                             77F1CF77 9 Bytes  [ FF, 50, FF, 75, 8C, E8, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddFontResourceW + 110                                             77F1CF81 70 Bytes  [ 3B, C7, 89, 45, 98, 0F, 8C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnableEUDC + 7                                                        77F1D160 55 Bytes  JMP 77EF456A C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBitmapAttributes + 2                                               77F1D198 108 Bytes  [ 8A, 51, 03, 80, FA, 6C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ClearBitmapAttributes + 7                                             77F1D205 70 Bytes  CALL 77EEB884 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ClearBitmapAttributes + 4E                                            77F1D24C 113 Bytes  CALL 77EE9F5B C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBoundsRect + C                                                     77F1D2BE 10 Bytes  [ 80, 7D, 13, 00, 75, 0F, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBoundsRect + 17                                                    77F1D2C9 80 Bytes  [ B9, E5, FC, FF, 56, E8, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertToDevmodeW + 24                                             77F1D31A 30 Bytes  [ E1, 97, 7C, 75, 0B, 38, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertToDevmodeW + 43                                             77F1D339 81 Bytes  [ 00, 68, 7C, 21, 94, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertToDevmodeW + 95                                             77F1D38B 53 Bytes  [ 5B, FF, 75, 98, 68, D4, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertToDevmodeW + CB                                             77F1D3C1 40 Bytes  JMP 77EF7A85 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertToDevmodeW + F6                                             77F1D3EC 71 Bytes  [ 38, 1D, C1, E1, 97, 7C, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtTextOutA + 23                                                      77F1D47D 11 Bytes  [ 83, C4, 14, 8D, 45, A0, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextAlign + 2                                                      77F1D489 16 Bytes  JMP 77F05FD7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextAlign + 13                                                     77F1D49A 153 Bytes  [ 38, 1D, C1, E1, 97, 7C, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LPtoDP + D                                                            77F1D534 18 Bytes  [ 4C, 64, 72, 70, 52, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LPtoDP + 20                                                           77F1D547 81 Bytes  [ 00, 4C, 44, 52, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LPtoDP + 73                                                           77F1D59A 88 Bytes  [ 00, 00, 4C, 64, 72, 70, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LPtoDP + CC                                                           77F1D5F3 121 Bytes  [ 00, 20, 20, 20, 50, 61, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LPtoDP + 146                                                          77F1D66D 22 Bytes  [ 00, 00, 00, 4C, 64, 72, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRgnBox + D                                                         77F1D756 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRgnBox + F                                                         77F1D758 165 Bytes  [ 4C, 44, 52, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRgnBox + B5                                                        77F1D7FE 94 Bytes  [ 6E, 55, 6E, 69, 63, 6F, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRandomRgn + 3F                                                     77F1D85D 28 Bytes  [ 35, 84, 10, 98, 7C, FF, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetBitmapBits + 18                                                    77F1D87A 30 Bytes  JMP 77EF70B6 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UnrealizeObject + 2                                                   77F1D899 60 Bytes  [ 35, 01, 00, C0, 0F, 84, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UnrealizeObject + 3F                                                  77F1D8D6 7 Bytes  [ FF, FF, 8D, 85, 48, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UnrealizeObject + 47                                                  77F1D8DE 4 Bytes  [ 89, 85, 64, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UnrealizeObject + 4D                                                  77F1D8E4 5 Bytes  [ 56, 8D, 85, 54, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UnrealizeObject + 54                                                  77F1D8EB 23 Bytes  CALL 77EDC6B4 C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LineTo + 16                                                           77F1DA0D 15 Bytes  [ 00, FF, 75, BC, 53, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LineTo + 26                                                           77F1DA1D 55 Bytes  JMP 77EF70B9 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCOrgEx + 7                                                        77F1DA56 1 Byte  [ E4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCOrgEx + 9                                                        77F1DA58 8 Bytes  CALL 77EE932D C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCOrgEx + 12                                                       77F1DA61 42 Bytes  [ 00, C0, 38, 1D, C1, E1, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowOrgEx + E                                                    77F1DA8C 25 Bytes  [ FF, 38, 1D, C1, E1, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowOrgEx + 28                                                   77F1DAA6 38 Bytes  [ E4, 68, D4, 2B, 94, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowOrgEx + 4F                                                   77F1DACD 90 Bytes  [ 40, 30, FF, 70, 08, E8, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowOrgEx + AA                                                   77F1DB28 81 Bytes  [ 8B, 46, 08, 8B, 4E, 0C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWindowOrgEx + FC                                                   77F1DB7A 52 Bytes  [ 8B, 45, 80, 89, 45, B0, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!InvertRgn + 30                                                        77F1DBAF 61 Bytes  JMP 77EF8C02 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!InvertRgn + 6F                                                        77F1DBEE 69 Bytes  JMP 77EF8BAD C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!InvertRgn + B5                                                        77F1DC34 17 Bytes  JMP 77EF70B6 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!InvertRgn + C7                                                        77F1DC46 80 Bytes  [ 8B, 46, 08, 8B, 4E, 0C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!InvertRgn + 118                                                       77F1DC97 80 Bytes  [ 1D, 80, 0B, 98, 7C, 75, 05, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPointA + 37                                              77F1DD96 190 Bytes  [ 69, 74, 68, 20, 73, 74, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPointA + F6                                              77F1DE55 408 Bytes  [ 00, 00, 00, 53, 54, 41, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsA + 49                                                  77F1DFEE 3 Bytes  [ 73, 20, 25 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsA + 4D                                                  77F1DFF2 29 Bytes  [ 0A, 00, 4C, 64, 72, 70, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsA + 6B                                                  77F1E010 99 Bytes  [ 90, 6A, 2C, 68, 78, 2F, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextMetricsA + CF                                                  77F1E074 42 Bytes  [ 02, 0F, 82, 8C, BB, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillRgn + 24                                                          77F1E09F 11 Bytes  [ C3, 74, 09, 39, 59, 04, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillRgn + 30                                                          77F1E0AB 19 Bytes  [ 8B, 7D, 18, 3B, FB, 74, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillRgn + 44                                                          77F1E0BF 142 Bytes  [ 66, 3B, C3, 74, 09, 39, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsW + 2F                                                77F1E14E 250 Bytes  [ 0F, 84, BF, BA, 02, 00, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsW + 12A                                               77F1E249 147 Bytes  [ 45, DC, 3B, C3, 0F, 8C, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthA + 76                                                    77F1E2DD 51 Bytes  [ 66, 3B, 47, 02, 0F, 84, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthA + AB                                                    77F1E312 62 Bytes  [ 53, FF, 75, 24, 8B, 45, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthA + EA                                                    77F1E351 7 Bytes  [ 8B, 45, E4, 66, 89, 98, 88 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthA + F2                                                    77F1E359 31 Bytes  [ 00, 00, 8B, 45, E4, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthA + 112                                                   77F1E379 15 Bytes  CALL 77F1DFF0 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DPtoLP + 17                                                           77F1E688 12 Bytes  [ 10, 33, 92, 7C, 40, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DPtoLP + 24                                                           77F1E695 48 Bytes  [ 00, 00, 00, 24, 00, 26, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DPtoLP + 55                                                           77F1E6C6 9 Bytes  [ 72, 00, 65, 00, 5C, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DPtoLP + 5F                                                           77F1E6D0 3 Bytes  [ 6C, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DPtoLP + 63                                                           77F1E6D4 35 Bytes  [ 63, 00, 69, 00, 65, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextCharacterExtra + 6                                             77F1E703 6 Bytes  [ 00, 61, 00, 66, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextCharacterExtra + D                                             77F1E70A 19 Bytes  [ 72, 00, 5C, 00, 43, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextCharacterExtra + 21                                            77F1E71E 5 Bytes  [ 74, 00, 69, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextCharacterExtra + 27                                            77F1E724 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetTextCharacterExtra + 29                                            77F1E726 5 Bytes  [ 65, 00, 72, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetLastError + 9                                                   77F1E852 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetLastError + B                                                   77F1E854 9 Bytes  [ 66, 00, 69, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetLastError + 15                                                  77F1E85E 17 Bytes  [ 00, 00, 54, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetLastError + 27                                                  77F1E870 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetLastError + 29                                                  77F1E872 2 Bytes  [ 6E, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMMode + 16                                                       77F1E8DE 5 Bytes  [ 89, BE, D8, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMMode + 1C                                                       77F1E8E4 175 Bytes  [ 89, BE, DC, 01, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMMode + CC                                                       77F1E994 25 Bytes  [ 4E, 00, 4E, 00, 4E, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry39 + 5                                                         77F1E9AE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry39 + 7                                                         77F1E9B0 48 Bytes  [ 8D, 73, F0, 89, 75, D4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry53 + 7                                                         77F1E9E1 22 Bytes  [ 00, 33, C0, 8D, 7D, A8, AB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry6 + A                                                         77F1E9F8 27 Bytes  [ FC, 01, 00, 00, 00, 33, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry46 + A                                                         77F1EA14 60 Bytes  [ DB, FD, FF, 89, 7D, FC, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Rectangle + 33                                                        77F1EA51 106 Bytes  [ 80, 3D, DC, E0, 97, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RealizePalette + 1                                                    77F1EABC 2 Bytes  [ 45, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RealizePalette + 4                                                    77F1EABF 22 Bytes  [ 40, 14, 5D, C2, 04, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RealizePalette + 1B                                                   77F1EAD6 98 Bytes  [ 0F, 85, 9E, 9D, 02, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICA + 50                                                        77F1EB39 45 Bytes  [ 35, B0, FF, 97, 7C, E8, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICA + 7E                                                        77F1EB67 7 Bytes  [ 00, 00, 8B, 40, 24, A3, A4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICA + 86                                                        77F1EB6F 39 Bytes  [ 97, 7C, C6, 05, C4, E0, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICA + AF                                                        77F1EB98 13 Bytes  [ FF, 84, C0, 0F, 85, BD, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICA + BE                                                        77F1EBA7 9 Bytes  [ 0F, 85, A1, BF, 01, 00, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetROP2 + F                                                           77F1EC66 52 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetROP2 + 44                                                          77F1EC9B 17 Bytes  [ C0, 0F, 8C, 9A, D5, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetROP2 + 56                                                          77F1ECAD 11 Bytes  [ B6, 45, FC, C9, C3, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetROP2 + 62                                                          77F1ECB9 142 Bytes  [ B7, D6, 8B, FA, C1, EF, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectA + 26                                              77F1ED49 17 Bytes  [ 0F, B7, 55, 18, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectA + 38                                              77F1ED5B 37 Bytes  [ 71, 8B, DA, C1, EB, 04, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectA + 5E                                              77F1ED81 146 Bytes  [ 0D, E0, E0, 97, 7C, 8B, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Polygon + F                                                           77F1EE14 92 Bytes  [ 00, 0F, B7, 55, 18, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Polygon + 6C                                                          77F1EE71 65 Bytes  [ 71, 66, 01, 4D, 18, E9, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Polygon + AE                                                          77F1EEB3 44 Bytes  [ 0D, E0, E0, 97, 7C, 8B, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Polygon + DC                                                          77F1EEE1 99 Bytes  [ 0F, B7, 55, 18, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceAliasW + 33                                                77F1EF45 22 Bytes  [ 00, 00, 0F, B7, 55, 18, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceAliasW + 4A                                                77F1EF5C 66 Bytes  [ C1, EB, 04, 83, E3, 0F, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32A + 2E                                            77F1EF9F 129 Bytes  [ F2, 66, 8B, 0C, 71, 66, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentPoint32A + B0                                            77F1F021 247 Bytes  [ C9, 03, C8, A1, 9C, 03, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteUse + B2                                              77F1F119 34 Bytes  [ EC, 51, 51, 53, 8B, 5D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteUse + D5                                              77F1F13C 1 Byte  [ CB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteUse + D8                                              77F1F13F 170 Bytes  [ 10, 85, C0, 89, 4D, 0C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteUse + 183                                             77F1F1EA 47 Bytes  [ 55, 08, 88, 4A, F8, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetSystemPaletteUse + 1B4                                             77F1F21B 83 Bytes  [ 89, 4D, 18, 0F, B7, 4D, 18, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsW + 18                                           77F1F356 121 Bytes  [ 55, 8B, EC, 51, 51, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceA + 16                                                     77F1F3D0 116 Bytes  [ B7, 00, 33, DB, 66, 8B, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceA + 8B                                                     77F1F445 49 Bytes  CALL 77EFD513 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextFaceA + BD                                                     77F1F477 45 Bytes  [ 00, 00, 00, 02, 00, 4C, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsA + F                                            77F1F4A5 6 Bytes  [ FF, 81, C1, E0, FF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsA + 16                                           77F1F4AC 281 Bytes  [ 89, 4D, 18, 0F, B7, 4D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsA + 132                                          77F1F5C8 2 Bytes  [ 39, 35 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsA + 135                                          77F1F5CB 16 Bytes  [ E1, 97, 7C, 74, 13, FF, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetOutlineTextMetricsA + 147                                          77F1F5DD 19 Bytes  [ 10, FF, 75, 0C, FF, D0, 5E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthW + 34                                                    77F1F8EE 19 Bytes  [ 83, A5, EC, FB, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthW + 49                                                    77F1F903 8 Bytes  [ 8A, 08, 84, C9, 0F, 84, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthW + 52                                                    77F1F90C 7 Bytes  [ FF, 8B, 35, D0, E3, 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthW + 5A                                                    77F1F914 12 Bytes  [ B6, C9, F6, 44, 4E, 01, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthW + 67                                                    77F1F921 7 Bytes  [ 40, FF, 85, EC, FB, FF, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RectInRegion + 18                                                     77F1FA71 111 Bytes  [ 89, 50, 04, 89, 02, 89, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RectInRegion + 89                                                     77F1FAE2 52 Bytes  [ 3B, CA, 0F, 84, 57, A3, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RectInRegion + BE                                                     77F1FB17 39 Bytes  [ 89, 50, 08, 89, 4A, 08, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry3 + 4                                                         77F1FB3F 8 Bytes  [ 31, 3B, F1, 0F, 85, 53, A3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry3 + D                                                         77F1FB48 19 Bytes  [ 89, 00, 89, 50, 04, 89, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry3 + 21                                                        77F1FB5C 10 Bytes  [ 85, F6, 89, 72, 08, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry20 + 5                                                         77F1FB67 71 Bytes  [ 8B, 70, 08, 85, F6, 89, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry23 + 5                                                         77F1FBAF 19 Bytes  [ 8B, C1, EB, F1, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry23 + 1A                                                        77F1FBC4 23 Bytes  CALL 77F1C067 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry23 + 32                                                        77F1FBDC 73 Bytes  [ 39, 00, 00, 00, 89, 07, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry23 + 7C                                                        77F1FC26 26 Bytes  [ 74, 06, 83, 7E, 08, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry23 + 97                                                        77F1FC41 30 Bytes  [ 5E, 5D, C2, 04, 00, 39, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteEnhMetaFile + 83                                                77F1FE16 2 Bytes  [ 45, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteEnhMetaFile + 86                                                77F1FE19 2 Bytes  [ FB, 1F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteEnhMetaFile + 89                                                77F1FE1C 3 Bytes  [ 87, 2D, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteEnhMetaFile + 8E                                                77F1FE21 104 Bytes  [ FF, 24, 9D, C2, 4A, 92, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteEnhMetaFile + F7                                                77F1FE8A 24 Bytes  [ B6, 19, 0F, B7, D2, 03, DA, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionW + 49                                       77F201A6 7 Bytes  [ 4D, A8, 39, 5D, AC, 75, 09 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionW + 51                                       77F201AE 67 Bytes  [ 80, 80, 00, 00, 00, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTransform + 1                                                      77F201F2 2 Bytes  [ 4D, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTransform + 4                                                      77F201F5 26 Bytes  [ 45, 10, 3B, CB, 0F, 84, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTransform + 1F                                                     77F20210 17 Bytes  [ C3, 0F, 85, DC, C2, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTransform + 31                                                     77F20222 35 Bytes  [ 89, 45, 10, 66, F7, 45, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTransform + 55                                                     77F20246 4 Bytes  [ 85, C0, 71, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CombineTransform + 53                                                 77F20437 44 Bytes  CALL 5C3F8F3F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileHeader + F                                              77F20464 81 Bytes  [ 00, 00, 00, 8B, 45, E4, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetVirtualResolution + 41                                             77F204B6 153 Bytes  [ 18, 00, 00, 56, 6A, 08, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetVirtualResolution + DB                                             77F20550 5 Bytes  [ 00, 00, 39, 83, 88 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetVirtualResolution + E1                                             77F20556 19 Bytes  [ 00, 00, 0F, 84, 9B, 59, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetVirtualResolution + F5                                             77F2056A 25 Bytes  [ 8B, 45, 08, 89, 04, 8A, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetVirtualResolution + 10F                                            77F20584 4 Bytes  CALL 77F205A8 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaRgn + 53                                                       77F206C2 20 Bytes  [ 04, 04, 04, 04, 04, 04, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaRgn + 68                                                       77F206D7 11 Bytes  [ 03, 02, 02, 02, 02, 02, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaRgn + 74                                                       77F206E3 41 Bytes  [ 02, 02, 02, 02, 02, 02, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaRgn + 9E                                                       77F2070D 46 Bytes  [ 01, 01, 01, 01, 01, 01, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaRgn + CE                                                       77F2073D 106 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPolyFillMode + 36                                                  77F208E5 104 Bytes  [ 8A, 86, B0, 97, 91, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPolyFillMode + 9F                                                  77F2094E 103 Bytes  [ 8B, FF, 55, 8B, EC, 83, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPolyFillMode + 107                                                 77F209B6 1 Byte  [ C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPolyFillMode + 109                                                 77F209B8 4 Bytes  [ 85, 7A, 57, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPolyFillMode + 10E                                                 77F209BD 4 Bytes  CALL 77F2092E C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMiterLimit + 19                                                    77F20F4F 59 Bytes  [ B6, 58, 0C, 66, 8B, 1C, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMiterLimit + 55                                                    77F20F8B 109 Bytes  [ B6, 58, 07, 66, 8B, 1C, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayEnhMetaFileRecord + 2B                                            77F20FF9 3 Bytes  [ FF, FF, 3B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayEnhMetaFileRecord + 2F                                            77F20FFD 19 Bytes  [ 18, 5F, 1B, C0, 5E, 25, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayEnhMetaFileRecord + 43                                            77F21011 46 Bytes  [ 8B, FF, 55, 8B, EC, 53, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayEnhMetaFileRecord + 72                                            77F21040 23 Bytes  [ 75, 08, 8D, 48, FE, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayEnhMetaFileRecord + 8A                                            77F21058 77 Bytes  [ 0F, B7, 07, 50, FF, 77, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreatePen + 78                                                     77F2181B 56 Bytes  [ 0F, 84, 91, 2B, FF, FF, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreatePen + B1                                                     77F21854 37 Bytes  [ FF, 0F, B7, C9, 8D, 44, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreatePen + D7                                                     77F2187A 11 Bytes  [ 28, 00, 28, 00, 20, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreatePen + E3                                                     77F21886 11 Bytes  [ 20, 00, 20, 00, 20, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtCreatePen + EF                                                     77F21892 11 Bytes  [ 20, 00, 20, 00, 20, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixelFormat + 21                                                   77F2282B 87 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixelFormat + 79                                                   77F22883 2 Bytes  [ 45, F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixelFormat + 7C                                                   77F22886 71 Bytes  [ 45, EC, A1, 80, E4, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixelFormat + C4                                                   77F228CE 7 Bytes  [ 0B, 8B, 4D, F4, 8D, 55, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPixelFormat + CC                                                   77F228D6 128 Bytes  [ 0E, 89, 10, 89, 71, 04, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileW + 8                                                77F22B3D 20 Bytes  [ FF, 0F, BE, 81, 48, 0B, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileW + 1D                                               77F22B52 9 Bytes  [ FF, 66, 3B, 18, 0F, 86, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileW + 27                                               77F22B5C 86 Bytes  JMP 77F1643D C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileW + 7E                                               77F22BB3 24 Bytes  JMP 77F12D57 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileW + 97                                               77F22BCC 74 Bytes  JMP 77F0F441 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseEnhMetaFile + 1F                                                 77F230D6 83 Bytes  [ 4E, 74, 52, 61, 69, 73, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseEnhMetaFile + 73                                                 77F2312A 197 Bytes  [ 4E, 74, 52, 65, 67, 69, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseEnhMetaFile + 139                                                77F231F0 34 Bytes  [ 52, 65, 63, 65, 69, 76, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseEnhMetaFile + 15C                                                77F23213 166 Bytes  [ 4E, 74, 52, 65, 71, 75, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseEnhMetaFile + 203                                                77F232BA 85 Bytes  [ 4E, 74, 53, 61, 76, 65, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetBkMode + 18                                                        77F236D6 108 Bytes  [ 4E, 74, 54, 72, 61, 63, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPolyFillMode + 18                                                  77F23743 10 Bytes  [ 4E, 74, 55, 6E, 6D, 61, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPolyFillMode + 23                                                  77F2374E 42 Bytes  [ 4F, 66, 53, 65, 63, 74, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPolyFillMode + 4E                                                  77F23779 19 Bytes  [ 4E, 74, 57, 61, 69, 74, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsMetaPrintDC + F                                                  77F2378D 132 Bytes  [ 4E, 74, 57, 61, 69, 74, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsMetaPrintDC + 94                                                 77F23812 4 Bytes  [ 61, 00, 4E, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsMetaPrintDC + 99                                                 77F23817 78 Bytes  [ 72, 69, 74, 65, 56, 69, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsMetaPrintDC + E8                                                 77F23866 431 Bytes  [ 50, 66, 78, 52, 65, 6D, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMiterLimit + 149                                                   77F23A16 390 Bytes  [ 00, 52, 74, 6C, 41, 64, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMiterLimit + 2D0                                                   77F23B9D 437 Bytes  [ 52, 74, 6C, 41, 6E, 73, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMiterLimit + 486                                                   77F23D53 130 Bytes  [ 69, 63, 61, 6C, 53, 65, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMiterLimit + 509                                                   77F23DD6 25 Bytes  [ 52, 74, 6C, 43, 6F, 6D, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMiterLimit + 523                                                   77F23DF0 157 Bytes  [ 65, 6D, 6F, 72, 79, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileA + 3                                                77F23E8E 58 Bytes  [ 00, 52, 74, 6C, 43, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileA + 3E                                               77F23EC9 207 Bytes  [ 52, 74, 6C, 43, 6F, 6E, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileA + 10E                                              77F23F99 134 Bytes  [ 52, 74, 6C, 43, 6F, 6E, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileA + 195                                              77F24020 9 Bytes  [ 62, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEnhMetaFileA + 19F                                              77F2402A 9 Bytes  [ 61, 00, 6E, 00, 67, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFileRecord + 4                                                77F24034 15 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFileRecord + 14                                               77F24044 45 Bytes  [ 72, 00, 64, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFileRecord + 42                                               77F24072 7 Bytes  [ 6F, 00, 72, 00, 64, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFileRecord + 4A                                               77F2407A 19 Bytes  [ 6E, 00, 61, 00, 6C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFileRecord + 5E                                               77F2408E 11 Bytes  [ 75, 00, 6C, 00, 64, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumMetaFile + 73                                                     77F257EB 71 Bytes  [ 52, 74, 6C, 4E, 65, 77, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumMetaFile + BB                                                     77F25833 118 Bytes  [ 52, 74, 6C, 4E, 65, 77, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumMetaFile + 132                                                    77F258AA 811 Bytes  [ 52, 74, 6C, 4E, 74, 53, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumMetaFile + 45E                                                    77F25BD6 214 Bytes  [ 52, 74, 6C, 51, 75, 65, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumMetaFile + 535                                                    77F25CAD 99 Bytes  [ 52, 74, 6C, 52, 65, 67, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetEnhMetaFileBits + 42                                               77F2693D 4 Bytes  [ 00, 83, E9, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetEnhMetaFileBits + 48                                               77F26943 3 Bytes  [ 03, 16, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetEnhMetaFileBits + 4C                                               77F26947 31 Bytes  CALL AAF26B61 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetEnhMetaFileBits + 6C                                               77F26967 27 Bytes  JMP 77F142E3 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetEnhMetaFileBits + 88                                               77F26983 6 Bytes  [ 75, 08, E8, 06, 0C, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Escape + 52                                                           77F26B88 35 Bytes  [ 00, 83, 7D, 0C, 00, A1, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Escape + 76                                                           77F26BAC 18 Bytes  [ 57, 6A, 47, 59, 33, C0, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Escape + 89                                                           77F26BBF 29 Bytes  [ FF, 50, C7, 85, E0, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Escape + A7                                                           77F26BDD 6 Bytes  [ 80, 0F, 84, 81, 30, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Escape + AE                                                           77F26BE4 51 Bytes  [ 66, 8B, 86, 18, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBPatternBrush + 26                                            77F26C19 58 Bytes  [ 10, 72, E2, 6A, 40, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateDIBPatternBrush + 65                                            77F26C58 69 Bytes  [ 8B, FF, 55, 8B, EC, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileA + 33                                                 77F26C9F 35 Bytes  CALL FA767BAA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileW + 1B                                                 77F26CC3 71 Bytes  JMP 77F26C0D C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileW + 63                                                 77F26D0B 102 Bytes  [ C7, 45, FC, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileW + CA                                                 77F26D72 98 Bytes  [ FF, 75, E4, 6A, 01, E8, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileW + 12D                                                77F26DD5 4 Bytes  [ 8B, 40, 24, 25 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyEnhMetaFileW + 132                                                77F26DDA 82 Bytes  [ 0F, 00, 00, C1, E0, 10, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumObjects + 40                                                      77F26E2D 6 Bytes  [ 89, 45, 0C, E9, 1D, 4C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumObjects + 47                                                      77F26E34 20 Bytes  [ FF, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumObjects + 5C                                                      77F26E49 17 Bytes  [ 8B, F8, 3B, FB, 0F, 84, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumObjects + 6E                                                      77F26E5B 79 Bytes  [ 1F, 00, 8D, 77, 04, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumObjects + BE                                                      77F26EAB 28 Bytes  [ 8B, F0, 3B, F3, 0F, 8C, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowExtEx + 18                                                   77F26EC8 32 Bytes  [ 39, 1D, 38, E4, 97, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowExtEx + 39                                                   77F26EE9 51 Bytes  [ BB, 60, E4, 97, 7C, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowExtEx + 6D                                                   77F26F1D 1 Byte  [ C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowExtEx + 6F                                                   77F26F1F 4 Bytes  [ 8C, 27, 41, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWindowExtEx + 74                                                   77F26F24 31 Bytes  [ 0F, BE, 45, F4, 50, 6A, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportExtEx + 1                                                  77F26F5A 38 Bytes  [ C6, EB, F7, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportExtEx + 28                                                 77F26F81 48 Bytes  [ 39, 35, 68, F9, 97, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportExtEx + 59                                                 77F26FB2 227 Bytes  [ FF, 8B, D8, 3B, DE, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportExtEx + 13D                                                77F27096 16 Bytes  [ 33, FF, 89, 7D, FC, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetViewportExtEx + 14F                                                77F270A8 26 Bytes  [ 84, C0, 0F, 85, 40, DD, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteMetaFile + 54                                                   77F272A5 4 Bytes  [ 84, 55, DA, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteMetaFile + 59                                                   77F272AA 48 Bytes  [ 57, 8B, CE, 8B, D1, C1, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteMetaFile + 8A                                                   77F272DB 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteMetaFile + 8C                                                   77F272DD 42 Bytes  [ C7, 03, 41, 74, 6F, 6D, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DeleteMetaFile + B7                                                   77F27308 31 Bytes  [ 90, 90, 90, 90, 90, 6A, 44, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaFileBitsEx + 10                                                77F27411 3 Bytes  [ D6, 28, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaFileBitsEx + 14                                                77F27415 48 Bytes  [ 83, 65, FC, 00, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMetaFileBitsEx + 45                                                77F27446 88 Bytes  [ 84, C0, 0F, 84, FF, 46, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGraphicsMode + 12                                                  77F2749F 5 Bytes  [ 0F, 84, A8, 46, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGraphicsMode + 18                                                  77F274A5 15 Bytes  [ 66, 8B, 46, 02, A8, 10, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGraphicsMode + 28                                                  77F274B5 45 Bytes  [ D8, 85, F6, 0F, 85, 81, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGraphicsMode + 56                                                  77F274E3 50 Bytes  [ 55, 8B, EC, 8B, 4D, 08, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileBitsEx + 26                                                77F27516 81 Bytes  [ D7, 73, 28, 0F, B7, 7A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePenIndirect + 10                                                77F27568 4 Bytes  [ 5D, C3, B9, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePenIndirect + 15                                                77F2756D 14 Bytes  [ 00, 00, 66, 3B, C1, 0F, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePenIndirect + 24                                                77F2757C 101 Bytes  [ 00, 66, 3B, C1, 0F, 83, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePenIndirect + 8A                                                77F275E2 9 Bytes  [ 00, 83, F8, 24, 0F, 8F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePenIndirect + 94                                                77F275EC 50 Bytes  [ 85, C0, 6A, 10, 5B, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPrinterThunk + 6                                                   77F2761F 79 Bytes  [ C8, FF, 33, D2, F7, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPrinterThunk + 57                                                  77F27670 77 Bytes  [ 8B, 55, 14, 4F, 4F, F6, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPrinterThunk + A5                                                  77F276BE 50 Bytes  [ 5F, 5E, 5B, C9, C3, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPrinterThunk + D8                                                  77F276F1 148 Bytes  [ 66, 8B, 07, 66, 83, F8, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPrinterThunk + 16D                                                 77F27786 41 Bytes  [ C0, 5E, C9, C2, 14, 00, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMultiByteToWideChar + 2                                            77F27849 15 Bytes  [ BE, 7A, 00, 00, C0, 6A, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMultiByteToWideChar + 12                                           77F27859 129 Bytes  JMP 77F1469C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMultiByteToWideChar + 94                                           77F278DB 35 Bytes  [ 72, 04, 8B, D1, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetCurrentCodePage + 2                                             77F278FF 55 Bytes  [ FF, 83, F8, 05, 0F, 85, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetCurrentCodePage + 3A                                            77F27937 4 Bytes  [ 85, 5D, 2A, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetCurrentCodePage + 3F                                            77F2793C 15 Bytes  [ 57, 68, 44, C5, 92, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetCurrentCodePage + 4F                                            77F2794C 11 Bytes  [ C4, 10, 83, F8, FF, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetCurrentCodePage + 5B                                            77F27958 2 Bytes  [ AE, C0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngDeletePalette + 9                                                  77F28305 28 Bytes  [ F3, A4, 8B, 7D, 18, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngDeletePalette + 26                                                 77F28322 9 Bytes  [ C0, EB, EA, 33, C0, E9, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngDeletePalette + 30                                                 77F2832C 14 Bytes  JMP 77F0C783 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngDeletePalette + 3F                                                 77F2833B 36 Bytes  [ 66, 89, 8F, FC, FF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngDeletePalette + 64                                                 77F28360 42 Bytes  [ 75, F0, 57, 50, 8D, 45, E0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceA + 2                                               77F28D4F 95 Bytes  [ 8B, 45, F4, 8B, 4D, EC, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExA + 48                                            77F28DAF 7 Bytes  [ 45, 18, 68, EE, FE, EE, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExA + 50                                            77F28DB7 47 Bytes  [ 75, F4, 83, C0, 10, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExA + 80                                            77F28DE7 76 Bytes  [ 8B, 45, 18, 8B, 4D, EC, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExA + CD                                            77F28E34 104 Bytes  [ 45, F8, 66, 89, 44, C6, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExW + 3C                                            77F28E9D 64 Bytes  CALL B0771BA5 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExW + 7D                                            77F28EDE 56 Bytes  [ EB, 10, 66, 8B, 55, F8, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceExW + B6                                            77F28F17 142 Bytes  [ C8, 8D, 34, 0A, 39, 75, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesA + 5F                                                77F28FA7 84 Bytes  [ 00, 48, 45, 41, 50, 5B, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceA + 7                                                  77F28FFC 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceA + 9                                                  77F28FFE 5 Bytes  [ 89, 98, F4, 0B, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceA + F                                                  77F29004 5 Bytes  [ 64, A1, 18, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceA + 15                                                 77F2900A 106 Bytes  CALL 77EEAA4A C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExA + 66                                               77F29075 157 Bytes  [ 85, F6, 0F, 84, 99, 9C, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExA + 104                                              77F29113 11 Bytes  [ 00, C0, 89, B0, F4, 0B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExA + 110                                              77F2911F 103 Bytes  [ 00, 00, 8B, F8, 56, E8, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExA + 178                                              77F29187 20 Bytes  [ 00, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExA + 18D                                              77F2919C 13 Bytes  JMP 77EF2AEE C:\WINDOWS\system32\RPCRT4.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCW + 7                                                          77F2B596 2 Bytes  [ 00, 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCW + A                                                          77F2B599 45 Bytes  [ 7F, C1, E1, 04, 8D, 34, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCW + 38                                                         77F2B5C7 61 Bytes  [ 00, 8D, 7E, F8, 8A, 45, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCW + 78                                                         77F2B607 65 Bytes  [ 00, 57, D2, 93, 7C, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCW + BA                                                         77F2B649 212 Bytes  [ FF, FF, FF, F5, F6, 94, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry1 + 1                                                         77F2B846 92 Bytes  [ 48, 20, 89, 4D, E4, 83, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry2 + 11                                                        77F2B8A3 25 Bytes  [ C0, AB, AB, EB, EE, 91, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry2 + 2B                                                        77F2B8BD 31 Bytes  [ 75, 08, 8B, 40, 30, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry2 + 4B                                                        77F2B8DD 6 Bytes  [ EC, 64, A1, 18, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry2 + 52                                                        77F2B8E4 7 Bytes  [ FF, 75, 08, 8B, 40, 30, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry2 + 5A                                                        77F2B8EC 75 Bytes  CALL 77F2B4E1 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry41 + 5                                                         77F2BC12 16 Bytes  [ C7, 45, FC, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry10 + 2                                                        77F2BC23 21 Bytes  [ FF, FF, 85, C0, 0F, 85, B2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry10 + 18                                                       77F2BC39 5 Bytes  [ 0F, FF, B7, 78, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry10 + 1F                                                       77F2BC40 57 Bytes  CALL 77F1C420 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileW + D                                                   77F2BC7A 108 Bytes  [ 00, 00, 0F, 82, 71, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileW + 7A                                                  77F2BCE7 30 Bytes  [ 41, F8, 89, 85, 7C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileW + 99                                                  77F2BD06 42 Bytes  [ 51, 04, 89, 95, 74, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileW + C4                                                  77F2BD31 14 Bytes  [ 33, DB, 80, BE, 86, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileW + D3                                                  77F2BD40 20 Bytes  [ 8B, 8E, 80, 05, 00, 00, 3B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileW + D                                                     77F2BE13 58 Bytes  [ FF, 80, 7D, 14, 00, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileW + 48                                                    77F2BE4E 9 Bytes  CALL 77F2BAA1 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileW + 52                                                    77F2BE58 72 Bytes  [ 14, 8B, 4D, 0C, 3B, C1, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileW + 9B                                                    77F2BEA1 25 Bytes  [ 3D, 80, 00, 73, BF, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileW + B5                                                    77F2BEBB 48 Bytes  [ 00, 30, 10, EB, A5, 80, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseMetaFile + 2C                                                    77F2BEEC 5 Bytes  [ 8B, 09, E9, 22, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseMetaFile + 32                                                    77F2BEF2 157 Bytes  [ 00, 33, C0, 8A, 46, 05, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseMetaFile + D0                                                    77F2BF90 9 Bytes  [ 03, 00, 01, 00, 02, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseMetaFile + DA                                                    77F2BF9A 17 Bytes  [ 01, 00, 02, 00, 01, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseMetaFile + EC                                                    77F2BFAC 11 Bytes  [ 02, 00, 01, 00, 03, 00, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileA + B                                                     77F2C116 21 Bytes  [ 66, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileA + 21                                                    77F2C12C 21 Bytes  [ 63, 00, 6F, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CopyMetaFileA + 37                                                    77F2C142 19 Bytes  [ 65, 00, 65, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Ellipse + F                                                           77F2C156 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Ellipse + 11                                                          77F2C158 1 Byte  [ 2E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Ellipse + 13                                                          77F2C15A 9 Bytes  [ 0D, 00, 0A, 00, 00, 00, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Ellipse + 1D                                                          77F2C164 7 Bytes  [ 41, 00, 74, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Ellipse + 25                                                          77F2C16C 15 Bytes  [ 6D, 00, 70, 00, 74, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharacterExtra + F                                             77F2C304 3 Bytes  [ 20, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharacterExtra + 13                                            77F2C308 5 Bytes  [ 6E, 00, 69, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharacterExtra + 19                                            77F2C30E 9 Bytes  [ 72, 00, 6F, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharacterExtra + 23                                            77F2C318 43 Bytes  [ 73, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextCharacterExtra + 4F                                            77F2C344 23 Bytes  [ 65, 00, 20, 00, 72, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayoutWidth + E                                                    77F2C35C 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayoutWidth + 10                                                   77F2C35E 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayoutWidth + 12                                                   77F2C360 15 Bytes  [ 6E, 00, 20, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayoutWidth + 22                                                   77F2C370 38 Bytes  [ 69, 00, 70, 00, 72, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetLayoutWidth + 49                                                   77F2C397 32 Bytes  [ 00, 0A, 00, 50, 00, 6C, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBColorTable + E                                                  77F2C3D4 25 Bytes  [ 6C, 00, 65, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDIBColorTable + 28                                                 77F2C3EE 85 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICW + 51                                                        77F2C444 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICW + 53                                                        77F2C446 39 Bytes  [ 79, 00, 6F, 00, 75, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICW + 7B                                                        77F2C46E 73 Bytes  [ 64, 00, 20, 00, 44, 00, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICW + C5                                                        77F2C4B8 7 Bytes  [ 69, 00, 62, 00, 72, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateICW + CD                                                        77F2C4C0 3 Bytes  [ 72, 00, 79 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BRUSHOBJ_ulGetBrushColor + 4                                          77F2C946 19 Bytes  [ 6F, 00, 70, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!XFORMOBJ_iGetXform + 4                                                77F2C95A 19 Bytes  [ 63, 00, 6F, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pxoGetXform + 4                                               77F2C96E 19 Bytes  [ 0D, 00, 0A, 00, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pifi + 4                                                      77F2C982 39 Bytes  [ 65, 00, 72, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pifi + 2C                                                     77F2C9AA 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pifi + 2E                                                     77F2C9AC 15 Bytes  [ 73, 00, 73, 00, 61, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pifi + 3E                                                     77F2C9BC 11 Bytes  [ 75, 00, 74, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pifi + 4A                                                     77F2C9C8 6 Bytes  [ 20, 00, 6E, 00, 6F, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnlockSurface + 2                                                  77F2CA0B 2 Bytes  [ 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnlockSurface + 5                                                  77F2CA0E 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnlockSurface + 7                                                  77F2CA10 7 Bytes  [ 49, 00, 50, 00, 20, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnlockSurface + F                                                  77F2CA18 11 Bytes  [ 64, 00, 64, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnlockSurface + 1B                                                 77F2CA24 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorSpace + D                                                     77F2CC80 5 Bytes  [ 20, 00, 64, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorSpace + 13                                                    77F2CC86 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorSpace + 15                                                    77F2CC88 3 Bytes  [ 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorSpace + 19                                                    77F2CC8C 17 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorSpace + 2B                                                    77F2CC9E 9 Bytes  [ 72, 00, 74, 00, 20, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipPath + E                                                    77F2CE12 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipPath + 10                                                   77F2CE14 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipPath + 12                                                   77F2CE16 7 Bytes  [ 20, 00, 6E, 00, 75, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipPath + 1A                                                   77F2CE1E 1 Byte  [ 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectClipPath + 1C                                                   77F2CE20 15 Bytes  [ 65, 00, 72, 00, 20, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetClipRgn + E                                                     77F2CF54 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetClipRgn + 10                                                    77F2CF56 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetClipRgn + 12                                                    77F2CF58 7 Bytes  [ E4, 00, 01, 00, 54, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetClipRgn + 1A                                                    77F2CF60 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!OffsetClipRgn + 1C                                                    77F2CF62 5 Bytes  [ 20, 00, 70, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngBitBlt + 7                                                         77F2D100 27 Bytes  [ 00, 00, 0F, BE, 81, 48, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngBitBlt + 24                                                        77F2D11D 154 Bytes  [ 8B, 48, 20, 66, F7, C1, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngBitBlt + BF                                                        77F2D1B8 27 Bytes  [ FF, 8B, 57, 64, 8B, 14, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngBitBlt + DB                                                        77F2D1D4 22 Bytes  JMP 77F2CFDA C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngBitBlt + F2                                                        77F2D1EB 113 Bytes  [ FF, 0F, B7, C3, 50, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStretchBlt + B                                                     77F2D2E8 39 Bytes  [ 8B, 4D, 08, 89, 01, 69, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStretchBlt + 33                                                    77F2D310 62 Bytes  [ 0E, B9, 67, FA, EB, 50, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStretchBlt + 72                                                    77F2D34F 34 Bytes  [ 00, 8B, C8, 33, D2, BF, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStretchBlt + 95                                                    77F2D372 158 Bytes  [ C1, F7, F3, 33, D2, BB, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStretchBlt + 134                                                   77F2D411 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BeginPath + 2B                                                        77F2D650 37 Bytes  [ 66, 85, DB, 74, 2C, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BeginPath + 51                                                        77F2D676 3 Bytes  [ 81, E6, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BeginPath + 55                                                        77F2D67A 32 Bytes  [ FF, 7F, 03, F3, 89, 75, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BeginPath + 77                                                        77F2D69C 10 Bytes  [ 00, 68, B0, 23, 91, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPath + 2                                                           77F2D6A7 57 Bytes  [ 8B, 7D, 0C, 89, 7D, 9C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPath + 3C                                                          77F2D6E1 53 Bytes  [ 00, 89, 4D, E4, 33, F6, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPath + 72                                                          77F2D717 59 Bytes  [ 02, 00, 00, 8A, 5D, D3, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPath + AE                                                          77F2D753 30 Bytes  [ 39, 45, A8, 0F, 85, 80, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPath + CD                                                          77F2D772 184 Bytes  [ FF, FF, FF, 0F, B7, C3, D1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageHandle + 22                                                 77F2DA3D 3 Bytes  [ E4, 3B, C1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageHandle + 26                                                 77F2DA41 84 Bytes  [ 10, 8B, 45, C4, FF, 45, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageHandle + 7B                                                 77F2DA96 8 Bytes  [ EB, 98, 84, DB, 0F, 84, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageHandle + 84                                                 77F2DA9F 7 Bytes  [ 00, 64, A1, 18, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageHandle + 8C                                                 77F2DAA7 121 Bytes  [ 85, 6C, FF, FF, FF, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndPageEMF + 58                                                    77F2DB21 35 Bytes  CALL 77F2B759 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndPageEMF + 7C                                                    77F2DB45 69 Bytes  [ 03, C6, 39, 45, 0C, 0F, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndPageEMF + C2                                                    77F2DB8B 34 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndPageEMF + E7                                                    77F2DBB0 1 Byte  [ 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndPageEMF + E9                                                    77F2DBB2 17 Bytes  [ 74, 24, 10, FF, 74, 24, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPage + 10                                                          77F2DD59 20 Bytes  [ C4, 66, 8B, 43, 18, 66, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPage + 25                                                          77F2DD6E 29 Bytes  [ 89, 45, E4, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPage + 44                                                          77F2DD8D 47 Bytes  [ FF, 89, 45, D4, 85, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPage + 74                                                          77F2DDBD 10 Bytes  [ FF, 0F, 84, 9A, 5B, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndPage + 7F                                                          77F2DDC8 25 Bytes  CALL 77F2DCBF C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndDocEMF + D                                                      77F2DF74 64 Bytes  CALL 824B9688 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndDocEMF + 4E                                                     77F2DFB5 31 Bytes  [ 0F, B7, 18, 8A, 1C, 33, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEndDocEMF + 6F                                                     77F2DFD6 3 Bytes  [ 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndDoc + 1                                                            77F2DFDA 34 Bytes  [ EC, 51, 53, 33, DB, 38, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndDoc + 25                                                           77F2DFFE 5 Bytes  [ 0F, 87, 99, AF, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndDoc + 2B                                                           77F2E004 18 Bytes  [ 38, 5D, 10, 56, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndDoc + 3E                                                           77F2E017 21 Bytes  [ 50, 66, 89, 46, 02, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EndDoc + 54                                                           77F2E02D 32 Bytes  [ 0F, B7, 07, 50, FF, 77, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CancelDC + 34                                                         77F2E150 38 Bytes  [ CC, BB, 02, 00, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteSpoolFileHandle + C                                          77F2E177 152 Bytes  [ 0F, 0F, 85, BB, BB, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteSpoolFileHandle + A5                                         77F2E210 67 Bytes  [ 5F, 3B, C3, 0F, 8C, D2, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteSpoolFileHandle + E9                                         77F2E254 13 Bytes  [ 40, 0C, 83, C0, 0C, 8B, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteSpoolFileHandle + F8                                         77F2E263 56 Bytes  [ 8B, D1, 83, 7A, 08, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteSpoolFileHandle + 131                                        77F2E29C 49 Bytes  [ 0A, C0, 74, 2E, 8A, 06, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngTextOut + 49                                                       77F2E478 101 Bytes  [ FF, 50, 66, 89, 46, 02, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngTextOut + AF                                                       77F2E4DE 38 Bytes  [ 8C, C1, AE, 02, 00, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStrokeAndFillPath + 4                                              77F2E505 29 Bytes  [ 48, 0F, 85, 35, A8, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStrokeAndFillPath + 22                                             77F2E523 14 Bytes  [ 85, C0, 0F, 84, 5C, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStrokeAndFillPath + 31                                             77F2E532 18 Bytes  CALL 77F2B2B4 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStrokeAndFillPath + 45                                             77F2E546 16 Bytes  [ 0F, B7, 85, A8, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngStrokeAndFillPath + 56                                             77F2E557 69 Bytes  [ 8D, 04, 70, 8B, 8D, A0, FD, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezierTo + 24                                                     77F2E803 3 Bytes  [ F6, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezierTo + 28                                                     77F2E807 97 Bytes  [ 84, C0, 74, 0B, 8B, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezierTo + 8A                                                     77F2E869 79 Bytes  [ 15, B0, 04, 91, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolylineTo + 2E                                                       77F2E8BA 2 Bytes  [ 09, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolylineTo + 32                                                       77F2E8BE 4 Bytes  [ 66, 83, F9, 2F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolylineTo + 38                                                       77F2E8C4 2 Bytes  [ FF, 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolylineTo + 3C                                                       77F2E8C8 8 Bytes  [ 66, 85, C9, 0F, 84, DF, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolylineTo + 45                                                       77F2E8D1 10 Bytes  [ 66, 83, 78, 02, 3A, 0F, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseFigure + 7                                                       77F2E92F 19 Bytes  CALL 01B36E9A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseFigure + 1B                                                      77F2E943 15 Bytes  [ 83, 7C, 77, FE, 3A, BA, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseFigure + 2B                                                      77F2E953 35 Bytes  [ 66, 85, C0, 0F, 84, 05, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseFigure + 4F                                                      77F2E977 9 Bytes  [ 00, 33, FF, 66, 85, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CloseFigure + 59                                                      77F2E981 20 Bytes  [ 00, 00, 0F, B7, D0, 8D, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StrokeAndFillPath + 1A                                                77F2E9C2 69 Bytes  [ 10, 66, 83, F8, 70, 74, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StrokeAndFillPath + 60                                                77F2EA08 126 Bytes  CALL 86F2EA13 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCurrentPositionEx + 4                                              77F2EA87 33 Bytes  [ 45, 08, 8B, 4D, 10, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCurrentPositionEx + 26                                             77F2EAA9 60 Bytes  [ 00, 81, 7D, 0C, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCurrentPositionEx + 63                                             77F2EAE6 19 Bytes  JMP C03F7651 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCurrentPositionEx + 77                                             77F2EAFA 7 Bytes  [ 0F, 84, 03, D1, FF, FF, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCurrentPositionEx + 7F                                             77F2EB02 150 Bytes  [ 44, 50, FE, 66, 83, F8, 5C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32W + 5D                                                  77F2EC68 37 Bytes  [ 16, 66, 3B, D3, 74, 26, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32W + 84                                                  77F2EC8F 75 Bytes  [ 00, C4, 9A, 91, 7C, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CLIPOBJ_cEnumStart + 13                                               77F2ECDB 73 Bytes  [ 4D, C8, 76, 1A, 8D, 51, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry13 + 34                                                       77F2ED25 8 Bytes  [ 00, 66, 39, 0A, 0F, 84, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry11 + 5                                                         77F2ED2F 9 Bytes  [ 83, 7D, 88, 01, 0F, 84, A3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry11 + F                                                         77F2ED39 8 Bytes  [ 89, 16, 83, 4D, FC, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry11 + 19                                                        77F2ED43 4 Bytes  [ 00, 0F, B7, C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry11 + 1E                                                        77F2ED48 5 Bytes  [ 4D, E4, E8, 48, C5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry11 + 24                                                        77F2ED4E 66 Bytes  CALL 77F29D25 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetDevmodeForPage + 11                                             77F2EDBE 26 Bytes  [ 75, 0C, 8B, 7D, 10, 89, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetDevmodeForPage + 2D                                             77F2EDDA 21 Bytes  [ C7, 85, 9C, FD, FF, FF, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetDevmodeForPage + 43                                             77F2EDF0 32 Bytes  [ 85, C4, FD, FF, FF, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetDevmodeForPage + 65                                             77F2EE12 28 Bytes  [ 89, 85, C8, FD, FF, FF, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartDocEMF + E                                                    77F2EE2F 13 Bytes  CALL 77F2B4E2 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartDocEMF + 1C                                                   77F2EE3D 35 Bytes  [ C0, 0F, 84, 71, A5, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartDocEMF + 40                                                   77F2EE61 56 Bytes  [ 00, 0F, 85, 72, 51, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartDocEMF + 79                                                   77F2EE9A 154 Bytes  [ FF, 00, 0F, 85, A4, 53, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartDocEMF + 114                                                  77F2EF35 30 Bytes  CALL 77F1D515 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngAssociateSurface + 4                                               77F2EFCA 6 Bytes  [ 90, 90, 90, 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngAssociateSurface + B                                               77F2EFD1 3 Bytes  [ FF, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngAssociateSurface + F                                               77F2EFD5 8 Bytes  [ 00, 00, 00, CD, 3B, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngCreateDeviceSurface + 5                                            77F2EFDF 10 Bytes  [ 00, B4, DF, 93, 7C, BD, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngCreateDeviceSurface + 13                                           77F2EFED 30 Bytes  [ 80, BD, D7, FD, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartPageEMF + A                                                   77F2F00C 62 Bytes  [ 90, 8B, FF, 55, 8B, EC, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartPageEMF + 49                                                  77F2F04B 17 Bytes  [ 75, 0C, 89, 75, FC, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartPageEMF + 5B                                                  77F2F05D 65 Bytes  [ 45, FA, EB, DC, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiStartPageEMF + 9D                                                  77F2F09F 21 Bytes  [ FF, C9, C2, 04, 00, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartPage + 7                                                         77F2F0B5 45 Bytes  JMP 77F2EB1B C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartPage + 35                                                        77F2F0E3 20 Bytes  [ 75, 14, 8D, 45, F8, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartPage + 4A                                                        77F2F0F8 34 Bytes  [ 66, 83, FA, 70, 0F, 84, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartPage + 6D                                                        77F2F11B 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartPage + 74                                                        77F2F122 57 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPageEMF + A4                                                   77F2F234 3 Bytes  [ 70, 10, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPageEMF + A8                                                   77F2F238 70 Bytes  CALL 77F2B82C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPageEMF + EF                                                   77F2F27F 105 Bytes  [ 5C, 77, FE, 4E, 89, 75, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPageEMF + 159                                                  77F2F2E9 4 Bytes  [ C6, 45, E7, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPageEMF + 15E                                                  77F2F2EE 33 Bytes  [ 43, 10, 8B, 70, 48, 89, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLockSurface + 3D                                                   77F2F582 18 Bytes  [ 16, 00, 28, 9B, 91, 7C, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLockSurface + 50                                                   77F2F595 45 Bytes  [ C6, 2B, 45, C8, D1, F8, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLockSurface + 7E                                                   77F2F5C3 31 Bytes  [ 75, DC, 6A, 01, 8D, 45, BC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLockSurface + 9E                                                   77F2F5E3 40 Bytes  [ 66, 89, 7D, BC, 66, 89, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLockSurface + C7                                                   77F2F60C 50 Bytes  [ 75, DC, 89, 75, C8, E9, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!STROBJ_bGetAdvanceWidths + B                                          77F2FA54 32 Bytes  CALL 77F2FADD C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_cGetGlyphs + 4                                                77F2FA75 17 Bytes  [ 74, 0B, 8D, 45, FA, 3B, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngUnicodeToMultiByteN + 2                                            77F2FA87 71 Bytes  [ FF, 2B, F8, 8B, 85, F8, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_vGetInfo + 25                                                 77F2FACF 110 Bytes  CALL 77F2B294 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolFileHandle + 53                                            77F2FB3F 41 Bytes  [ 33, D2, F7, 75, 0C, 4E, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolFileHandle + 7D                                            77F2FB69 12 Bytes  [ 0F, 8F, 6A, 85, 03, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolFileHandle + 8A                                            77F2FB76 61 Bytes  [ 8B, CA, 8B, 7D, 9C, 8B, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolFileHandle + C8                                            77F2FBB4 31 Bytes  [ C7, 45, 0C, 0A, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetSpoolFileHandle + E8                                            77F2FBD4 122 Bytes  [ 34, 00, 35, 00, 36, 00, 37, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLoadModule + 1                                                     77F2FE1E 11 Bytes  [ C3, 8B, 4D, FC, 5F, 5E, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLoadModule + D                                                     77F2FE2A 84 Bytes  [ C9, C2, 04, 00, 5C, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLoadModule + 62                                                    77F2FE7F 13 Bytes  [ B6, 4E, 01, 6B, C9, 0B, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLoadModule + 70                                                    77F2FE8D 204 Bytes  [ 4D, 0C, 89, 01, 33, C0, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPFormatPalette + 4A                                          77F2FF5A 14 Bytes  [ FF, 0F, 8D, 65, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPFormatPalette + 59                                          77F2FF69 28 Bytes  [ FE, 0F, 85, 5E, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPFormatPalette + 76                                          77F2FF86 12 Bytes  [ 55, 8B, EC, 8B, 4D, 14, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMarkBandingSurface + 7                                             77F2FF93 16 Bytes  [ 8B, 45, 08, 85, C0, 74, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMarkBandingSurface + 18                                            77F2FFA4 114 Bytes  [ FF, FF, 75, 27, 83, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngMarkBandingSurface + 8C                                            77F30018 204 Bytes  [ 03, C7, 13, D3, 89, 86, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryLocalTime                                                     77F300E8 120 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngComputeGlyphSet + 8                                                77F30161 7 Bytes  [ 8A, 06, 46, E9, 9C, 68, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngComputeGlyphSet + 10                                               77F30169 6 Bytes  [ 33, C9, 41, E9, AC, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngComputeGlyphSet + 17                                               77F30170 27 Bytes  [ FF, 3C, 41, 0F, 8D, D9, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngComputeGlyphSet + 33                                               77F3018C 13 Bytes  CALL 77F2CE5E C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngComputeGlyphSet + 41                                               77F3019A 76 Bytes  JMP 77F2CE45 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry21 + B                                                         77F3023A 107 Bytes  CALL 77F0840A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry11 + 34                                                       77F302A8 44 Bytes  CALL 77F0A0D9 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry12 + 9                                                        77F302D5 56 Bytes  [ FF, 80, 3D, C4, E0, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry52 + 23                                                        77F3030E 74 Bytes  [ 50, 00, 54, 00, 00, 00, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry12 + 32                                                        77F30359 43 Bytes  [ 0F, 84, E5, 1B, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry28 + 22                                                        77F30385 280 Bytes  [ 14, 56, 66, 89, 50, 2C, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry27 + 19                                                        77F3049E 94 Bytes  [ 3B, C6, 8D, 91, FC, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry38 + 19                                                        77F304FD 11 Bytes  [ 0C, 8D, 0C, 00, 00, 00, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry38 + 25                                                        77F30509 4 Bytes  [ D7, AF, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry38 + 2A                                                        77F3050E 86 Bytes  [ F8, 3B, FE, 0F, 84, 91, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry38 + 81                                                        77F30565 26 Bytes  [ B7, D0, D1, EA, 33, DB, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry38 + 9C                                                        77F30580 104 Bytes  [ 0C, 66, 83, FA, 2F, 74, 06, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry31 + 16                                                        77F30A0C 59 Bytes  [ FF, 50, FF, 15, 30, 10, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry26 + 7                                                         77F30A48 78 Bytes  [ 49, 66, 83, 38, 00, 74, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry55 + 7                                                         77F30A97 18 Bytes  [ 00, 00, 89, 8D, BC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry55 + 1A                                                        77F30AAA 118 Bytes  [ 04, 51, C6, 85, D8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry55 + 92                                                        77F30B22 23 Bytes  JMP 77F30D68 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry55 + AA                                                        77F30B3A 2 Bytes  [ A9, 92 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry55 + AE                                                        77F30B3E 11 Bytes  [ F7, D8, 83, D2, 00, F7, DA, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry47 + 33                                                        77F30BE3 15 Bytes  [ 9D, E4, FD, FF, FF, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry47 + 44                                                        77F30BF4 17 Bytes  [ 33, C0, 66, 8B, 03, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry47 + 56                                                        77F30C06 59 Bytes  [ 85, C0, 59, 0F, 8E, 20, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry47 + 92                                                        77F30C42 59 Bytes  CALL 77F30F73 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry47 + CF                                                        77F30C7F 13 Bytes  [ 89, 85, C0, FD, FF, FF, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry19 + F                                                         77F30CB1 12 Bytes  [ 00, A1, C8, E0, 97, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry19 + 1C                                                        77F30CBE 37 Bytes  [ 45, 08, 89, 85, C8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry19 + 42                                                        77F30CE4 113 Bytes  [ DC, FD, FF, FF, 0F, 84, C5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry19 + B4                                                        77F30D56 122 Bytes  [ 8D, C8, FD, FF, FF, 8D, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry19 + 130                                                       77F30DD2 92 Bytes  [ 00, F6, 85, F0, FD, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDllInitialize + 2                                                  77F321DB 16 Bytes  [ 66, 83, BB, 84, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDllInitialize + 13                                                 77F321EC 50 Bytes  [ 80, 00, 0F, 85, 49, 93, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDllInitialize + 46                                                 77F3221F 44 Bytes  [ 7F, 02, 0F, 84, CD, 93, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDllInitialize + 73                                                 77F3224C 51 Bytes  [ FF, 89, 5D, D8, 83, C0, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDllInitialize + A7                                                 77F32280 35 Bytes  [ 0F, 85, 20, 97, 01, 00, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFile + 69                                                     77F34D88 132 Bytes  [ F1, 56, 83, EC, 74, 8B, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFile + EF                                                     77F34E0E 27 Bytes  [ FF, 72, 02, F7, D9, 8B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFile + 10B                                                    77F34E2A 312 Bytes  [ 70, 08, 8B, 78, 0C, 8B, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFile + 244                                                    77F34F63 287 Bytes  [ 69, 30, 33, C7, 03, DD, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlayMetaFile + 364                                                    77F35083 129 Bytes  [ C6, C1, C2, 14, 8B, 69, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileW + 4D                                                     77F3819A 16 Bytes  [ FF, 85, C0, 74, 0C, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileW + 5E                                                     77F381AB 18 Bytes  JMP 77F13169 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileW + 71                                                     77F381BE 79 Bytes  [ 08, 89, 45, FC, 8B, 41, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileW + C3                                                     77F38210 5 Bytes  [ 8B, 40, 30, 8B, 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileW + C9                                                     77F38216 101 Bytes  [ 8B, 40, 0C, 83, C0, 2C, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileW + 2                                                   77F393B5 149 Bytes  JMP 77F0EFB8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileW + 98                                                  77F3944B 15 Bytes  [ B7, 0E, D1, F8, D1, E9, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileW + A9                                                  77F3945C 9 Bytes  JMP 77F2C8F3 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileW + B4                                                  77F39467 212 Bytes  JMP 77F1F3CC C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileW + 189                                                 77F3953C 172 Bytes  [ 06, 66, 89, 45, F4, 66, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileBits + 6                                                77F39695 5 Bytes  [ A5, D4, FD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileBits + C                                                77F3969B 4 Bytes  JMP 77F158BA C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileBits + 11                                               77F396A0 6 Bytes  [ 33, C0, 89, 85, D4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileBits + 19                                               77F396A8 43 Bytes  JMP 77F27900 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileBits + 46                                               77F396D5 41 Bytes  [ 66, 83, FA, 2F, 0F, 84, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiComment + 1B                                                       77F398B1 59 Bytes  [ DF, FE, FF, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiComment + 57                                                       77F398ED 50 Bytes  [ 75, 05, 6A, 03, 58, EB, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiComment + 8A                                                       77F39920 290 Bytes  [ 89, 85, 70, FF, FF, FF, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiComment + 1AD                                                      77F39A43 117 Bytes  [ C3, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiComment + 224                                                      77F39ABA 217 Bytes  [ 4C, 64, 72, 56, 65, 72, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumEnhMetaFile + 20                                                  77F39B94 95 Bytes  [ 56, 08, 83, 4D, FC, FF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumEnhMetaFile + 80                                                  77F39BF4 53 Bytes  CALL 77F61A62 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumEnhMetaFile + B6                                                  77F39C2A 3 Bytes  [ 00, BE, F0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumEnhMetaFile + BA                                                  77F39C2E 40 Bytes  JMP 77F0E119 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumEnhMetaFile + E3                                                  77F39C57 81 Bytes  JMP 77F0F778 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FixBrushOrgEx + 31                                                    77F3AD06 8 Bytes  CALL 77F3397B C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FixBrushOrgEx + 3B                                                    77F3AD10 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FixBrushOrgEx + 3F                                                    77F3AD14 45 Bytes  CALL 77F3AED1 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FixBrushOrgEx + 6D                                                    77F3AD42 21 Bytes  [ 1B, 83, EB, 04, 89, BD, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FixBrushOrgEx + 85                                                    77F3AD5A 71 Bytes  [ C7, 45, FC, 02, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileA + 15                                                  77F3ADA2 190 Bytes  [ A8, FE, FF, FF, EB, 07, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileA + D4                                                  77F3AE61 42 Bytes  [ 07, 83, E0, 02, 33, C9, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileA + FF                                                  77F3AE8C 2 Bytes  [ 48, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileA + 102                                                 77F3AE8F 108 Bytes  [ 8E, A4, 00, 00, 00, 8B, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateMetaFileA + 170                                                 77F3AEFD 117 Bytes  [ 85, C0, 74, 10, 57, 50, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontA + 1B                                                      77F3BB03 6 Bytes  [ 5E, 08, 89, 5D, FC, C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontA + 22                                                      77F3BB0A 19 Bytes  [ FC, 01, 00, 00, 00, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontA + 36                                                      77F3BB1E 108 Bytes  [ C8, 57, 53, 8B, 40, 30, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontA + A3                                                      77F3BB8B 21 Bytes  CALL 77F2F00B C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontA + BA                                                      77F3BBA2 21 Bytes  [ D4, C7, 45, 84, 18, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32A + 47                                                  77F3BDDC 2 Bytes  [ 83, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32A + 4A                                                  77F3BDDF 3 Bytes  [ 00, BB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32A + 4E                                                  77F3BDE3 129 Bytes  [ FF, 7F, 53, 6A, 00, 89, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32A + D0                                                  77F3BE65 49 Bytes  [ 11, 66, 85, D2, 74, 42, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidth32A + 102                                                 77F3BE97 140 Bytes  [ FF, A1, 04, 00, 98, 7C, E9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCleanCacheDC + 26                                                  77F3C1C6 60 Bytes  [ 4C, 44, 52, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RoundRect + 15                                                        77F3C203 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RoundRect + 17                                                        77F3C205 53 Bytes  [ 00, 4C, 64, 72, 70, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RoundRect + 4D                                                        77F3C23B 181 Bytes  [ 65, 6E, 53, 79, 6D, 62, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PaintRgn + 38                                                         77F3C2F1 122 Bytes  CALL 77F196D3 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWinMetaFileBits                                                    77F3C36D 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWinMetaFileBits + 4                                                77F3C371 57 Bytes  CALL 01C03901 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWinMetaFileBits + 3E                                               77F3C3AB 5 Bytes  [ 75, E0, E8, B0, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWinMetaFileBits + 45                                               77F3C3B2 33 Bytes  JMP 77F13D1D C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetWinMetaFileBits + 67                                               77F3C3D4 168 Bytes  [ 4C, 44, 52, 3A, 20, 2A, 2A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertMetaFilePict + 96                                           77F3CAB0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertMetaFilePict + 98                                           77F3CAB2 67 Bytes  [ 53, 68, B0, 14, 98, 7C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertMetaFilePict + DC                                           77F3CAF6 44 Bytes  [ 45, 08, 8B, 40, 04, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertMetaFilePict + 109                                          77F3CB23 3 Bytes  [ FF, 70, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertMetaFilePict + 10D                                          77F3CB27 6 Bytes  [ 00, C7, 85, 88, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalEnhMetaFile + 2                                         77F3CB2E 215 Bytes  [ 05, 10, 00, 00, FF, 15, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalEnhMetaFile + DB                                        77F3CC07 20 Bytes  CALL 77F08DDB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalEnhMetaFile + F0                                        77F3CC1C 68 Bytes  [ 05, 70, 1D, 98, 7C, E9, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Pie + 10                                                              77F3CC62 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Pie + 12                                                              77F3CC64 174 Bytes  [ 4C, 44, 52, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Pie + C1                                                              77F3CD13 54 Bytes  [ 66, 83, 4E, 38, FF, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AnimatePalette + C                                                    77F3CD4A 85 Bytes  JMP 77F11A71 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPaletteEntries + 18                                                77F3CDA0 58 Bytes  CALL 77F0B882 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPaletteEntries + 53                                                77F3CDDB 8 Bytes  JMP 77F1198F C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPaletteEntries + 5C                                                77F3CDE4 153 Bytes  CALL 77F0B883 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry14 + 18                                                       77F3CE7E 59 Bytes  [ E4, 50, 8D, 45, DC, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesW + 15                                                77F3CEBA 2 Bytes  [ FF, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumFontFamiliesW + 18                                                77F3CEBD 31 Bytes  CALL 77F14C68 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetBatchLimit + 8                                                  77F3CEDD 36 Bytes  CALL 7C7BE4E1 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiSetBatchLimit + 2D                                                 77F3CF02 175 Bytes  JMP 77F18642 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmapIndirect + 19                                             77F3CFB2 18 Bytes  [ 84, 60, AB, FD, FF, 57, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmapIndirect + 2C                                             77F3CFC5 100 Bytes  CALL 77F196D5 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmapIndirect + 91                                             77F3D02A 186 Bytes  CALL 7C3B0232 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateBitmapIndirect + 14C                                            77F3D0E5 99 Bytes  [ EC, 83, EC, 10, A1, 04, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleViewportExtEx + 3E                                               77F3D149 7 Bytes  [ 8D, 45, F4, 50, 57, 53, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleViewportExtEx + 46                                               77F3D151 130 Bytes  [ C7, 45, F4, C0, FF, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleViewportExtEx + C9                                               77F3D1D4 86 Bytes  [ 45, 08, 66, 8B, 4D, F8, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleWindowExtEx + 40                                                 77F3D22C 152 Bytes  [ 00, 84, ED, 79, 68, 81, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleWindowExtEx + DA                                                 77F3D2C6 1 Byte  [ 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleWindowExtEx + DC                                                 77F3D2C8 55 Bytes  [ 4F, 00, 62, 00, 6A, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleWindowExtEx + 114                                                77F3D300 3 Bytes  [ 75, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ScaleWindowExtEx + 118                                                77F3D304 54 Bytes  [ 6C, 00, 41, 00, 6C, 00, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiInitializeLanguagePack + CE                                        77F3D5FF 18 Bytes  CALL 77F4630A C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiInitializeLanguagePack + E1                                        77F3D612 7 Bytes  [ 75, 08, 8B, 87, 80, 05, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiInitializeLanguagePack + EA                                        77F3D61B 56 Bytes  [ 02, 33, C0, 89, 45, D0, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapperFlags + 26                                                   77F3D654 30 Bytes  CALL 77EEB34A C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMapperFlags + 45                                                   77F3D673 79 Bytes  [ 3F, 8B, 45, 0C, 0B, 43, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetSystemPaletteUse + B                                               77F3D6C3 20 Bytes  [ 8B, 00, 89, 45, C8, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorAdjustment + 10                                               77F3D6D8 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetColorAdjustment + 12                                               77F3D6DA 84 Bytes  [ 89, 45, C0, 8D, 88, F4, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetAspectRatioFilterEx + 7                                            77F3D72F 51 Bytes  [ 4C, 3B, C7, 74, 48, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementA + 20                                           77F3D763 17 Bytes  [ 55, D4, 66, 89, 50, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementA + 32                                           77F3D775 14 Bytes  CALL 77F4FDAB C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementA + 41                                           77F3D784 29 Bytes  [ C2, 0C, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementA + 5F                                           77F3D7A2 26 Bytes  CALL 77EDC4FF C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementA + 7A                                           77F3D7BD 122 Bytes  [ 00, 00, 00, 9E, 22, 96, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthFloatA + 1F                                               77F3DA8F 21 Bytes  [ 00, F6, 43, 05, 01, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthFloatW + 11                                               77F3DAA5 15 Bytes  [ 73, 05, 0F, B6, C0, EB, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthI + 1                                                     77F3DAB6 18 Bytes  CALL AAFF65BE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthI + 14                                                    77F3DAC9 6 Bytes  [ 8C, 0F, B7, 40, 10, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharWidthI + 1B                                                    77F3DAD0 86 Bytes  [ 88, EB, 03, 0F, B7, 03, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesA + 4                                                  77F3DB27 5 Bytes  [ 3F, 89, 7D, D8, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesA + A                                                  77F3DB2D 13 Bytes  [ 89, 45, C4, 83, 20, 00, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesA + 18                                                 77F3DB3B 48 Bytes  [ D0, 50, 8D, 46, 20, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesA + 49                                                 77F3DB6C 200 Bytes  [ 89, 45, A0, 66, 8B, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesA + 112                                                77F3DC35 18 Bytes  [ 7D, D8, FE, 45, E7, E9, 19, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointA + 1                                             77F3DCB9 32 Bytes  [ 45, DC, 89, 45, 94, 8B, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointA + 22                                            77F3DCDA 6 Bytes  [ BC, 8B, 45, B8, E9, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointA + 29                                            77F3DCE1 151 Bytes  [ FF, FF, 83, 7D, E0, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointA + C1                                            77F3DD79 10 Bytes  [ 75, D4, 8D, 46, 20, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointA + CC                                            77F3DD84 56 Bytes  [ 89, 45, E0, 85, C0, 7C, 1B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointI + 4A                                            77F3E03A 64 Bytes  [ 00, 00, 4C, 64, 72, 70, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointI + 8B                                            77F3E07B 17 Bytes  [ 73, 20, 3D, 20, 25, 78, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointI + 9D                                            77F3E08D 78 Bytes  [ 70, 73, 20, 75, 6E, 73, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointI + EC                                            77F3E0DC 98 Bytes  [ 4C, 64, 72, 70, 4D, 61, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetTextExtentExPointI + 150                                           77F3E140 9 Bytes  [ 4C, 44, 52, 3A, 20, 46, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsFloatA + 6                                            77F3E186 4 Bytes  JMP 77F1833C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsFloatA + B                                            77F3E18B 12 Bytes  [ 80, 3D, C1, E1, 97, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsFloatA + 18                                           77F3E198 43 Bytes  [ 57, 68, 36, 2E, 94, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsI + 2                                                 77F3E1C4 8 Bytes  [ 57, 56, 50, 8B, 85, F0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsI + B                                                 77F3E1CD 8 Bytes  [ FF, 70, 04, FF, B5, EC, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharABCWidthsI + 14                                                77F3E1D6 65 Bytes  [ 68, 9E, 2E, 94, 7C, 68, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphOutlineW + 7                                                  77F3E218 36 Bytes  [ 8B, 40, 30, 8B, 0E, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphOutlineW + 2C                                                 77F3E23D 146 Bytes  CALL 77F0B884 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphOutlineW + BF                                                 77F3E2D0 157 Bytes  [ 6C, 65, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetKerningPairsW + 1F                                                 77F3E36E 317 Bytes  [ 20, 20, 66, 61, 69, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetKerningPairs + 134                                                 77F3E4AC 548 Bytes  [ FF, 90, 4C, 44, 52, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiRealizationInfo + 4D                                               77F3E6D1 47 Bytes  JMP 77F1856A C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiRealizationInfo + 7D                                               77F3E701 140 Bytes  [ 73, 65, 64, 20, 62, 79, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementW + 62                                           77F3E78E 205 Bytes  [ 00, 00, 4C, 44, 52, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementW + 130                                          77F3E85C 31 Bytes  CALL 77F0928E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementW + 150                                          77F3E87C 219 Bytes  [ 0A, 2A, 2A, 2A, 45, 78, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementW + 22D                                          77F3E959 95 Bytes  [ 81, CB, 00, 00, 07, 80, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetCharacterPlacementW + 28D                                          77F3E9B9 73 Bytes  [ FB, 02, 76, 51, 64, A1, 18, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry9 + ED                                                        77F3EFD7 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry9 + EF                                                        77F3EFD9 54 Bytes  CALL 77F08C2D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry9 + 126                                                       77F3F010 122 Bytes  [ 7E, 04, 89, 7D, D8, 81, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry9 + 1A1                                                       77F3F08B 209 Bytes  [ 6A, 20, 8D, 45, 84, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiEntry9 + 273                                                       77F3F15D 23 Bytes  JMP 77F141C2 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontMemResourceEx + 91                                          77F3F3C0 3 Bytes  [ 69, 63, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontMemResourceEx + 95                                          77F3F3C4 55 Bytes  [ 20, 73, 65, 63, 74, 69, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontMemResourceEx + CD                                          77F3F3FC 14 Bytes  [ 69, 63, 61, 6C, 20, 73, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontMemResourceEx + DC                                          77F3F40B 100 Bytes  [ 00, 49, 6E, 69, 74, 69, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontMemResourceEx + 141                                         77F3F470 137 Bytes  [ 69, 63, 61, 6C, 20, 73, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceTracking + 39                                          77F3F9D1 76 Bytes  [ 3A, 20, 41, 63, 74, 69, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceTracking + 86                                          77F3FA1E 181 Bytes  [ 69, 76, 61, 74, 69, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceW + 9                                                  77F3FAD4 11 Bytes  JMP 77F1B7CC C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceW + 15                                                 77F3FAE0 14 Bytes  [ 00, 8B, 40, 30, 56, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExW + A                                                77F3FAEF 31 Bytes  JMP 77F1B7BD C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AddFontResourceExW + 2A                                               77F3FB0F 337 Bytes  [ 00, 53, 58, 53, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontResourceInfoW + 14D                                            77F3FC61 12 Bytes  CALL 77F0B964 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontResourceInfoW + 15A                                            77F3FC6E 34 Bytes  [ 52, 74, 6C, 44, 65, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceW + 11                                      77F3FC91 284 Bytes  [ 3A, 20, 25, 73, 28, 29, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceW + 12E                                     77F3FDAE 71 Bytes  [ 75, F4, 8B, 45, FC, 83, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceW + 176                                     77F3FDF6 47 Bytes  CALL 77F09944 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceW + 1A6                                     77F3FE26 92 Bytes  [ 55, 6E, 73, 61, 66, 65, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!RemoveFontResourceTracking + 4                                        77F3FE83 206 Bytes  [ 43, 14, 85, C0, 0F, 84, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceA + 21                                      77F3FF52 76 Bytes  [ FF, 0F, 86, C9, 03, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceA + 6E                                      77F3FF9F 17 Bytes  [ 73, 04, 56, 53, 68, FE, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceA + 80                                      77F3FFB1 111 Bytes  [ 83, C4, 18, B8, 03, 00, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceA + F0                                      77F40021 82 Bytes  [ 6E, 64, 73, 20, 28, 25, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateScalableFontResourceA + 143                                     77F40074 86 Bytes  [ 6E, 74, 20, 3D, 20, 25, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetColorSpace + 10                                                    77F400CC 117 Bytes  [ 00, 00, 53, 58, 53, 2F, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetLogColorSpaceW + 28                                                77F40142 86 Bytes  [ 6E, 64, 20, 28, 6F, 66, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetLogColorSpaceW + 7F                                                77F40199 255 Bytes  [ 00, 00, 00, 00, 00, 53, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CheckColorsInGamut + FB                                               77F40299 365 Bytes  [ C0, 50, 68, 38, 4F, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDeviceGammaRamp + B4                                               77F40407 6 Bytes  JMP 77F10495 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDeviceGammaRamp + BB                                               77F4040E 58 Bytes  JMP 77F104A0 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDeviceGammaRamp + F6                                               77F40449 143 Bytes  [ 5D, 18, FF, 75, 10, E8, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDeviceGammaRamp + 186                                              77F404D9 220 Bytes  [ 00, 39, 07, 0F, 85, 4F, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDeviceGammaRamp + 264                                              77F405B7 38 Bytes  [ 00, 00, 00, 53, 58, 53, 3A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetLogColorSpaceA + 79                                                77F40B27 31 Bytes  [ 83, C4, 14, B8, 0D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetLogColorSpaceA + 99                                                77F40B47 104 Bytes  [ 75, F0, FF, 75, FC, E8, ED, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ColorCorrectPalette + C                                               77F40BB0 15 Bytes  [ 44, D0, 10, 03, C6, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ColorCorrectPalette + 1C                                              77F40BC0 71 Bytes  [ 00, 74, 06, 83, C2, 32, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ColorCorrectPalette + 65                                              77F40C09 40 Bytes  JMP 77F33D28 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ColorCorrectPalette + 8E                                              77F40C32 120 Bytes  [ 33, C9, 89, 4B, 24, 8B, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ColorCorrectPalette + 107                                             77F40CAB 81 Bytes  [ 55, 14, 83, E1, 03, F3, A4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateColorSpaceA + B                                                 77F410D7 62 Bytes  [ 00, 00, 00, 53, 58, 53, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateColorSpaceA + 4A                                                77F41116 291 Bytes  [ 52, 74, 6C, 51, 75, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumICMProfilesA + 4A                                                 77F4123A 128 Bytes  [ 00, 00, 00, 00, 53, 58, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EnumICMProfilesW + 4E                                                 77F412BB 102 Bytes  [ 73, 65, 20, 61, 63, 74, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyW + 3A                                                 77F41323 69 Bytes  [ 00, 00, 00, 53, 58, 53, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyW + 81                                                 77F4136A 36 Bytes  [ 52, 74, 6C, 51, 75, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyW + A6                                                 77F4138F 296 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyA + 5E                                                 77F414B8 40 Bytes  [ 00, 00, 52, 74, 6C, 51, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyA + 87                                                 77F414E1 201 Bytes  [ 00, 00, 00, 00, 00, 53, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyA + 151                                                77F415AB 35 Bytes  [ 0F, 84, E7, 00, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyA + 175                                                77F415CF 16 Bytes  [ 89, 85, D4, FD, FF, FF, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!UpdateICMRegKeyA + 186                                                77F415E0 36 Bytes  [ 00, 00, 50, FF, B5, C8, FD, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileW + 2                                                    77F424FD 16 Bytes  [ 8B, 85, B8, FB, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileW + 13                                                   77F4250E 117 Bytes  [ FF, 66, 3B, C3, 74, 14, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileW + 89                                                   77F42584 18 Bytes  CALL 77F089BE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileW + 9C                                                   77F42597 77 Bytes  [ 70, 04, 68, DE, 75, 94, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileW + EA                                                   77F425E5 53 Bytes  [ 68, CE, 76, 94, 7C, 53, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileA + A                                                    77F4261B 28 Bytes  JMP 77F19E52 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileW + A                                                    77F42638 241 Bytes  JMP 77F19E5E C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileW + FC                                                   77F4272A 124 Bytes  [ 68, 69, 73, 20, 69, 73, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileW + 179                                                  77F427A7 187 Bytes  [ 58, 53, 3A, 20, 41, 74, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileW + 235                                                  77F42863 203 Bytes  [ 68, 65, 20, 6C, 61, 73, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetICMProfileW + 301                                                  77F4292F 216 Bytes  [ 58, 53, 3A, 20, 53, 74, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetICMProfileA + 71                                                   77F42BA2 97 Bytes  [ 83, C4, 10, BE, 0D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmapV5 + 5                                                77F42C04 69 Bytes  JMP 77F19B57 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmapV5 + 4B                                               77F42C4A 359 Bytes  [ 69, 6F, 6E, 20, 63, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmapV5 + 1B3                                              77F42DB2 386 Bytes  [ 78, 0A, 00, 00, 00, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmapV5 + 336                                              77F42F35 77 Bytes  [ 06, 85, C0, 74, 1C, 3B, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmapV5 + 384                                              77F42F83 172 Bytes  [ 00, 00, 00, 64, 3A, 5C, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetRelAbs + 1C                                                        77F43465 36 Bytes  JMP 77F42F1A C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCBrushColor + 20                                                  77F4348A 51 Bytes  JMP 77F436E1 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCBrushColor + 54                                                  77F434BE 11 Bytes  [ EC, 83, EC, 5C, 8B, 4D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCPenColor + 1                                                     77F434CA 123 Bytes  [ F1, D1, EE, B8, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCPenColor + 7D                                                    77F43546 15 Bytes  [ FF, 0F, 84, C8, 14, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCPenColor + 8D                                                    77F43556 3 Bytes  [ 00, 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCPenColor + 91                                                    77F4355A 23 Bytes  [ 8D, 34, 58, 66, 8B, 0E, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetDCPenColor + A9                                                    77F43572 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCPenColor + 10                                                    77F43628 7 Bytes  [ 3B, FB, 0F, 84, DD, 13, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetDCPenColor + 18                                                    77F43630 111 Bytes  [ 83, FF, 1A, 0F, 84, 48, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontLanguageInfo + 29                                              77F436A0 46 Bytes  [ 8B, 45, DC, 8B, 4D, D8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStretchBltMode + 1                                                 77F436CF 100 Bytes  [ 4D, B4, 03, C1, 03, 45, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRelAbs + 13                                                        77F43734 1 Byte  [ 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetRelAbs + 15                                                        77F43736 70 Bytes  [ 00, 32, C0, 5E, 5B, C9, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsPlayMetafileDC + E                                               77F4377D 6 Bytes  [ 75, 08, 8A, D8, E8, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiIsPlayMetafileDC + 16                                              77F43785 68 Bytes  [ 00, 3A, C3, 0F, 85, F4, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LineDDA + 2                                                           77F437CA 161 Bytes  JMP 77F435A4 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!LineDDA + A4                                                          77F4386C 97 Bytes  [ B8, 89, 7D, A8, 89, 7D, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiConvertBitmap + 6                                                  77F438CE 11 Bytes  [ 4D, B8, 49, 85, C9, 0F, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SelectBrushLocal + 1                                                  77F438DA 221 Bytes  [ 45, 8C, 66, 83, 26, 00, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteLocalDC + C6                                                 77F439B8 25 Bytes  [ 42, 83, C1, 04, 3B, D7, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteLocalDC + E0                                                 77F439D2 59 Bytes  [ D2, 39, 7D, 9C, 89, 4D, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiDeleteLocalDC + 11D                                                77F43A0F 74 Bytes  [ B8, 00, 0F, 8E, C2, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileA + 37                                                     77F43A5A 68 Bytes  [ FF, 66, C7, 45, BC, 25, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileA + 7C                                                     77F43A9F 18 Bytes  [ 83, 20, 00, 03, DA, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileA + 8F                                                     77F43AB2 17 Bytes  [ BE, 0F, 84, B3, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileA + A1                                                     77F43AC4 11 Bytes  [ 83, 39, 49, 0F, 84, AD, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaFileA + AD                                                     77F43AD0 19 Bytes  [ 83, 39, 00, 0F, 84, 93, FE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEllipticRgnIndirect + D                                         77F44234 6 Bytes  [ 72, 6F, 63, 65, 73, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateEllipticRgnIndirect + 14                                        77F4423B 71 Bytes  [ 52, 74, 6C, 43, 72, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExA + 35                                            77F44283 3 Bytes  [ 6C, 43, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateFontIndirectExA + 39                                            77F44287 247 Bytes  [ 6F, 76, 65, 72, 54, 69, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetMetaRgn + 26                                                       77F4437F 204 Bytes  [ 52, 74, 6C, 44, 65, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ResetDCA + 16                                                         77F4444C 72 Bytes  [ 6C, 44, 65, 6C, 65, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreateHatchBrush + 9                                                  77F44495 103 Bytes  [ 65, 00, 52, 74, 6C, 44, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortDoc + 1E                                                         77F444FD 91 Bytes  [ 52, 74, 6C, 44, 65, 73, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortDoc + 7A                                                         77F44559 29 Bytes  [ 52, 74, 6C, 44, 65, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortDoc + 98                                                         77F44577 72 Bytes  [ 52, 74, 6C, 44, 6C, 6C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortDoc + E1                                                         77F445C0 109 Bytes  [ 00, 52, 74, 6C, 44, 6F, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetAbortProc + 2F                                                     77F4462E 498 Bytes  [ 72, 00, 52, 74, 6C, 44, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DrawEscape + 47                                                       77F44821 113 Bytes  [ 61, 6C, 43, 6F, 6D, 70, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AngleArc + 1D                                                         77F44893 61 Bytes  [ 52, 74, 6C, 45, 72, 61, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AngleArc + 5B                                                         77F448D1 32 Bytes  [ 72, 69, 6E, 67, 73, 5F, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AngleArc + 7C                                                         77F448F2 68 Bytes  [ 49, 6E, 74, 65, 67, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Arc + F                                                               77F44937 13 Bytes  [ 52, 74, 6C, 46, 69, 6C, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Arc + 1D                                                              77F44945 287 Bytes  [ 52, 74, 6C, 46, 69, 6C, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ArcTo + 51                                                            77F44A65 6 Bytes  [ 6E, 43, 6C, 65, 61, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ArcTo + 58                                                            77F44A6C 118 Bytes  [ 52, 74, 6C, 46, 69, 6E, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Chord + F                                                             77F44AE3 18 Bytes  [ 52, 74, 6C, 46, 69, 72, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Chord + 22                                                            77F44AF6 41 Bytes  [ 52, 74, 6C, 46, 69, 72, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Chord + 4C                                                            77F44B20 64 Bytes  [ 52, 74, 6C, 46, 6F, 72, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!Chord + 8D                                                            77F44B61 125 Bytes  [ 6C, 46, 72, 65, 65, 48, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlgBlt + 1F                                                           77F44BDF 22 Bytes  [ 52, 74, 6C, 46, 72, 65, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlgBlt + 36                                                           77F44BF6 38 Bytes  [ 52, 74, 6C, 47, 55, 49, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlgBlt + 5D                                                           77F44C1D 108 Bytes  [ 52, 74, 6C, 47, 65, 74, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PlgBlt + CA                                                           77F44C8A 73 Bytes  [ 72, 69, 74, 79, 44, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtFloodFill + 1A                                                     77F44CD4 11 Bytes  [ 79, 44, 65, 73, 63, 72, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtFloodFill + 26                                                     77F44CE0 85 Bytes  [ 52, 74, 6C, 47, 65, 74, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtFloodFill + 7C                                                     77F44D36 65 Bytes  [ 6C, 47, 65, 74, 46, 75, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtFloodFill + BE                                                     77F44D78 70 Bytes  [ 73, 00, 52, 74, 6C, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ExtFloodFill + 105                                                    77F44DBF 206 Bytes  [ 6C, 47, 65, 74, 4C, 65, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutW + 7D                                                     77F44E8E 235 Bytes  [ 6C, 47, 65, 74, 50, 72, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutA + 8C                                                     77F44F7A 113 Bytes  [ 52, 74, 6C, 49, 6D, 61, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutA + FE                                                     77F44FEC 103 Bytes  [ 6C, 49, 6E, 69, 74, 4D, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutA + 166                                                    77F45054 12 Bytes  [ 0F, 86, 9B, 6B, FE, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutA + 173                                                    77F45061 29 Bytes  [ F8, 8D, 94, C7, 78, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyTextOutA + 192                                                    77F45080 38 Bytes  [ 89, 45, 10, 83, E1, 07, B0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocW + 28                                                        77F45197 41 Bytes  [ 00, 00, 0F, 87, 5B, 44, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocW + 52                                                        77F451C1 99 Bytes  [ 75, 1C, 8D, 45, E0, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocW + B6                                                        77F45225 190 Bytes  [ 90, 90, 90, 90, 90, E8, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocW + 175                                                       77F452E4 28 Bytes  JMP 77F2D7F8 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocW + 192                                                       77F45301 9 Bytes  [ 0F, B7, 06, 8D, 48, 0A, 3B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocA + 4A                                                        77F456D3 123 Bytes  [ 85, 65, FD, FF, FF, C1, EA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocA + C6                                                        77F4574F 49 Bytes  [ 00, 00, 00, 0F, 84, 91, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocA + F8                                                        77F45781 75 Bytes  [ 8B, 08, 03, C8, 83, C0, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocA + 144                                                       77F457CD 49 Bytes  [ FF, 74, 3C, 8B, C8, 81, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StartDocA + 176                                                       77F457FF 29 Bytes  [ 18, 0F, BE, 80, 48, 0B, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortPath + 4                                                         77F4581D 11 Bytes  [ D0, 66, A9, FF, FF, 74, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortPath + 10                                                        77F45829 32 Bytes  [ 00, 74, B7, 0F, BE, 82, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!AbortPath + 31                                                        77F4584A 136 Bytes  [ 8D, 45, F8, 50, 0F, B6, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StrokePath + C                                                        77F458D3 107 Bytes  CALL 77F2CF0D C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!StrokePath + 78                                                       77F4593F 29 Bytes  [ 0F, 83, 11, C8, 00, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillPath + 9                                                          77F4595D 49 Bytes  [ 89, 85, 90, FE, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillPath + 3B                                                         77F4598F 67 Bytes  [ 32, C0, 5F, C9, C2, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FillPath + 7F                                                         77F459D3 31 Bytes  [ 8B, D8, 83, FB, FF, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!WidenPath + 13                                                        77F459F4 8 Bytes  [ F6, C3, 03, 0F, 85, 7A, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!WidenPath + 1C                                                        77F459FD 60 Bytes  [ 8B, 43, 04, 3B, 45, F8, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PathToRegion + 2                                                      77F45A3A 7 Bytes  [ F6, 05, FA, E3, 97, 7C, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PathToRegion + A                                                      77F45A42 15 Bytes  [ F8, 0F, 85, F8, 5A, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PathToRegion + 1A                                                     77F45A52 42 Bytes  [ 8B, C7, 33, C9, 2B, C1, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PathToRegion + 45                                                     77F45A7D 28 Bytes  [ 55, 8B, EC, 83, EC, 34, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PathToRegion + 63                                                     77F45A9B 2 Bytes  [ 5A, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPath + 1                                                           77F45AAD 8 Bytes  [ 7D, F8, 3B, FB, 0F, 84, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetPath + B                                                           77F45AB7 100 Bytes  [ 83, F8, FF, 0F, 84, 10, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!ChoosePixelFormat + 19                                                77F45B1C 147 Bytes  [ 84, C0, 0F, 84, A5, 3C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelFormat + 1D                                                   77F45BB0 9 Bytes  [ F6, 40, 5F, 04, 0F, 85, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelFormat + 27                                                   77F45BBA 33 Bytes  [ 8D, 45, FC, 50, 6A, 0A, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetPixelFormat + 49                                                   77F45BDC 92 Bytes  [ 00, 83, F9, 40, 0F, 85, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SwapBuffers + B                                                       77F45C39 13 Bytes  [ 8D, 85, 28, FD, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SwapBuffers + 19                                                      77F45C47 16 Bytes  [ 3B, F7, 75, 2B, 8B, 45, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SwapBuffers + 2A                                                      77F45C58 20 Bytes  [ FF, FF, 27, 00, 00, C0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SwapBuffers + 3F                                                      77F45C6D 52 Bytes  [ FC, FF, FF, 89, BD, 94, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolygon + 2                                                       77F45CA2 82 Bytes  [ FF, 10, 89, 85, E0, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolygon + 55                                                      77F45CF5 15 Bytes  [ 8B, 43, 04, 3B, 85, 28, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolygon + 66                                                      77F45D06 27 Bytes  [ 0F, 82, 1A, 59, 02, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolygon + 82                                                      77F45D22 78 Bytes  [ 48, 0F, 85, C0, 58, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolyline + 2C                                                     77F45D71 13 Bytes  JMP 77F45A6B C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolyline + 3A                                                     77F45D7F 51 Bytes  [ FF, 8D, 79, FF, 3B, FA, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyPolyline + 6E                                                     77F45DB3 48 Bytes  [ 57, 57, 57, 8D, 45, E4, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezier + B                                                        77F45DE4 8 Bytes  [ F0, 3B, F7, 0F, 8D, 0A, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezier + 14                                                       77F45DED 19 Bytes  [ 81, FE, 08, 00, 15, C0, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezier + 28                                                       77F45E01 66 Bytes  [ 75, 08, 57, 57, FF, 75, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyBezier + 6B                                                       77F45E44 45 Bytes  [ 8D, 48, 20, 85, C9, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CreatePolyPolygonRgn + 8                                              77F45E72 38 Bytes  JMP 77F63607 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyDraw + E                                                          77F45E99 44 Bytes  [ 8B, 40, 30, FF, 70, 18, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyDraw + 3B                                                         77F45EC6 62 Bytes  CALL 77F2B4E2 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyDraw + 7B                                                         77F45F06 30 Bytes  [ 00, 89, 45, E0, 8B, 8B, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PolyDraw + 9A                                                         77F45F25 106 Bytes  [ E4, 85, FF, 0F, 84, 16, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PtInRegion                                                            77F45F94 51 Bytes  [ 33, DB, 8B, B5, BC, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PtInRegion + 34                                                       77F45FC8 31 Bytes  [ F0, EB, D6, 38, 1D, C1, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PtInRegion + 54                                                       77F45FE8 53 Bytes  JMP 77F37A84 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PtVisible + 7                                                         77F4601E 12 Bytes  [ CF, 02, FD, FF, 83, C0, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PtVisible + 14                                                        77F4602B 214 Bytes  JMP 77F0CF69 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MirrorRgn + 2                                                         77F46102 10 Bytes  [ A9, 00, 00, 00, 10, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MirrorRgn + D                                                         77F4610D 131 Bytes  CALL 77F6A0D6 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!MirrorRgn + 91                                                        77F46191 98 Bytes  [ CC, 9C, 02, 00, 8B, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayDCScript + 48                                                  77F461F4 153 Bytes  [ 55, 4C, 4C, 20, 29, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayDCScript + E2                                                  77F4628E 40 Bytes  [ FE, FF, 83, C4, 10, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayDCScript + 10B                                                 77F462B7 54 Bytes  [ 5D, 08, 3B, CB, 0F, 84, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayDCScript + 143                                                 77F462EF 21 Bytes  [ 55, F8, 66, 89, 50, 04, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayDCScript + 159                                                 77F46305 12 Bytes  [ 1E, 8B, 00, 89, 46, 04, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontAssocStatus + 17                                               77F467B9 72 Bytes  CALL 77F6A1AD C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontAssocStatus + 60                                               77F46802 28 Bytes  [ 89, 4D, B0, A8, 02, 74, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontAssocStatus + 7D                                               77F4681F 3 Bytes  [ A0, 77, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontAssocStatus + 81                                               77F46823 40 Bytes  [ 89, 85, 40, FF, FF, FF, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontAssocStatus + AA                                               77F4684C 67 Bytes  [ FF, 89, 85, B4, FE, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EudcUnloadLinkW + 17                                                  77F46A07 25 Bytes  [ FF, FF, C6, 46, 06, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EudcUnloadLinkW + 31                                                  77F46A21 81 Bytes  [ FF, FF, 50, 8D, 47, 10, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapW + 2                                                  77F46A73 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapW + 4                                                  77F46A75 72 Bytes  [ 4E, 0C, 89, 8D, 60, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapA + 22                                                 77F46ABE 155 Bytes  [ E1, 07, 33, D2, 42, D3, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapA + BE                                                 77F46B5A 142 Bytes  [ FF, 8D, 44, 30, 10, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapA + 14D                                                77F46BE9 49 Bytes  [ 39, 12, 75, 7A, 0F, B7, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapA + 17F                                                77F46C1B 31 Bytes  [ FF, FF, 88, 06, EB, 46, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetStringBitmapA + 19F                                                77F46C3B 16 Bytes  CALL 77F0CF0F 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageCount + 6B                                                  77F47320 3 Bytes  [ 89, 85, 60 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiGetPageCount + 6F                                                  77F47324 63 Bytes  [ FF, FF, B9, 0D, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPrivatePageEMF + 36                                            77F47367 19 Bytes  CALL 780D14D0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPrivatePageEMF + 4A                                            77F4737B 14 Bytes  [ 00, 8B, 45, 9C, 89, 01, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPrivatePageEMF + 59                                            77F4738A 42 Bytes  [ B5, 48, FF, FF, FF, FF, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPrivatePageEMF + 84                                            77F473B5 96 Bytes  [ B6, 78, 05, 00, 00, E8, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayPrivatePageEMF + E5                                            77F47416 25 Bytes  [ AB, FD, FF, B8, 05, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayEMF + 3F                                                       77F47797 34 Bytes  [ 8B, 45, B0, 8D, 34, 46, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayEMF + 62                                                       77F477BA 60 Bytes  [ 05, FF, FF, 00, 00, 66, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayEMF + A0                                                       77F477F8 50 Bytes  JMP 77F10B63 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayEMF + D3                                                       77F4782B 32 Bytes  JMP 77F2F4C6 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiPlayEMF + F5                                                       77F4784D 97 Bytes  [ B8, 06, 01, 00, C0, E9, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGetPrinterDataFileName + 27                                        77F493D8 63 Bytes  [ 48, 45, 41, 50, 5B, 25, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!XLATEOBJ_piVector + F                                                 77F49418 202 Bytes  [ 48, 45, 41, 50, 5B, 25, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryEMFInfo + 5                                                   77F494E3 41 Bytes  [ 74, 1B, 8B, 45, 08, C6, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryEMFInfo + 2F                                                  77F4950D 16 Bytes  [ EC, 83, EC, 1C, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryEMFInfo + 40                                                  77F4951E 161 Bytes  [ 00, 00, 8B, 40, 30, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryEMFInfo + E2                                                  77F495C0 39 Bytes  [ 75, 0C, 3B, F7, 0F, 84, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngQueryEMFInfo + 10C                                                 77F495EA 90 Bytes  [ 8B, 40, 0C, 8B, 40, 0C, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePaletteEntries + 36                                     77F4A224 21 Bytes  [ 46, 28, 83, F8, FF, 74, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePaletteEntries + 4C                                     77F4A23A 46 Bytes  [ D0, E1, FB, FF, 33, FF, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePaletteEntries + 7B                                     77F4A269 3 Bytes  [ E0, 10, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePaletteEntries + 7F                                     77F4A26D 112 Bytes  CALL 77F2CF40 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePixelFormat + 2                                         77F4A2DE 7 Bytes  [ 85, FF, 0F, 84, 60, 2B, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePixelFormat + A                                         77F4A2E6 119 Bytes  CALL 77F26B00 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePixelFormat + 82                                        77F4A35E 8 Bytes  JMP 77F2A7E3 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePixelFormat + 8B                                        77F4A367 18 Bytes  [ 45, 9C, 83, FA, 01, 0F, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFilePixelFormat + 9E                                        77F4A37A 41 Bytes  [ 66, 83, 79, 02, 36, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecord + 2                                              77F4A3A4 17 Bytes  CALL 77F16E4F C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecord + 14                                             77F4A3B6 71 Bytes  [ 50, FC, 66, 83, FA, 68, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecordOffExt + 23                                       77F4A3FE 29 Bytes  [ 8B, 58, FC, 89, 9C, 95, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecordOffExt + 41                                       77F4A41C 27 Bytes  [ 4D, A8, 8B, 13, FF, 45, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecordOffExt + 5D                                       77F4A438 202 Bytes  [ 52, FC, 83, 7D, 9C, 01, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecordOffExt + 128                                      77F4A503 62 Bytes  [ FE, FF, 66, C7, 06, 25, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!IsValidEnhMetaRecordOffExt + 167                                      77F4A542 36 Bytes  [ 8B, CA, 66, 8B, 01, 66, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileA + B                                                   77F4A675 325 Bytes  JMP 77F0AB43 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWinMetaFileBits + E2                                               77F4A7BB 36 Bytes  CALL 77F089EA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetWinMetaFileBits + 107                                              77F4A7E0 177 Bytes  [ 8B, F0, 85, F6, 0F, 84, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionA + 4E                                       77F4A892 103 Bytes  [ 50, 8D, 45, F0, 50, E8, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionA + B6                                       77F4A8FA 22 Bytes  [ 6E, 00, 65, 00, 5C, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionA + CD                                       77F4A911 48 Bytes  [ 00, 72, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionA + FE                                       77F4A942 144 Bytes  [ 50, 00, 72, 00, 6F, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetEnhMetaFileDescriptionA + 18F                                      77F4A9D3 18 Bytes  [ FD, FF, 8B, 75, 10, 8B, C3, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsRecord + 19                                                  77F4C902 19 Bytes  CALL 77F49D23 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsRecord + 2D                                                  77F4C916 36 Bytes  [ 00, 00, 01, 15, 91, 7C, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsRecord + 52                                                  77F4C93B 50 Bytes  [ FF, 55, 8B, EC, 83, EC, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsRecord + 86                                                  77F4C96F 37 Bytes  [ FF, 00, 89, 47, 14, 39, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsRecord + AC                                                  77F4C995 3 Bytes  [ 14, 89, 5E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsBounds + 5C                                                  77F4C9FB 62 Bytes  CALL 77F49CE8 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsBounds + 9E                                                  77F4CA3D 19 Bytes  [ 8B, FF, 55, 8B, EC, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsBounds + B2                                                  77F4CA51 6 Bytes  JMP 77F4CFDC C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsBounds + B9                                                  77F4CA58 125 Bytes  JMP 77F4C972 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiAddGlsBounds + 137                                                 77F4CAD6 27 Bytes  [ BF, 70, 01, 00, 00, 00, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalMetaFilePict + 1F                                       77F4D329 134 Bytes  [ F0, B9, 60, F9, 97, 7C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalMetaFilePict + A6                                       77F4D3B0 64 Bytes  [ 8D, 45, CC, 89, 85, C0, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalMetaFilePict + E7                                       77F4D3F1 16 Bytes  [ D8, 03, C1, 74, 51, 8B, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalMetaFilePict + F8                                       77F4D402 2 Bytes  [ 66, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiCreateLocalMetaFilePict + FB                                       77F4D405 1 Byte  [ D8 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiArtificialDecrementDriver + 56                                     77F51571 77 Bytes  [ 55, 8B, EC, 83, EC, 20, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiArtificialDecrementDriver + A4                                     77F515BF 10 Bytes  [ 41, 0C, 3B, D0, 72, 09, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiArtificialDecrementDriver + AF                                     77F515CA 7 Bytes  [ 3B, D3, 72, 49, 83, C1, 28 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiArtificialDecrementDriver + B7                                     77F515D2 34 Bytes  [ 45, FC, 39, 75, FC, 72, E5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiArtificialDecrementDriver + DA                                     77F515F5 9 Bytes  [ 45, F8, 50, 6A, FF, E8, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FontIsLinked + 2                                                      77F51758 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FontIsLinked + 4                                                      77F5175A 42 Bytes  [ 41, 56, 52, 46, 3A, 53, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FontIsLinked + 2F                                                     77F51785 49 Bytes  [ 00, 41, 56, 52, 46, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FontIsLinked + 64                                                     77F517BA 54 Bytes  [ 90, 8B, FF, 55, 8B, EC, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FontIsLinked + 9B                                                     77F517F1 95 Bytes  CALL 77EFC6B5 C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry1 + B                                                          77F51851 15 Bytes  [ 3B, C3, 7C, 09, C6, 85, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry2 + 7                                                          77F51861 77 Bytes  [ 15, C0, 75, 02, 33, C0, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry6 + 5                                                          77F518AF 5 Bytes  [ 00, 8B, 85, C4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry6 + B                                                          77F518B5 32 Bytes  [ FF, 56, 57, 8B, 78, 18, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry8 + 5                                                          77F518D7 5 Bytes  [ 00, 8B, 85, E4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry8 + B                                                          77F518DD 19 Bytes  [ FF, 39, 18, 0F, 84, C1, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry10 + B                                                         77F518F1 13 Bytes  [ FF, 8B, 85, F0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry13 + 5                                                         77F518FF 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry13 + 7                                                         77F51901 123 Bytes  [ 33, C0, 39, 5E, 18, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry32 + B                                                         77F5197D 39 Bytes  CALL B3F5197F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry34 + B                                                         77F519A5 83 Bytes  [ FF, FF, 8B, 85, C8, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry42 + F                                                         77F519F9 139 Bytes  [ 8B, 40, 30, 8B, 40, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry56 + F                                                         77F51A85 251 Bytes  [ 00, 00, 8B, 40, 30, 80, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry56 + 10B                                                       77F51B81 57 Bytes  [ 00, 00, FF, 75, 2C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry56 + 145                                                       77F51BBB 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry56 + 147                                                       77F51BBD 27 Bytes  [ 8B, 40, 30, F6, 40, 69, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry56 + 163                                                       77F51BD9 68 Bytes  [ 00, 00, FF, 75, 2C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!DdEntry0 + 41                                                         77F51C1F 339 Bytes  [ 00, FF, 75, 2C, FF, 75, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetGlyphIndicesW + 5                                                  77F51D73 363 Bytes  [ 00, 56, 45, 52, 49, 46, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontUnicodeRanges + 1F                                             77F51EDF 59 Bytes  [ 55, 8B, EC, 81, EC, 40, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontUnicodeRanges + 5B                                             77F51F1B 59 Bytes  [ 89, 85, D4, FD, FF, FF, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GetFontUnicodeRanges + 97                                             77F51F57 59 Bytes  [ 66, 89, 9D, D0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiQueryFonts + B                                                     77F51F93 19 Bytes  [ 6A, 01, FF, B5, E4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiQueryFonts + 1F                                                    77F51FA7 19 Bytes  [ 88, 85, EF, FD, FF, FF, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiQueryFonts + 33                                                    77F51FBB 13 Bytes  [ 80, BD, EF, FD, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiQueryFonts + 41                                                    77F51FC9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!GdiQueryFonts + 43                                                    77F51FCB 37 Bytes  [ 8B, 85, CC, FD, FF, FF, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMagicColors + B                                                    77F52083 19 Bytes  [ FF, 3B, 47, 14, 72, 8A, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMagicColors + 1F                                                   77F52097 26 Bytes  [ FF, 39, 18, 0F, 85, 64, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMagicColors + 3A                                                   77F520B2 40 Bytes  [ 50, 61, 67, 65, 20, 68, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMagicColors + 64                                                   77F520DC 13 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!SetMagicColors + 72                                                   77F520EA 50 Bytes  [ FF, 75, 0C, 83, C8, 01, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngCopyBits + 13                                                      77F5218F 15 Bytes  [ 8B, FF, 55, 8B, EC, F6, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngEraseSurface + F                                                   77F5219F 40 Bytes  [ 00, FF, 75, 0C, 8B, 40, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngFillPath + 10                                                      77F521C8 27 Bytes  [ 8B, FF, 55, 8B, EC, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngLineTo + 5                                                         77F521E5 30 Bytes  [ 00, 8B, 40, 30, 53, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngAlphaBlend + 12                                                    77F52206 16 Bytes  [ 8B, FF, 55, 8B, EC, F6, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngGradientFill + F                                                   77F52217 19 Bytes  [ 8B, 40, 30, FF, 75, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!EngTransparentBlt + F                                                 77F5222B 32 Bytes  [ 8B, D0, 85, D2, 74, 1F, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!XLATEOBJ_cGetPalette + 8                                              77F5224C 38 Bytes  [ F3, AA, 5F, 5E, 8B, C2, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!XLATEOBJ_hGetColorTransform + 7                                       77F52273 25 Bytes  [ 00, FF, 75, 0C, 8B, 40, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CLIPOBJ_ppoGetPath + D                                                77F5228D 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!CLIPOBJ_ppoGetPath + F                                                77F5228F 69 Bytes  [ A1, E4, 1B, 98, 7C, 5D, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BRUSHOBJ_pvAllocRbrush + 7                                            77F522D5 14 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!BRUSHOBJ_pvGetRbrush + 2                                              77F522E4 53 Bytes  [ 56, 8B, 75, 08, 0F, AF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_pQueryGlyphAttrs + 12                                         77F5231C 32 Bytes  [ 8B, FF, 55, 8B, EC, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!FONTOBJ_cGetAllGlyphHandles + B                                       77F5233D 33 Bytes  [ 75, 08, 50, A1, D4, 1B, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!STROBJ_dwGetCodePage + 5                                              77F5235F 13 Bytes  [ FF, 35, D4, 1B, 98, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PATHOBJ_vGetBounds                                                    77F5236E 26 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PATHOBJ_bEnum + 7                                                     77F52389 56 Bytes  [ 5D, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!PATHOBJ_bEnumClipLines + 4                                            77F523C2 62 Bytes  [ 50, 61, 67, 65, 20, 68, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + 7                                             77F52401 34 Bytes  [ 33, DB, 43, 8B, 75, 08, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + 2A                                            77F52424 39 Bytes  [ 7C, 66, 83, 65, D0, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + 52                                            77F5244C 253 Bytes  [ 8D, 7E, 10, 57, 8D, 46, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + 150                                           77F5254A 53 Bytes  [ 90, FD, FF, 83, C4, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] GDI32.dll!HT_Get8BPPMaskPalette + 186                                           77F52580 116 Bytes  [ 76, 0C, 68, 24, 73, 95, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WdtpInterfacePointer_UserFree + FFEDCA04                              774E1931 72 Bytes  [ 8D, 45, F4, 50, 8D, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WdtpInterfacePointer_UserFree + FFEDCA4D                              774E197A 31 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WdtpInterfacePointer_UserFree + FFEDCA6E                              774E199B 161 Bytes  [ C0, EB, 24, 83, 7D, 10, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WdtpInterfacePointer_UserFree + FFEDCB10                              774E1A3D 3 Bytes  JMP 774E1AD9 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WdtpInterfacePointer_UserFree + FFEDCB16                              774E1A43 68 Bytes  [ 66, 0F, B6, 4E, 01, 66, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllCanUnloadNow + 37                                         774FCF60 39 Bytes  [ 6A, 00, 6A, 01, FF, B6, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllCanUnloadNow + 5F                                         774FCF88 4 Bytes  [ 89, 45, E0, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllCanUnloadNow + 64                                         774FCF8D 53 Bytes  [ 10, 00, 00, 8B, 0D, F0, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllCanUnloadNow + 9A                                         774FCFC3 21 Bytes  CALL 77493E98 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllCanUnloadNow + B0                                         774FCFD9 20 Bytes  [ 83, 24, B8, 00, 83, C7, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemFree + 1                                                     774FD02D 127 Bytes  [ EC, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemAlloc + 65                                                   774FD0AD 12 Bytes  CALL 7749582C C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemAlloc + 72                                                   774FD0BA 77 Bytes  [ 75, 36, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemAlloc + C0                                                   774FD108 6 Bytes  [ 00, C0, E8, 3E, 79, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemAlloc + C7                                                   774FD10F 12 Bytes  CALL 774FBAA9 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemAlloc + D4                                                   774FD11C 36 Bytes  [ 89, 84, BE, 10, 0E, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidInterface                                                      774FD429 10 Bytes  [ 8B, FF, 55, 8B, EC, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidInterface + B                                                  774FD434 42 Bytes  CALL 774FD347 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidInterface + 36                                                 774FD45F 26 Bytes  CALL 774FCD7C C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidInterface + 51                                                 774FD47A 70 Bytes  [ CE, 83, E1, 04, 0B, C1, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidInterface + 98                                                 774FD4C1 111 Bytes  CALL 774FD428 C:\WINDOWS\system32\ole32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMalloc + 20                                                      774FDD18 45 Bytes  [ 00, 83, 4D, FC, FF, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMalloc + 4E                                                      774FDD46 9 Bytes  CALL 774FD51F C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMalloc + 58                                                      774FDD50 48 Bytes  [ 75, 9C, 53, FF, 35, 9C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMalloc + 89                                                      774FDD81 196 Bytes  [ 36, 8B, 02, 8B, 4A, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromGUID2 + 45                                                  774FDE47 38 Bytes  [ FF, 33, C0, 40, C3, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromGUID2 + 6C                                                  774FDE6E 37 Bytes  CALL 77493D26 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromGUID2 + 92                                                  774FDE94 41 Bytes  [ 17, 88, 97, 7C, 2D, 88, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromGUID2 + BC                                                  774FDEBE 110 Bytes  [ 7D, F8, 89, 7D, FC, 75, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromGUID2 + 12B                                                 774FDF2D 14 Bytes  [ 75, F8, FF, 75, 18, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateBindCtx + 2                                                     774FE53C 24 Bytes  [ 00, 00, 76, 1E, 8D, 85, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateBindCtx + 1B                                                    774FE555 33 Bytes  [ C4, 10, BE, 06, 01, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateBindCtx + 3D                                                    774FE577 38 Bytes  [ C0, EB, 32, 8B, 8D, EC, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateBindCtx + 64                                                    774FE59E 11 Bytes  [ 33, F6, 66, 89, 03, 33, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateBindCtx + 71                                                    774FE5AB 274 Bytes  [ C0, 39, BD, E0, FD, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetState + 31                                                       774FEE17 3 Bytes  [ E4, 0D, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetState + 35                                                       774FEE1B 113 Bytes  CALL 774B3D22 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUninitialize + 57                                                   774FEE8D 3 Bytes  [ 84, 86, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUninitialize + 5B                                                   774FEE91 61 Bytes  [ 83, C4, 0C, 33, C0, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetErrorInfo + 35                                                     774FEECF 1 Byte  [ 5D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetErrorInfo + 38                                                     774FEED2 43 Bytes  [ 45, E0, 50, 8D, 45, D8, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetErrorInfo + 64                                                     774FEEFE 49 Bytes  [ E4, 06, 01, 00, C0, EB, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateGuid + F                                                      774FEF30 53 Bytes  [ 00, C0, EB, 0F, 8B, 03, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateGuid + 45                                                     774FEF66 6 Bytes  [ 00, 00, E9, AF, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeEx + 2                                                    774FEF6D 77 Bytes  [ 90, 90, 90, 90, 90, E8, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeEx + 50                                                   774FEFBB 50 Bytes  [ A3, CA, 00, 00, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeEx + 83                                                   774FEFEE 7 Bytes  [ 6F, 00, 6C, 00, 65, 00, 33 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeEx + 8B                                                   774FEFF6 66 Bytes  [ 32, 00, 2E, 00, 64, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeEx + CE                                                   774FF039 2 Bytes  [ 75, 18 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RegisterDragDrop + 2                                                  774FF61C 17 Bytes  CALL 774B761F C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RegisterDragDrop + 14                                                 774FF62E 132 Bytes  [ C0, 74, 68, 8B, 4B, 04, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RegisterDragDrop + 99                                                 774FF6B3 90 Bytes  [ FF, FF, 7F, FF, 45, E8, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitialize + 34                                                    774FF70E 132 Bytes  [ 76, 12, A1, 44, 29, 98, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitialize + B9                                                    774FF793 21 Bytes  [ 00, C0, 83, 4D, FC, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitialize + D0                                                    774FF7AA 48 Bytes  [ 00, 8D, 45, DC, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitialize + 101                                                   774FF7DB 61 Bytes  [ 00, C0, 83, 4D, FC, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitialize + 13F                                                   774FF819 7 Bytes  [ C8, 0B, DA, 89, 0E, 89, 5E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstanceEx + 4                                                774FFA6F 9 Bytes  [ 13, 85, D2, 79, 71, 81, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstanceEx + E                                                774FFA79 8 Bytes  [ 7F, 03, D6, 89, 95, 14, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstanceEx + 17                                               774FFA82 48 Bytes  [ 66, 8B, 0A, 66, 81, F9, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstanceEx + 48                                               774FFAB3 5 Bytes  [ 00, FF, B5, 68, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstanceEx + 4F                                               774FFABA 10 Bytes  [ FF, B5, 5C, FD, FF, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstance + 2                                                  774FFAC5 18 Bytes  CALL 774B761F C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstance + 15                                                 774FFAD8 17 Bytes  [ B5, 60, FD, FF, FF, 8B, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstance + 27                                                 774FFAEA 5 Bytes  [ FF, FF, B5, 5C, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstance + 2D                                                 774FFAF0 51 Bytes  [ FF, 0F, B7, 03, 50, E8, 27, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateInstance + 61                                                 774FFB24 74 Bytes  [ 89, 8D, 68, FD, FF, FF, 84, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitialize + 13                                                     77502A4A 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitialize + 2F                                                     77502A66 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitialize + 44                                                     77502A7B 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitialize + 8A                                                     77502AC1 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitialize + C4                                                     77502AFB 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisconnectObject + 15                                               77502D12 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisconnectObject + 1E                                               77502D1B 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisconnectObject + 2C                                               77502D29 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisconnectObject + 39                                               77502D36 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisconnectObject + 52                                               77502D4F 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeAllLibraries + 14                                               77503AAB 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeAllLibraries + 1A                                               77503AB1 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeAllLibraries + 2F                                               77503AC6 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeAllLibraries + 48                                               77503ADF 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeAllLibraries + 54                                               77503AEB 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStreamOnHGlobal + A                                             7750641A 13 Bytes  [ 6F, 00, 20, 00, 62, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStreamOnHGlobal + 18                                            77506428 15 Bytes  [ 73, 00, 61, 00, 62, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStreamOnHGlobal + 28                                            77506438 21 Bytes  [ 69, 00, 74, 00, 68, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStreamOnHGlobal + 3E                                            7750644E 7 Bytes  [ 6E, 00, 67, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStreamOnHGlobal + 46                                            77506456 11 Bytes  [ 6F, 00, 20, 00, 6B, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorage + 25                                                   77507962 37 Bytes  [ 64, 00, 6F, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorage + 4B                                                   77507988 9 Bytes  [ 6E, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorage + 55                                                   77507992 131 Bytes  [ 75, 00, 72, 00, 69, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorage + D9                                                   77507A16 3 Bytes  [ 63, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorage + DD                                                   77507A1A 103 Bytes  [ 6D, 00, 70, 00, 75, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetRunningObjectTable + 3E                                            7750C272 47 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetRunningObjectTable + 6E                                            7750C2A2 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetRunningObjectTable + 70                                            7750C2A4 5 Bytes  [ 72, 00, 75, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetRunningObjectTable + 76                                            7750C2AA 21 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetRunningObjectTable + 8C                                            7750C2C0 68 Bytes  [ 25, 00, 30, 00, 38, 00, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DllGetClassObject + 23                                                7750C8CA 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DllGetClassObject + 25                                                7750C8CC 11 Bytes  [ 63, 00, 68, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DllGetClassObject + 31                                                7750C8D8 11 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DllGetClassObject + 3D                                                7750C8E4 7 Bytes  [ 65, 00, 78, 00, 69, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DllGetClassObject + 45                                                7750C8EC 27 Bytes  [ 74, 00, 20, 00, 77, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromString + 18                                                  7750CBB4 3 Bytes  [ 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromString + 1C                                                  7750CBB8 5 Bytes  [ 72, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromString + 22                                                  7750CBBE 87 Bytes  [ 69, 00, 73, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromString + 7A                                                  7750CC16 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromString + 7C                                                  7750CC18 7 Bytes  [ 6B, 00, 20, 00, 69, 00, 6E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromCLSID + A                                                   7750D5DA 458 Bytes  [ 4F, 49, 49, 74, 1F, 68, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromCLSID + 1D5                                                 7750D7A5 77 Bytes  [ 45, 18, 85, C0, 8B, 4D, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromCLSID + 223                                                 7750D7F3 19 Bytes  [ 4D, 0C, 89, 3E, 3B, 51, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromCLSID + 237                                                 7750D807 40 Bytes  [ 55, 18, 85, D2, 0F, 84, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromCLSID + 260                                                 7750D830 116 Bytes  [ FB, 83, C2, 04, C6, 02, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReleaseMarshalData + 34                                             7750EA8F 43 Bytes  [ FF, 7D, 1E, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReleaseMarshalData + 60                                             7750EABB 7 Bytes  CALL 774D268C C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReleaseMarshalData + 68                                             7750EAC3 24 Bytes  [ 06, 89, 78, 0C, FF, 36, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReleaseMarshalData + 82                                             7750EADD 80 Bytes  [ 8D, 45, F8, 50, 57, E8, A7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReleaseMarshalData + D3                                             7750EB2E 161 Bytes  [ 00, 00, 00, 80, 3F, 03, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DcomChannelSetHResult + 10                                            7750F6CF 17 Bytes  CALL 774B58FB C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DcomChannelSetHResult + 31                                            7750F6F0 65 Bytes  [ 75, 10, 85, F6, 57, 75, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DcomChannelSetHResult + 73                                            7750F732 69 Bytes  [ 90, 90, 90, 90, 90, 68, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DcomChannelSetHResult + B9                                            7750F778 50 Bytes  [ 8B, 0D, 4C, 26, 98, 7C, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DcomChannelSetHResult + EC                                            7750F7AB 148 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMarshalSizeMax + 25                                              77510D44 11 Bytes  [ 61, 00, 64, 00, 20, 00, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMarshalSizeMax + 31                                              77510D50 31 Bytes  [ 67, 00, 65, 00, 7D, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMarshalSizeMax + 51                                              77510D70 15 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMarshalSizeMax + 61                                              77510D80 19 Bytes  [ 44, 00, 4C, 00, 4C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetMarshalSizeMax + 75                                              77510D94 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalInterface + 25                                             77510E78 7 Bytes  [ 65, 00, 6E, 00, 63, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalInterface + 2D                                             77510E80 3 Bytes  [ 20, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalInterface + 31                                             77510E84 35 Bytes  [ 20, 00, 74, 00, 6F, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalInterface + 55                                             77510EA8 23 Bytes  [ 74, 00, 20, 00, 65, 00, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalInterface + 6D                                             77510EC0 55 Bytes  [ 69, 00, 73, 00, 20, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoImpersonateClient + 25                                              77512A54 147 Bytes  [ B4, 30, BB, 30, D5, 30, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoImpersonateClient + B9                                              77512AE8 258 Bytes  [ 78, 00, 00, 00, 12, 31, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoImpersonateClient + 1BC                                             77512BEB 300 Bytes  [ 34, 0B, 35, 10, 35, 61, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoImpersonateClient + 2E9                                             77512D18 66 Bytes  [ 85, 34, 8D, 34, 9D, 34, A2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoImpersonateClient + 32C                                             77512D5B 76 Bytes  [ 36, 88, 36, 8D, 36, 33, 37, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeUnusedLibrariesEx + 24                                          7751356E 288 Bytes  [ 00, 00, 84, 31, 89, 31, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeUnusedLibrariesEx + 145                                         7751368F 126 Bytes  [ 00, 55, 30, 22, 31, 90, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeUnusedLibrariesEx + 1C4                                         7751370E 87 Bytes  [ 05, 00, 48, 00, 00, 00, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeUnusedLibrariesEx + 21C                                         77513766 81 Bytes  [ 00, 00, 98, 30, 9F, 30, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFreeUnusedLibrariesEx + 26E                                         775137B8 84 Bytes  [ 11, 34, A1, 34, DE, 34, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterface + 1B                                               775142A8 9 Bytes  [ 65, 00, 20, 00, 73, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterface + 25                                               775142B2 7 Bytes  [ 72, 00, 63, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterface + 2D                                               775142BA 25 Bytes  [ 6F, 00, 66, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterface + 47                                               775142D4 37 Bytes  [ 20, 00, 72, 00, 65, 00, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterface + 6D                                               775142FA 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReleaseStgMedium + C                                                  77514BF9 20 Bytes  [ 00, 68, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReleaseStgMedium + 21                                                 77514C0E 37 Bytes  [ 6E, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReleaseStgMedium + 47                                                 77514C34 17 Bytes  [ 61, 00, 69, 00, 6E, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReleaseStgMedium + 59                                                 77514C46 23 Bytes  [ 73, 00, 65, 00, 72, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReleaseStgMedium + 71                                                 77514C5E 5 Bytes  [ 68, 00, 69, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObjectContext + 26                                               775151EA 5 Bytes  [ FF, E9, CA, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObjectContext + 2C                                               775151F0 36 Bytes  [ 83, 4D, E0, FF, 33, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObjectContext + 51                                               77515215 35 Bytes  [ 00, 8B, 46, 10, 0D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObjectContext + 75                                               77515239 54 Bytes  CALL 7751397F C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObjectContext + AC                                               77515270 26 Bytes  [ 8B, 00, 89, 45, DC, 33, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateFreeThreadedMarshaler + 2E                                    77515C98 9 Bytes  [ 0F, B7, 7B, 10, 8B, C1, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateFreeThreadedMarshaler + 38                                    77515CA2 60 Bytes  [ 10, 89, 55, 0C, 33, D2, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateFreeThreadedMarshaler + 75                                    77515CDF 100 Bytes  CALL AB138FE7 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCallContext + 14                                                 77515D45 10 Bytes  [ 81, 7F, 14, C0, D0, E0, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCallContext + 1F                                                 77515D50 122 Bytes  [ 00, 00, 8B, 5F, 08, 53, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassObject + 19                                                 77515DCB 47 Bytes  JMP 77515D31 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassObject + 4A                                                 77515DFC 124 Bytes  [ 87, FE, FF, FF, C6, 46, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassObject + C7                                                 77515E79 83 Bytes  [ 45, 10, 53, 8B, 5D, 08, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassObject + 11B                                                77515ECD 103 Bytes  CALL 774DDF88 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassObject + 183                                                77515F35 46 Bytes  [ 67, F6, C2, 01, 74, 0D, 8A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterChannelHook + 5                                             77517154 4 Bytes  [ 68, 03, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterChannelHook + A                                             77517159 44 Bytes  CALL 774CB296 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterChannelHook + 37                                            77517186 152 Bytes  [ EC, 68, 80, 00, 00, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterChannelHook + D0                                            7751721F 114 Bytes  [ 59, 59, EB, 0D, 8B, 0D, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterChannelHook + 143                                           77517292 128 Bytes  [ 4D, 10, 39, 4D, 10, 75, 13, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeSecurity + EE                                             7751750B 15 Bytes  [ 45, 10, 74, 53, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeSecurity + FE                                             7751751B 124 Bytes  [ 02, 50, FF, 75, 0C, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeSecurity + 17B                                            77517598 218 Bytes  [ DD, 5D, F8, 59, DD, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeSecurity + 256                                            77517673 44 Bytes  [ 00, 00, DD, 45, F8, DC, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeSecurity + 283                                            775176A0 189 Bytes  [ 00, DD, 45, 10, DC, 1D, F0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterClassObject + 2                                             77518722 94 Bytes  [ FF, 89, 95, 48, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterClassObject + 62                                            77518782 97 Bytes  [ EB, 0C, FE, 8D, 6E, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterClassObject + C4                                            775187E4 26 Bytes  [ FF, 00, 75, 18, 8A, 07, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterClassObject + DF                                            775187FF 7 Bytes  [ 01, 8B, 9D, 4C, FE, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterClassObject + E7                                            77518807 37 Bytes  [ B6, 3B, 83, CF, 20, 83, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryClientBlanket + 50                                             7751AABE 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryClientBlanket + 52                                             7751AAC0 9 Bytes  [ 70, 00, 69, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryClientBlanket + 5C                                             7751AACA 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryClientBlanket + 5E                                             7751AACC 21 Bytes  [ 70, 00, 65, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryClientBlanket + 74                                             7751AAE2 5 Bytes  [ 73, 00, 20, 00, 66 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetProxyBlanket + 11                                                7751B464 21 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetProxyBlanket + 27                                                7751B47A 41 Bytes  [ 64, 00, 20, 00, 62, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IIDFromString + 20                                                    7751B4A4 3 Bytes  [ 6D, 00, 27 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IIDFromString + 24                                                    7751B4A8 37 Bytes  [ 73, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IIDFromString + 4A                                                    7751B4CE 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IIDFromString + 4C                                                    7751B4D0 9 Bytes  [ 69, 00, 63, 00, 79, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IIDFromString + 56                                                    7751B4DA 25 Bytes  [ 0A, 00, 50, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetPSClsid + A                                                      7751B526 7 Bytes  [ 6F, 00, 20, 00, 67, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetPSClsid + 12                                                     7751B52E 3 Bytes  [ 61, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetPSClsid + 16                                                     7751B532 35 Bytes  [ 74, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetPSClsid + 3A                                                     7751B556 17 Bytes  [ 72, 00, 6D, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetPSClsid + 4C                                                     7751B568 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCopyProxy + C                                                       775200F3 4 Bytes  [ 00, 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCopyProxy + 11                                                      775200F8 12 Bytes  [ 20, 00, 66, 00, 69, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCopyProxy + 1E                                                      77520105 48 Bytes  [ 00, 65, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCopyProxy + 4F                                                      77520136 55 Bytes  [ 72, 00, 6F, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCopyProxy + 87                                                      7752016E 23 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSwitchCallContext + B                                               77520332 5 Bytes  [ 20, 00, 6C, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSwitchCallContext + 11                                              77520338 11 Bytes  [ 73, 00, 74, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSwitchCallContext + 1D                                              77520344 21 Bytes  [ 68, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSwitchCallContext + 33                                              7752035A 103 Bytes  [ 61, 00, 79, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevertToSelf + 63                                                   775203C2 3 Bytes  [ 6F, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevertToSelf + 67                                                   775203C6 5 Bytes  [ 20, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevertToSelf + 6D                                                   775203CC 5 Bytes  [ 74, 00, 77, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevertToSelf + 73                                                   775203D2 3 Bytes  [ 72, 00, 6B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevertToSelf + 77                                                   775203D6 25 Bytes  [ 20, 00, 63, 00, 6F, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FreePropVariantArray + A                                              77520DD0 43 Bytes  [ 74, 00, 61, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FreePropVariantArray + 36                                             77520DFC 7 Bytes  [ 20, 00, 61, 00, 20, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FreePropVariantArray + 3E                                             77520E04 7 Bytes  [ 6F, 00, 6D, 00, 61, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FreePropVariantArray + 46                                             77520E0C 15 Bytes  [ 6E, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FreePropVariantArray + 56                                             77520E1C 43 Bytes  [ 6C, 00, 6C, 00, 65, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptorFromTypeInfo + 38                                     77521C0C 21 Bytes  [ 65, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptorFromTypeInfo + 4E                                     77521C22 7 Bytes  [ 69, 00, 63, 00, 69, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptorFromTypeInfo + 56                                     77521C2A 5 Bytes  [ 6E, 00, 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptorFromTypeInfo + 5C                                     77521C30 23 Bytes  [ 61, 00, 63, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptorFromTypeInfo + 74                                     77521C48 5 Bytes  [ 72, 00, 6D, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgID + 12                                                  775242DE 5 Bytes  [ 67, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgID + 18                                                  775242E4 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgID + 1A                                                  775242E6 9 Bytes  [ 73, 00, 6F, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgID + 24                                                  775242F0 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgID + 26                                                  775242F2 25 Bytes  [ 20, 00, 65, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromOle1Class + 1B                                               775243AE 19 Bytes  [ 61, 00, 69, 00, 6E, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromOle1Class + 2F                                               775243C2 3 Bytes  [ 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromOle1Class + 33                                               775243C6 5 Bytes  [ 0A, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromOle1Class + 39                                               775243CC 9 Bytes  [ 74, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromOle1Class + 43                                               775243D6 5 Bytes  [ 20, 00, 73, 00, 70 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MkParseDisplayName + 23                                               77524754 57 Bytes  [ 65, 00, 72, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MkParseDisplayName + 5D                                               7752478E 23 Bytes  [ 74, 00, 65, 00, 6D, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MkParseDisplayName + 75                                               775247A6 5 Bytes  [ 20, 00, 66, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MkParseDisplayName + 7B                                               775247AC 49 Bytes  [ 6C, 00, 65, 00, 20, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MkParseDisplayName + AD                                               775247DE 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObject + B3                                                      77524F13 10 Bytes  [ 00, 76, 00, 69, 00, 63, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObject + BE                                                      77524F1E 123 Bytes  [ 65, 00, 6E, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObject + 13A                                                     77524F9A 39 Bytes  [ 69, 00, 63, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObject + 162                                                     77524FC2 13 Bytes  [ 0A, 00, 00, 00, 00, 00, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetObject + 170                                                     77524FD0 45 Bytes  [ 65, 00, 20, 00, 73, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoResumeClassObjects + 85                                             77527561 45 Bytes  [ 89, BB, A0, 00, 00, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSuspendClassObjects + 29                                            77527590 25 Bytes  [ 85, C0, 0F, 84, 3E, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSuspendClassObjects + 43                                            775275AA 22 Bytes  [ 00, FF, 15, FC, 3C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSuspendClassObjects + 5A                                            775275C1 22 Bytes  [ 30, B9, 04, 00, 00, 00, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSuspendClassObjects + 71                                            775275D8 5 Bytes  [ C0, 40, EB, 1C, B9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSuspendClassObjects + 77                                            775275DE 8 Bytes  [ 00, 00, 00, BF, F0, 7F, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryProxyBlanket + 85                                              77527D79 59 Bytes  [ E4, 8B, 4D, F0, 64, 89, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryProxyBlanket + C1                                              77527DB5 55 Bytes  [ 00, 00, 50, 64, 89, 25, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryProxyBlanket + F9                                              77527DED 54 Bytes  [ 45, 10, 8B, 48, 04, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryProxyBlanket + 130                                             77527E24 238 Bytes  [ 41, 10, 8B, 79, 14, 89, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryProxyBlanket + 21F                                             77527F13 126 Bytes  [ 89, 45, D4, 83, 45, D0, 30, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantClear + 18                                                 77528BC2 31 Bytes  [ 73, 00, 69, 00, 6E, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantClear + 38                                                 77528BE2 23 Bytes  [ 00, 00, 50, 00, 01, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantClear + 50                                                 77528BFA 33 Bytes  [ 55, 00, 49, 00, 44, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantClear + 72                                                 77528C1C 69 Bytes  [ 61, 00, 76, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantClear + B8                                                 77528C62 1 Byte  [ 66 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetErrorInfo + 11                                                     77529B60 5 Bytes  [ 65, 00, 20, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetErrorInfo + 17                                                     77529B66 13 Bytes  [ 6F, 00, 72, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetErrorInfo + 25                                                     77529B74 27 Bytes  [ 66, 00, 6F, 00, 72, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetErrorInfo + 41                                                     77529B90 13 Bytes  [ 65, 00, 61, 00, 72, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetErrorInfo + 4F                                                     77529B9E 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeClassObject + 1A                                              77529CAC 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeClassObject + 1C                                              77529CAE 31 Bytes  [ 69, 00, 65, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeClassObject + 3C                                              77529CCE 77 Bytes  [ 65, 00, 6E, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeClassObject + 8A                                              77529D1C 25 Bytes  [ 74, 00, 65, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeClassObject + A4                                              77529D36 7 Bytes  [ 0D, 00, 0A, 00, 00, 00, 98 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoadFromStream + 25                                                7752A27C 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoadFromStream + 27                                                7752A27E 15 Bytes  [ 73, 00, 22, 00, 20, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoadFromStream + 37                                                7752A28E 11 Bytes  [ 6E, 00, 74, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoadFromStream + 43                                                7752A29A 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoadFromStream + 45                                                7752A29C 7 Bytes  [ 61, 00, 6E, 00, 20, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStm + 2A                                                     7752A356 23 Bytes  [ 61, 00, 69, 00, 6C, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStm + 42                                                     7752A36E 23 Bytes  [ 75, 00, 72, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStm + 5A                                                     7752A386 19 Bytes  [ 6F, 00, 72, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStm + 6E                                                     7752A39A 93 Bytes  [ 6F, 00, 72, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStm + CC                                                     7752A3F8 41 Bytes  [ 62, 00, 65, 00, 63, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateGenericComposite + 3B                                           7752A546 33 Bytes  [ 73, 00, 20, 00, 65, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateGenericComposite + 5D                                           7752A568 25 Bytes  [ 6C, 00, 69, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateGenericComposite + 77                                           7752A582 45 Bytes  [ 6A, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateGenericComposite + A5                                           7752A5B0 11 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateGenericComposite + B1                                           7752A5BC 13 Bytes  [ 65, 00, 20, 00, 76, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetTreatAsClass + 9                                                 7752D216 33 Bytes  [ 67, 00, 61, 00, 6C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetTreatAsClass + 2B                                                7752D238 93 Bytes  [ 41, 00, 6E, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetTreatAsClass + 89                                                7752D296 33 Bytes  [ 75, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetTreatAsClass + AB                                                7752D2B8 25 Bytes  [ 61, 00, 6C, 00, 69, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetTreatAsClass + C5                                                7752D2D2 7 Bytes  [ 75, 00, 65, 00, 6E, 00, 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetComCatalog + 34                                                  7752F04C 5 Bytes  [ 20, 00, 6F, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetComCatalog + 3A                                                  7752F052 29 Bytes  [ 65, 00, 72, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetComCatalog + 58                                                  7752F070 7 Bytes  [ 6E, 00, 67, 00, 20, 00, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetComCatalog + 60                                                  7752F078 1 Byte  [ 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetComCatalog + 62                                                  7752F07A 9 Bytes  [ 73, 00, 20, 00, 66, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromStream + 54                                             775329B3 16 Bytes  [ 00, 00, D9, C9, D8, 86, BC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromStream + 65                                             775329C4 39 Bytes  [ 00, D9, C9, D8, 86, B8, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemRealloc + E                                                  775329EC 47 Bytes  [ FF, D9, CA, D8, 8F, A4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTaskMemRealloc + 3E                                                 77532A1C 72 Bytes  [ FF, D9, CB, D8, 8F, A8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RevokeDragDrop + 36                                                   77532A65 97 Bytes  [ D9, C9, D8, 86, 90, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RevokeDragDrop + 98                                                   77532AC7 36 Bytes  [ D8, 86, 78, FE, FF, FF, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RevokeDragDrop + BD                                                   77532AEC 22 Bytes  [ FF, D9, CA, D8, 8F, C4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RevokeDragDrop + D4                                                   77532B03 139 Bytes  [ 00, 00, D9, C9, D8, 86, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!RevokeDragDrop + 160                                                  77532B8F 20 Bytes  [ D8, 8F, D8, 00, 00, 00, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeNow + B0                                                    77532D24 28 Bytes  [ 51, 52, FF, 15, A8, 3C, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeNow + CD                                                    77532D41 71 Bytes  [ FF, 55, 8B, EC, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeNow + 115                                                   77532D89 10 Bytes  [ 4D, 0C, 56, 8B, 70, 08, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeNow + 120                                                   77532D94 36 Bytes  [ 40, 18, 0F, AF, C1, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeNow + 145                                                   77532DB9 6 Bytes  [ 89, 07, 83, C7, 04, 4B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserFree + 34                                              77532EFC 35 Bytes  [ 50, 08, 56, 8B, 70, 18, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserFree + 58                                              77532F20 44 Bytes  [ D9, 02, 83, C2, 20, D8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetClipboard + 12                                                  77532F4D 136 Bytes  CALL 513B892B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetClipboard + 9C                                                  77532FD7 63 Bytes  [ 08, 8B, 48, 0C, 8B, 50, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetClipboard + DC                                                  77533017 89 Bytes  [ 0F, BF, 5A, 0A, 01, 59, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetClipboard + 136                                                 77533071 9 Bytes  [ 53, 56, 57, 8B, 78, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetClipboard + 140                                                 7753307B 17 Bytes  [ 8F, 0C, 01, 00, 00, 85, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleUninitialize + 14                                                  77533387 86 Bytes  [ 03, C2, 8B, 51, 38, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleUninitialize + 6B                                                  775333DE 3 Bytes  [ 87, 10, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleUninitialize + 70                                                  775333E3 19 Bytes  [ 8B, 00, 0F, AF, 45, F8, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleUninitialize + 84                                                  775333F7 84 Bytes  [ 03, D0, 89, 11, 8B, 41, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleUninitialize + D9                                                  7753344C 14 Bytes  [ C0, 74, 5D, 53, 89, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryLinkFromData + 15                                             77533537 3 Bytes  [ 00, C1, E3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryLinkFromData + 19                                             7753353B 149 Bytes  [ 01, 59, 10, 0F, B6, 5A, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryCreateFromData + 7D                                           775335D1 41 Bytes  [ C9, 89, 55, FC, 89, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryCreateFromData + A7                                           775335FB 51 Bytes  [ 00, 00, 8B, 14, CF, 03, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryCreateFromData + DB                                           7753362F 26 Bytes  [ 00, 89, 14, CF, 8B, 54, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryCreateFromData + F6                                           7753364A 41 Bytes  [ 8B, 55, 0C, 8B, 48, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleQueryCreateFromData + 120                                          77533674 52 Bytes  [ 87, 10, 01, 00, 00, 8B, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoLockObjectExternal + 23                                             77533D46 107 Bytes  [ BF, 56, 02, 8B, D8, 8B, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoLockObjectExternal + 8F                                             77533DB2 133 Bytes  [ 00, 00, 8B, 40, 04, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoLockObjectExternal + 115                                            77533E38 66 Bytes  [ 99, 81, E2, FF, 7F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoLockObjectExternal + 158                                            77533E7B 53 Bytes  [ 7F, 00, 00, 03, C2, 0F, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoLockObjectExternal + 18E                                            77533EB1 90 Bytes  [ 40, 04, 0F, AF, C2, 99, 81, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateFileMoniker + B5                                                7753408D 85 Bytes  [ 10, 07, 00, 50, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateFileMoniker + 10B                                               775340E3 373 Bytes  [ 00, D9, 30, 37, 31, 92, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateFileMoniker + 281                                               77534259 341 Bytes  [ 39, 5E, 39, 6F, 39, BB, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateFileMoniker + 3D8                                               775343B0 168 Bytes  [ 00, 30, 09, 31, 13, 31, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateFileMoniker + 481                                               77534459 4 Bytes  [ A0, 07, 00, 8C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCurrentProcess + 29                                              775346B8 59 Bytes  [ 20, 00, 00, 00, 2C, 30, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCurrentProcess + 67                                              775346F6 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCurrentProcess + 96                                              77534725 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCurrentProcess + A9                                              77534738 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCurrentProcess + B7                                              77534746 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStandardMarshal + 17                                             7753482B 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStandardMarshal + 2D                                             77534841 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStandardMarshal + 34                                             77534848 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStandardMarshal + 3C                                             77534850 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStandardMarshal + 47                                             7753485B 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgSetTimes + B                                                       775354CA 19 Bytes  [ 69, 00, 73, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgSetTimes + 1F                                                      775354DE 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgSetTimes + 21                                                      775354E0 3 Bytes  [ 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgSetTimes + 25                                                      775354E4 3 Bytes  [ 74, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgSetTimes + 29                                                      775354E8 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageEx + 1D                                                 7753AFBC 14 Bytes  [ 00, 00, 00, 00, 03, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageEx + 2D                                                 7753AFCC 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageEx + 44                                                 7753AFE3 12 Bytes  [ 00, 00, 00, 00, 00, 21, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageEx + 51                                                 7753AFF0 26 Bytes  [ 20, 00, 00, 00, 04, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageEx + 6C                                                 7753B00B 24 Bytes  [ 00, 00, 00, 00, 00, 23, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnHandle + 15                                           7753E116 3 Bytes  [ 01, 00, 4E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnHandle + 19                                           7753E11A 53 Bytes  [ 6F, 00, 20, 00, 45, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnHandle + 4F                                           7753E150 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnHandle + 51                                           7753E152 37 Bytes  [ 20, 00, 6F, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnHandle + 77                                           7753E178 79 Bytes  [ 6F, 00, 67, 00, 20, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSaveToStream + 34                                                  7753F54A 21 Bytes  [ 68, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSaveToStream + 4A                                                  7753F560 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSaveToStream + 4C                                                  7753F562 29 Bytes  [ 20, 00, 64, 00, 6F, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSaveToStream + 6A                                                  7753F580 31 Bytes  [ 6E, 00, 69, 00, 7A, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStm + 17                                                    7753F5A0 3 Bytes  [ 63, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStm + 1B                                                    7753F5A4 13 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStm + 29                                                    7753F5B2 29 Bytes  [ 75, 00, 65, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStm + 47                                                    7753F5D0 7 Bytes  [ 20, 00, 73, 00, 70, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStm + 4F                                                    7753F5D8 25 Bytes  [ 63, 00, 69, 00, 66, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfile + 28                                                 77544D13 88 Bytes  [ FF, 2B, C3, 8B, 14, 24, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfile + 81                                                 77544D6C 112 Bytes  [ 55, F4, 03, C2, 79, 11, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfile + F2                                                 77544DDD 99 Bytes  [ 4D, FC, 8B, 55, C0, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfile + 157                                                77544E42 51 Bytes  [ F0, 66, 8B, 3C, 4F, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfile + 18B                                                77544E76 17 Bytes  [ 78, 0C, 8D, 0C, 3F, 8B, F1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStg + 17                                                    77545F8A 13 Bytes  [ 61, 00, 79, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteClassStg + 25                                                    77545F98 41 Bytes  [ 77, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStg + 25                                                     77545FC2 7 Bytes  [ 20, 00, 73, 00, 74, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStg + 2D                                                     77545FCA 13 Bytes  [ 6E, 00, 64, 00, 62, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStg + 3B                                                     77545FD8 19 Bytes  [ 64, 00, 65, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStg + 4F                                                     77545FEC 35 Bytes  [ 74, 00, 75, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadClassStg + 73                                                     77546010 22 Bytes  [ 4E, 75, EF, 33, C0, 5E, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateStorageEx + C5                                               77547277 515 Bytes  [ B3, A4, D7, 61, B3, D7, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateStorageEx + 2C9                                              7754747B 9 Bytes  [ B4, C9, D8, E6, B4, 07, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateStorageEx + 2D3                                              77547485 417 Bytes  [ 58, DC, B4, 91, 85, D7, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateStorageEx + 475                                              77547627 35 Bytes  [ 35, 68, AD, 87, 35, 09, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateStorageEx + 499                                              7754764B 233 Bytes  [ 35, 1E, 8F, 8E, 35, 40, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteFmtUserTypeStg + 87                                              77547735 1403 Bytes  [ 84, 2A, 35, 24, 34, 25, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteStringStream + 363                                               77547CB1 257 Bytes  [ 50, 34, 35, 4E, CC, 24, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteStringStream + 465                                               77547DB3 497 Bytes  [ B6, 2C, 77, 59, B6, 82, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteStringStream + 657                                               77547FA5 43 Bytes  [ BB, 93, 35, E2, 8E, A0, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteStringStream + 683                                               77547FD1 62 Bytes  [ 7E, 10, 36, 08, DF, 16, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteStringStream + 6C2                                               77548010 19 Bytes  [ 00, 00, 00, 00, 8B, 4B, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsRunning + 48                                                     7754971A 28 Bytes  [ 00, 89, 45, F8, EB, 14, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsRunning + 65                                                     77549737 80 Bytes  [ 03, 75, 18, 8B, B3, 08, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsRunning + B6                                                     77549788 144 Bytes  [ 89, 42, 24, EB, 0F, 8B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsRunning + 147                                                    77549819 129 Bytes  [ F4, B9, 04, 00, 00, 00, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsRunning + 1C9                                                    7754989B 52 Bytes  [ 85, C0, EB, 1C, 8D, 8B, B4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerRelativePathTo + 1F                                            7754A03B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerRelativePathTo + 21                                            7754A03D 57 Bytes  [ 83, F4, 00, 00, 00, 3B, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerRelativePathTo + 5B                                            7754A077 15 Bytes  [ 01, 00, 00, 3B, C7, 74, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerRelativePathTo + 6B                                            7754A087 83 Bytes  [ 00, 3B, C7, 74, 04, 57, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerRelativePathTo + BF                                            7754A0DB 84 Bytes  [ 70, 0C, 8B, 47, 08, 85, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetMiscStatus + 38                                              7754A461 55 Bytes  [ A3, 48, 77, 03, 00, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetMiscStatus + 70                                              7754A499 2 Bytes  [ 45, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetMiscStatus + 73                                              7754A49C 32 Bytes  [ 48, 30, 83, F9, 03, 77, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetMiscStatus + 94                                              7754A4BD 30 Bytes  [ 8B, CE, FF, 15, D4, 3D, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetMiscStatus + B3                                              7754A4DC 12 Bytes  [ 00, 8B, 55, FC, 52, 53, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserSize + 10                                            7754A751 12 Bytes  [ 00, 8B, 0D, B0, 58, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserSize + 1D                                            7754A75E 121 Bytes  [ 7B, 50, 01, 75, 21, B8, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserMarshal + 51                                         7754A7D8 21 Bytes  [ B3, FC, 00, 00, 00, A1, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserMarshal + 67                                         7754A7EE 46 Bytes  [ A3, 78, 78, 03, 00, A1, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserMarshal + 96                                         7754A81D 11 Bytes  [ 72, 05, A3, D8, 79, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserMarshal + A2                                         7754A829 49 Bytes  [ 8B, 4D, 0C, A3, 78, 77, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserMarshal + D5                                         7754A85C 71 Bytes  [ FF, 15, 28, 3E, 01, 00, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetAutoConvert + 53                                                7754B27B 21 Bytes  [ 50, 28, 89, 15, CC, 58, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetAutoConvert + 69                                                7754B291 24 Bytes  [ D4, 58, 01, 00, 8B, 48, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetAutoConvert + 82                                                7754B2AA 58 Bytes  [ 8B, 40, 3C, A3, E0, 58, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetAutoConvert + BE                                                7754B2E6 7 Bytes  [ 89, 50, 04, 8B, 0D, 88, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetAutoConvert + C8                                                7754B2F0 10 Bytes  [ 55, 08, 89, 48, 08, C7, 42, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataAdviseHolder + 24                                           7754B669 6 Bytes  [ 00, 69, 00, 6D, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataAdviseHolder + 2B                                           7754B670 21 Bytes  [ 64, 00, 69, 00, 61, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataAdviseHolder + 41                                           7754B686 53 Bytes  [ 6F, 00, 5C, 00, 4B, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataAdviseHolder + 77                                           7754B6BC 21 Bytes  [ 65, 00, 67, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataAdviseHolder + 8D                                           7754B6D2 43 Bytes  [ 68, 00, 69, 00, 6E, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInstanceFromFile + 22                                            7754B6FE 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInstanceFromFile + 24                                            7754B700 3 Bytes  [ 5C, 00, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInstanceFromFile + 28                                            7754B704 28 Bytes  [ 75, 00, 6C, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInstanceFromFile + 45                                            7754B721 12 Bytes  [ 00, 64, 00, 69, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInstanceFromFile + 52                                            7754B72E 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromData + 8                                             7754B995 36 Bytes  [ 00, 6C, 00, 74, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromData + 2D                                            7754B9BA 1 Byte  [ 4B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromData + 2F                                            7754B9BC 17 Bytes  [ 6D, 00, 69, 00, 78, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromData + 41                                            7754B9CE 87 Bytes  [ 54, 00, 6F, 00, 46, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromDataEx + 4E                                          7754BA26 13 Bytes  [ 74, 00, 5C, 00, 4D, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromDataEx + 5C                                          7754BA34 5 Bytes  [ 6D, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromDataEx + 62                                          7754BA3A 11 Bytes  [ 69, 00, 61, 00, 5C, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromDataEx + 6E                                          7754BA46 2 Bytes  [ 41, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkFromDataEx + 71                                          7754BA49 24 Bytes  [ 00, 64, 00, 69, 00, 6F, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsHandlerConnected + 35                                             7754C8C1 15 Bytes  [ 97, B8, 00, 00, 00, 6A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsHandlerConnected + 45                                             7754C8D1 5 Bytes  [ 5F, 5E, 8B, C3, 5B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsHandlerConnected + 4B                                             7754C8D7 49 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsHandlerConnected + 7D                                             7754C909 86 Bytes  [ 48, 04, 8B, 78, 08, 8B, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsHandlerConnected + D4                                             7754C960 30 Bytes  [ 55, F8, 89, 10, 8B, 55, F4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateOleAdviseHolder + C3                                            7754CAFD 219 Bytes  [ 00, 00, 00, DB, 04, 97, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateOleAdviseHolder + 19F                                           7754CBD9 69 Bytes  [ 45, 08, 8B, 48, 0C, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateOleAdviseHolder + 1E5                                           7754CC1F 10 Bytes  [ E0, 8B, 55, F4, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateOleAdviseHolder + 1F0                                           7754CC2A 62 Bytes  [ 82, C0, 00, 00, 00, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateOleAdviseHolder + 22F                                           7754CC69 111 Bytes  [ 49, D9, 58, EC, DB, 44, 07, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadFmtUserTypeStg + 31                                               7754DDB0 15 Bytes  [ 65, 00, 6D, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadFmtUserTypeStg + 41                                               7754DDC0 7 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadFmtUserTypeStg + 49                                               7754DDC8 7 Bytes  [ 7C, 00, 01, 00, 41, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadFmtUserTypeStg + 51                                               7754DDD0 81 Bytes  [ 63, 00, 6C, 00, 6F, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadFmtUserTypeStg + A3                                               7754DE22 30 Bytes  [ 6C, 00, 20, 00, 43, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OpenOrCreateStream + 10                                               7754F31E 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OpenOrCreateStream + 12                                               7754F320 11 Bytes  [ 6C, 00, 69, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OpenOrCreateStream + 1E                                               7754F32C 7 Bytes  [ 65, 00, 20, 00, 6E, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OpenOrCreateStream + 26                                               7754F334 99 Bytes  [ 6D, 00, 62, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSave + 5A                                                          7754F398 17 Bytes  [ 20, 00, 63, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSave + 6C                                                          7754F3AA 27 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSave + 88                                                          7754F3C6 31 Bytes  [ 71, 00, 75, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSave + A8                                                          7754F3E6 19 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSave + BC                                                          7754F3FA 53 Bytes  [ 65, 00, 72, 00, 6D, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromILockBytes + E5                                         77550AD4 33 Bytes  [ FF, FF, FF, D9, C9, D8, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromILockBytes + 107                                        77550AF6 29 Bytes  [ FF, D9, C9, D8, 8F, 94, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromILockBytes + 125                                        77550B14 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromILockBytes + 127                                        77550B16 31 Bytes  [ FF, D9, C9, D8, 8F, A4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHGlobalFromILockBytes + 147                                        77550B36 47 Bytes  [ FF, D9, C9, D8, 8F, A8, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateILockBytesOnHGlobal + 3D                                        77550E40 132 Bytes  [ 89, 45, D0, 8B, 55, F4, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateILockBytesOnHGlobal + C2                                        77550EC5 11 Bytes  [ C1, E1, 02, 2B, CB, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateILockBytesOnHGlobal + CE                                        77550ED1 8 Bytes  [ 7D, CC, 50, D9, 46, 04, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateILockBytesOnHGlobal + D7                                        77550EDA 46 Bytes  [ D9, 46, 08, D9, 46, 0C, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateILockBytesOnHGlobal + 106                                       77550F09 298 Bytes  [ F4, D9, C9, D8, 4F, 04, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfileOnILockBytes + 101                                    77551034 27 Bytes  [ D9, CA, D8, 86, 7C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfileOnILockBytes + 11D                                    77551050 22 Bytes  [ 00, D9, CA, D8, 86, 78, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfileOnILockBytes + 134                                    77551067 17 Bytes  [ FF, FF, D9, C9, D8, 8F, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfileOnILockBytes + 146                                    77551079 6 Bytes  [ D9, C9, D8, 8F, 90, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreateDocfileOnILockBytes + 14E                                    77551081 37 Bytes  [ D9, CA, D8, 86, 6C, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateErrorInfo + 47                                                  775520E8 57 Bytes  [ FF, B8, 03, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateErrorInfo + 81                                                  77552122 6 Bytes  [ 00, C0, 8B, 4D, F0, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateErrorInfo + 88                                                  77552129 44 Bytes  [ 0D, 00, 00, 00, 00, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateErrorInfo + B5                                                  77552156 223 Bytes  [ 00, 5F, 5E, 5B, 8B, E5, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateErrorInfo + 195                                                 77552236 5 Bytes  [ 15, 14, 4D, 15, B0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserSize + B                                               77552AC9 176 Bytes  CALL 77550C5D C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserMarshal + 46                                           77552B7A 23 Bytes  [ 00, 00, C1, E1, 05, 8B, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserMarshal + 5E                                           77552B92 2 Bytes  [ 55, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserMarshal + 61                                           77552B95 19 Bytes  [ 5A, 14, 85, DB, 0F, 84, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserMarshal + 4                                             77552BA9 23 Bytes  [ 4D, C4, 0F, AF, 4D, C8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserMarshal + 1C                                            77552BC1 8 Bytes  [ 02, 00, 00, 8B, 8E, 14, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserMarshal + 25                                            77552BCA 24 Bytes  CALL 7754004E C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserMarshal + 3E                                            77552BE3 30 Bytes  [ 00, 8B, CB, 0F, AF, 4D, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserMarshal + 5E                                            77552C03 27 Bytes  [ 33, FF, 3B, C7, 75, 4E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserSize + 2                                                77552C20 54 Bytes  [ 8B, 8E, 48, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserSize + 39                                               77552C57 22 Bytes  JMP 77552EA1 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserSize + 50                                               77552C6E 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserSize + 53                                               77552C71 5 Bytes  [ 86, 34, 01, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserSize + 5A                                               77552C78 68 Bytes  [ 89, 4D, BC, C7, 45, FC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserFree + 31                                               77552CBD 34 Bytes  [ 8B, 45, C0, 8B, 4D, DC, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserFree + 54                                               77552CE0 9 Bytes  [ D7, 75, 22, 0F, AF, D1, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserFree + 5E                                               77552CEA 44 Bytes  [ 00, 00, BB, C0, 56, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserFree + 8B                                               77552D17 7 Bytes  [ 63, 0F, AF, C1, 8B, C8, B8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserFree + 93                                               77552D1F 71 Bytes  [ 08, 00, 00, 33, D2, F7, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserUnmarshal + 3B                                          77552D67 2 Bytes  [ F6, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserUnmarshal + 3E                                          77552D6A 87 Bytes  CALL 7756610E C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserUnmarshal + 96                                          77552DC2 5 Bytes  [ 00, 00, C1, E1, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserUnmarshal + 9C                                          77552DC8 31 Bytes  [ D1, 89, 90, 9C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!STGMEDIUM_UserUnmarshal + BC                                          77552DE8 20 Bytes  [ 60, 0F, 94, C2, 52, 8B, 51, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserUnmarshal + 4                                          77552E61 60 Bytes  [ 96, 48, 01, 00, 00, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserUnmarshal + 41                                         77552E9E 41 Bytes  [ D9, 72, BF, 89, 5D, F4, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserUnmarshal + 6C                                         77552EC9 40 Bytes  [ 83, C0, 20, 3B, F0, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserUnmarshal + 96                                         77552EF3 3 Bytes  [ 8B, 4D, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLIPFORMAT_UserUnmarshal + 9A                                         77552EF7 39 Bytes  [ 71, 14, 85, F6, C7, 45, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserMarshal + 8                                               775531C2 97 Bytes  [ 1A, 8B, 06, 83, C0, 60, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserMarshal + 6A                                              77553224 98 Bytes  [ EC, 83, EC, 18, 8B, 45, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserSize + 34                                                 77553287 86 Bytes  [ 45, 18, 83, C0, 30, B9, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserSize + 8B                                                 775532DE 32 Bytes  [ 00, C0, 89, 45, 18, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserSize + AC                                                 775532FF 26 Bytes  [ 40, 10, 85, C0, 74, 29, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserSize + C7                                                 7755331A 45 Bytes  [ 00, BF, 40, 90, 17, B0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserSize + F6                                                 77553349 48 Bytes  JMP 77553CD7 C:\WINDOWS\system32\ole32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetClipboard + 11                                                  77553961 11 Bytes  [ 51, 6A, 01, FF, 15, F4, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetClipboard + 1D                                                  7755396D 20 Bytes  [ 00, 00, 00, 85, C9, 89, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetClipboard + 33                                                  77553983 8 Bytes  [ 00, 85, C9, 0F, 84, B7, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetClipboard + 3C                                                  7755398C 32 Bytes  [ 85, C0, 0F, 84, AF, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetClipboard + 5D                                                  775539AD 13 Bytes  [ 00, 8B, 45, 08, 68, 4B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsOle1Class + 9                                                     7755489D 23 Bytes  [ 00, 00, 00, 0F, BF, 1E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoIsOle1Class + 22                                                    775548B6 8 Bytes  [ 03, C2, C1, F8, 0F, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromIID + 4                                                     775548BF 4 Bytes  [ 87, 10, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromIID + 9                                                     775548C4 45 Bytes  [ 8B, 00, 0F, AF, C3, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromIID + 37                                                    775548F2 48 Bytes  [ 8B, 40, 04, 0F, AF, C3, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromIID + 68                                                    77554923 25 Bytes  [ F8, D8, 41, 08, D9, 59, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StringFromIID + 82                                                    7755493D 11 Bytes  [ 8B, 40, 04, 0F, AF, C3, 99, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ProgIDFromCLSID + 41                                                  77554BB3 74 Bytes  [ 00, 8B, 47, 04, 0F, AF, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ProgIDFromCLSID + 8C                                                  77554BFE 18 Bytes  [ 5F, 5B, 5E, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ProgIDFromCLSID + 9F                                                  77554C11 53 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ProgIDFromCLSID + D5                                                  77554C47 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ProgIDFromCLSID + D7                                                  77554C49 30 Bytes  [ C1, E3, 08, 89, 5D, 08, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateItemMoniker + F5                                                77555379 79 Bytes  [ 8B, 40, 04, 0F, AF, C3, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateItemMoniker + 146                                               775553CA 24 Bytes  [ 03, C2, C1, F8, 0F, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateItemMoniker + 15F                                               775553E3 25 Bytes  [ 00, 03, C2, C1, F8, 0F, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateItemMoniker + 179                                               775553FD 23 Bytes  [ 87, 10, 01, 00, 00, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateItemMoniker + 191                                               77555415 154 Bytes  [ 45, 08, 8B, 87, 10, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMessageFilter + B                                           7755577A 86 Bytes  [ 45, 08, D9, 5A, F8, 0F, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMessageFilter + 62                                          775557D1 35 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMessageFilter + 86                                          775557F5 18 Bytes  [ 45, FC, 89, 4D, 08, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMessageFilter + 99                                          77555808 200 Bytes  [ 7D, F8, 8B, 75, FC, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMessageFilter + 162                                         775558D1 35 Bytes  [ 87, 10, 01, 00, 00, 8B, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetMenuDescriptor + 30                                             7755616A 7 Bytes  [ 0A, 00, 00, 00, 00, 00, A8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetMenuDescriptor + 38                                             77556172 9 Bytes  [ 01, 00, 41, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetMenuDescriptor + 42                                             7755617C 9 Bytes  [ 6E, 00, 76, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetMenuDescriptor + 4C                                             77556186 9 Bytes  [ 64, 00, 20, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetMenuDescriptor + 56                                             77556190 63 Bytes  [ 61, 00, 6D, 00, 65, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRun + 16                                                           775561D0 21 Bytes  [ 72, 00, 20, 00, 66, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRun + 2C                                                           775561E6 9 Bytes  [ 61, 00, 73, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRun + 36                                                           775561F0 55 Bytes  [ 65, 00, 20, 00, 6E, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgIDEx + 2A                                                77556228 52 Bytes  [ 61, 00, 6C, 00, 69, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgIDEx + 5F                                                7755625D 18 Bytes  [ 00, 6F, 00, 20, 00, 61, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgIDEx + 72                                                77556270 15 Bytes  [ 63, 00, 65, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgIDEx + 82                                                77556280 115 Bytes  [ 6E, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CLSIDFromProgIDEx + F6                                                775562F4 85 Bytes  [ 20, 00, 70, 00, 61, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateClassMoniker + 21                                               77556AB0 73 Bytes  [ 6E, 00, 20, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateClassMoniker + 6B                                               77556AFA 53 Bytes  [ 6F, 00, 66, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateClassMoniker + A1                                               77556B30 5 Bytes  [ 49, 00, 44, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateClassMoniker + A7                                               77556B36 9 Bytes  [ 6F, 00, 66, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateClassMoniker + B1                                               77556B40 13 Bytes  [ 20, 00, 61, 00, 6C, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterfaceAndReleaseStream + B                                    77556DD1 24 Bytes  [ 00, 69, 00, 6C, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterfaceAndReleaseStream + 24                                   77556DEA 3 Bytes  [ 64, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterfaceAndReleaseStream + 28                                   77556DEE 13 Bytes  [ 72, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterfaceAndReleaseStream + 36                                   77556DFC 55 Bytes  [ 64, 00, 72, 00, 69, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterfaceAndReleaseStream + 6E                                   77556E34 5 Bytes  [ 20, 00, 64, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterThreadInterfaceInStream + 18                            77556ECE 15 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterThreadInterfaceInStream + 28                            77556EDE 13 Bytes  [ 0A, 00, 00, 00, 00, 00, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterThreadInterfaceInStream + 36                            77556EEC 33 Bytes  [ 6C, 00, 46, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterThreadInterfaceInStream + 58                            77556F0E 7 Bytes  [ 64, 00, 20, 00, 6E, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalInterThreadInterfaceInStream + 60                            77556F16 1 Byte  [ 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoWaitForMultipleHandles + F                                          77557150 14 Bytes  [ FC, 83, C1, 04, D9, 59, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoWaitForMultipleHandles + 1E                                         7755715F 1 Byte  [ F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoWaitForMultipleHandles + 20                                         77557161 13 Bytes  [ 7D, F8, 0F, 82, 67, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoWaitForMultipleHandles + 2E                                         7755716F 69 Bytes  [ 00, 00, 00, 03, D1, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoWaitForMultipleHandles + 74                                         775571B5 77 Bytes  [ 53, 66, 89, 45, F0, 66, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserUnmarshal + 1C                                      77572F3B 62 Bytes  JMP 7757315A C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserMarshal + 15                                        77572F7A 109 Bytes  [ 51, 50, 69, D2, 40, 0D, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserMarshal + 84                                        77572FE9 41 Bytes  [ F4, 85, C0, 0F, 84, 9B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserMarshal + AE                                        77573013 75 Bytes  [ 00, 6A, 00, 51, FF, D6, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserSize + 4                                            7757305F 105 Bytes  [ 43, 7C, 3B, 87, B0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserSize + 6E                                           775730C9 32 Bytes  JMP 7757315A C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserSize + 8F                                           775730EA 12 Bytes  [ 45, 14, 57, 52, 50, E8, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserSize + 9C                                           775730F7 2 Bytes  [ 45, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserSize + 9F                                           775730FA 3 Bytes  [ 8C, 85, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteOleStg + 1B                                                      77574F58 79 Bytes  [ C0, 68, 15, B0, 89, 50, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteOleStg + 6B                                                      77574FA8 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteOleStg + 6D                                                      77574FAA 69 Bytes  [ C7, 40, 1C, 40, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteOleStg + B3                                                      77574FF0 27 Bytes  [ 00, 8B, 48, 0C, 3B, F1, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!WriteOleStg + CF                                                      7757500C 231 Bytes  [ 8B, 48, 08, 85, C9, 0F, 84, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadStringStream + 2A                                                 77575A7C 23 Bytes  [ 61, 00, 5C, 00, 57, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadStringStream + 42                                                 77575A94 29 Bytes  [ 6D, 00, 69, 00, 78, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadStringStream + 60                                                 77575AB2 15 Bytes  [ 63, 00, 51, 00, 75, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadStringStream + 70                                                 77575AC2 59 Bytes  [ 00, 00, 00, 00, 00, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadStringStream + AC                                                 77575AFE 27 Bytes  [ 4D, 00, 69, 00, 63, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageFile + 89                                                 77575D18 78 Bytes  [ FF, 6A, 00, 68, 98, 6C, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetUserType + 1E                                                77575D67 3 Bytes  [ F5, F3, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetUserType + 22                                                77575D6B 305 Bytes  [ 6A, 01, 68, 78, 6E, 16, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetUserType + 154                                               77575E9D 39 Bytes  [ 06, 85, C0, 74, 0F, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetUserType + 17C                                               77575EC5 54 Bytes  [ D1, E0, 83, FF, 01, 7D, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegGetUserType + 1B3                                               77575EFC 45 Bytes  [ 04, 99, 83, E2, 7F, 03, C2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadOleStg + 17                                                       7757722A 227 Bytes  [ 89, 3B, B5, 3B, 09, 3C, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadOleStg + FB                                                       7757730E 113 Bytes  [ 38, 3D, 00, 30, 01, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ReadOleStg + 16D                                                      77577380 328 Bytes  [ DC, 00, 00, 00, 05, 30, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDoAutoConvert + 5F                                                 775774C9 234 Bytes  [ 00, 00, 00, 83, 30, 88, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDoAutoConvert + 14A                                                775775B4 36 Bytes  [ 11, 30, 53, 30, 62, 30, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDoAutoConvert + 16F                                                775775D9 81 Bytes  [ 3C, 98, 3C, 11, 3D, AD, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDoAutoConvert + 1C1                                                7757762B 122 Bytes  [ 37, FA, 37, 02, 38, 2F, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDoAutoConvert + 23C                                                775776A6 100 Bytes  [ 00, 00, 17, 30, 2D, 30, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoBuildVersion + 82                                                   77577986 27 Bytes  [ 7B, 33, 5F, 34, 6F, 34, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoBuildVersion + 9E                                                   775779A2 330 Bytes  [ 74, 35, 78, 35, 7C, 35, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoBuildVersion + 1E9                                                  77577AED 203 Bytes  [ 3D, 78, 3D, 7C, 3D, 80, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoBuildVersion + 2B5                                                  77577BB9 29 Bytes  [ 00, 00, 00, 0B, 31, 1E, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoBuildVersion + 2D4                                                  77577BD8 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumVerbs + B                                                   77577C40 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumVerbs + 30                                                  77577C65 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumVerbs + 4A                                                  77577C7F 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumVerbs + 4D                                                  77577C82 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumVerbs + 4F                                                  77577C84 88 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoad + 13                                                          77577F87 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoad + 1B                                                          77577F8F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoad + 35                                                          77577FA9 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoad + 45                                                          77577FB9 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLoad + 7A                                                          77577FEE 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsEqualGUID + 1                                                       775784AE 62 Bytes  [ 88, 20, 52, 00, 00, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsAccelerator + 1F                                                    775784EE 30 Bytes  [ 8B, 90, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsAccelerator + 3F                                                    7757850E 18 Bytes  [ 8B, 90, 20, 52, 00, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsAccelerator + 52                                                    77578521 2 Bytes  [ FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsAccelerator + 55                                                    77578524 18 Bytes  [ FF, 8B, 88, 20, 52, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsAccelerator + 6A                                                    77578539 61 Bytes  [ 8B, 90, 20, 52, 00, 00, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleTranslateAccelerator + 1EB                                         77578863 17 Bytes  [ FF, FF, 8B, 88, 20, 52, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleTranslateAccelerator + 1FE                                         77578876 23 Bytes  [ 00, 00, 00, 8B, 90, 20, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleTranslateAccelerator + 216                                         7757888E 24 Bytes  [ 00, C1, E1, 05, 89, B4, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleTranslateAccelerator + 22F                                         775788A7 63 Bytes  [ 89, B0, 7C, 51, 00, 00, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleTranslateAccelerator + 26F                                         775788E7 41 Bytes  [ A1, 98, 80, 03, 00, 53, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateMenuDescriptor + 55                                          775789DB 41 Bytes  [ D6, 0F, AF, CE, 0F, AF, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateMenuDescriptor + 7F                                          77578A05 33 Bytes  [ FF, FF, 50, 51, 8D, 45, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateMenuDescriptor + A1                                          77578A27 8 Bytes  [ 45, 90, 0F, 85, B5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateMenuDescriptor + AA                                          77578A30 119 Bytes  [ 4D, DC, 8B, 83, B0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateMenuDescriptor + 122                                         77578AA8 38 Bytes  [ 53, 50, 89, 50, 3C, 8B, 86, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserFree + 2                                                  77578BB0 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserFree + 4                                                  77578BB2 14 Bytes  [ 03, 3B, C3, 0F, 84, FD, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserFree + 13                                                 77578BC1 8 Bytes  [ 88, 14, FF, FF, FF, 05, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserFree + 1C                                                 77578BCA 8 Bytes  [ FF, 83, F9, 03, 0F, 85, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserFree + 25                                                 77578BD3 32 Bytes  [ 00, 8B, 88, 20, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserUnmarshal + 1C                                            77578BF4 38 Bytes  [ 00, 00, 81, F9, A0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HGLOBAL_UserUnmarshal + 43                                            77578C1B 132 Bytes  [ 85, DB, 76, 1F, 8B, B2, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDestroyMenuDescriptor + 80                                         77578CA0 55 Bytes  [ 14, 01, 00, 00, 8B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDestroyMenuDescriptor + B8                                         77578CD8 43 Bytes  [ 85, 8E, 00, 00, 00, 8B, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDestroyMenuDescriptor + E4                                         77578D04 2 Bytes  [ 48, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDestroyMenuDescriptor + E7                                         77578D07 25 Bytes  [ 70, 14, 83, C9, 01, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDestroyMenuDescriptor + 101                                        77578D21 38 Bytes  [ 75, 21, 8B, 4D, FC, 85, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitializeWOW + B                                                  77579435 86 Bytes  [ 50, FF, 15, 10, 3E, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitializeWOW + 62                                                 7757948C 26 Bytes  [ 52, 6A, 01, FF, D3, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitializeWOW + 7D                                                 775794A7 41 Bytes  [ C7, 5F, 5E, 5B, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitializeWOW + A7                                                 775794D1 13 Bytes  [ 00, 50, 33, 03, 00, E9, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleInitializeWOW + B6                                                 775794E0 107 Bytes  CALL 775792CF C:\WINDOWS\system32\ole32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInitializeWOW + 48                                                  77579605 12 Bytes  CALL 77579340 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalHresult + 8                                                77579612 12 Bytes  CALL 7757951D C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnmarshalHresult + 15                                               7757961F 46 Bytes  [ 00, 85, C9, 74, 06, 89, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnloadingWOW + 1                                                    7757964E 27 Bytes  CALL 775795DD C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnloadingWOW + 1D                                                   7757966A 9 Bytes  [ 00, 83, C6, 04, F3, A5, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnloadingWOW + 28                                                   77579675 37 Bytes  [ 00, 8B, 75, 0C, 8B, BB, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnloadingWOW + 4E                                                   7757969B 10 Bytes  [ A8, 00, 00, 00, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoUnloadingWOW + 59                                                   775796A6 68 Bytes  [ 00, 00, C1, E1, 03, 8B, D1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetConvertStg + 1D                                                    7757A003 13 Bytes  [ 8B, 46, 0C, C1, E0, 02, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetConvertStg + 2B                                                    7757A011 23 Bytes  [ 8B, 45, 0C, 03, FB, C1, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetConvertStg + 43                                                    7757A029 6 Bytes  [ 45, 0C, 85, C0, 74, 4A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetConvertStg + 4A                                                    7757A030 2 Bytes  [ 7D, D8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SetConvertStg + 4D                                                    7757A033 29 Bytes  [ 45, EC, C1, E0, 02, 03, CF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsCurrentClipboard + 1                                             7757A641 263 Bytes  [ 17, 8B, 45, F0, 8B, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleIsCurrentClipboard + 109                                           7757A749 406 Bytes  [ 54, 8B, F0, 83, C0, 0C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleFlushClipboard + F0                                                7757A8E1 28 Bytes  [ 00, D9, CA, D8, 86, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleFlushClipboard + 10D                                               7757A8FE 48 Bytes  [ 00, D9, CA, D8, 86, 78, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleFlushClipboard + 13E                                               7757A92F 18 Bytes  [ D9, CA, D8, 86, 6C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleFlushClipboard + 151                                               7757A942 166 Bytes  [ 86, 64, FF, FF, FF, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleFlushClipboard + 1F8                                               7757A9E9 117 Bytes  [ D8, 8F, C0, 00, 00, 00, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEx + 3E                                                      7757B7E4 11 Bytes  [ D9, CB, D8, 4F, 40, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEx + 4A                                                      7757B7F0 12 Bytes  [ FF, D9, CA, D8, 4F, 44, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEx + 57                                                      7757B7FD 51 Bytes  [ FF, D9, CB, D8, 4F, 44, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEx + 8B                                                      7757B831 120 Bytes  [ FF, D9, CB, D8, 4F, 4C, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEx + 105                                                     7757B8AB 50 Bytes  [ FC, 83, C3, 08, 2D, A0, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreate + 14                                                        7757B928 51 Bytes  [ 8B, 55, 0C, 53, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreate + 48                                                        7757B95C 3 Bytes  [ 89, 55, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreate + 4C                                                        7757B960 27 Bytes  JMP 01573E69 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreate + 6A                                                        7757B97E 49 Bytes  [ 3B, F0, 72, 0B, 83, C1, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreate + 9C                                                        7757B9B0 9 Bytes  [ D9, C9, D8, 46, EC, D9, CB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromDataEx + 2                                               7757BDE3 65 Bytes  [ FF, D9, CB, D8, 4F, 40, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromDataEx + 44                                              7757BE25 11 Bytes  [ D9, CA, D8, 4F, 4C, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromDataEx + 50                                              7757BE31 77 Bytes  [ FF, D9, CB, D8, 4F, 4C, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromDataEx + 9E                                              7757BE7F 11 Bytes  [ FF, D9, CB, D8, 4F, 58, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromDataEx + AA                                              7757BE8B 14 Bytes  [ FF, FF, D9, CA, D8, 4F, 5C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromData + 9A                                                7757BF77 14 Bytes  [ D9, CA, D8, 8F, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromData + A9                                                7757BF86 7 Bytes  [ FF, D9, CB, D8, 8F, 80, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromData + B1                                                7757BF8E 143 Bytes  [ 00, D9, C9, D8, 86, F0, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromData + 142                                               7757C01F 31 Bytes  [ D9, C9, D8, 86, CC, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromData + 162                                               7757C03F 38 Bytes  [ D9, C9, D8, 86, C4, FE, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateAntiMoniker + 4                                                 7757C391 2 Bytes  [ 45, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateAntiMoniker + 7                                                 7757C394 187 Bytes  [ 31, 89, 41, 08, 8B, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateObjrefMoniker + 18                                              7757C450 49 Bytes  [ D9, C9, D8, 46, EC, D9, CB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateObjrefMoniker + 4A                                              7757C482 108 Bytes  [ D9, C9, D8, 46, D8, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateObjrefMoniker + B7                                              7757C4EF 128 Bytes  [ 24, D9, C9, D8, 46, AC, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateObjrefMoniker + 138                                             7757C570 76 Bytes  [ D9, CB, D8, 4F, 3C, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateObjrefMoniker + 185                                             7757C5BD 141 Bytes  [ FF, D9, CB, D8, 4F, 48, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!BindMoniker + 77                                                      7757C7B3 33 Bytes  [ 00, 00, D9, C9, D8, 86, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!BindMoniker + 99                                                      7757C7D5 6 Bytes  [ D9, C9, D8, 86, C8, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!BindMoniker + A0                                                      7757C7DC 7 Bytes  [ FF, D9, CA, D8, 8F, 98, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!BindMoniker + A8                                                      7757C7E4 55 Bytes  [ 00, D9, C9, D8, 86, C4, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!BindMoniker + E0                                                      7757C81C 7 Bytes  [ FF, D9, CA, D8, 8F, A0, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerCommonPrefixWith + 17                                          7757DE57 14 Bytes  [ 45, 08, 8B, 0D, 80, 76, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerCommonPrefixWith + 26                                          7757DE66 55 Bytes  [ 8B, 70, 18, 57, 0F, 84, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerCommonPrefixWith + 5E                                          7757DE9E 60 Bytes  [ 4B, A8, 07, 75, E5, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerCommonPrefixWith + 9B                                          7757DEDB 66 Bytes  [ FC, 0F, 62, E4, 0F, EF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!MonikerCommonPrefixWith + DE                                          7757DF1E 157 Bytes  [ 0F, 72, E1, 10, 0F, 7F, 44, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStdProgressIndicator + 59                                       7757EA21 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStdProgressIndicator + 5F                                       7757EA27 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStdProgressIndicator + 66                                       7757EA2E 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStdProgressIndicator + 8E                                       7757EA56 19 Bytes  [ 01, 00, 01, 00, 00, 00, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateStdProgressIndicator + A2                                       7757EA6A 122 Bytes  [ 00, 00, 00, 00, 01, 00, 09, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetClassFile + 50                                                     7757EB3A 1 Byte  [ 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetClassFile + 52                                                     7757EB3C 31 Bytes  [ 4E, 00, 61, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetClassFile + 72                                                     7757EB5C 1 Byte  [ 43 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetClassFile + 74                                                     7757EB5E 13 Bytes  [ 6F, 00, 72, 00, 70, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetClassFile + 82                                                     7757EB6C 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoMarshalHresult + 5                                                  77582057 40 Bytes  [ 08, DD, 14, 24, 8B, 44, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCallerTID + 9                                                    77582080 193 Bytes  [ F0, 7F, 74, 5F, 66, 8B, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassVersion + 5D                                                77582142 13 Bytes  JMP 3C4F0226 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassVersion + 6B                                                77582150 20 Bytes  [ DC, 35, B8, 5F, 15, B0, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassVersion + 80                                                77582165 17 Bytes  JMP 58377AC3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassVersion + 92                                                77582177 87 Bytes  [ C3, 33, C0, 40, C9, C3, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetClassVersion + EA                                                775821CF 71 Bytes  [ DD, 45, F8, DC, 1D, 10, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTreatAsClass + 50                                                   7758272C 62 Bytes  [ 83, E0, 04, 31, 46, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTreatAsClass + 8F                                                   7758276B 39 Bytes  [ 83, 4E, 0C, 04, A8, 10, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTreatAsClass + B7                                                   77582793 1 Byte  [ 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTreatAsClass + B9                                                   77582795 243 Bytes  [ 00, 74, 09, 3B, C1, 75, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTreatAsClass + 1AD                                                  77582889 42 Bytes  [ FF, 0D, 00, 08, 00, 00, EB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterInitializeSpy + 1D                                          77582A10 45 Bytes  [ F6, 45, 10, 10, 0F, 84, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterInitializeSpy + 4B                                          77582A3E 87 Bytes  [ 45, F8, 50, 51, 51, DD, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterInitializeSpy + A3                                          77582A96 45 Bytes  [ 3B, C8, 7D, 1F, 2B, C1, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterInitializeSpy + D1                                          77582AC4 21 Bytes  [ F0, DD, 45, F0, DD, 1F, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterInitializeSpy + E7                                          77582ADA 9 Bytes  [ 59, 83, 65, FC, FD, 8B, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeInitializeSpy + 56                                            77582BE3 29 Bytes  [ C1, 20, 74, 06, D9, EB, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeInitializeSpy + 74                                            77582C01 29 Bytes  [ 25, 94, 4C, 15, B0, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetState + D                                                        77582C21 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetState + 13                                                       77582C27 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetState + 2F                                                       77582C43 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetState + 48                                                       77582C5C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetState + 50                                                       77582C64 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryReleaseObject + 41                                             77582CAA 33 Bytes  [ 02, 00, E2, 8B, 02, 00, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryReleaseObject + 63                                             77582CCC 143 Bytes  [ 0A, 8B, 02, 00, F6, 8A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryReleaseObject + F3                                             77582D5C 19 Bytes  [ 12, 84, 02, 00, D0, 87, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryReleaseObject + 107                                            77582D70 47 Bytes  [ 14, 88, 02, 00, 22, 88, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryReleaseObject + 137                                            77582DA0 3 Bytes  [ 64, 86, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMallocSpy + 13                                              77582E92 21 Bytes  [ 30, 00, 30, 00, 32, 00, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMallocSpy + 29                                              77582EA8 69 Bytes  [ 34, 00, 7D, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMallocSpy + 70                                              77582EEF 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMallocSpy + A3                                              77582F22 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterMallocSpy + C2                                              77582F41 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeMallocSpy + 60                                                77582FAF 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeMallocSpy + 63                                                77582FB2 115 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeMallocSpy + D8                                                77583027 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeMallocSpy + F6                                                77583045 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRevokeMallocSpy + 114                                               77583063 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetHookInterface + 16                                                 7758373C 30 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HkOleRegisterObject + 16                                              7758375B 287 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HkOleRegisterObject + 136                                             7758387B 91 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HkOleRegisterObject + 192                                             775838D7 286 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!EnableHookObject + 2A                                                 775839F6 204 Bytes  [ 80, 80, 80, 80, 80, 80, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!EnableHookObject + F7                                                 77583AC3 51 Bytes  [ 00, 90, 43, 02, 00, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!EnableHookObject + 12B                                                77583AF7 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!EnableHookObject + 132                                                77583AFE 300 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!EnableHookObject + 25F                                                77583C2B 59 Bytes  [ 00, 80, 0C, 02, 00, 20, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidPtrIn + 9                                                      7758459C 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidPtrIn + 2F                                                     775845C2 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidPtrOut + 9                                                     775845D0 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidPtrOut + F                                                     775845D6 37 Bytes  [ 00, 00, 03, 00, 00, 00, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!IsValidPtrOut + 35                                                    775845FC 26 Bytes  [ 00, 00, 00, 00, 04, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStdMarshalEx + 18                                                77584619 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStdMarshalEx + 27                                                77584628 9 Bytes  [ 05, 00, 00, 00, 90, 5F, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStdMarshalEx + 33                                                77584634 2 Bytes  [ 04, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStdMarshalEx + 36                                                77584637 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetStdMarshalEx + 3B                                                7758463C 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDeactivateObject + F                                                77584894 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDeactivateObject + 3D                                               775848C2 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDeactivateObject + 3F                                               775848C4 11 Bytes  [ FF, FF, FF, FF, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDeactivateObject + 4B                                               775848D0 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDeactivateObject + 57                                               775848DC 45 Bytes  [ 01, 00, 00, 00, 18, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoReactivateObject + 42                                               7758495A 159 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInvalidateRemoteMachineBindings + 9                                 775849FA 10 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInvalidateRemoteMachineBindings + 14                                77584A05 24 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRetireServer + 9                                                    77584A1E 10 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRetireServer + 14                                                   77584A29 31 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetProcessIdentifier + 10                                           77584A49 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetProcessIdentifier + 12                                           77584A4B 41 Bytes  [ 3F, 00, 00, 80, 3F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetContextToken + 11                                                77584A75 32 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetContextToken + 32                                                77584A96 19 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetSystemSecurityPermissions + F                                    77584AAA 18 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetSystemSecurityPermissions + 22                                   77584ABD 8 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetSystemSecurityPermissions + 2B                                   77584AC6 46 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetDefaultContext + C                                               77584AF5 15 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetDefaultContext + 1D                                              77584B06 11 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetDefaultContext + 29                                              77584B12 6 Bytes  [ 80, 3F, 00, 00, 80, 3F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetDefaultContext + 31                                              77584B1A 54 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetDefaultContext + 68                                              77584B51 101 Bytes  [ 00, 80, 3F, 00, 00, 80, 3F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetCancelObject + 14                                                775850C6 138 Bytes  [ 0F, F5, 57, 68, 0F, FE, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCancelCall + 9                                                      77585151 37 Bytes  [ 0F, FE, F2, 83, C7, 18, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCancelCall + 2F                                                     77585177 17 Bytes  [ 54, 8F, FC, 0F, 7E, C0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTestCancel + 1                                                      77585189 20 Bytes  [ 44, 24, 08, 0F, 85, A0, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTestCancel + 16                                                     7758519E 16 Bytes  [ 55, DC, 8B, 02, 89, 45, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTestCancel + 27                                                     775851AF 2 Bytes  [ 75, EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoTestCancel + 2A                                                     775851B2 74 Bytes  [ 7D, F0, 8B, 5D, DC, 03, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoEnableCallCancellation + 3E                                         775851FF 32 Bytes  [ 00, 8B, 45, 0C, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisableCallCancellation + 18                                        77585220 209 Bytes  [ 66, 8B, 14, 4F, 66, 89, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisableCallCancellation + EA                                        775852F2 25 Bytes  CALL 7759C08F C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisableCallCancellation + 104                                       7758530C 11 Bytes  [ C2, F5, 01, 00, 97, F5, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisableCallCancellation + 111                                       77585319 73 Bytes  [ 03, 03, 03, 01, 03, 03, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDisableCallCancellation + 15B                                       77585363 9 Bytes  [ 00, 49, 00, 58, 00, 45, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetCancelObject + 54                                                775856B2 115 Bytes  [ 4E, 04, 83, F9, 64, 72, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetCancelObject + C9                                                77585727 8 Bytes  [ C0, 89, 45, E4, EB, 0E, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetCancelObject + D4                                                77585732 7 Bytes  [ C3, 8B, 65, E8, B8, 0D, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetCancelObject + DC                                                7758573A 21 Bytes  [ C0, C7, 45, FC, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoSetCancelObject + F2                                                77585750 62 Bytes  [ E5, 5D, C2, 04, 00, CC, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryAuthenticationServices + 54                                    77585905 34 Bytes  [ 00, 33, C9, 85, C0, 74, 7B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryAuthenticationServices + 77                                    77585928 88 Bytes  [ 5D, F8, 8B, 5D, FC, 8D, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryAuthenticationServices + D0                                    77585981 28 Bytes  JMP 77585A32 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryAuthenticationServices + ED                                    7758599E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoQueryAuthenticationServices + EF                                    775859A0 20 Bytes  [ 00, 00, 89, 5D, F8, 8B, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateObjectInContext + 12                                          77589AD6 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateObjectInContext + 3B                                          77589AFF 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateObjectInContext + 54                                          77589B18 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateObjectInContext + 56                                          77589B1A 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoCreateObjectInContext + 8B                                          77589B4F 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetApartmentID + 1E5                                                7758B5D8 33 Bytes  [ 00, 00, 80, 40, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetApartmentID + 207                                                7758B5FA 34 Bytes  [ 7A, 44, 00, 00, 7A, 44, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetApartmentID + 22A                                                7758B61D 37 Bytes  [ 00, 00, 00, 00, 00, 80, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetApartmentID + 250                                                7758B643 107 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetApartmentID + 2BD                                                7758B6B0 38 Bytes  [ 04, 00, 00, 00, 08, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterPSClsid + A                                                 7758C712 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterPSClsid + 12                                                7758C71A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterPSClsid + 16                                                7758C71E 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterPSClsid + 1E                                                7758C726 74 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterPSClsid + 69                                                7758C771 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPushServiceDomain + 9                                               7758C7B5 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPushServiceDomain + 30                                              7758C7DC 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPushServiceDomain + 36                                              7758C7E2 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPopServiceDomain + 9                                                7758C7F0 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPopServiceDomain + E                                                7758C7F5 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPopServiceDomain + 14                                               7758C7FB 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPopServiceDomain + 2B                                               7758C812 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoPopServiceDomain + 31                                               7758C818 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogateEx + 33                                            7758E281 6 Bytes  [ 5F, 5B, B8, 9A, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogateEx + 3A                                            7758E288 9 Bytes  [ 5E, 5D, C2, 0C, 00, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogateEx + 44                                            7758E292 100 Bytes  [ FF, 85, FF, B9, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogateEx + A9                                            7758E2F7 62 Bytes  [ 75, 08, 8B, 46, 34, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogateEx + EA                                            7758E338 5 Bytes  [ 8B, 46, 14, 3D, A0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UpdateDCOMSettings + 20                                               7758F5F2 5 Bytes  [ 8D, 68, FF, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UpdateDCOMSettings + 26                                               7758F5F8 80 Bytes  [ 4D, AC, 89, 8D, 64, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UpdateDCOMSettings + 77                                               7758F649 152 Bytes  [ 00, 00, 52, 8B, 53, 7C, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UpdateDCOMSettings + 110                                              7758F6E2 12 Bytes  [ 45, B8, 8B, 9B, 48, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UpdateDCOMSettings + 11D                                              7758F6EF 50 Bytes  [ 8D, 14, 82, 8B, 43, 0C, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoAddRefServerProcess + 5                                             7759617D 65 Bytes  [ D9, 5A, FC, 75, D0, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoRegisterSurrogate + 33                                              775961BF 401 Bytes  [ 00, 0F, B6, 41, 02, 0F, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInstall + 2A                                                        77596351 9 Bytes  [ 4F, DB, 45, 0C, D8, 0D, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInstall + 34                                                        7759635B 146 Bytes  [ D8, 42, FC, D9, 5A, FC, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInstall + C7                                                        775963EE 16 Bytes  [ 00, 00, 03, C2, C1, F8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInstall + D8                                                        775963FF 20 Bytes  [ FF, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoInstall + ED                                                        77596414 8 Bytes  [ 03, C2, C1, F8, 10, 89, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoFileTimeToDosDateTime + 71                                          7759B108 167 Bytes  [ 75, F0, 8B, 7D, F8, D9, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDosDateTimeToFileTime + 9D                                          7759B1B0 190 Bytes  [ B8, D9, CA, D8, 4F, 20, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDosDateTimeToFileTime + 15C                                         7759B26F 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDosDateTimeToFileTime + 15E                                         7759B271 22 Bytes  [ D9, CA, D8, 4F, 44, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDosDateTimeToFileTime + 175                                         7759B288 39 Bytes  [ FF, FF, FF, D9, CA, D8, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoDosDateTimeToFileTime + 19D                                         7759B2B0 13 Bytes  [ FF, FF, D9, CB, D8, 4F, 4C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptor + 1A                                                 775A01B6 26 Bytes  [ 5F, 5E, 5B, 8B, E5, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptor + 35                                                 775A01D1 26 Bytes  [ FF, 55, 8B, EC, 83, EC, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptor + 50                                                 775A01EC 5 Bytes  [ 71, 18, 57, 8B, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptor + 56                                                 775A01F2 103 Bytes  [ 89, 45, FC, 8B, 41, 1C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CoGetInterceptor + BE                                                 775A025A 23 Bytes  [ 89, F4, 00, 00, 00, 33, DB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_QueryInterface + 4                               775A056D 27 Bytes  [ 45, 10, 0F, FA, D1, 0F, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_AddRef + 1                                       775A0589 4 Bytes  [ 55, D0, D1, E1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_AddRef + 6                                       775A058E 30 Bytes  [ 46, 04, 8B, 5E, 08, 89, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_Invoke + B                                       775A05AD 64 Bytes  [ D9, 46, 08, D8, 4A, 04, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_DebugServerQueryInterface + F                    775A05EE 15 Bytes  [ 45, E4, 8B, 4D, 14, 40, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_DebugServerRelease + 2                           775A05FE 32 Bytes  [ FF, 5F, 39, 1D, 80, 76, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrCStdStubBuffer2_Release + 6                                  775A061F 52 Bytes  [ 4D, FC, 8B, 45, 14, 5E, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_CStdStubBuffer_Disconnect + 4                                   775A0654 56 Bytes  [ 75, 0C, 0F, B7, 4E, 4E, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubForwardingFunction + 9                                   775A068D 236 Bytes  [ 79, 5C, 3B, 79, 60, 74, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubForwardingFunction + F6                                  775A077A 8 Bytes  [ 00, 00, EB, 02, 33, F6, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubForwardingFunction + FF                                  775A0783 49 Bytes  [ 70, 18, 85, F6, 89, 48, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubForwardingFunction + 131                                 775A07B5 16 Bytes  [ 0B, 85, DB, 75, 07, BE, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubForwardingFunction + 142                                 775A07C6 105 Bytes  [ 70, 04, 89, 48, 10, 8B, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_AddRef_Proxy + 1                                       775A0955 19 Bytes  [ 90, 50, 01, 00, 00, C1, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_AddRef_Proxy + 15                                      775A0969 8 Bytes  [ 00, C1, E2, 05, 3B, CB, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_Release_Proxy + 4                                      775A0972 20 Bytes  [ 1C, 8D, B0, 8B, 17, B0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_Release_Proxy + 19                                     775A0987 4 Bytes  [ 00, 00, 00, B0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_Release_Proxy + 1E                                     775A098C 159 Bytes  [ 17, B0, 8B, 90, 50, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_Release_Proxy + BE                                     775A0A2C 33 Bytes  [ 00, 85, D2, 74, 22, C1, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_IUnknown_Release_Proxy + E2                                     775A0A50 4 Bytes  [ 8B, 5D, 08, 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2_va + 6F                                          775A4694 13 Bytes  [ 4D, 10, 8D, 7A, FF, 85, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2_va + 7D                                          775A46A2 9 Bytes  [ 7D, FC, D8, E1, D8, 4E, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2_va + 87                                          775A46AC 55 Bytes  [ 48, FC, DE, C1, D9, 58, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2_va + BF                                          775A46E4 189 Bytes  [ 64, 15, B0, D8, 4D, 10, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2_va + 17D                                         775A47A2 44 Bytes  [ 55, 8B, EC, 57, 8B, 7D, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2 + 12                                             775A4ADF 302 Bytes  [ 73, 35, 85, FF, 89, 7D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2 + 141                                            775A4C0E 6 Bytes  [ 4D, 14, 03, C9, 74, 07 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2 + 148                                            775A4C15 32 Bytes  [ 7D, 10, 33, C0, F3, AB, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2 + 169                                            775A4C36 11 Bytes  [ 45, 10, 56, 8B, 75, 08, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrClientCall2 + 175                                            775A4C42 43 Bytes  [ FF, 85, C0, 7C, 06, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllGetClassObject + B                                        775A521B 266 Bytes  [ D9, 05, 74, 5F, 15, B0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllGetClassObject + 116                                      775A5326 39 Bytes  [ 8B, 7D, 08, 85, FF, 74, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllGetClassObject + 13E                                      775A534E 34 Bytes  [ 8D, 77, 10, C7, 45, 08, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllGetClassObject + 161                                      775A5371 62 Bytes  [ FF, 8B, 45, 08, C7, 46, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrDllGetClassObject + 1A1                                      775A53B1 26 Bytes  [ 00, 85, F6, 57, 75, 1A, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubCall2 + 1C                                               775A5FD4 15 Bytes  [ 00, 00, C7, 42, 10, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubCall2 + 2C                                               775A5FE4 15 Bytes  [ 7A, 24, 8D, 42, 14, 8B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubCall2 + 3C                                               775A5FF4 2 Bytes  [ 71, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubCall2 + 3F                                               775A5FF7 163 Bytes  [ 35, 24, 8F, 17, B0, 89, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!ComPs_NdrStubCall2 + E3                                               775A609B 77 Bytes  [ 77, 88, 39, 95, 72, 19, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserSize + 1A                                                 775B9993 102 Bytes  [ 03, C2, 78, DA, 2B, C2, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserMarshal + 1                                               775B99FA 2 Bytes  [ 55, EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserMarshal + 4                                               775B99FD 19 Bytes  [ 45, D0, 8B, 75, E0, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserMarshal + 18                                              775B9A11 168 Bytes  [ 55, C0, 03, CA, 48, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserMarshal + C1                                              775B9ABA 1 Byte  [ C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserMarshal + C3                                              775B9ABC 83 Bytes  [ 3B, CE, 72, F0, 8B, 17, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HBITMAP_UserUnmarshal + 6                                             775B9B8F 474 Bytes  [ C3, 04, 33, C0, 85, D2, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserFree + 2                                            775B9D6A 9 Bytes  [ D9, C9, D8, 4F, 7C, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserFree + C                                            775B9D74 17 Bytes  [ FF, FF, FF, D9, C9, D8, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserFree + 1E                                           775B9D86 14 Bytes  [ FF, D9, C9, D8, 8F, 8C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserFree + 2D                                           775B9D95 32 Bytes  [ FF, FF, D9, C9, D8, 8F, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILEPICT_UserFree + 4E                                           775B9DB6 62 Bytes  [ FF, D9, C9, D8, 8F, 98, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserUnmarshal + 2D                                       775B9DF5 15 Bytes  [ FF, FF, D9, C9, D8, 8F, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HENHMETAFILE_UserUnmarshal + 3D                                       775B9E05 185 Bytes  [ FF, FF, D9, C9, D8, 8F, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserMarshal + 40                                            775B9EBF 10 Bytes  [ D9, CA, D8, 86, 20, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserMarshal + 4B                                            775B9ECA 12 Bytes  [ 8F, D8, 00, 00, 00, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserMarshal + 58                                            775B9ED7 73 Bytes  [ D9, C9, D8, 8F, E0, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserMarshal + A2                                            775B9F21 6 Bytes  [ 03, C2, 78, DA, 2B, C2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserUnmarshal + 1                                           775B9F28 233 Bytes  [ 55, F8, D9, C9, D8, 4F, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HMETAFILE_UserFree + 25                                               775BA012 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserSize + 15                                                775BA02C 45 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserSize + 43                                                775BA05A 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserMarshal + 17                                             775BA076 61 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserMarshal + 55                                             775BA0B4 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserMarshal + 6B                                             775BA0CA 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserMarshal + 8A                                             775BA0E9 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserMarshal + 8D                                             775BA0EC 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!HPALETTE_UserUnmarshal + 16                                           775BA28A 256 Bytes  [ E4, 00, 00, 00, 83, EB, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserMarshal + 5E                                                  775BA38B 21 Bytes  [ 14, DF, 89, 4C, DF, 04, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserMarshal + 74                                                  775BA3A1 40 Bytes  [ 5D, 0C, 8B, 75, FC, 4B, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserUnmarshal + 1                                                 775BA3CA 40 Bytes  [ 45, F8, C1, E1, 10, 0B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserUnmarshal + 2A                                                775BA3F3 22 Bytes  [ F8, 0F, AF, 4D, F4, C1, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserUnmarshal + 41                                                775BA40A 89 Bytes  [ 44, DF, 04, 89, 14, DF, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserUnmarshal + 9B                                                775BA464 33 Bytes  [ 7F, 64, DF, 38, 0F, 69, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserUnmarshal + BD                                                775BA486 142 Bytes  [ 7F, 0C, DF, 0F, 72, E2, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserFree + E                                                      775BA539 7 Bytes  [ CC, CC, CC, CC, CC, CC, CC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserFree + 16                                                     775BA541 23 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserFree + 2E                                                     775BA559 38 Bytes  [ 00, 89, 4D, 08, 8B, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserFree + 55                                                     775BA580 9 Bytes  [ 53, 56, 57, 0F, 84, FC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!SNB_UserFree + 5F                                                     775BA58A 2 Bytes  [ 5D, 0C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleLockRunning + 3D                                                   775C88B3 129 Bytes  [ D9, CA, D8, 4F, 7C, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleNoteObjectVisible + 16                                             775C8935 6 Bytes  [ D9, C9, D8, 86, DC, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleNoteObjectVisible + 1D                                             775C893C 102 Bytes  [ FF, D9, CB, D8, 8F, 8C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleNoteObjectVisible + 84                                             775C89A3 40 Bytes  [ 00, 00, D9, C9, D8, 86, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleNoteObjectVisible + AD                                             775C89CC 15 Bytes  [ FF, D9, CA, D8, 8F, A0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleNoteObjectVisible + BD                                             775C89DC 24 Bytes  [ FF, D9, CB, D8, 8F, A0, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetConvertStg + 1                                                     775C8C65 2 Bytes  [ 45, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!GetConvertStg + 4                                                     775C8C68 79 Bytes  [ 75, FC, 03, F0, 8B, 45, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDraw + 28                                                          775C8CB8 48 Bytes  [ 00, 00, 00, 00, BF, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDraw + 59                                                          775C8CE9 44 Bytes  [ 8B, 45, F8, 2B, C2, 5F, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDraw + 86                                                          775C8D16 2 Bytes  [ 45, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDraw + 89                                                          775C8D19 103 Bytes  [ 4D, 0C, 8B, 55, 08, 68, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDraw + F1                                                          775C8D81 75 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDuplicateData + 46                                                 775C8F98 22 Bytes  [ D8, 41, FC, D9, 59, FC, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDuplicateData + 5D                                                 775C8FAF 58 Bytes  [ 83, C1, 04, 4E, D8, 41, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDuplicateData + 98                                                 775C8FEA 235 Bytes  [ 8B, F7, C1, EE, 03, 85, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDuplicateData + 184                                                775C90D6 77 Bytes  [ 00, 8A, 84, 05, 08, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleDuplicateData + 1D2                                                775C9124 53 Bytes  [ 5C, CF, 04, 03, D3, 03, D0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateStaticFromData + 2                                           775C96DC 34 Bytes  [ 7F, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateStaticFromData + 25                                          775C96FF 7 Bytes  [ 51, 08, C1, F8, 0F, 03, D0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateStaticFromData + 2D                                          775C9707 2 Bytes  [ 51, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateStaticFromData + 30                                          775C970A 35 Bytes  [ 55, 08, 03, DA, 89, 59, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateStaticFromData + 54                                          775C972E 7 Bytes  [ 7F, 00, 00, 03, C2, C1, F8 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkToFileEx + 1A                                            775C9C36 8 Bytes  [ 4D, 08, 0F, 84, 88, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkToFileEx + 23                                            775C9C3F 15 Bytes  [ 4D, 0C, 33, DB, 83, F9, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkToFileEx + 33                                            775C9C4F 3 Bytes  [ 75, FC, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkToFileEx + 37                                            775C9C53 88 Bytes  [ 6D, 08, 8A, 04, 4E, 8A, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateLinkToFileEx + 90                                            775C9CAC 75 Bytes  [ 8A, 84, 05, 08, 05, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFileEx + 2F                                              775C9E0F 61 Bytes  [ 00, 0F, AF, C2, 99, 81, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFileEx + 6D                                              775C9E4D 108 Bytes  [ 8B, 00, 0F, AF, C2, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFileEx + DA                                              775C9EBA 25 Bytes  [ 7F, 00, 00, 03, C2, 0F, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFileEx + F4                                              775C9ED4 35 Bytes  [ 7F, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFileEx + 118                                             775C9EF8 31 Bytes  [ 8B, 55, F8, 85, D2, 74, 51, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFile + A2                                                775CA238 48 Bytes  [ C1, E3, 08, 89, 5A, 18, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFile + D4                                                775CA26A 46 Bytes  [ C1, E6, 08, 89, 32, 41, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFile + 103                                               775CA299 21 Bytes  [ 45, 08, 53, 56, 57, 8B, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFile + 119                                               775CA2AF 1 Byte  [ 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateFromFile + 11B                                               775CA2B1 29 Bytes  [ 89, 55, F8, 89, 45, FC, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataCache + E                                                   775CC019 4 Bytes  CALL 775CB31F C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataCache + 13                                                  775CC01E 42 Bytes  [ FF, 85, C0, 0F, 84, BF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataCache + 3E                                                  775CC049 59 Bytes  [ 05, 8B, 40, 0C, EB, 09, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataCache + 7A                                                  775CC085 3 Bytes  [ 57, F2, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!CreateDataCache + 7E                                                  775CC089 15 Bytes  [ 89, 45, E4, 8B, C8, 85, C9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DoDragDrop + 1                                                        775D03F2 7 Bytes  [ 5D, 0C, 83, EF, 04, 8B, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DoDragDrop + 9                                                        775D03FA 728 Bytes  [ 8B, 55, E4, 89, 4F, 04, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DoDragDrop + 2E2                                                      775D06D3 2 Bytes  [ 45, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DoDragDrop + 2E5                                                      775D06D6 1 Byte  [ 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!DoDragDrop + 2E7                                                      775D06D8 14 Bytes  [ 89, 4D, A0, 8B, 55, A0, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEmbeddingHelper + 43                                         775D1B22 10 Bytes  [ 80, 3F, 00, 00, 80, 3F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEmbeddingHelper + 4F                                         775D1B2E 28 Bytes  [ 80, 3F, 6D, 5D, D2, 35, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleCreateEmbeddingHelper + 6C                                         775D1B4B 638 Bytes  [ 37, 5F, BF, D8, 37, 30, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetAutoConvert + 184                                               775D1DCA 134 Bytes  [ 1D, B7, A9, A6, 20, B7, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetAutoConvert + 20B                                               775D1E51 157 Bytes  [ 71, 00, B7, 02, D0, FB, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetAutoConvert + 2A9                                               775D1EEF 278 Bytes  [ 37, FF, 58, 14, 37, 1A, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetAutoConvert + 3C1                                               775D2007 119 Bytes  [ 5F, 33, C0, 5E, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleSetAutoConvert + 439                                               775D207F 42 Bytes  [ 15, 68, 3D, 01, 00, 5D, C2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleMetafilePictFromIconAndLabel + 16B                                 775D28FA 93 Bytes  [ 39, 24, 58, 03, 77, 17, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleMetafilePictFromIconAndLabel + 1C9                                 775D2958 34 Bytes  [ 37, 26, 86, 36, 41, 28, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleMetafilePictFromIconAndLabel + 1EC                                 775D297B 240 Bytes  [ 46, 73, 62, 91, 32, 17, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleMetafilePictFromIconAndLabel + 2DD                                 775D2A6C 776 Bytes  [ 85, 57, 53, 33, 23, 11, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfFile + 12E                                                775D2D75 205 Bytes  [ 02, 32, 58, 93, 88, 31, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfFile + 1FC                                                775D2E43 554 Bytes  [ 87, 76, 37, 34, 40, 11, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfClass + 13D                                               775D306E 675 Bytes  [ 95, 28, 91, 64, 48, 91, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfClass + 3E1                                               775D3312 354 Bytes  [ 86, 58, 22, 59, 28, 97, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfClass + 544                                               775D3475 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfClass + 578                                               775D34A9 94 Bytes  [ 00, 00, 00, F0, 46, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleGetIconOfClass + 5D7                                               775D3508 21 Bytes  [ A0, 66, 87, 1A, CE, 62, CF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumFormatEtc + B                                               775D3DAC 84 Bytes  [ 04, C1, 00, 00, 60, BA, AA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumFormatEtc + 60                                              775D3E01 93 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumFormatEtc + BE                                              775D3E5F 148 Bytes  [ 00, 00, A3, 30, D2, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumFormatEtc + 153                                             775D3EF4 4 Bytes  [ 96, 8C, 02, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleRegEnumFormatEtc + 158                                             775D3EF9 38 Bytes  [ 8C, 02, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAM + 56                                    775D96C2 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAMEx + 11                                  775D96D8 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAMEx + 15                                  775D96DC 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAMEx + 37                                  775D96FE 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAMEx + 56                                  775D971D 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertIStorageToOLESTREAMEx + 5D                                  775D9724 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorage + 58                                    775D9A0A 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorage + 5F                                    775D9A11 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorage + 9C                                    775D9A4E 77 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorageEx + 4A                                  775D9A9D 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorageEx + 66                                  775D9AB9 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorageEx + 6A                                  775D9ABD 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorageEx + 8A                                  775D9ADD 89 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!OleConvertOLESTREAMToIStorageEx + E4                                  775D9B37 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd16Info + 2                                                   775DA750 69 Bytes  [ 8B, 85, 7C, FF, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd16Info + 49                                                  775DA797 6 Bytes  [ 08, 8B, 45, FC, 8B, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd16Info + 50                                                  775DA79E 61 Bytes  [ 8B, 55, EC, 89, 14, 81, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd16Info + 8E                                                  775DA7DC 59 Bytes  [ 00, 00, 56, 8B, F0, 6B, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd16Info + CA                                                  775DA818 21 Bytes  [ 00, 00, 41, 89, 4D, 08, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd16toDvtd32 + 4                                           775DA87C 82 Bytes  [ 79, 08, D9, 07, 83, C7, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd16toDvtd32 + 57                                          775DA8CF 143 Bytes  [ 89, 71, 08, 76, 05, 8B, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd16toDvtd32 + E7                                          775DA95F 9 Bytes  [ 8B, 45, 10, EB, 08, C7, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd16toDvtd32 + F2                                          775DA96A 41 Bytes  [ 00, 00, 8B, 4C, BB, 0C, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd16toDvtd32 + 11C                                         775DA994 62 Bytes  [ 0C, 89, 44, BB, 1C, 8B, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd32Info + 83                                                  775DAAEC 22 Bytes  [ 03, 8D, 49, 00, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd32Info + 9A                                                  775DAB03 24 Bytes  [ C1, 04, 3B, CB, 89, 48, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd32Info + B3                                                  775DAB1C 15 Bytes  [ 5D, F4, 8B, 7D, F8, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd32Info + C3                                                  775DAB2C 28 Bytes  [ C1, 64, 83, C6, 04, 83, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtGetDvtd32Info + E0                                                  775DAB49 121 Bytes  [ E5, 5D, C2, 0C, 00, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd32toDvtd16 + 4A                                          775DABC3 46 Bytes  [ FF, 15, 10, 4E, 15, B0, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd32toDvtd16 + 79                                          775DABF2 20 Bytes  [ 53, 8B, 5E, 04, 85, DB, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd32toDvtd16 + 8E                                          775DAC07 50 Bytes  [ 15, B0, 6A, 00, 53, C7, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd32toDvtd16 + C1                                          775DAC3A 82 Bytes  CALL 775DAE50 C:\WINDOWS\system32\ole32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!UtConvertDvtd32toDvtd16 + 114                                         775DAC8D 189 Bytes  [ 53, 50, FF, 15, 10, 4E, 15, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnILockBytes + 1                                        775DC091 24 Bytes  [ F8, EB, 32, B9, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnILockBytes + 1A                                       775DC0AA 1 Byte  [ 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnILockBytes + 1D                                       775DC0AD 42 Bytes  [ 0D, 48, E4, 15, B0, 8B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnILockBytes + 48                                       775DC0D8 57 Bytes  [ B0, 8B, C7, 5F, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenStorageOnILockBytes + 82                                       775DC112 106 Bytes  [ 55, 8B, EC, 83, EC, 40, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageILockBytes + 26                                           775DC40B 70 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageILockBytes + 6D                                           775DC452 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageILockBytes + 85                                           775DC46A 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageILockBytes + AF                                           775DC494 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgIsStorageILockBytes + CF                                           775DC4B4 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantChangeType + 15                                            775E3A4C 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantChangeType + 2E                                            775E3A65 42 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantChangeType + 59                                            775E3A90 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantChangeType + 94                                            775E3ACB 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantChangeType + 9B                                            775E3AD2 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FmtIdToPropStgName + 52                                               775E3B4F 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!FmtIdToPropStgName + 5B                                               775E3B58 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropStgNameToFmtId + 9                                                775E3B66 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropStgNameToFmtId + E                                                775E3B6B 57 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropStgNameToFmtId + 49                                               775E3BA6 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropStgNameToFmtId + 4E                                               775E3BAB 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropStgNameToFmtId + 57                                               775E3BB4 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropStg + 20                                                 775E3BD9 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropStg + 27                                                 775E3BE0 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropStg + 34                                                 775E3BED 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropStg + 52                                                 775E3C0B 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropStg + 6E                                                 775E3C27 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenPropStg + 21                                                   775E3D5B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenPropStg + 28                                                   775E3D62 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenPropStg + 35                                                   775E3D6F 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenPropStg + 51                                                   775E3D8B 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenPropStg + 59                                                   775E3D93 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropSetStg + 1C                                              775E3EB8 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropSetStg + 62                                              775E3EFE 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropSetStg + 7D                                              775E3F19 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropSetStg + 91                                              775E3F2D 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgCreatePropSetStg + B6                                              775E3F52 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropSysFreeString + 100                                               775E41F0 39 Bytes  [ 8B, 5D, 0C, 8B, 75, FC, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropSysFreeString + 128                                               775E4218 87 Bytes  [ F4, 8B, 45, F8, C1, E1, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropSysFreeString + 180                                               775E4270 4 Bytes  [ F9, 03, 75, C1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropSysFreeString + 185                                               775E4275 236 Bytes  [ EB, 03, 0F, 6E, 0C, 1E, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantCopy + 48                                                  775E4362 18 Bytes  [ 55, 8B, EC, 56, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantCopy + 5B                                                  775E4375 84 Bytes  [ 45, 10, 8B, 4D, 08, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantCopy + B0                                                  775E43CA 39 Bytes  [ F7, C1, 00, 80, FF, FF, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantCopy + D8                                                  775E43F2 3 Bytes  [ 83, EB, 06 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!PropVariantCopy + DC                                                  775E43F6 21 Bytes  [ EF, C0, 8D, 0C, 1E, F7, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgConvertPropertyToVariant + BE                                      775E5EF9 83 Bytes  [ 4F, 54, D9, CA, D8, 46, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgConvertPropertyToVariant + 112                                     775E5F4D 87 Bytes  [ D8, 46, 80, D9, C9, D8, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgConvertPropertyToVariant + 16A                                     775E5FA5 41 Bytes  [ FF, FF, D9, C9, D8, 8F, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgConvertPropertyToVariant + 194                                     775E5FCF 6 Bytes  [ D9, CA, D8, 86, 5C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgConvertPropertyToVariant + 19B                                     775E5FD6 17 Bytes  [ FF, D9, C9, D8, 8F, 9C, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnILockBytes + 7                                  775F058B 145 Bytes  [ 4D, FC, 89, 55, EC, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnILockBytes + 99                                 775F061D 4 Bytes  [ C8, 8B, 45, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnILockBytes + 9E                                 775F0622 1 Byte  [ 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnILockBytes + A0                                 775F0624 12 Bytes  [ 2B, C1, 33, C9, 85, F6, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnILockBytes + AD                                 775F0631 33 Bytes  [ 34, 02, 89, 30, 8B, 77, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 8                               775F0653 125 Bytes  [ 89, 4F, 08, 5F, 5E, 5B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 86                              775F06D1 15 Bytes  [ 46, 0C, C1, E0, 02, 2B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 96                              775F06E1 37 Bytes  [ 55, E0, 89, 4D, DC, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + BC                              775F0707 98 Bytes  [ 45, DC, 03, CF, 8D, 3C, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgOpenAsyncDocfileOnIFillLockBytes + 11F                             775F076A 70 Bytes  [ 7D, EC, C1, E7, 02, 8D, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnFile + 7C                                       775F0874 116 Bytes  [ 46, A4, D9, C9, D8, 4F, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnFile + F1                                       775F08E9 11 Bytes  [ FF, D9, C9, D8, 4F, 7C, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnFile + FD                                       775F08F5 33 Bytes  [ FF, FF, D9, C9, D8, 8F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnFile + 11F                                      775F0917 22 Bytes  [ D9, C9, D8, 8F, 88, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] ole32.dll!StgGetIFillLockBytesOnFile + 136                                      775F092E 56 Bytes  [ 00, D9, CA, D8, 86, 6C, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + FFFEF0D0                                                       71AB11D5 53 Bytes  [ 3A, FF, FF, 98, 46, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + FFFEF107                                                       71AB120C 12 Bytes  [ 65, DE, FF, FF, A7, E9, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + FFFEF115                                                       71AB121A 14 Bytes  [ 00, 00, 00, 00, C0, 4B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + FFFEF125                                                       71AB122A 27 Bytes  [ C0, 4B, BF, 44, FF, FF, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + FFFEF141                                                       71AB1246 11 Bytes  [ E0, 3F, 70, 6F, 77, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStringToAddressW + 3A                                             71AB2858 5 Bytes  [ 00, 8B, 5D, 0C, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStringToAddressW + 40                                             71AB285E 5 Bytes  [ FC, 8D, 1C, 5D, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStringToAddressW + 46                                             71AB2864 191 Bytes  [ FF, FF, 83, FB, 0E, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!GetAddrInfoW + 8B                                                    71AB2924 60 Bytes  [ 77, 83, C3, 08, 74, 1F, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!GetAddrInfoW + C9                                                    71AB2962 43 Bytes  [ 83, FB, 0E, 8B, 7D, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!GetAddrInfoW + F5                                                    71AB298E 10 Bytes  [ 74, 37, 83, C3, 06, 0B, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!GetAddrInfoW + 100                                                   71AB2999 248 Bytes  [ 00, 00, 0F, BF, 0C, 1E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getaddrinfo + 23                                                     71AB2A92 84 Bytes  [ 55, 8B, EC, 8B, 45, 10, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getaddrinfo + 78                                                     71AB2AE7 112 Bytes  [ E4, 83, C3, 04, 0F, 6F, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!FreeAddrInfoW + 4D                                                   71AB2B58 70 Bytes  [ AF, 45, 10, 89, 55, F4, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!htons + 39                                                           71AB2B9F 27 Bytes  JMP 3BDFB8B0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!htons + 55                                                           71AB2BBB 95 Bytes  [ 0F, 6F, 56, 08, 0F, 6E, ED, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!inet_addr + 27                                                       71AB2C1B 159 Bytes  [ 00, 00, 00, 2B, C1, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!sendto + 52                                                          71AB2CBB 221 Bytes  [ 45, E4, 8D, 04, DD, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!recvfrom + 8A                                                        71AB2D99 376 Bytes  [ 53, 0C, 89, 50, 0C, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextW + 79                                           71AB2F12 64 Bytes  [ 55, C8, 2B, C2, 8B, 5D, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextW + BA                                           71AB2F53 239 Bytes  [ 6F, 46, F8, 0F, FE, F2, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextW + 1AA                                          71AB3043 147 Bytes  [ FE, F4, 0F, 6F, 66, F8, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextW + 23E                                          71AB30D7 29 Bytes  [ FF, 8B, 48, 0C, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextW + 25C                                          71AB30F5 19 Bytes  [ 4D, 0C, 85, C9, 74, 4A, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceEnd + 63                                             71AB3289 74 Bytes  [ 55, D8, 03, D2, 89, 55, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceEnd + AE                                             71AB32D4 11 Bytes  CALL FD8F7862 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceEnd + BA                                             71AB32E0 3 Bytes  [ 55, C8, 2B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceEnd + BE                                             71AB32E4 123 Bytes  [ 8B, 5D, F4, 8B, 75, E4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginW + 59                                          71AB3360 47 Bytes  [ F5, 67, 40, 0F, 6F, 7E, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginW + 89                                          71AB3390 32 Bytes  [ 6F, 66, A0, 0F, FE, F7, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginW + AA                                          71AB33B1 118 Bytes  [ FF, 2B, C3, 8B, 14, 24, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginW + 121                                         71AB3428 8 Bytes  CALL 818BB1B8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginW + 12A                                         71AB3431 28 Bytes  [ 75, E4, 0F, 7F, F0, 0F, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketW + 3F                                                      71AB3A0A 5 Bytes  [ C0, C7, 45, FC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketW + 45                                                      71AB3A10 40 Bytes  [ FF, FF, 8B, 4D, F0, 64, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketW + 6F                                                      71AB3A3A 23 Bytes  [ 00, 8B, 55, 14, 53, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketW + 87                                                      71AB3A52 19 Bytes  [ 7D, AC, F3, A5, 89, 55, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketW + 9B                                                      71AB3A66 23 Bytes  [ FF, F3, A5, 8B, 7D, 10, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!socket + 17A                                                         71AB3D0B 8 Bytes  [ 00, 8B, 48, 7C, 85, C9, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!socket + 183                                                         71AB3D14 18 Bytes  [ 40, 54, 8B, BD, 70, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!socket + 196                                                         71AB3D27 3 Bytes  [ 8D, 95, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!socket + 19B                                                         71AB3D2C 6 Bytes  [ FF, 52, 50, E8, 2C, 87 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!socket + 1A3                                                         71AB3D34 37 Bytes  [ 85, C0, 89, 45, 14, 0F, 8C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!bind + 6                                                             71AB3E06 15 Bytes  [ 52, EB, 07, 0F, B7, 40, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!bind + 16                                                            71AB3E16 317 Bytes  [ 8B, 45, 14, 85, C0, 74, 2F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!inet_ntoa + 13                                                       71AB3F54 32 Bytes  [ EC, 8B, 45, 08, 8B, 48, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!inet_ntoa + 34                                                       71AB3F75 237 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!inet_ntoa + 122                                                      71AB4063 21 Bytes  [ 02, 33, C9, 85, F6, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!connect + F                                                          71AB4079 68 Bytes  [ E4, 41, 3B, CE, 72, F1, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!connect + 54                                                         71AB40BE 10 Bytes  [ 73, 0C, 41, 83, C0, 02, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!connect + 5F                                                         71AB40C9 53 Bytes  CALL BF365459 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!connect + 95                                                         71AB40FF 24 Bytes  [ 01, 83, F8, 17, 57, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!connect + AE                                                         71AB4118 7 Bytes  [ 46, 1C, 56, 83, C8, 20, 57 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!send + 29                                                            71AB42B3 5 Bytes  [ E0, C7, 86, A4, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!send + 30                                                            71AB42BA 117 Bytes  [ 70, 05, 16, B0, 89, 8E, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecv + 18                                                         71AB4330 17 Bytes  [ 00, A1, B8, 68, 15, B0, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecv + 2C                                                         71AB4344 6 Bytes  [ EB, 0A, E8, C5, EC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecv + 33                                                         71AB434B 19 Bytes  [ A3, 80, 76, 17, B0, 8B, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecv + 47                                                         71AB435F 34 Bytes  [ D7, 6A, 0E, 56, FF, D7, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecv + 6A                                                         71AB4382 89 Bytes  [ 55, 8B, EC, 56, 8B, 75, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACleanup + 2D                                                      71AB4455 74 Bytes  [ 00, 00, 50, 64, 89, 25, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAIoctl + 18                                                        71AB44A1 86 Bytes  [ 00, 8D, 7E, 1A, BE, 22, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAIoctl + 6F                                                        71AB44F8 144 Bytes  [ 08, B8, 0D, 00, 00, C0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEventSelect + 17                                                  71AB458A 4 Bytes  [ C0, C7, 45, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEventSelect + 1C                                                  71AB458F 9 Bytes  [ FF, FF, FF, 8B, 4D, F0, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEventSelect + 27                                                  71AB459A 40 Bytes  [ 00, 00, 5F, 5E, 5B, 8B, E5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEventSelect + 50                                                  71AB45C3 13 Bytes  [ 83, 48, 01, 00, 00, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEventSelect + 5E                                                  71AB45D1 8 Bytes  [ 8D, 7D, AC, F3, A5, 89, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACreateEvent + 8                                                   71AB45FF 45 Bytes  [ FF, 8B, 4F, 38, 89, 55, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNetworkEvents + 16                                            71AB462D 6 Bytes  [ 8B, 83, D0, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNetworkEvents + 1E                                            71AB4635 60 Bytes  [ 74, 31, 8B, 4D, C8, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNetworkEvents + 5B                                            71AB4672 9 Bytes  [ C9, 0F, 84, 0D, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNetworkEvents + 65                                            71AB467C 21 Bytes  [ 8B, 75, B8, 3B, F0, 76, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACloseEvent + 10                                                   71AB4692 351 Bytes  [ 00, 85, C0, 89, 45, 14, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockopt + 129                                                     71AB47F2 13 Bytes  [ 89, 5D, F8, 8B, 5D, FC, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockopt + 137                                                     71AB4800 139 Bytes  [ DB, 47, F4, 83, C0, 10, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockopt + 1C3                                                     71AB488C 13 Bytes  [ 8B, 48, 7C, 85, C9, 74, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockopt + 1D1                                                     71AB489A 65 Bytes  [ FF, FF, 3B, F8, 76, 02, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockopt + 213                                                     71AB48DC 9 Bytes  [ 2B, D7, 8B, CF, 8D, 3C, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSANSPIoctl + 5E                                                     71AB4D64 24 Bytes  [ 80, FF, FF, 7D, 07, B8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSANSPIoctl + 77                                                     71AB4D7D 12 Bytes  [ 05, 60, 87, 17, B0, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSANSPIoctl + 84                                                     71AB4D8A 44 Bytes  [ C5, 5F, 33, C0, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSANSPIoctl + B1                                                     71AB4DB7 10 Bytes  [ 00, 0B, C2, 41, 89, 04, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSANSPIoctl + BC                                                     71AB4DC2 22 Bytes  [ 10, 01, 00, 00, 00, 74, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyname + 5D                                                   71AB5031 39 Bytes  [ 00, 01, 00, 00, 00, 8B, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyname + 85                                                   71AB5059 11 Bytes  [ 00, 00, 8B, 86, 8C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyname + 92                                                   71AB5066 18 Bytes  [ 0F, B7, 57, 4E, 8B, 4F, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyname + A6                                                   71AB507A 10 Bytes  [ 75, 0C, 83, F8, 3F, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyname + B2                                                   71AB5086 17 Bytes  [ EB, 11, 3D, 3F, 06, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostname + A                                                      71AB50D2 30 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostname + 29                                                     71AB50F1 91 Bytes  [ D9, 5E, 1C, 56, D9, 5E, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostname + 85                                                     71AB514D 9 Bytes  [ 76, 2C, D9, 58, 30, 8B, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostname + 8F                                                     71AB5157 10 Bytes  [ 3C, 8B, 49, 14, 89, 48, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostname + 9B                                                     71AB5163 91 Bytes  [ 33, C0, 5E, 5D, C2, 10, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginA + 35                                          71AB52DF 12 Bytes  [ 3D, 0F, 06, 00, 00, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginA + 42                                          71AB52EC 22 Bytes  [ 05, B8, 3F, 00, 00, 00, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginA + 5A                                          71AB5304 57 Bytes  [ EB, 11, 3D, 3F, 06, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginA + 94                                          71AB533E 72 Bytes  [ E5, 5D, C2, 0C, 00, B8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceBeginA + DD                                          71AB5387 36 Bytes  [ 40, 08, 53, 50, 75, 1E, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextA + 27                                           71AB5735 9 Bytes  [ 76, 44, 33, F6, 8D, A4, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextA + 33                                           71AB5741 74 Bytes  [ 4B, 48, 8B, 44, 31, 08, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextA + 7E                                           71AB578C 66 Bytes  [ 50, FF, D6, 6A, 00, 53, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextA + C1                                           71AB57CF 94 Bytes  [ 4D, 0C, 83, 79, 30, 02, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSALookupServiceNextA + 120                                          71AB582E 2 Bytes  [ F8, 85 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!recv + 8C                                                            71AB61E6 251 Bytes  [ 52, 74, 6C, 49, 6E, 73, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringW + 30                                             71AB62E2 225 Bytes  [ 52, 74, 6C, 49, 70, 76, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringW + 112                                            71AB63C4 178 Bytes  [ 52, 74, 6C, 49, 70, 76, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringW + 1C5                                            71AB6477 20 Bytes  [ 52, 74, 6C, 49, 73, 44, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringW + 1DA                                            71AB648C 228 Bytes  [ 52, 74, 6C, 49, 73, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringW + 2BF                                            71AB6571 222 Bytes  [ 52, 74, 6C, 4C, 61, 72, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStartup + 3                                                       71AB6650 62 Bytes  [ 53, 69, 64, 00, 52, 74, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStartup + 42                                                      71AB668F 100 Bytes  [ 52, 74, 6C, 4C, 6F, 63, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStartup + A7                                                      71AB66F4 164 Bytes  [ 52, 74, 6C, 4C, 6F, 6F, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStartup + 14C                                                     71AB6799 97 Bytes  [ 66, 65, 72, 00, 52, 74, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStartup + 1AE                                                     71AB67FB 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnumProtocols + 82                                                71AB77E3 94 Bytes  [ 89, 40, 04, 89, 00, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnumProtocols + E1                                                71AB7842 62 Bytes  [ 89, BB, 48, 01, 00, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnumProtocols + 120                                               71AB7881 5 Bytes  [ 00, 8B, 83, 48, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnumProtocols + 127                                               71AB7888 3 Bytes  [ 8B, B8, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnumProtocols + 12D                                               71AB788E 78 Bytes  [ 85, FF, 75, 0C, C7, 45, 18, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsW + 23                                               71AB84AF 87 Bytes  CALL 71ABC5BE C:\WINDOWS\system32\WS2_32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsW + 7B                                               71AB8507 16 Bytes  [ 00, 8B, 87, D0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsW + 8C                                               71AB8518 82 Bytes  [ 6A, 00, 83, C0, 48, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsW + DF                                               71AB856B 165 Bytes  [ 00, 00, 8B, 01, 8D, 57, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsW + 185                                              71AB8611 250 Bytes  [ 15, 08, 4E, 15, B0, 8B, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketA + 12                                                      71AB877B 135 Bytes  [ 4D, FC, 51, 53, 56, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASocketA + 9A                                                      71AB8803 131 Bytes  [ D8, 85, DB, 75, 0D, 5E, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAProviderConfigChange + 68                                         71AB8887 11 Bytes  [ EB, 77, 68, 4B, 4D, 49, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAProviderConfigChange + 74                                         71AB8893 103 Bytes  [ D6, 85, C0, 8B, 4D, 18, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!listen + 28                                                          71AB88FB 74 Bytes  [ 15, 88, 4D, 15, B0, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!listen + 73                                                          71AB8946 79 Bytes  [ 15, 0C, 4E, 15, B0, B8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!listen + C3                                                          71AB8996 52 Bytes  [ DE, 75, 0C, C7, 45, FC, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!listen + F8                                                          71AB89CB 85 Bytes  [ 00, 50, FF, D7, 8D, 4B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!listen + 14F                                                         71AB8A22 73 Bytes  [ 8B, 0D, B0, 68, 15, B0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCGetProviderPath + 45                                              71AB8A6C 44 Bytes  [ 8D, 43, 38, 89, 40, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCGetProviderPath + 72                                              71AB8A99 162 Bytes  [ 4B, 68, 89, BB, 90, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCGetProviderPath + 115                                             71AB8B3C 151 Bytes  [ 15, 54, 4D, 15, B0, 53, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCGetProviderPath + 1AD                                             71AB8BD4 5 Bytes  [ 00, 01, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCGetProviderPath + 1B3                                             71AB8BDA 45 Bytes  [ 15, 00, 4E, 15, B0, 8B, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStringToAddressA + 8E                                             71AB9166 28 Bytes  [ 78, 48, 8B, 49, 44, 8B, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAStringToAddressA + AB                                             71AB9183 248 Bytes  [ 00, 8B, 48, 48, 3B, CA, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringA + 86                                             71AB927C 131 Bytes  [ 8B, 45, 14, B9, 10, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringA + 10A                                            71AB9300 161 Bytes  [ 8B, 91, 1C, 8A, 17, B0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringA + 1AC                                            71AB93A2 204 Bytes  [ 15, A4, 68, 15, B0, 89, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAddressToStringA + 279                                            71AB946F 148 Bytes  [ 00, 00, 8B, 48, 0C, 3B, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetLastError + 28                                                 71AB9504 157 Bytes  [ 0C, 89, 15, B0, 68, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockname + 84                                                     71AB95A2 99 Bytes  [ 55, 8B, EC, 8B, 0D, 84, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockname + E8                                                     71AB9606 43 Bytes  [ 0C, 56, 8B, 30, 6A, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getsockname + 114                                                    71AB9632 63 Bytes  [ 6F, 00, 72, 00, 65, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!closesocket + 39                                                     71AB9672 29 Bytes  [ 5C, 00, 4D, 00, 61, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!closesocket + 57                                                     71AB9690 1 Byte  [ 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!closesocket + 59                                                     71AB9692 2 Bytes  [ 43, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!closesocket + 5C                                                     71AB9695 30 Bytes  [ 00, 72, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!closesocket + 7B                                                     71AB96B4 79 Bytes  [ 5C, 00, 53, 00, 65, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAHtons + D4                                                        71ABBE85 101 Bytes  [ 4D, FC, 8B, 91, B4, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAHtons + 13A                                                       71ABBEEB 52 Bytes  [ 00, 00, 4F, 8B, FF, D9, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAHtons + 16F                                                       71ABBF20 125 Bytes  [ 8B, 4D, F8, 8B, 92, B8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAHtons + 1EF                                                       71ABBFA0 148 Bytes  [ D9, 40, 04, 83, C0, 20, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAHtons + 284                                                       71ABC035 271 Bytes  [ 40, 00, 00, 8C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!GetNameInfoW + 11                                                    71ABC4FD 498 Bytes  [ 31, 76, 31, 7B, 31, 86, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getnameinfo + 7F                                                     71ABC6F0 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getnameinfo + 82                                                     71ABC6F3 24 Bytes  [ 00, A8, 30, 00, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getnameinfo + 9B                                                     71ABC70C 343 Bytes  [ 76, 30, D6, 30, 3C, 31, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getnameinfo + 1F3                                                    71ABC864 108 Bytes  [ 6B, 30, 87, 31, D8, 31, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getnameinfo + 260                                                    71ABC8D1 255 Bytes  [ 50, 02, 00, 9C, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACancelBlockingCall + 2A                                           71ABD41C 2 Bytes  [ 51, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACancelBlockingCall + 2D                                           71ABD41F 8 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACancelBlockingCall + 36                                           71ABD428 87 Bytes  [ 89, 9C, 01, 60, 51, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAIsBlocking + 3F                                                   71ABD480 80 Bytes  [ C1, E1, 05, 89, B4, 01, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetBlockingHook + 3D                                              71ABD4D1 30 Bytes  [ 8D, 8C, 01, D0, 50, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAUnhookBlockingHook                                                71ABD4F0 47 Bytes  [ 20, 52, 00, 00, C1, E2, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAUnhookBlockingHook + 31                                           71ABD521 62 Bytes  [ FF, FF, FF, FF, 8B, 88, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAUnhookBlockingHook + 70                                           71ABD560 8 Bytes  [ 90, CC, 50, 00, 00, 8B, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAUnhookBlockingHook + 79                                           71ABD569 118 Bytes  [ 00, 00, 85, C9, 0F, 84, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAUnhookBlockingHook + F1                                           71ABD5E1 36 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketW + 3D                                             71ABDB31 10 Bytes  [ 33, 3B, F3, 74, 72, 57, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketW + 48                                             71ABDB3C 5 Bytes  [ FF, 56, E8, 5D, EA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketW + 4E                                             71ABDB42 73 Bytes  [ FF, 8B, 86, 48, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketA + A                                              71ABDB8C 11 Bytes  [ 8B, 40, 24, 8D, 14, 80, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketA + 16                                             71ABDB98 23 Bytes  [ B4, 97, B8, 28, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketA + 2E                                             71ABDBB0 9 Bytes  [ FF, 8B, 03, 3B, C3, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketA + 3A                                             71ABDBBC 7 Bytes  [ 03, 8D, 49, 00, 8B, 88, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSADuplicateSocketA + 42                                             71ABDBC4 5 Bytes  [ FF, FF, 05, D8, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsA + 31                                               71ABDC78 36 Bytes  [ 74, 2A, FF, 8A, 50, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsA + 57                                               71ABDC9E 43 Bytes  [ 89, 90, 14, 01, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsA + 83                                               71ABDCCA 26 Bytes  [ 8D, 9B, 00, 00, 00, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsA + 9E                                               71ABDCE5 24 Bytes  [ 00, 00, 00, 8B, 42, 20, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumProtocolsA + B7                                               71ABDCFE 17 Bytes  [ 1C, 85, F6, 74, 11, 8B, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobynumber + AD                                                71ABE161 66 Bytes  [ 8B, 45, D8, 85, C0, 74, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobyname + 2E                                                  71ABE1A4 29 Bytes  [ 1E, 41, 81, F9, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobyname + 4C                                                  71ABE1C2 108 Bytes  [ 8B, 5D, FC, EB, 4E, B9, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobyname + BA                                                  71ABE230 68 Bytes  [ 00, 8B, 7D, 14, D9, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobyname + FF                                                  71ABE275 48 Bytes  [ 00, 00, 75, DF, DB, 9F, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getprotobyname + 130                                                 71ABE2A6 8 Bytes  [ 05, 08, 05, 00, 00, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByNumber + 4                                         71ABE2AF 57 Bytes  [ 45, F8, 43, 3B, D8, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByNumber + 3F                                        71ABE2EA 38 Bytes  [ 41, 3B, CE, 72, E1, 8D, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByNumber + 66                                        71ABE311 179 Bytes  [ FF, 55, 8B, EC, 83, EC, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSACancelAsyncRequest + 96                                           71ABE3C5 356 Bytes  [ 4D, EC, 89, 45, FC, 73, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyaddr + B2                                                   71ABE52B 16 Bytes  [ 2B, F1, 8B, 0B, 8D, 14, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyaddr + C3                                                   71ABE53C 44 Bytes  [ 53, 44, 89, 4D, DC, 8B, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyaddr + F0                                                   71ABE569 32 Bytes  [ 00, 00, 89, 45, E0, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!gethostbyaddr + 111                                                  71ABE58A 22 Bytes  [ 45, F8, 8D, 0C, 02, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyport + 4                                                    71ABE5A1 89 Bytes  [ 14, 86, 89, 11, 8B, 55, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyport + 5F                                                   71ABE5FC 68 Bytes  [ 03, D0, 8B, 45, E0, 89, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyport + A5                                                   71ABE642 79 Bytes  [ 0C, 85, C0, 74, 41, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyport + F5                                                   71ABE692 59 Bytes  [ 8B, C8, 8B, 45, 08, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyport + 131                                                  71ABE6CE 125 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyname + 62                                                   71ABE74D 95 Bytes  [ 00, 0F, 86, CA, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyname + C3                                                   71ABE7AE 90 Bytes  [ 00, 00, 8B, 45, F0, 8B, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyname + 11E                                                  71ABE809 15 Bytes  [ FF, 45, E4, 8B, 55, 10, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyname + 12E                                                  71ABE819 22 Bytes  [ FF, FF, 8B, 55, 08, 8B, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getservbyname + 145                                                  71ABE830 120 Bytes  [ D6, 8B, 75, DC, 39, 75, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByName + 5A                                           71ABE8A9 26 Bytes  JMP E47623BA 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByName + 76                                           71ABE8C5 22 Bytes  [ FC, 2B, C8, 8B, 34, 01, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByName + 8D                                           71ABE8DC 10 Bytes  [ 45, C8, 89, 57, 08, 2B, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByName + 98                                           71ABE8E7 8 Bytes  [ 47, 30, 8B, 45, 10, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByName + A1                                           71ABE8F0 102 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByPort + 5C                                           71ABE957 2 Bytes  [ 4F, 38 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByPort + 5F                                           71ABE95A 2 Bytes  [ 45, CC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByPort + 62                                           71ABE95D 17 Bytes  [ 45, 08, 8B, 40, 08, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetServByPort + 74                                           71ABE96F 110 Bytes  [ 2B, C2, 85, C9, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetHostByName + 59                                           71ABE9DE 78 Bytes  [ 45, EC, 8B, 00, 2B, C3, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetHostByAddr + 2                                            71ABEA2D 120 Bytes  [ 45, E4, 8B, 55, 10, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetHostByAddr + 7B                                           71ABEAA6 5 Bytes  [ 55, 0C, 8B, 45, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetHostByAddr + 82                                           71ABEAAD 27 Bytes  [ DC, 2B, C1, 4A, 3B, C1, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetHostByAddr + 9E                                           71ABEAC9 15 Bytes  [ C8, 8B, 45, 08, 8B, 40, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByName + 4                                           71ABEAD9 70 Bytes  [ 4D, F8, 8B, F1, C1, EE, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByName + 4B                                          71ABEB20 35 Bytes  [ 30, 8B, 45, 10, 5F, 5E, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByName + 6F                                          71ABEB44 263 Bytes  [ EC, 83, EC, 40, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByName + 177                                         71ABEC4C 2 Bytes  [ 4D, E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncGetProtoByName + 17A                                         71ABEC4F 12 Bytes  [ 7D, CC, 50, D9, 46, 04, D8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnableNSProvider + 2D                                             71ABEE6E 6 Bytes  [ 00, D9, CA, D8, 86, 4C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnableNSProvider + 34                                             71ABEE75 32 Bytes  [ FF, FF, D9, C9, D8, 8F, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnableNSProvider + 55                                             71ABEE96 45 Bytes  [ FF, D9, C9, D8, 8F, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnableNSProvider + 85                                             71ABEEC6 30 Bytes  [ FF, D9, C9, D8, 8F, C8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCEnableNSProvider + A4                                             71ABEEE5 9 Bytes  [ FF, FF, D9, C9, D8, 8F, CC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteNameSpaceOrder + 7                                           71ABF008 36 Bytes  [ C1, E0, 02, 03, F8, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteNameSpaceOrder + 2C                                          71ABF02D 58 Bytes  [ 45, 08, 8B, 40, 08, 8D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteNameSpaceOrder + 67                                          71ABF068 25 Bytes  [ 45, 10, 5E, 5B, 8B, E5, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteNameSpaceOrder + 81                                          71ABF082 6 Bytes  [ 55, 8B, EC, 83, EC, 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteNameSpaceOrder + 89                                          71ABF08A 7 Bytes  [ 08, 53, 56, 57, 8B, 78, 04 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallNameSpace + 1C                                             71ABF151 288 Bytes  [ FC, 8B, 4D, F4, 2B, C1, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallNameSpace + 13D                                            71ABF272 153 Bytes  [ D8, 4F, 40, D9, CA, D8, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUnInstallNameSpace + B                                            71ABF30C 156 Bytes  [ D9, C9, D8, 4F, 7C, D9, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUnInstallNameSpace + A8                                           71ABF3A9 7 Bytes  [ D9, C9, D8, 8F, A8, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUnInstallNameSpace + B0                                           71ABF3B1 54 Bytes  [ D9, CA, D8, 86, 54, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUnInstallNameSpace + E7                                           71ABF3E8 16 Bytes  [ FF, D9, C9, D8, 8F, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUnInstallNameSpace + F8                                           71ABF3F9 30 Bytes  [ D9, C9, D8, 8F, B8, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetQOSByName + AD                                                 71ABF505 106 Bytes  [ 04, 24, D9, 1C, 8F, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetQOSByName + 118                                                71ABF570 62 Bytes  [ 4D, F4, 89, 45, 0C, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetQOSByName + 157                                                71ABF5AF 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetQOSByName + 159                                                71ABF5B1 56 Bytes  [ 8B, 45, FC, 2B, 45, F4, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvDisconnect + 14                                               71ABF5EA 57 Bytes  [ C0, 04, 3B, CE, 72, F0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvDisconnect + 4E                                               71ABF624 46 Bytes  [ EC, 83, EC, 24, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvFrom + 1                                                      71ABF653 56 Bytes  [ 45, 0C, 83, C0, 02, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvFrom + 3A                                                     71ABF68C 129 Bytes  [ 8B, 45, FC, 55, 8B, D6, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvFrom + BC                                                     71ABF70E 7 Bytes  [ 5D, E0, 0F, AF, CA, 2B, C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvFrom + C4                                                     71ABF716 116 Bytes  [ 34, 88, 8D, 0C, 88, 89, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARecvFrom + 139                                                    71ABF78B 74 Bytes  [ 5F, 20, 51, 52, 56, 89, 7D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNameSpaceProvidersW + F                                       71ABFA38 53 Bytes  [ 81, FE, A0, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNameSpaceProvidersW + 45                                      71ABFA6E 27 Bytes  [ 40, 08, 8B, 11, 83, E8, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNameSpaceProvidersW + 61                                      71ABFA8A 42 Bytes  [ E5, 5D, C2, 0C, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNameSpaceProvidersW + 8C                                      71ABFAB5 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAEnumNameSpaceProvidersW + 8E                                      71ABFAB7 11 Bytes  CALL FAB43C47 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAInstallServiceClassW + D8                                         71ABFC89 62 Bytes  [ FF, FF, D9, CA, D8, 4F, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARemoveServiceClass + 2C                                           71ABFCC8 50 Bytes  [ D9, CB, D8, 4F, 50, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARemoveServiceClass + 5F                                           71ABFCFB 12 Bytes  [ 75, FC, 89, 45, EC, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARemoveServiceClass + 6C                                           71ABFD08 2 Bytes  [ 08, 81 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARemoveServiceClass + 6F                                           71ABFD0B 85 Bytes  [ FC, A0, 00, 00, 00, 72, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSARemoveServiceClass + C5                                           71ABFD61 28 Bytes  [ 34, 03, 89, 30, 8B, 71, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdA + 27                                71ABFDAE 19 Bytes  [ 75, 08, 8B, 5E, 04, 8B, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdA + 3B                                71ABFDC2 1 Byte  [ E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdA + 3D                                71ABFDC4 3 Bytes  [ 4D, F4, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdA + 41                                71ABFDC8 63 Bytes  [ 12, 00, 00, 8B, 43, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdA + 81                                71ABFE08 3 Bytes  [ 4D, F0, 89 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdW + C                                 71ABFF75 127 Bytes  [ FF, FF, D9, CA, D8, 4F, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdW + 8C                                71ABFFF5 50 Bytes  CALL 75A87585 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdW + BF                                71AC0028 184 Bytes  [ D9, CA, D8, 46, F8, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdW + 178                               71AC00E1 4 Bytes  [ 55, F8, 2B, C8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassNameByClassIdW + 17D                               71AC00E6 224 Bytes  [ 45, 0C, 03, CA, C1, F9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassInfoW + 86                                         71AC01C7 23 Bytes  [ C1, 0F, AF, 45, 10, 8D, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassInfoW + 9E                                         71AC01DF 8 Bytes  [ 3C, CD, 00, 00, 00, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassInfoW + A7                                         71AC01E8 27 Bytes  [ 4D, DC, 8D, 0C, 82, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassInfoW + C3                                         71AC0204 71 Bytes  CALL F5984794 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAGetServiceClassInfoW + 10B                                        71AC024C 48 Bytes  [ C7, 08, 0F, AF, CD, C1, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceW + 14                                                  71AC027D 33 Bytes  [ F8, 89, 45, FC, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceW + 36                                                  71AC029F 132 Bytes  [ 04, 89, 70, 04, 8B, 71, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceW + BB                                                  71AC0324 110 Bytes  [ 8B, 4F, 38, 8B, D3, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceW + 12A                                                 71AC0393 88 Bytes  [ 00, 2B, CB, 0F, AF, CD, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAInstallServiceClassA + 43                                         71AC03EC 327 Bytes  [ 4D, DC, 8B, 5D, E0, 0F, AF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceA + 7A                                                  71AC0534 31 Bytes  [ EC, 83, EC, 14, 8B, 55, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceA + 9A                                                  71AC0554 3 Bytes  [ 7D, EC, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceA + 9E                                                  71AC0558 30 Bytes  CALL 71AC1B8F C:\WINDOWS\system32\WS2_32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceA + BD                                                  71AC0577 217 Bytes  [ 5D, F8, 8B, 55, F4, 55, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASetServiceA + 197                                                 71AC0651 5 Bytes  [ 51, 2C, 8D, 14, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncSelect + 1C                                                  71AC0995 108 Bytes  [ D8, 0F, D9, 46, F4, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAsyncSelect + 89                                                  71AC0A02 217 Bytes  [ D8, 46, CC, D9, CB, D8, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASendTo + 47                                                       71AC0ADC 24 Bytes  [ FF, D9, CA, D8, 4F, 40, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASendTo + 60                                                       71AC0AF5 14 Bytes  [ FF, FF, D9, CA, D8, 4F, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASendTo + 6F                                                       71AC0B04 11 Bytes  [ D9, CB, D8, 4F, 44, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASendTo + 7B                                                       71AC0B10 12 Bytes  [ FF, D9, CA, D8, 4F, 48, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSASendTo + 88                                                       71AC0B1D 111 Bytes  [ FF, D9, CB, D8, 4F, 48, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!getpeername + 3D                                                     71AC0B8D 84 Bytes  [ 75, 08, 81, 7D, FC, A0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!shutdown + 4                                                         71AC0BE2 75 Bytes  [ 34, 01, 89, 30, 8B, 73, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!shutdown + 50                                                        71AC0C2E 78 Bytes  [ 4E, 04, 8B, 41, 18, 8B, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAConnect + 14                                                      71AC0C7D 330 Bytes  [ C3, 08, 2B, F0, 89, 5D, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAccept + 1F                                                       71AC0DC8 40 Bytes  [ FF, FF, D9, CB, D8, 4F, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAccept + 48                                                       71AC0DF1 49 Bytes  [ D9, CA, D8, 4F, 44, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAccept + 7A                                                       71AC0E23 25 Bytes  [ FF, FF, D9, CA, D8, 4F, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAccept + 94                                                       71AC0E3D 39 Bytes  [ FF, FF, D9, CA, D8, 4F, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAAccept + BC                                                       71AC0E65 12 Bytes  [ FF, D9, CB, D8, 4F, 54, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAJoinLeaf + 1F                                                     71AC0F77 21 Bytes  [ D9, CA, D8, 8F, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAJoinLeaf + 35                                                     71AC0F8D 9 Bytes  [ 00, 00, D9, C9, D8, 86, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAJoinLeaf + 3F                                                     71AC0F97 14 Bytes  [ D9, CA, D8, 8F, 84, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAJoinLeaf + 4F                                                     71AC0FA7 106 Bytes  [ D9, CB, D8, 8F, 84, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSAJoinLeaf + BA                                                     71AC1012 81 Bytes  [ 55, 8B, EC, 8B, 55, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!accept + 3C                                                          71AC1064 28 Bytes  [ 40, 18, 0F, AF, C1, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!accept + 59                                                          71AC1081 112 Bytes  CALL 71AA438D C:\WINDOWS\system32\WS2HELP.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!accept + CA                                                          71AC10F2 207 Bytes  [ 45, 0C, 5B, 5F, 5E, 5D, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!accept + 19A                                                         71AC11C2 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!accept + 19C                                                         71AC11C4 34 Bytes  [ EC, 8B, 45, 08, 8B, 48, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUpdateProvider + 43                                               71AC12BC 13 Bytes  [ C1, EE, 03, 85, F6, 74, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUpdateProvider + 51                                               71AC12CA 48 Bytes  [ 19, 0F, BF, 5A, 02, 01, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUpdateProvider + 82                                               71AC12FB 64 Bytes  [ 1C, 83, C2, 10, 83, C1, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUpdateProvider + C3                                               71AC133C 41 Bytes  [ 48, 0C, 8B, 50, 08, 53, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCUpdateProvider + ED                                               71AC1366 131 Bytes  [ 0F, 84, 94, 00, 00, 00, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteProviderOrder + 2                                            71AC151B 11 Bytes  [ 7F, 00, 00, 03, C2, 0F, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteProviderOrder + E                                            71AC1527 40 Bytes  [ 87, 10, 01, 00, 00, 8B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteProviderOrder + 37                                           71AC1550 113 Bytes  [ 87, 10, 01, 00, 00, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteProviderOrder + A9                                           71AC15C2 56 Bytes  [ 7F, 00, 00, 03, C2, 8B, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCWriteProviderOrder + E2                                           71AC15FB 15 Bytes  [ D8, 8B, 87, 10, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallProvider + 35                                              71AC1682 3 Bytes  [ 8B, 55, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallProvider + 39                                              71AC1686 31 Bytes  [ D2, 74, 5E, 89, 55, 08, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallProvider + 59                                              71AC16A6 91 Bytes  [ 7F, 00, 00, 03, C2, 8B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallProvider + B5                                              71AC1702 198 Bytes  [ 55, 8B, EC, 83, EC, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCInstallProvider + 17C                                             71AC17C9 26 Bytes  [ C1, E3, 08, 01, 19, 0F, B6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCDeinstallProvider + 6D                                            71AC1A1E 84 Bytes  [ 03, C2, 8B, 51, 10, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCDeinstallProvider + C2                                            71AC1A73 58 Bytes  [ 51, 18, C1, F8, 0F, 03, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCDeinstallProvider + FD                                            71AC1AAE 52 Bytes  [ 87, 10, 01, 00, 00, 8B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCDeinstallProvider + 132                                           71AC1AE3 45 Bytes  [ 04, 81, EB, 80, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSCDeinstallProvider + 160                                           71AC1B11 75 Bytes  [ 7F, 00, 00, 03, C2, 8B, 51, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WPUCompleteOverlappedRequest + 1A                                    71AC1CC1 2 Bytes  [ 0F, AF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WPUCompleteOverlappedRequest + 1D                                    71AC1CC4 9 Bytes  [ 99, 81, E2, FF, 7F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WPUCompleteOverlappedRequest + 27                                    71AC1CCE 88 Bytes  [ 13, C1, F8, 0F, C1, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WPUCompleteOverlappedRequest + 80                                    71AC1D27 7 Bytes  [ 40, 08, A8, 07, 8B, DA, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WPUCompleteOverlappedRequest + 88                                    71AC1D2F 2 Bytes  [ 08, 89 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSApSetPostRoutine + 4E                                              71AC1F17 94 Bytes  [ 72, 33, C0, 49, 8B, 7D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSApSetPostRoutine + AD                                              71AC1F76 92 Bytes  [ 94, 9D, 08, 06, 00, 00, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSApSetPostRoutine + 10A                                             71AC1FD3 112 Bytes  [ 7F, 00, 00, 03, C2, 8B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSApSetPostRoutine + 17B                                             71AC2044 38 Bytes  [ 00, 8B, 40, 04, 0F, AF, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WSApSetPostRoutine + 1A2                                             71AC206B 52 Bytes  [ 00, 03, C2, C1, F8, 0F, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + 4C                                                             71AC2151 8 Bytes  [ BF, 56, 0C, 8B, D8, 8B, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + 57                                                             71AC215C 71 Bytes  [ 8B, 00, 0F, AF, C2, 99, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + 9F                                                             71AC21A4 35 Bytes  [ 7F, 00, 00, 03, C2, C1, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + C3                                                             71AC21C8 85 Bytes  [ 8B, 55, F8, 85, D2, 74, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2_32.dll!WEP + 119                                                            71AC221E 74 Bytes  [ 75, B2, 8B, 45, 0C, 5F, 5E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + FFFFD463                                    71AA1161 29 Bytes  [ 0D, 2C, 65, 15, B0, D8, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + FFFFD482                                    71AA1180 17 Bytes  [ 0F, B6, 71, 02, 0F, B6, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + FFFFD4F2                                    71AA11F0 7 Bytes  [ 8B, 01, 99, 81, E2, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + FFFFD4FA                                    71AA11F8 34 Bytes  [ 00, 03, C2, C1, F8, 10, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + FFFFD51E                                    71AA121C 34 Bytes  [ 03, C2, C1, F8, 10, 89, 46, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahReferenceContextByHandle + 7                                     71AA14A7 1 Byte  [ 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahReferenceContextByHandle + 9                                     71AA14A9 18 Bytes  [ 48, 0C, 8B, 50, 08, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahReferenceContextByHandle + 1C                                    71AA14BC 196 Bytes  [ EE, 03, 85, F6, 0F, 84, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenCurrentThread + 4                                            71AA1581 52 Bytes  [ FF, 55, 8B, EC, 83, EC, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenCurrentThread + 39                                           71AA15B6 169 Bytes  [ C7, 45, 08, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenCurrentThread + E4                                           71AA1661 88 Bytes  [ 10, 5F, 5E, 5B, 8B, E5, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenCurrentThread + 13E                                          71AA16BB 89 Bytes  [ 8B, 4D, F4, 4A, 8B, 7D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahInsertHandleContext + 9                                          71AA1715 134 Bytes  [ 4D, F4, 4A, 8B, 7D, FC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahInsertHandleContext + 90                                         71AA179C 28 Bytes  [ 48, 08, 8B, 50, 0C, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahInsertHandleContext + AE                                         71AA17BA 46 Bytes  [ 56, 57, 89, 55, 08, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahInsertHandleContext + DD                                         71AA17E9 12 Bytes  [ 4F, 20, 74, 5E, D9, 44, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahInsertHandleContext + EA                                         71AA17F6 165 Bytes  [ D8, 4F, 10, D9, C9, D9, C2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateHandleContextTable + 15                                    71AA196D 87 Bytes  [ 6F, 68, 08, 0F, 72, E2, 0E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateHandleContextTable + 6D                                    71AA19C5 5 Bytes  [ 81, 4C, 01, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateHandleContextTable + 73                                    71AA19CB 9 Bytes  [ 4D, 0C, 41, 89, 45, F0, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateHandleContextTable + 7D                                    71AA19D5 13 Bytes  [ 75, F8, 8B, 5D, 08, C1, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateHandleContextTable + 8B                                    71AA19E3 9 Bytes  [ 5D, FC, 8B, 4D, 08, 8B, 7D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenApcHelper + 47                                               71AA1A72 63 Bytes  [ F0, 0F, 7F, 58, F8, 75, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenApcHelper + 87                                               71AA1AB2 66 Bytes  JMP 71AA19DF C:\WINDOWS\system32\WS2HELP.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenApcHelper + CA                                               71AA1AF5 128 Bytes  [ FF, 8B, E5, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenApcHelper + 14C                                              71AA1B77 10 Bytes  [ 00, 8B, 90, 4C, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenApcHelper + 157                                              71AA1B82 136 Bytes  [ 89, 55, FC, 89, 45, F4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenNotificationHandleHelper + C                                 71AA1C0B 14 Bytes  [ 89, 55, EC, 74, 07, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenNotificationHandleHelper + 1B                                71AA1C1A 82 Bytes  [ 8B, 80, 4C, 01, 00, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenNotificationHandleHelper + 6E                                71AA1C6D 143 Bytes  [ 0C, 17, 0F, F5, 5C, 17, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenNotificationHandleHelper + FE                                71AA1CFD 9 Bytes  [ 4C, 01, 00, 00, 8B, 5E, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahWaitForNotification + 8                                          71AA1D07 76 Bytes  CALL 71A9DB8D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahWaitForNotification + 55                                         71AA1D54 10 Bytes  [ EC, 83, EC, 14, 8B, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahWaitForNotification + 60                                         71AA1D5F 12 Bytes  [ 51, 08, 53, 8B, 1D, 80, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahWaitForNotification + 6D                                         71AA1D6C 42 Bytes  [ 71, 18, 57, 8B, 79, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahWaitForNotification + 98                                         71AA1D97 8 Bytes  CALL 71AA178D C:\WINDOWS\system32\WS2HELP.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateNotificationHandle + 21                                    71AA20BB 126 Bytes  [ 46, 40, 89, 7E, 28, 8B, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateNotificationHandle + A1                                    71AA213B 115 Bytes  [ 00, 00, 74, 7D, 8B, 55, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateNotificationHandle + 115                                   71AA21AF 44 Bytes  [ 46, 40, 8B, 45, 08, 5E, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateNotificationHandle + 142                                   71AA21DC 19 Bytes  [ 00, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateNotificationHandle + 156                                   71AA21F0 1 Byte  [ 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnumerateHandleContexts + 18                                     71AA22E9 60 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnumerateHandleContexts + 55                                     71AA2326 24 Bytes  [ 00, 00, 0F, 84, B8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnumerateHandleContexts + 6E                                     71AA233F 8 Bytes  CALL 3D2F3248 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnumerateHandleContexts + 77                                     71AA2348 43 Bytes  [ 46, 18, 85, C0, 74, 19, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCloseApcHelper + 12                                              71AA2375 62 Bytes  [ 00, 56, 57, FF, 15, C8, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCloseApcHelper + 51                                              71AA23B4 99 Bytes  [ 00, 00, 52, 6A, 01, 81, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCloseApcHelper + B5                                              71AA2418 14 Bytes  [ 15, C4, 4C, 15, B0, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCloseApcHelper + C4                                              71AA2427 63 Bytes  [ 96, F0, 00, 00, 00, B9, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCloseApcHelper + 104                                             71AA2467 43 Bytes  [ 0F, 95, C1, 83, C1, 30, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahQueueUserApc + E6                                                71AA2B9B 43 Bytes  [ 0B, C0, 74, 14, 32, ED, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahQueueUserApc + 112                                               71AA2BC7 21 Bytes  [ FF, 02, C3, D9, ED, D9, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahQueueUserApc + 128                                               71AA2BDD 10 Bytes  [ FF, 41, 75, D2, D9, F1, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahQueueUserApc + 133                                               71AA2BE8 73 Bytes  [ FF, FF, 02, DD, D8, DB, 2D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahQueueUserApc + 17D                                               71AA2C32 10 Bytes  [ E2, 15, B0, 83, F8, 01, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateSocketHandle + 5B                                          71AA3165 34 Bytes  JMP 52898AC3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateSocketHandle + 7E                                          71AA3188 86 Bytes  [ 55, 8B, EC, 51, 51, DD, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateSocketHandle + D5                                          71AA31DF 32 Bytes  [ 18, 0F, 8B, 89, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateSocketHandle + F6                                          71AA3200 83 Bytes  [ F8, DC, 1D, 10, 64, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahCreateSocketHandle + 14A                                         71AA3254 5 Bytes  [ E3, 15, B0, E9, 84 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnableNonIFSHandleSupport + 29                                   71AA338C 8 Bytes  [ B5, 7C, FF, FF, FF, E8, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnableNonIFSHandleSupport + 32                                   71AA3395 61 Bytes  [ 00, 83, C4, 0C, 85, C0, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnableNonIFSHandleSupport + 70                                   71AA33D3 4 Bytes  [ 8D, 85, 78, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnableNonIFSHandleSupport + 75                                   71AA33D8 113 Bytes  [ FF, 50, 8D, 45, 80, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahEnableNonIFSHandleSupport + E7                                   71AA344A 10 Bytes  [ 55, 8B, EC, 8B, 45, 0E, B9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahDisableNonIFSHandleSupport + 29                                  71AA358A 91 Bytes  [ B0, DD, 45, 08, DA, E9, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahDisableNonIFSHandleSupport + 85                                  71AA35E6 100 Bytes  [ 4A, F6, 45, 0E, 10, 74, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahDisableNonIFSHandleSupport + EA                                  71AA364B 104 Bytes  [ 08, 83, 65, B8, 00, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahDisableNonIFSHandleSupport + 153                                 71AA36B4 3 Bytes  [ 10, A8, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahDisableNonIFSHandleSupport + 157                                 71AA36B8 53 Bytes  [ 74, 0B, 83, 4E, 04, 01, C7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenHandleHelper + 13                                            71AA388E 112 Bytes  [ 00, EB, 0C, 8B, 07, 25, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenHandleHelper + 84                                            71AA38FF 4 Bytes  CALL 71AA3B96 C:\WINDOWS\system32\WS2HELP.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenHandleHelper + 89                                            71AA3904 68 Bytes  [ 00, 59, 83, E6, F7, E9, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenHandleHelper + CE                                            71AA3949 371 Bytes  [ 00, 23, C1, 0F, 84, 8C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahOpenHandleHelper + 242                                           71AA3ABD 42 Bytes  [ DD, 45, F0, D9, E0, DD, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + A                                           71AA3D08 59 Bytes  [ BC, 89, 02, 00, 9E, 89, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + 46                                          71AA3D44 59 Bytes  [ 3C, 87, 02, 00, 46, 87, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + 82                                          71AA3D80 15 Bytes  [ C2, 83, 02, 00, AA, 83, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + 92                                          71AA3D90 15 Bytes  [ C0, 86, 02, 00, A6, 86, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WS2HELP.dll!WahNotifyAllProcesses + A2                                          71AA3DA0 59 Bytes  [ 64, 86, 02, 00, 54, 86, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + FFFBB348                               5B861491 4 Bytes  [ 9D, EF, 38, 5A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + FFFBB34D                               5B861496 119 Bytes  [ ED, 38, 89, FF, EB, 38, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + FFFBB8F6                               5B861A3F 315 Bytes  [ 39, 90, BA, FD, 38, BC, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + FFFBBA32                               5B861B7B 186 Bytes  [ B9, 14, 3F, 04, B9, 4C, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + FFFBBAED                               5B861C36 62 Bytes  [ 67, B9, 97, C3, 67, B9, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNtStatusToApiStatus + 28                                       5B863C38 8 Bytes  [ 66, 89, 58, 02, 83, C7, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNtStatusToApiStatus + 31                                       5B863C41 65 Bytes  [ 7D, 9C, 0F, B7, C7, 40, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNtStatusToApiStatus + 78                                       5B863C88 19 Bytes  [ FF, FF, FF, FF, B1, D8, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNtStatusToApiStatus + 8C                                       5B863C9C 75 Bytes  [ 1C, 61, 93, 7C, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNtStatusToApiStatus + D8                                       5B863CE8 25 Bytes  CALL 5B853871 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferFree + 14                                              5B867764 14 Bytes  [ BE, D2, 00, 00, CE, D2, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferFree + 23                                              5B867773 32 Bytes  [ 00, FE, D2, 00, 00, 0E, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferFree + 44                                              5B867794 31 Bytes  [ 7E, D3, 00, 00, 8E, D3, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferFree + 64                                              5B8677B4 83 Bytes  [ FE, D3, 00, 00, 0E, D4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferFree + B8                                              5B867808 31 Bytes  [ 4E, D5, 00, 00, 5E, D5, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAccessCheckAndAudit + 7D                                       5B868748 58 Bytes  [ BE, 9F, 00, 00, D6, 9F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareGetInfo + 25                                               5B868783 23 Bytes  [ 00, 1F, A1, 00, 00, 32, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareGetInfo + 3E                                               5B86879C 6 Bytes  [ B0, A1, 00, 00, C8, A1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareGetInfo + 45                                               5B8687A3 11 Bytes  [ 00, DE, A1, 00, 00, F6, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareGetInfo + 52                                               5B8687B0 10 Bytes  [ 27, A2, 00, 00, 34, A2, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareGetInfo + 5D                                               5B8687BB 19 Bytes  [ 00, 63, A2, 00, 00, 6F, A2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDbgPrint + 21                                                  5B868A6B 19 Bytes  [ 00, 3A, B2, 00, 00, 4A, B2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDbgPrint + 36                                                  5B868A80 51 Bytes  [ A2, B2, 00, 00, AE, B2, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDbgPrint + 6A                                                  5B868AB4 23 Bytes  [ A3, B3, 00, 00, B7, B3, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDbgPrint + 82                                                  5B868ACC 11 Bytes  [ 35, B4, 00, 00, 51, B4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDbgPrint + 8E                                                  5B868AD8 7 Bytes  [ 80, B4, 00, 00, 94, B4, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferAllocate + 2A                                          5B868C33 19 Bytes  [ 00, 05, BB, 00, 00, 1B, BB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsRemote + B                                                   5B868C47 39 Bytes  [ 00, 74, BB, 00, 00, 88, BB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsRemote + 34                                                  5B868C70 18 Bytes  [ 18, BC, 00, 00, 34, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsRemote + 48                                                  5B868C84 18 Bytes  [ 86, BC, 00, 00, 9D, BC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsRemote + 5B                                                  5B868C97 52 Bytes  [ 00, FC, BC, 00, 00, 0E, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyStringToBuffer + 30                                        5B868CCC 22 Bytes  JMP 59868D8E 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyStringToBuffer + 47                                        5B868CE3 15 Bytes  [ 00, 42, BE, 00, 00, 54, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyStringToBuffer + 57                                        5B868CF3 28 Bytes  [ 00, 86, BE, 00, 00, 99, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyStringToBuffer + 74                                        5B868D10 10 Bytes  [ 1E, BF, 00, 00, 34, BF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyStringToBuffer + 7F                                        5B868D1B 63 Bytes  [ 00, 5F, BF, 00, 00, 74, BF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnum + 2A                                                  5B868E8F 12 Bytes  [ 00, BA, C6, 00, 00, CC, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnum + 37                                                  5B868E9C 19 Bytes  [ 00, C7, 00, 00, 14, C7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnum + 4B                                                  5B868EB0 26 Bytes  [ 7B, C7, 00, 00, 8B, C7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnum + 67                                                  5B868ECC 27 Bytes  [ FC, C7, 00, 00, 0D, C8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnum + 83                                                  5B868EE8 6 Bytes  [ 7F, C8, 00, 00, 94, C8 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBitsEx + 15                                   5B868F75 9 Bytes  [ CA, 00, 00, 8D, CA, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBitsEx + 20                                   5B868F80 26 Bytes  [ A3, CA, 00, 00, AB, CA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBitsEx + 3C                                   5B868F9C 7 Bytes  [ E0, CA, 00, 00, E8, CA, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBitsEx + 44                                   5B868FA4 6 Bytes  [ F1, CA, 00, 00, F7, CA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBitsEx + 4B                                   5B868FAB 12 Bytes  [ 00, FF, CA, 00, 00, 07, CB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinInformation + 1D                                         5B8698C1 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinInformation + 24                                         5B8698C8 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinInformation + 39                                         5B8698DD 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinInformation + 41                                         5B8698E5 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinInformation + 47                                         5B8698EB 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteComputerSupports + B                                      5B8699AC 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteComputerSupports + 30                                     5B8699D1 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteComputerSupports + 3C                                     5B8699DD 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteComputerSupports + 45                                     5B8699E6 39 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteComputerSupports + 6D                                     5B869A0E 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaGetInfo + 19                                               5B869A53 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaGetInfo + 22                                               5B869A5C 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaGetInfo + 34                                               5B869A6E 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaGetInfo + 3F                                               5B869A79 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaGetInfo + 45                                               5B869A7F 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserGetInfo + 23                                           5B869AFB 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserGetInfo + 35                                           5B869B0D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserGetInfo + 3D                                           5B869B15 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserGetInfo + 43                                           5B869B1B 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserGetInfo + 50                                           5B869B28 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathType + F                                                  5B869E1E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathType + 1C                                                 5B869E2B 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathType + 28                                                 5B869E37 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathType + 38                                                 5B869E47 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathType + 3D                                                 5B869E4C 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCanonicalize + 5                                          5B869FCE 69 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCanonicalize + 4B                                         5B86A014 3 Bytes  [ 2C, 05, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCanonicalize + 4F                                         5B86A018 6 Bytes  [ 2D, 05, 00, 00, 2E, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCanonicalize + 57                                         5B86A020 30 Bytes  [ 2F, 05, 00, 00, 30, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCanonicalize + 76                                         5B86A03F 7 Bytes  [ 00, 37, 05, 00, 00, 38, 05 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCanonicalize + 15                                         5B86A116 23 Bytes  JMP 7287891B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCanonicalize + 2D                                         5B86A12E 27 Bytes  [ 34, 00, 35, 00, 36, 00, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCanonicalize + 49                                         5B86A14A 9 Bytes  [ 42, 00, 43, 00, 44, 00, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCanonicalize + 53                                         5B86A154 61 Bytes  [ 47, 00, 48, 00, 58, 00, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCanonicalize + 91                                         5B86A192 99 Bytes  [ 57, 00, 57, 00, 57, 00, 57, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseEnum + 6F                                                    5B86A3CF 216 Bytes  [ 00, 33, 03, 09, 80, 34, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseEnum + 148                                                   5B86A4A8 16 Bytes  [ 10, 80, F1, 04, 00, 00, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseEnum + 159                                                   5B86A4B9 14 Bytes  [ 00, F5, 04, 00, 00, F6, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseEnum + 168                                                   5B86A4C8 268 Bytes  [ A7, 06, A8, 06, A9, 06, AA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseEnum + 275                                                   5B86A5D5 78 Bytes  [ 1B, 8D, 1B, 8C, 1B, 92, 1B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetInfo + 35                                                5B86AA2E 12 Bytes  [ 01, 00, CF, 02, 00, C0, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetInfo + 42                                                5B86AA3B 2 Bytes  [ C0, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetInfo + 45                                                5B86AA3E 15 Bytes  [ 01, 00, DF, 02, 00, C0, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetInfo + 55                                                5B86AA4E 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetInfo + 57                                                5B86AA50 10 Bytes  [ EC, 02, 00, C0, 20, 00, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameValidate + 42                                             5B86AEFB 36 Bytes  [ 00, 00, 83, C6, 08, 3B, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameValidate + 68                                             5B86AF21 21 Bytes  [ 8B, 40, 30, 8B, 40, 68, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameValidate + 7E                                             5B86AF37 27 Bytes  CALL 5B8698CB C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameValidate + 9A                                             5B86AF53 82 Bytes  [ 01, 00, 00, 80, BF, 86, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameValidate + ED                                             5B86AFA6 49 Bytes  [ 83, 4D, FC, FF, 0F, B7, 0E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCanonicalize + C                                          5B86B16A 17 Bytes  [ C7, 00, 30, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCanonicalize + 1E                                         5B86B17C 28 Bytes  [ 90, 88, 00, 00, 00, 03, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCanonicalize + 3B                                         5B86B199 46 Bytes  [ 5B, 5D, C2, 04, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCanonicalize + 6A                                         5B86B1C8 23 Bytes  [ 8B, 4D, 0C, 8B, 55, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCanonicalize + 82                                         5B86B1E0 12 Bytes  [ 74, 20, 3D, 00, 80, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCanonicalize + 20                                         5B86B236 58 Bytes  [ 00, 00, 0B, C2, 41, 89, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCanonicalize + 5B                                         5B86B271 17 Bytes  [ 74, 70, 8B, 4D, 0C, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCanonicalize + 6D                                         5B86B283 12 Bytes  [ B8, 00, 80, 00, 00, C1, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCanonicalize + 7A                                         5B86B290 27 Bytes  [ 74, 20, 3D, 00, 80, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCanonicalize + 96                                         5B86B2AC 169 Bytes  [ FF, 05, 60, 87, 17, B0, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetComputerName + 7                                            5B86B39C 41 Bytes  [ 00, 7D, 64, 8B, 91, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetComputerName + 31                                           5B86B3C6 16 Bytes  [ 75, 18, 8B, 89, 04, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetComputerName + 42                                           5B86B3D7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetComputerName + 45                                           5B86B3DA 32 Bytes  [ 5F, 5E, 5D, C2, 0C, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetComputerName + 66                                           5B86B3FB 7 Bytes  [ 00, 00, 5F, 5E, 5D, C2, 0C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetServerEnum + 11                                               5B86B4C7 75 Bytes  [ 9E, 14, 01, 00, 00, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetServerEnum + 5E                                               5B86B514 94 Bytes  [ 00, 01, 00, 00, 00, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetServerEnum + BD                                               5B86B573 22 Bytes  [ 9A, 58, 01, 00, 00, EB, 9F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetServerEnum + D4                                               5B86B58A 2 Bytes  [ F7, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetServerEnum + D7                                               5B86B58D 32 Bytes  [ FF, 8B, 90, 00, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxRemoteApi + 93                                                   5B86B90A 108 Bytes  [ 00, 01, 00, 00, 00, 8B, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxRemoteApi + 100                                                  5B86B977 78 Bytes  [ 15, 08, 4E, 15, B0, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxRemoteApi + 14F                                                  5B86B9C6 52 Bytes  [ 75, 3A, 8B, 92, 48, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxRemoteApi + 186                                                  5B86B9FD 9 Bytes  [ 5E, 5D, C2, 0C, 00, C7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxRemoteApi + 190                                                  5B86BA07 182 Bytes  [ 00, 00, B8, 10, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetapipBufferAllocate + 2D                                         5B86BF34 2 Bytes  [ EC, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetapipBufferAllocate + 31                                         5B86BF38 27 Bytes  [ 08, 8B, 49, 60, 8B, 51, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetapipBufferAllocate + 4E                                         5B86BF55 23 Bytes  [ C0, 89, 7D, FC, 0F, 85, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetapipBufferAllocate + 66                                         5B86BF6D 23 Bytes  [ 00, 00, 85, C0, 0F, 85, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetapipBufferAllocate + 7E                                         5B86BF85 7 Bytes  [ 53, 6A, 00, 6A, 00, 6A, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsUncComputerNameValid + 19                                    5B86CA38 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsUncComputerNameValid + 1B                                    5B86CA3A 34 Bytes  [ 70, 04, 83, EE, 08, 89, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsUncComputerNameValid + 3E                                    5B86CA5D 9 Bytes  [ 12, 3B, 57, 04, 0F, 85, A7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsUncComputerNameValid + 48                                    5B86CA67 8 Bytes  [ 3B, D1, 0F, 85, 9F, 50, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpIsUncComputerNameValid + 51                                    5B86CA70 26 Bytes  [ 8D, 78, FF, FF, FF, 89, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleFreeMemory + 1                                               5B86CBE6 2 Bytes  [ 50, 60 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleFreeMemory + 4                                               5B86CBE9 2 Bytes  [ CF, C1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleFreeMemory + 7                                               5B86CBEC 44 Bytes  [ 03, 8D, 34, 0A, 8B, CF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleFreeMemory + 34                                              5B86CC19 192 Bytes  [ 42, 3B, 48, 44, 89, 50, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleFreeMemory + F5                                              5B86CCDA 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleGetPrimaryDomainInformation + 29                             5B86CD0E 2 Bytes  [ F0, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleGetPrimaryDomainInformation + 2C                             5B86CD11 56 Bytes  [ 56, 8D, 45, C0, 50, E8, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleGetPrimaryDomainInformation + 65                             5B86CD4A 46 Bytes  [ 83, 79, 4C, 00, 74, 09, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleGetPrimaryDomainInformation + 95                             5B86CD7A 62 Bytes  JMP 5B86BF1E C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleGetPrimaryDomainInformation + D5                             5B86CDBA 10 Bytes  [ 8B, 12, 3B, F2, 75, EA, E9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameW + 5                                                   5B86CE96 22 Bytes  [ 51, 51, 56, 6A, 0D, FF, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameW + 1C                                                  5B86CEAD 30 Bytes  [ F9, 11, FF, FF, 6A, 1A, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountW + 12                                       5B86CECC 50 Bytes  [ 01, 69, C0, 00, 5C, 26, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountW + 45                                       5B86CEFF 63 Bytes  [ 55, 8B, EC, 51, 53, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountW + 85                                       5B86CF3F 28 Bytes  [ 93, FE, FF, FF, 33, D2, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountW + A2                                       5B86CF5C 42 Bytes  [ 03, 45, 08, 03, F8, 8D, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountW + CD                                       5B86CF87 99 Bytes  [ 0F, B6, 87, F0, 1F, 91, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathType + 74                                                 5B86D366 12 Bytes  [ 89, 75, 88, 88, 5D, CB, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathType + 81                                                 5B86D373 13 Bytes  [ 8D, 3C, DE, 75, 04, 8D, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathType + 8F                                                 5B86D381 11 Bytes  [ 75, AC, 8B, 45, 0C, FF, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathType + 9B                                                 5B86D38D 35 Bytes  [ 89, 45, 84, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathType + BF                                                 5B86D3B1 23 Bytes  [ FF, FF, FF, 7E, 25, 91, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseAdd + C                                                      5B86D43C 26 Bytes  [ 90, 90, 90, 90, 90, 6A, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseAdd + 27                                                     5B86D457 77 Bytes  [ C8, 50, 6A, 02, 6A, 01, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseAdd + 75                                                     5B86D4A5 2 Bytes  [ 5D, C4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseAdd + 84                                                     5B86D4B4 87 Bytes  [ 51, 85, 94, 7C, 64, 85, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameValidate + 24                                             5B86D50C 35 Bytes  [ 45, B8, 8B, 47, 04, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameValidate + 48                                             5B86D530 4 Bytes  [ FF, 89, 45, CC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameValidate + 4D                                             5B86D535 1 Byte  [ C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameValidate + 4F                                             5B86D537 4 Bytes  [ 8D, 9F, 8A, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameValidate + 54                                             5B86D53C 31 Bytes  JMP 5B88267F C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCompare + 107                                             5B86EF94 19 Bytes  [ 5A, 77, 49, 6D, 70, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCompare + 11B                                             5B86EFA8 85 Bytes  [ 5A, 77, 49, 6E, 69, 74, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetNameCompare + 171                                             5B86EFFE 453 Bytes  [ 5A, 77, 4C, 69, 73, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCompare + 12D                                             5B86F1C4 75 Bytes  [ 5A, 77, 4F, 70, 65, 6E, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCompare + 179                                             5B86F210 88 Bytes  [ 72, 6F, 63, 65, 73, 73, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCompare + 1D2                                             5B86F269 28 Bytes  [ 68, 72, 65, 61, 64, 54, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwNameCompare + 1EF                                             5B86F286 588 Bytes  [ 78, 00, 5A, 77, 4F, 70, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLogonPutUnicodeString + 221                                    5B86F4D3 236 Bytes  [ 5A, 77, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLogonPutUnicodeString + 30E                                    5B86F5C0 229 Bytes  [ 74, 79, 4F, 62, 6A, 65, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLogonPutUnicodeString + 3F4                                    5B86F6A6 4 Bytes  [ 5A, 77, 51, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLogonPutUnicodeString + 3FA                                    5B86F6AC 16 Bytes  [ 79, 56, 6F, 6C, 75, 6D, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLogonPutUnicodeString + 40B                                    5B86F6BD 2 Bytes  [ 6E, 46 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitOemString + 18                                             5B86FA33 236 Bytes  [ 5A, 77, 53, 65, 74, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitOemString + 105                                            5B86FB20 224 Bytes  [ 5A, 77, 53, 65, 74, 53, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitOemString + 1E6                                            5B86FC01 290 Bytes  [ 5A, 77, 53, 65, 74, 56, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUseDel + 5B                                                     5B86FD24 292 Bytes  [ 6E, 6C, 6F, 61, 64, 4B, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDel + 31                                                   5B86FE49 45 Bytes  [ 5F, 43, 49, 63, 6F, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDel + 5F                                                   5B86FE77 28 Bytes  [ 5F, 5F, 69, 73, 63, 73, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDel + 7C                                                   5B86FE94 62 Bytes  [ 5F, 61, 6C, 6C, 64, 69, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDel + BB                                                   5B86FED3 258 Bytes  [ 5F, 61, 74, 6F, 69, 36, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBits + 1E                                     5B86FFD6 31 Bytes  [ 5F, 76, 73, 6E, 70, 72, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBits + 3E                                     5B86FFF6 39 Bytes  [ 5F, 77, 63, 73, 6C, 77, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerSetServiceBits + 66                                     5B87001E 100 Bytes  [ 5F, 77, 74, 6F, 6C, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetPrivilege + 57                                              5B870083 31 Bytes  [ 69, 73, 70, 72, 69, 6E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetPrivilege + 77                                              5B8700A3 110 Bytes  [ 69, 73, 77, 61, 6C, 70, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetPrivilege + E6                                              5B870112 76 Bytes  [ 6D, 65, 6D, 73, 65, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetPrivilege + 133                                             5B87015F 173 Bytes  [ 73, 74, 72, 6C, 65, 6E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonGetTimeServiceParentDomain + 6C                            5B87020D 81 Bytes  [ 63, 73, 63, 68, 72, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonGetTimeServiceParentDomain + BE                            5B87025F 35 Bytes  [ 77, 63, 73, 73, 74, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonGetTimeServiceParentDomain + E2                            5B870283 14 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonGetTimeServiceParentDomain + F1                            5B870292 10 Bytes  [ 00, BA, 00, 03, FE, 7F, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonGetTimeServiceParentDomain + FC                            5B87029D 13 Bytes  [ 90, B8, 02, 00, 00, 00, BA, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromWStr + 2                                          5B870EB9 35 Bytes  [ 12, C2, 10, 00, 90, B8, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromWStr + 26                                         5B870EDD 99 Bytes  [ 90, B8, C6, 00, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromWStr + 8A                                         5B870F41 55 Bytes  [ 00, 00, BA, 00, 03, FE, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromWStr + C2                                         5B870F79 3 Bytes  [ 12, C2, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromWStr + C6                                         5B870F7D 7 Bytes  [ 90, B8, D0, 00, 00, 00, BA ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareSetInfo + 31                                               5B8710F5 44 Bytes  [ 03, FE, 7F, FF, 12, C2, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareSetInfo + 5F                                               5B871123 14 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareSetInfo + 6F                                               5B871133 45 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareSetInfo + 9E                                               5B871162 6 Bytes  [ 00, BA, 00, 03, FE, 7F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareSetInfo + A5                                               5B871169 11 Bytes  [ 12, C2, 08, 00, 90, B8, EF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpReleasePrivilege + A                                           5B8713BD 9 Bytes  [ 90, B8, 14, 01, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpReleasePrivilege + 14                                          5B8713C7 13 Bytes  [ 7F, FF, 12, C2, 18, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpReleasePrivilege + 22                                          5B8713D5 8 Bytes  [ 03, FE, 7F, FF, 12, C2, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRegisterDomainNameChangeNotification                            5B8713DE 15 Bytes  [ B8, 16, 01, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRegisterDomainNameChangeNotification + 10                       5B8713EE 20 Bytes  [ B8, 17, 01, 00, 00, BA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRegisterDomainNameChangeNotification + 25                       5B871403 9 Bytes  [ BA, 00, 03, FE, 7F, FF, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRegisterDomainNameChangeNotification + 2F                       5B87140D 23 Bytes  [ 90, B8, 19, 01, 00, 00, BA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRegisterDomainNameChangeNotification + 47                       5B871425 48 Bytes  [ 03, FE, 7F, FF, 12, C2, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameAdd + B                                              5B871615 19 Bytes  [ DD, D8, DD, D8, DB, 2D, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameAdd + 1F                                             5B871629 53 Bytes  [ D9, C0, D9, FC, D8, D9, B1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameAdd + 55                                             5B87165F 52 Bytes  [ DE, C1, D9, FD, DD, D9, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameAdd + 8B                                             5B871695 34 Bytes  [ C3, 8B, 42, 04, 25, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameAdd + AE                                             5B8716B8 2 Bytes  [ 42, 04 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameDel + 8C                                             5B87176A 102 Bytes  [ E0, 20, 74, 18, B8, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameDel + F5                                             5B8717D3 13 Bytes  CALL 4703A8BB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameDel + 103                                            5B8717E1 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameDel + 106                                            5B8717E4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameDel + 108                                            5B8717E6 11 Bytes  [ F0, 3F, FF, FF, FF, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetSiteNameW + 9C                                                5B8726D3 131 Bytes  [ F1, 8B, 75, 0C, 8D, 45, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetSiteNameW + 120                                               5B872757 17 Bytes  [ 00, 00, D9, 5E, 28, 8D, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetSiteNameW + 132                                               5B872769 2 Bytes  [ 1C, 9A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetSiteNameW + 135                                               5B87276C 58 Bytes  [ 34, B2, 8B, 0C, 82, 8B, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsW + 2B                                      5B8727A7 45 Bytes  [ 04, D6, 8B, 47, 10, 89, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsW + 59                                      5B8727D5 12 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsW + 66                                      5B8727E2 15 Bytes  [ 55, 8B, EC, 83, EC, 14, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsW + 76                                      5B8727F2 3 Bytes  [ 80, A8, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsW + 7A                                      5B8727F6 104 Bytes  [ 00, 8B, 50, 04, 89, 4D, F4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerGetInfo + 88                                              5B87299E 43 Bytes  [ 4D, 10, 8B, 4D, 0C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerGetInfo + B4                                              5B8729CA 4 Bytes  [ 08, 8B, 88, A4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerGetInfo + B9                                              5B8729CF 146 Bytes  [ 00, 00, 8B, 80, A8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerGetInfo + 14C                                             5B872A62 67 Bytes  [ 5E, 18, D8, 4E, 20, 43, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerGetInfo + 190                                             5B872AA6 188 Bytes  [ 8B, 45, 0C, 8B, 4D, 10, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceGetInfo + 2                                              5B872D5B 43 Bytes  [ 8B, 93, A4, 00, 00, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceGetInfo + 2E                                             5B872D87 29 Bytes  CALL 5B8726FF C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceGetInfo + 4C                                             5B872DA5 90 Bytes  [ 72, A9, 8D, 4D, DC, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceGetInfo + A8                                             5B872E01 47 Bytes  CALL 5B87143E C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceGetInfo + D8                                             5B872E31 20 Bytes  [ 08, 89, 13, 8B, 88, A8, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnum + 21                                                 5B874FB4 3 Bytes  [ 89, 4D, E4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnum + 25                                                 5B874FB8 8 Bytes  CALL E97F9548 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnum + 2F                                                 5B874FC2 23 Bytes  [ 00, 00, 03, F2, 8B, 55, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnumEx + F                                                5B874FDA 11 Bytes  [ 85, FF, 75, 07, BF, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnumEx + 1B                                               5B874FE6 83 Bytes  [ 4D, 08, C7, 81, 20, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnumEx + 6F                                               5B87503A 3 Bytes  [ 86, 44, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnumEx + 74                                               5B87503F 103 Bytes  [ 89, 45, D0, 8B, 45, FC, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerEnumEx + DC                                               5B8750A7 50 Bytes  [ FC, 8B, 55, C8, 2B, C2, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpPackString + C6                                                5B8759E5 20 Bytes  [ 0C, 8B, 4D, F0, 3B, 4D, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpPackString + DB                                                5B8759FA 56 Bytes  [ 55, EC, 8B, 45, D0, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpPackString + 114                                               5B875A33 101 Bytes  [ 2B, C8, 8B, 45, 0C, 03, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpPackString + 17B                                               5B875A9A 114 Bytes  [ 00, 00, 8B, C8, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpPackString + 1EE                                               5B875B0D 111 Bytes  [ 48, 0C, 8B, 06, 89, 4D, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetQueryDisplayInformation + 5                                     5B875B7D 4 Bytes  [ C1, E0, 02, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetQueryDisplayInformation + A                                     5B875B82 19 Bytes  [ DC, 8B, 7D, D8, 8B, 45, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetQueryDisplayInformation + 20                                    5B875B98 69 Bytes  [ 76, 16, 8D, 9B, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetQueryDisplayInformation + 66                                    5B875BDE 153 Bytes  [ 5D, F8, 8B, 75, D4, 8D, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetQueryDisplayInformation + 100                                   5B875C78 68 Bytes  [ 1C, D9, CA, D8, 46, D4, D9, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetLocalGroups + AA                                         5B875E76 110 Bytes  [ FF, D9, C9, D8, 8F, C8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetLocalGroups + 11A                                        5B875EE6 137 Bytes  [ 00, 81, C7, E4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetLocalGroups + 1A4                                        5B875F70 7 Bytes  [ FF, 83, C4, 0C, 8B, 4D, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetLocalGroups + 1AC                                        5B875F78 2 Bytes  [ 4D, C4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetLocalGroups + 1AF                                        5B875F7B 48 Bytes  [ 08, 8B, 55, E4, 8B, 02, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsGet + 1                                               5B876167 63 Bytes  JMP 5B8727C8 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsGet + 42                                              5B8761A8 25 Bytes  [ 08, 60, 68, 60, 60, 60, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsGet + 5C                                              5B8761C2 74 Bytes  [ 00, 08, 00, 08, 00, 07, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsGet + A8                                              5B87620E 69 Bytes  [ 80, 8D, F8, FB, FF, FF, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsGet + EF                                              5B876255 63 Bytes  [ 83, 85, F4, FB, FF, FF, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaise + 37                                                 5B87D8D9 4 Bytes  [ 88, 20, 52, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaise + 3C                                                 5B87D8DE 29 Bytes  [ C1, E1, 05, C7, 84, 01, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaise + 5A                                                 5B87D8FC 79 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaise + AA                                                 5B87D94C 3 Bytes  [ 89, B9, AC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaise + AE                                                 5B87D950 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaiseEx + A                                                5B87D97D 35 Bytes  [ C1, E2, 05, 89, 84, 02, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaiseEx + 2E                                               5B87D9A1 11 Bytes  [ 52, 00, 00, C1, E2, 05, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaiseEx + 3B                                               5B87D9AE 40 Bytes  [ 00, 00, 00, 00, 8B, 90, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaiseEx + 64                                               5B87D9D7 56 Bytes  [ 79, 0E, 18, BF, 30, 31, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAlertRaiseEx + 9D                                               5B87DA10 28 Bytes  [ 00, 89, 99, AC, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetApiBufferReallocate + 43                                        5B87DA75 77 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditClear + 10                                                 5B87DAC3 12 Bytes  [ 85, C9, 74, 27, C1, E1, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditClear + 1E                                                 5B87DAD1 66 Bytes  [ 8B, 88, 20, 52, 00, 00, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditRead + 35                                                  5B87DB14 9 Bytes  [ C1, E1, 05, 89, 84, 01, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditRead + 3F                                                  5B87DB1E 1 Byte  [ 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditRead + 41                                                  5B87DB20 17 Bytes  [ 20, 52, 00, 00, 83, C2, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListCanonicalize + F                                          5B87DB32 68 Bytes  [ FF, FF, FF, 8B, 88, 20, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListCanonicalize + 54                                         5B87DB77 20 Bytes  [ 89, B0, 7C, 51, 00, 00, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListCanonicalize + 69                                         5B87DB8C 56 Bytes  [ CC, CC, CC, CC, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListCanonicalize + A3                                         5B87DBC6 38 Bytes  [ B8, 02, 00, 00, 00, 56, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListCanonicalize + CA                                         5B87DBED 9 Bytes  [ 4D, 80, 75, 23, 8D, 43, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetListTraverse + 1                                              5B87DD12 26 Bytes  [ 51, 50, 0F, AF, D0, B8, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCompare + C                                               5B87DD2D 20 Bytes  [ 00, 00, 8B, 37, 3B, F7, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCompare + 21                                              5B87DD42 4 Bytes  [ 4D, 8C, 8B, 86 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetPathCompare + 26                                              5B87DD47 254 Bytes  [ 00, 00, 00, 83, C6, F4, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGet + D                                                   5B87DE46 38 Bytes  [ 83, 7E, 3C, 03, 75, 22, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGet + 34                                                  5B87DE6D 34 Bytes  [ 00, 8B, B6, 28, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGet + 57                                                  5B87DE90 2 Bytes  [ 8B, 88 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGet + 5A                                                  5B87DE93 194 Bytes  [ FF, FF, FF, 05, D8, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGetAll + 94                                               5B87DF56 71 Bytes  [ 8B, 52, 24, 8D, 14, 92, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGetAll + DC                                               5B87DF9E 83 Bytes  [ 00, 00, 83, BA, 14, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGetAll + 130                                              5B87DFF2 20 Bytes  [ 21, 8B, 4D, FC, 85, C9, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGetAll + 145                                              5B87E007 34 Bytes  [ 0C, 8B, 89, 08, C7, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConfigGetAll + 168                                              5B87E02A 35 Bytes  [ C9, 01, 89, 48, 10, 8B, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnregisterDomainNameChangeNotification + 9                      5B87E1D2 3 Bytes  [ 00, 85, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnregisterDomainNameChangeNotification + D                      5B87E1D6 41 Bytes  [ 8B, 3D, 10, 4E, 15, B0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnregisterDomainNameChangeNotification + 37                     5B87E200 101 Bytes  [ 00, 00, 00, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetStatisticsGet + 61                                              5B87E266 6 Bytes  [ 0C, EB, 07, 8D, A4, 24 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetStatisticsGet + 69                                              5B87E26E 134 Bytes  [ 00, 00, 8B, 93, A8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetStatisticsGet + F0                                              5B87E2F5 9 Bytes  [ 8B, 45, F8, 0F, AF, C7, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetStatisticsGet + FA                                              5B87E2FF 2 Bytes  [ 7F, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetStatisticsGet + FD                                              5B87E302 23 Bytes  [ 03, C2, C1, F8, 0F, 3D, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessAdd + 4A                                                5B87E4C5 142 Bytes  [ F5, E1, 0F, FE, E5, 0F, F5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessAdd + D9                                                5B87E554 68 Bytes  [ 00, 00, C1, E1, 03, 8B, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessAdd + 11E                                               5B87E599 24 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessAdd + 137                                               5B87E5B2 28 Bytes  [ 8B, 3D, 10, 4E, 15, B0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessAdd + 154                                               5B87E5CF 14 Bytes  [ 85, C0, 74, 0F, 6A, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessDel + B                                                 5B87E5DF 49 Bytes  [ 00, 00, 00, 8B, 86, A0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessDel + 3D                                                5B87E611 58 Bytes  [ FF, 55, 8B, EC, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessDel + 78                                                5B87E64C 8 Bytes  [ 90, 98, 00, 00, 00, 66, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessDel + 81                                                5B87E655 9 Bytes  [ 0F, 8B, 90, A0, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessEnum + 1                                                5B87E65F 27 Bytes  [ 80, A0, 00, 00, 00, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessEnum + 1D                                               5B87E67B 39 Bytes  [ 56, 8B, 75, 08, 57, C7, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessEnum + 45                                               5B87E6A3 90 Bytes  [ 8B, 1D, F4, 4D, 15, B0, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessEnum + A0                                               5B87E6FE 45 Bytes  [ 00, 85, C0, 74, 09, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessEnum + CF                                               5B87E72D 42 Bytes  [ 72, 0E, 8B, 86, A0, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetInfo + A                                             5B87E7E3 16 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetInfo + 1B                                            5B87E7F4 7 Bytes  [ EC, 51, 53, 56, 8B, 75, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetInfo + 23                                            5B87E7FC 11 Bytes  [ 56, C7, 45, FC, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetInfo + 2F                                            5B87E808 75 Bytes  [ FF, 8B, 7D, 0C, 8B, 1D, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetInfo + 7B                                            5B87E854 78 Bytes  [ D3, 85, C0, 89, 86, A0, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetUserPerms + 5A                                       5B87E9A1 16 Bytes  [ FF, 55, 8B, EC, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetUserPerms + 6C                                       5B87E9B3 28 Bytes  [ 8B, 45, 18, 89, 86, AC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessGetUserPerms + 89                                       5B87E9D0 49 Bytes  [ 85, C0, 89, 45, 08, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessSetInfo + 1                                             5B87EA02 2 Bytes  [ 5A, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessSetInfo + 4                                             5B87EA05 66 Bytes  [ 86, 94, 00, 00, 00, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessSetInfo + 48                                            5B87EA49 49 Bytes  [ 00, 66, 89, 1C, C8, 8B, 9E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessSetInfo + 7A                                            5B87EA7B 48 Bytes  [ 9E, A0, 00, 00, 00, 89, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetAccessSetInfo + AB                                            5B87EAAC 32 Bytes  [ CC, CC, CC, CC, 8B, FF, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetUserPasswordSet + 30                                          5B87EC43 22 Bytes  [ 15, 10, 4E, 15, B0, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetUserPasswordSet + 47                                          5B87EC5A 22 Bytes  [ CC, CC, CC, CC, CC, CC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetUserPasswordSet + 5E                                          5B87EC71 48 Bytes  [ 75, 08, 8B, 1C, 86, 8B, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetUserPasswordSet + 8F                                          5B87ECA2 92 Bytes  [ 8B, 46, 28, 8B, 4D, 18, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!RxNetUserPasswordSet + EC                                          5B87ECFF 105 Bytes  [ 00, 00, 83, BB, AC, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAccessCheck + 13                                               5B881554 33 Bytes  [ 06, 04, 07, 04, 08, 04, 09, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAccessCheck + 35                                               5B881576 69 Bytes  [ 17, 04, 18, 04, 19, 04, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAccessCheck + 7B                                               5B8815BC 43 Bytes  [ 3A, 04, 3B, 04, 3C, 04, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAccessCheck + A7                                               5B8815E8 95 Bytes  [ 50, 04, 51, 04, 52, 04, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitFtinfoContext + 39                                         5B881648 374 Bytes  [ 80, 04, 81, 04, 82, 04, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitFtinfoContext + 1B0                                        5B8817BF 303 Bytes  [ 65, 73, 73, 61, 67, 65, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitFtinfoContext + 2E0                                        5B8818EF 92 Bytes  [ 65, 61, 6B, 50, 6F, 69, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitFtinfoContext + 33D                                        5B88194C 73 Bytes  [ 44, 65, 62, 75, 67, 46, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpInitFtinfoContext + 387                                        5B881996 160 Bytes  [ 72, 75, 63, 74, 75, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyFtinfoContext + 61                                         5B881A37 34 Bytes  [ 68, 61, 6E, 67, 65, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyFtinfoContext + 84                                         5B881A5A 6 Bytes  [ 6D, 43, 61, 6C, 6C, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCopyFtinfoContext + 8B                                         5B881A61 355 Bytes  [ 69, 46, 61, 73, 74, 53, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCleanFtinfoContext + 11B                                       5B881BC5 233 Bytes  [ 4C, 64, 72, 46, 69, 6E, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocFtinfoEntry + E5                                          5B881CAF 188 Bytes  [ 68, 69, 6D, 45, 6E, 67, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAddTlnFtinfoEntry + A3                                         5B881D6C 361 Bytes  [ 4C, 64, 72, 53, 65, 74, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpMergeFtinfo + 8B                                               5B881ED6 248 Bytes  [ 4E, 74, 41, 63, 63, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpMergeFtinfo + 184                                              5B881FCF 124 Bytes  [ 65, 49, 64, 00, 4E, 74, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpMergeFtinfo + 201                                              5B88204C 79 Bytes  [ 43, 61, 6C, 6C, 62, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpMergeFtinfo + 251                                              5B88209C 125 Bytes  [ 76, 65, 6E, 74, 00, 4E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpMergeFtinfo + 2CF                                              5B88211A 154 Bytes  [ 65, 00, 4E, 74, 43, 72, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocConfigName + 27                                           5B882305 90 Bytes  [ 4E, 74, 44, 65, 6C, 61, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocConfigName + 82                                           5B882360 350 Bytes  [ 74, 41, 6C, 61, 72, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromStr + A3                                          5B8824BF 94 Bytes  [ 4E, 74, 46, 72, 65, 65, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpAllocWStrFromStr + 102                                         5B88251E 133 Bytes  [ 00, 4E, 74, 47, 65, 74, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpHexDump + 29                                                   5B8825A4 100 Bytes  [ 4E, 74, 49, 73, 50, 72, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpHexDump + 8E                                                   5B882609 717 Bytes  [ 4E, 74, 4C, 6F, 63, 6B, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpHexDump + 35C                                                  5B8828D7 120 Bytes  [ 50, 72, 6F, 74, 65, 63, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpHexDump + 3D5                                                  5B882950 167 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpHexDump + 47D                                                  5B8829F8 20 Bytes  [ 51, 75, 65, 72, 79, 49, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDeleteSecurityObject + A3                                      5B882BFF 46 Bytes  [ 65, 45, 78, 00, 4E, 74, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDeleteSecurityObject + D2                                      5B882C2E 120 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDeleteSecurityObject + 14B                                     5B882CA7 159 Bytes  [ 52, 61, 69, 73, 65, 45, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpDeleteSecurityObject + 1EB                                     5B882D47 387 Bytes  [ 74, 61, 6E, 74, 00, 4E, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpCreateSecurityObject + 3B                                      5B882ECB 192 Bytes  [ 4E, 74, 53, 65, 74, 42, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigBool + 94                                             5B882F8C 252 Bytes  [ 4E, 74, 53, 65, 74, 48, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigDword + 3A                                            5B883089 77 Bytes  [ 4E, 74, 53, 65, 74, 49, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigDword + 88                                            5B8830D7 4 Bytes  [ 4E, 74, 53, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigDword + 8D                                            5B8830DC 103 Bytes  [ 51, 75, 6F, 74, 61, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigDword + F5                                            5B883144 81 Bytes  [ 53, 79, 73, 74, 65, 6D, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigDword + 147                                           5B883196 10 Bytes  [ 4E, 74, 53, 65, 74, 54, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetConfigTStrArray + 7A                                        5B883221 417 Bytes  [ 61, 72, 74, 50, 72, 6F, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetDomainName + 9D                                             5B8833C3 71 Bytes  [ 4E, 74, 57, 72, 69, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLocalTimeZoneOffset + 24                                       5B88340B 69 Bytes  [ 59, 69, 65, 6C, 64, 45, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLocalTimeZoneOffset + 6A                                       5B883451 44 Bytes  [ 65, 66, 69, 78, 00, 50, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLocalTimeZoneOffset + 97                                       5B88347E 32 Bytes  [ 6C, 41, 62, 73, 6F, 6C, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLocalTimeZoneOffset + B8                                       5B88349F 151 Bytes  [ 69, 72, 65, 50, 65, 62, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpLocalTimeZoneOffset + 150                                      5B883537 720 Bytes  [ 55, 6E, 73, 61, 66, 65, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStringToNetBiosName + 3                                        5B883808 90 Bytes  [ 6E, 69, 63, 6F, 64, 65, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStringToNetBiosName + 5E                                       5B883863 151 Bytes  [ 73, 65, 73, 47, 72, 61, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosStatusToApiStatus + 60                                  5B8838FB 15 Bytes  [ 75, 72, 65, 53, 74, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosStatusToApiStatus + 70                                  5B88390B 66 Bytes  [ 52, 74, 6C, 43, 68, 61, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosStatusToApiStatus + B3                                  5B88394E 91 Bytes  [ 73, 50, 61, 72, 61, 6D, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosStatusToApiStatus + 10F                                 5B8839AA 11 Bytes  [ 65, 6D, 6F, 72, 79, 53, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosStatusToApiStatus + 11B                                 5B8839B6 156 Bytes  [ 52, 74, 6C, 43, 6F, 6D, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSmbCheck + 91                                                  5B883A53 29 Bytes  [ 6C, 43, 6F, 6D, 70, 75, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSmbCheck + AF                                                  5B883A71 9 Bytes  [ 6C, 43, 6F, 6E, 73, 6F, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSmbCheck + B9                                                  5B883A7B 197 Bytes  [ 6C, 74, 69, 42, 79, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosReset + 41                                              5B883B41 83 Bytes  [ 52, 74, 6C, 43, 6F, 6E, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosAddName + 3C                                            5B883B95 355 Bytes  [ 52, 74, 6C, 43, 6F, 70, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosCall + 86                                               5B883CF9 401 Bytes  [ 52, 74, 6C, 43, 72, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosReceive + CD                                            5B883E8B 43 Bytes  [ 72, 6F, 63, 65, 73, 73, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosReceive + F9                                            5B883EB7 92 Bytes  [ 52, 74, 6C, 44, 65, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpNetBiosReceive + 156                                           5B883F14 243 Bytes  [ 6F, 69, 6E, 74, 65, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpOpenConfigData + 1F                                            5B884008 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsUserPropertyFree + 1B                                     5B884028 5 Bytes  [ 04, 00, 00, 00, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsUserPropertyFree + 21                                     5B88402E 3 Bytes  [ 00, 00, B8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsUserPropertyFree + 27                                     5B884034 54 Bytes  [ 00, 00, 00, 00, 40, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsUserPropertyFree + 5E                                     5B88406B 106 Bytes  [ 4C, CD, 21, 54, 68, 69, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsUserPropertyFree + C9                                     5B8840D6 58 Bytes  [ AE, 0B, 8A, 3C, F4, 0B, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserProperty + 1D                                      5B88420B 30 Bytes  [ 00, 20, 00, 00, 60, 2E, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserProperty + 3C                                      5B88422A 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserProperty + 5B                                      5B884249 84 Bytes  [ C0, 02, 00, 00, F8, 07, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserProperty + B1                                      5B88429F 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserProperty + B7                                      5B8842A5 62 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsSetUserPropertyWithLength + 65                            5B8845EA 115 Bytes  [ 00, 8B, 45, 08, 83, 48, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserProperty + 43                                    5B88465E 1 Byte  [ 33 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserProperty + 45                                    5B884660 71 Bytes  [ F2, AE, F7, D1, 81, F9, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserProperty + 8E                                    5B8846A9 189 Bytes  [ 66, 89, 4A, 02, 49, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserProperty + 14C                                   5B884767 108 Bytes  [ FF, 0F, 00, 75, F2, 83, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserProperty + 1B9                                   5B8847D4 21 Bytes  [ A9, 00, 00, 00, 80, 75, 1F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserPropertyWithLength + 2                           5B884803 201 Bytes  [ FF, 0F, 00, 75, 27, 83, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserPropertyWithLength + CC                          5B8848CD 73 Bytes  [ F4, F7, F1, 8B, F0, F7, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserPropertyWithLength + 116                         5B884917 120 Bytes  [ 54, 24, 10, F7, D8, F7, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserPropertyWithLength + 18F                         5B884990 103 Bytes  [ 64, 24, 1C, 8B, C8, 8B, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpParmsQueryUserPropertyWithLength + 1F7                         5B8849F8 21 Bytes  [ F7, E1, C2, 10, 00, 53, F7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStoreIntialDcRecord + 1                                        5B88606D 22 Bytes  JMP BB345374 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStoreIntialDcRecord + 18                                       5B886084 67 Bytes  [ 57, 8B, 7C, 24, 08, 8B, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStoreIntialDcRecord + 5C                                       5B8860C8 44 Bytes  [ D1, 83, E2, 03, C1, E9, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStoreIntialDcRecord + 89                                       5B8860F5 200 Bytes  [ EB, E5, 90, 55, 8B, EC, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpStoreIntialDcRecord + 152                                      5B8861BE 379 Bytes  [ 8B, 5E, 0C, 0F, C3, 47, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpTStrArrayEntryCount + 66                                       5B88A53D 74 Bytes  CALL 5B889FD3 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpTStrArrayEntryCount + B1                                       5B88A588 7 Bytes  CALL C07D1B16 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpTStrArrayEntryCount + B9                                       5B88A590 37 Bytes  [ 00, 00, 39, 75, 0C, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpTStrArrayEntryCount + DF                                       5B88A5B6 5 Bytes  [ 0F, 85, 82, 0E, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpTStrArrayEntryCount + E5                                       5B88A5BC 34 Bytes  [ 83, C0, 0C, 01, 45, FC, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpUpgradePreNT5JoinInfo + 5A                                     5B88D53F 8 Bytes  [ 06, FF, 75, 08, E8, D6, B2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpUpgradePreNT5JoinInfo + 63                                     5B88D548 71 Bytes  [ 8B, F8, 3B, FE, 0F, 85, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpUpgradePreNT5JoinInfo + AB                                     5B88D590 32 Bytes  [ 00, 8D, 45, F4, 50, 6A, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpUpgradePreNT5JoinInfo + CD                                     5B88D5B2 61 Bytes  [ F4, C6, 45, FF, 01, E8, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpUpgradePreNT5JoinInfo + 10B                                    5B88D5F0 6 Bytes  [ 75, F4, E8, 27, B2, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCompare + 17                                              5B88F4D2 107 Bytes  [ 08, 08, 08, 08, 08, 08, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCompare + 83                                              5B88F53E 45 Bytes  [ 0B, 0B, 0B, 0B, 0B, 0B, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCompare + B3                                              5B88F56E 51 Bytes  CALL 5B88DF84 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCompare + E7                                              5B88F5A2 45 Bytes  [ 0F, 85, EE, 56, 03, 00, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpwPathCompare + 115                                             5B88F5D0 13 Bytes  [ 8B, CF, 51, 68, FC, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!Netbios + 16                                                       5B891783 5 Bytes  [ 56, 57, 8B, 7D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!Netbios + 1C                                                       5B891789 141 Bytes  [ 85, 4A, 46, 01, 00, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!Netbios + AA                                                       5B891817 19 Bytes  [ 85, C0, 0F, 8C, A6, 77, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!Netbios + BE                                                       5B89182B 19 Bytes  [ C9, C2, 08, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!Netbios + D2                                                       5B89183F 78 Bytes  [ FF, 33, D2, 89, 55, E0, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleUpgradeDownlevelServer + D                                   5B891C02 18 Bytes  CALL 5B891800 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleUpgradeDownlevelServer + 20                                  5B891C15 1 Byte  [ 1C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleUpgradeDownlevelServer + 23                                  5B891C18 1 Byte  [ 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleUpgradeDownlevelServer + 25                                  5B891C1A 173 Bytes  CALL 5B88EC9E C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleUpgradeDownlevelServer + D3                                  5B891CC8 13 Bytes  [ 8D, 45, E4, 50, FF, 75, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!CredpValidateTargetName + 73                                       5B892308 23 Bytes  [ 3B, F0, 73, 29, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!CredpValidateTargetName + 8B                                       5B892320 60 Bytes  [ D8, 66, 3B, DF, 89, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!CredpValidateTargetName + C8                                       5B89235D 61 Bytes  [ 10, 89, 45, 10, 66, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!CredpValidateTargetName + 106                                      5B89239B 10 Bytes  [ 8B, 45, 14, 85, C0, 74, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!CredpValidateTargetName + 111                                      5B8923A6 43 Bytes  [ 48, 04, 8B, 4F, 0C, 03, CE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDisplayInformationIndex + 28                                 5B892785 24 Bytes  [ 40, 3B, C3, 0F, 84, 40, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDisplayInformationIndex + 41                                 5B89279E 16 Bytes  CALL 5B88AF18 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDisplayInformationIndex + 52                                 5B8927AF 10 Bytes  [ 8B, 4D, DC, 2B, 4D, 14, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDisplayInformationIndex + 5D                                 5B8927BA 119 Bytes  [ FF, 81, F9, FF, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAdd + 2                                                    5B892832 100 Bytes  [ 66, 89, 0E, 8A, 4E, 05, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAdd + 67                                                   5B892897 33 Bytes  [ FF, FF, 89, 01, 89, 48, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAdd + 89                                                   5B8928B9 95 Bytes  [ 00, 0F, B7, 06, 8B, 55, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAdd + E9                                                   5B892919 85 Bytes  [ 0F, 82, C2, 21, 01, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAdd + 13F                                                  5B89296F 35 Bytes  [ FF, 01, 5E, 28, 8B, 7D, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupAddUser + 42                                               5B892A97 52 Bytes  [ 0F, 83, 4A, 22, 01, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupDel + 2C                                                   5B892ACC 38 Bytes  [ 8B, 4A, 04, 8D, 46, 08, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupDelUser + 8                                                5B892AF3 47 Bytes  [ F6, 47, 0C, 40, 0F, 85, EA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupDelUser + 38                                               5B892B23 86 Bytes  [ FF, 66, 8B, 06, 66, 3D, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupEnum + 44                                                  5B892B7A 10 Bytes  [ 45, 14, 39, 56, 08, 0F, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupEnum + 4F                                                  5B892B85 11 Bytes  JMP E6892CB2 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupEnum + 5B                                                  5B892B91 4 Bytes  [ 45, 0C, 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupEnum + 60                                                  5B892B96 154 Bytes  [ 8B, 88, 7C, 05, 00, 00, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupEnum + FB                                                  5B892C31 13 Bytes  [ 11, 01, 56, 04, 8B, 11, 29, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupGetUsers + 9                                               5B8930DD 7 Bytes  [ 46, 18, 3B, F8, 89, 7D, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupGetUsers + 11                                              5B8930E5 120 Bytes  [ 45, E4, 89, 4D, E0, C7, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupGetUsers + 8A                                              5B89315E 99 Bytes  [ 55, F0, 8B, 45, F0, 8B, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupGetUsers + EE                                              5B8931C2 88 Bytes  [ CA, 3B, CB, 89, 7E, 2C, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupGetUsers + 147                                             5B89321B 2 Bytes  [ 45, FC ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetInfo + 1B                                               5B8933E5 16 Bytes  [ 08, 2B, C1, 83, C0, 04, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetInfo + 2C                                               5B8933F6 93 Bytes  [ 4D, 18, 33, FF, 51, 56, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetInfo + 8A                                               5B893454 27 Bytes  [ CC, CC, CC, CC, CC, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetInfo + A6                                               5B893470 66 Bytes  [ 33, C0, 5E, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetInfo + EA                                               5B8934B4 83 Bytes  [ 08, 8B, 51, 50, 69, D2, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetUsers + 3C                                              5B8935E4 4 Bytes  [ 05, 6A, 00, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetUsers + 41                                              5B8935E9 11 Bytes  [ D7, C7, 46, 04, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGroupSetUsers + 4D                                              5B8935F5 11 Bytes  [ 76, 11, 8B, 06, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAdd + 2                                               5B893601 123 Bytes  [ D7, C7, 06, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAdd + 7E                                              5B89367D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAdd + 80                                              5B89367F 91 Bytes  [ 7E, 0A, D9, 05, 74, 5F, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAdd + DC                                              5B8936DB 81 Bytes  [ 08, C7, 45, FC, BF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAddMember + 2                                         5B89372D 17 Bytes  [ 15, 5C, 4D, 15, B0, A1, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupAddMember + 14                                        5B89373F 347 Bytes  [ 53, 56, BE, 64, E4, 15, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupEnum + B0                                             5B89389B 127 Bytes  [ E1, FE, FF, FF, A1, F0, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupEnum + 130                                            5B89391B 82 Bytes  [ 4D, F4, 81, C6, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupEnum + 183                                            5B89396E 28 Bytes  [ 8B, 75, 0C, 8B, 5D, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupEnum + 1A0                                            5B89398B 12 Bytes  [ 3D, F0, D6, 15, B0, 85, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupEnum + 1AE                                            5B893999 27 Bytes  [ 00, 75, 0E, 85, C9, 74, 71, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetInfo + 39                                          5B893B97 17 Bytes  [ C1, 73, 0E, 8B, C8, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetInfo + 4B                                          5B893BA9 16 Bytes  [ 45, F8, 8B, 0D, F0, D6, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetInfo + 5C                                          5B893BBA 23 Bytes  [ 89, 7D, EC, 0F, 82, 6D, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetMembers + 1                                        5B893BD2 69 Bytes  [ 75, 14, 85, 34, 85, A8, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetMembers + 47                                       5B893C18 3 Bytes  [ 04, BE, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetMembers + 4B                                       5B893C1C 20 Bytes  [ 80, 3F, 8B, 7D, 0C, 42, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetMembers + 60                                       5B893C31 132 Bytes  [ 00, 00, 00, 89, 4D, F0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupGetMembers + E5                                       5B893CB6 42 Bytes  [ 8B, 45, 0C, 3B, D0, 73, 26, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupSetInfo + 7F                                          5B8940FD 45 Bytes  [ 95, 8B, 4D, 0C, 3B, F1, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupSetInfo + AD                                          5B89412B 5 Bytes  [ 75, E3, 8B, 83, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupSetInfo + B3                                          5B894131 6 Bytes  [ 00, 00, C7, 83, 20, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupSetInfo + BA                                          5B894138 53 Bytes  [ 00, 01, 00, 00, 00, 8B, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupSetInfo + F0                                          5B89416E 25 Bytes  CALL E75986FC 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupDelMembers + 4                                        5B8941E8 15 Bytes  [ 4D, F8, D9, 41, F8, D8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLocalGroupDelMembers + 14                                       5B8941F8 109 Bytes  [ 66, 89, 46, 02, 8B, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserAdd + 5E                                                    5B894266 59 Bytes  [ 66, 89, 46, 0A, 8B, 4D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserAdd + 9A                                                    5B8942A2 12 Bytes  [ 75, 31, 66, 83, 7E, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserAdd + A8                                                    5B8942B0 34 Bytes  [ 75, 23, 66, 83, 7E, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserAdd + CB                                                    5B8942D3 3 Bytes  [ 74, 06, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserAdd + CF                                                    5B8942D7 81 Bytes  [ 14, 83, C6, 20, 8B, 45, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserDel + 2C                                                    5B894438 8 Bytes  CALL E98189C8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserDel + 35                                                    5B894441 24 Bytes  [ 00, 00, 00, 03, F2, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserDel + 4E                                                    5B89445A 251 Bytes  [ 85, FF, 75, 07, BF, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserDel + 14A                                                   5B894556 84 Bytes  [ 00, 8B, 04, 9A, 50, E8, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserDel + 19F                                                   5B8945AB 80 Bytes  [ 45, D0, 89, 04, 9A, 8B, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserEnum + 13                                                   5B8945FC 4 Bytes  [ 45, E4, DB, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserEnum + 18                                                   5B894601 50 Bytes  [ D9, 45, F0, DE, C9, D9, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserEnum + 4C                                                   5B894635 50 Bytes  [ F4, 81, F3, 00, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserEnum + 7F                                                   5B894668 42 Bytes  [ DB, 94, 8F, 00, 03, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserEnum + AC                                                   5B894695 37 Bytes  [ 8B, 45, 14, C7, 80, 00, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetInfo + 38                                                5B89499C 11 Bytes  [ 89, 55, FC, 8B, 53, 30, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetInfo + 44                                                5B8949A8 33 Bytes  [ 00, 00, 00, 2B, F1, 8B, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetInfo + 66                                                5B8949CA 17 Bytes  [ 4D, 08, 89, 55, EC, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetInfo + 78                                                5B8949DC 4 Bytes  [ 30, 36, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetInfo + 7D                                                5B8949E1 14 Bytes  [ 45, 10, 85, C0, 0F, 86, AB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetGroups + 9                                               5B894A85 113 Bytes  [ 55, D8, 03, CA, 48, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetGroups + 7B                                              5B894AF7 10 Bytes  [ 8B, 45, FC, 2B, 45, F4, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetGroups + 86                                              5B894B02 18 Bytes  [ F4, 89, 45, FC, 73, B8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetGroups + 99                                              5B894B15 106 Bytes  [ 45, 08, 8B, 40, 08, 2B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserGetGroups + 104                                             5B894B80 5 Bytes  [ 47, 08, 89, 45, F4 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetGroups + 1F                                              5B894D4C 61 Bytes  [ 30, 8B, 77, 0C, 42, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetGroups + 5D                                              5B894D8A 28 Bytes  [ 08, 8B, 50, 0C, 53, 8B, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetGroups + 7A                                              5B894DA7 44 Bytes  [ 57, 30, 89, 4D, F4, 8B, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetGroups + A7                                              5B894DD4 94 Bytes  [ 47, 3C, 8B, 4F, 38, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserSetGroups + 108                                             5B894E35 40 Bytes  [ C9, 85, F6, 89, 55, D4, 76, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsSet + 5D                                              5B8951C3 27 Bytes  [ 00, 00, 77, 20, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsSet + 79                                              5B8951DF 28 Bytes  [ 50, 06, 33, C0, 5D, C2, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsSet + 96                                              5B8951FC 100 Bytes  [ 14, FF, 75, 10, 6A, 00, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsSet + FB                                              5B895261 4 Bytes  [ 00, 00, 51, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserModalsSet + 100                                             5B895266 69 Bytes  CALL 5B88B0C1 C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserChangePassword + 51                                         5B89579F 14 Bytes  [ EC, 83, EC, 24, 53, 57, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserChangePassword + 60                                         5B8957AE 29 Bytes  [ 33, DB, 3B, C3, 6A, 18, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserChangePassword + 7E                                         5B8957CC 6 Bytes  [ 75, 0C, 89, 5D, E0, C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserChangePassword + 85                                         5B8957D3 27 Bytes  CALL 5B895E18 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUserChangePassword + A1                                         5B8957EF 28 Bytes  [ 39, 5D, FC, 0F, 8C, F8, 33, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceControl + 10                                             5B8976C7 3 Bytes  [ 97, 90, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceControl + 14                                             5B8976CB 43 Bytes  [ 8B, F8, 3B, FB, 7C, 26, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceControl + 40                                             5B8976F7 59 Bytes  [ 39, 5D, FC, 74, 0D, 81, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceControl + 7C                                             5B897733 20 Bytes  [ FF, 89, 5D, B4, 83, 65, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceEnum + 2                                                 5B897748 16 Bytes  [ 45, B8, 66, 39, 7D, B8, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceEnum + 14                                                5B89775A 4 Bytes  [ 8B, 4D, B0, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceEnum + 19                                                5B89775F 31 Bytes  [ FF, 00, 00, 66, 85, C0, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceEnum + 39                                                5B89777F 88 Bytes  [ 66, 85, FF, 77, B9, EB, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceInstall + D                                              5B8977D8 44 Bytes  [ FF, 8B, F0, 3B, F3, 0F, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceInstall + 3A                                             5B897805 20 Bytes  [ 8B, 45, 14, 3B, C3, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceInstall + 4F                                             5B89781A 5 Bytes  [ 36, E8, AE, 10, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceInstall + 55                                             5B897820 10 Bytes  [ 8B, F8, 3B, FB, 0F, 8C, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServiceInstall + 60                                             5B89782B 3 Bytes  [ 45, D4, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobAdd + 18                                             5B897CA9 2 Bytes  [ 7E, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobAdd + 1B                                             5B897CAC 178 Bytes  [ 74, 5D, 6A, 08, 68, 28, CD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobDel + E                                              5B897D5F 3 Bytes  [ D8, 50, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobDel + 12                                             5B897D63 12 Bytes  [ 6A, 01, 8B, 45, 08, FF, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobDel + 1F                                             5B897D70 40 Bytes  [ 89, 45, BC, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobDel + 48                                             5B897D99 1 Byte  [ 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobDel + 4B                                             5B897D9C 128 Bytes  [ 89, 45, CC, 8D, 45, D0, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobEnum + C                                             5B897E1D 65 Bytes  CALL 5B894073 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobEnum + 4E                                            5B897E5F 21 Bytes  CALL 5B889904 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobEnum + 64                                            5B897E75 20 Bytes  [ C6, 93, 7C, 06, C7, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobEnum + 7C                                            5B897E8D 9 Bytes  [ 8B, FF, 55, 8B, EC, 81, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobEnum + 87                                            5B897E98 88 Bytes  [ A1, C8, E0, 97, 7C, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobGetInfo + C                                          5B897F0D 14 Bytes  CALL 5B88980D C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobGetInfo + 1B                                         5B897F1C 77 Bytes  [ 33, FF, 57, 8D, 85, E0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobGetInfo + 69                                         5B897F6A 46 Bytes  CALL 5B890291 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobGetInfo + 98                                         5B897F99 276 Bytes  [ B5, EC, FD, FF, FF, E8, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetScheduleJobGetInfo + 1AD                                        5B8980AE 84 Bytes  CALL 8F061893 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserServerEnum + 25                                           5B898418 29 Bytes  [ 8D, 45, AC, 50, 8D, 45, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserServerEnum + 43                                           5B898436 29 Bytes  [ B8, 0F, 84, 19, 2C, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserServerEnum + 61                                           5B898454 2 Bytes  [ 4D, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserServerEnum + 64                                           5B898457 14 Bytes  [ 48, 04, C7, 40, 08, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserServerEnum + 73                                           5B898466 90 Bytes  JMP 5B86B054 C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryOtherDomains + 22                                    5B89850B 26 Bytes  [ 41, 06, 24, 10, 89, 38, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryOtherDomains + 3D                                    5B898526 10 Bytes  JMP 5B86B960 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryOtherDomains + 48                                    5B898531 36 Bytes  [ 89, 85, 68, FF, FF, FF, B9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryOtherDomains + 6E                                    5B898557 42 Bytes  [ 33, C0, 40, C3, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryOtherDomains + 99                                    5B898582 13 Bytes  [ 89, 46, 34, 83, 4D, FC, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetNetlogonState + 3                                    5B8985E4 8 Bytes  [ EE, FE, EE, FE, 8D, 04, C5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetNetlogonState + C                                    5B8985ED 58 Bytes  [ FF, FF, 50, 8D, 47, 10, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetNetlogonState + 47                                   5B898628 30 Bytes  [ 75, 0C, 39, 05, 40, 17, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetNetlogonState + 67                                   5B898648 1 Byte  [ EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetNetlogonState + 69                                   5B89864A 20 Bytes  [ 8D, 45, FC, 50, 8D, 45, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugCall + 22                                            5B8986CB 67 Bytes  [ 90, 48, 45, 41, 50, 5B, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugCall + 66                                            5B89870F 52 Bytes  [ C3, F0, 89, 5D, 08, E9, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugCall + 9B                                            5B898744 105 Bytes  [ 00, 39, 12, 0F, 85, 8B, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugTrace + 45                                           5B8987AE 21 Bytes  CALL 5B8CFA3F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugTrace + 5B                                           5B8987C4 82 Bytes  [ 0F, 84, 8A, 5A, FD, FF, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserDebugTrace + AE                                           5B898817 25 Bytes  [ FC, 00, 83, 65, 08, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryStatistics + 8                                       5B898831 5 Bytes  [ 0C, 72, 03, 00, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryStatistics + E                                       5B898837 9 Bytes  [ 08, 85, C0, 0F, 84, 7C, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryStatistics + 18                                      5B898841 1 Byte  [ 7D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryStatistics + 1B                                      5B898844 11 Bytes  [ 0F, 84, 72, 5A, FD, FF, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryStatistics + 27                                      5B898850 9 Bytes  [ 50, 04, 8D, 48, 10, 8B, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetStatistics + 13                                      5B898904 8 Bytes  CALL 5B86820E C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetStatistics + 1C                                      5B89890D 13 Bytes  JMP 5B86B428 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetStatistics + 2B                                      5B89891C 77 Bytes  JMP 5B86E697 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetStatistics + 79                                      5B89896A 5 Bytes  [ 45, D0, E9, 3B, 5E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserResetStatistics + 80                                      5B898971 94 Bytes  [ 3D, 23, 00, 00, C0, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetBrowserStatisticsGet + 17                                       5B8989D0 57 Bytes  [ 3B, 2E, 0F, 85, D0, C0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetBrowserStatisticsGet + 51                                       5B898A0A 168 Bytes  [ 8B, 45, C8, 0F, B7, 4D, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetBrowserStatisticsGet + FA                                       5B898AB3 10 Bytes  [ 8B, CA, 89, 4D, BC, E9, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetBrowserStatisticsGet + 107                                      5B898AC0 298 Bytes  [ 08, 00, 0A, 00, 50, 49, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryEmulatedDomains + 5A                                 5B898BEB 40 Bytes  JMP 5B880C66 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryEmulatedDomains + 83                                 5B898C14 89 Bytes  [ B8, F0, 00, 00, C0, E9, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryEmulatedDomains + DD                                 5B898C6E 5 Bytes  [ C0, E9, D4, 04, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryEmulatedDomains + E3                                 5B898C74 14 Bytes  [ 50, FF, 15, 88, 04, 91, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_BrowserQueryEmulatedDomains + F2                                 5B898C83 233 Bytes  [ B8, 06, 01, 00, C0, E9, 29, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetClientInfo + 50                                           5B8992C1 25 Bytes  [ FA, 2E, 0F, 84, 05, CB, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetClientInfo + 6A                                           5B8992DB 18 Bytes  [ B7, C0, 50, FF, 15, B0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetClientInfo + 7D                                           5B8992EE 12 Bytes  [ BD, C9, FE, FF, EB, 6B, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetClientInfo + 8B                                           5B8992FC 28 Bytes  [ 0F, 84, D6, C1, FD, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetClientInfo + A8                                           5B899319 16 Bytes  [ 8D, 8D, F4, FD, FF, FF, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetClientInfo + 14                                           5B8995D5 153 Bytes  [ FF, 75, E0, 6A, FF, E8, 2F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetClientInfo + AE                                           5B89966F 690 Bytes  [ B8, 21, 02, 00, C0, E9, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetClientInfo + 361                                          5B899922 15 Bytes  CALL 5B8C1641 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetClientInfo + 371                                          5B899932 5 Bytes  [ 90, 90, 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetClientInfo + 377                                          5B899938 40 Bytes  [ 45, EC, 8B, 08, 8B, 09, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRoot + 1F                                              5B89A2D5 6 Bytes  [ 85, BC, FD, FF, FF, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRoot + 26                                              5B89A2DC 1 Byte  [ C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRoot + 28                                              5B89A2DE 4 Bytes  [ 85, 03, 74, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRoot + 2D                                              5B89A2E3 10 Bytes  [ 89, BD, C4, FD, FF, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRoot + 38                                              5B89A2EE 37 Bytes  [ FF, 89, 85, A0, FD, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRootForced + E                                         5B89A38F 104 Bytes  [ FF, 8B, 78, 04, 8B, D1, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRootForced + 77                                        5B89A3F8 5 Bytes  [ FF, 8B, 40, 30, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddStdRootForced + 7D                                        5B89A3FE 123 Bytes  CALL 5B88AF2A C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetDcAddress + 19                                            5B89A47A 7 Bytes  [ 53, 00, 79, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetDcAddress + 21                                            5B89A482 47 Bytes  [ 65, 00, 6D, 00, 52, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetDcAddress + 51                                            5B89A4B2 5 Bytes  [ 89, 85, C0, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetDcAddress + 57                                            5B89A4B8 65 Bytes  [ 89, 85, C4, FD, FF, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetDcAddress + 99                                            5B89A4FA 22 Bytes  [ 7D, 0B, 3D, 34, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveStdRoot + 17                                           5B89A538 55 Bytes  [ 79, 00, 5C, 00, 4D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveStdRoot + 4F                                           5B89A570 77 Bytes  [ 5C, 00, 57, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveStdRoot + 9D                                           5B89A5BE 44 Bytes  [ 6D, 00, 62, 00, 6C, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerInitialize + 1A                                       5B89A5EB 56 Bytes  CALL 5B8898C7 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerInitialize + 53                                       5B89A624 9 Bytes  [ 90, 02, 00, 39, 73, 20, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerInitialize + 5D                                       5B89A62E 35 Bytes  [ 02, 00, 39, 73, 1C, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerInitialize + 81                                       5B89A652 30 Bytes  [ 43, 24, 83, E0, 03, 3C, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerInitialize + A0                                       5B89A671 49 Bytes  [ 02, 00, 33, C0, AB, 83, 7B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsIsThisADomainName + A                                      5B89B153 7 Bytes  [ 00, 00, 00, 00, 00, 00, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsIsThisADomainName + 12                                     5B89B15B 8 Bytes  [ 00, 78, BE, 02, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsIsThisADomainName + 1B                                     5B89B164 41 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsIsThisADomainName + 45                                     5B89B18E 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsIsThisADomainName + 76                                     5B89B1BF 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddFtRoot + 2B                                               5B89B264 8 Bytes  [ 40, 00, 00, 42, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddFtRoot + 35                                               5B89B26E 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddFtRoot + 40                                               5B89B279 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddFtRoot + 49                                               5B89B282 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAddFtRoot + 54                                               5B89B28D 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRoot + 22                                            5B89B573 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRoot + 2B                                            5B89B57C 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRoot + 36                                            5B89B587 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRoot + 3F                                            5B89B590 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRoot + 4A                                            5B89B59B 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRootForced + 1C                                      5B89B74D 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRootForced + 25                                      5B89B756 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRootForced + 30                                      5B89B761 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRootForced + 39                                      5B89B76A 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemoveFtRootForced + 44                                      5B89B775 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetInfo + 19                                                 5B89B97A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetInfo + 22                                                 5B89B983 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetInfo + 3B                                                 5B89B99C 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetInfo + 6F                                                 5B89B9D0 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsGetInfo + 79                                                 5B89B9DA 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsEnum + 4                                                     5B89BAB5 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsEnum + 10                                                    5B89BAC1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsEnum + 14                                                    5B89BAC5 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsEnum + 1F                                                    5B89BAD0 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsEnum + 2B                                                    5B89BADC 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerGetConfigInfo + 37                                    5B89BD60 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerGetConfigInfo + 40                                    5B89BD69 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerGetConfigInfo + 48                                    5B89BD71 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerGetConfigInfo + 51                                    5B89BD7A 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerGetConfigInfo + 85                                    5B89BDAE 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerSendSiteInfo + 1C                                     5B89BE95 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerSendSiteInfo + 25                                     5B89BE9E 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerSendSiteInfo + 30                                     5B89BEA9 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerSendSiteInfo + 39                                     5B89BEB2 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsManagerSendSiteInfo + 6D                                     5B89BEE6 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAdd + 12                                                     5B89C1A9 39 Bytes  [ E5, 5D, C2, 0C, 00, 57, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAdd + 3A                                                     5B89C1D1 169 Bytes  [ FF, 55, 8B, EC, 83, EC, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAdd + E4                                                     5B89C27B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAdd + E6                                                     5B89C27D 52 Bytes  [ 8D, 49, 00, D9, 42, F8, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsAdd + 11B                                                    5B89C2B2 54 Bytes  [ 08, 3B, D8, 73, 1A, C1, E6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemove + 5B                                                  5B89C354 26 Bytes  [ FB, 02, 77, 28, 8B, 89, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemove + 76                                                  5B89C36F 28 Bytes  CALL 5B89BC0D C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemove + 93                                                  5B89C38C 5 Bytes  [ 4D, F0, 8B, FF, 33 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemove + 99                                                  5B89C392 28 Bytes  [ 85, DB, 89, 7D, F8, 0F, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsRemove + B6                                                  5B89C3AF 73 Bytes  [ 33, DB, 83, F8, 04, 8D, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetInfo + F4                                                 5B89C525 253 Bytes  [ 55, CC, D1, E1, 0F, 6F, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetInfo + 1F2                                                5B89C623 32 Bytes  CALL 5B87D86B C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetInfo + 213                                                5B89C644 71 Bytes  [ EC, 8B, 55, 08, 0F, B7, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetInfo + 25B                                                5B89C68C 59 Bytes  [ 8B, 79, 5C, 3B, 79, 60, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetDfsSetInfo + 297                                                5B89C6C8 47 Bytes  [ 00, 00, 00, 33, DB, F3, A7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcOpenA + 2                                                   5B89D143 14 Bytes  [ 24, 85, 58, 21, 90, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcOpenA + 11                                                  5B89D152 94 Bytes  [ 24, 8D, D4, 21, 90, 7C, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcOpenA + 70                                                  5B89D1B1 25 Bytes  [ 24, 95, 40, 22, 90, 7C, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcOpenA + 8A                                                  5B89D1CB 31 Bytes  [ 24, 95, 40, 22, 90, 7C, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcOpenA + AA                                                  5B89D1EB 33 Bytes  [ 7C, FC, 21, 90, 7C, F4, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextW + 20                                                  5B89D20D 27 Bytes  [ 44, 8E, F0, 89, 44, 8F, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextW + 3C                                                  5B89D229 40 Bytes  [ 44, 8F, FC, 8D, 04, 8D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextW + 65                                                  5B89D252 61 Bytes  [ 08, 5E, 5F, C9, C3, 90, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextW + A3                                                  5B89D290 30 Bytes  [ 8D, 74, 31, FC, 8D, 7C, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextA + 1B                                                  5B89D2AF 45 Bytes  [ FF, 24, 95, E0, 23, 90, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNextA + 49                                                  5B89D2DD 375 Bytes  [ 24, 8D, E0, 23, 90, 7C, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcCloseW + FF                                                 5B89D455 98 Bytes  [ 08, 2B, D1, 88, 07, 47, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcCloseW + 162                                                5B89D4B8 206 Bytes  [ F1, 8B, 01, BA, FF, FE, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcCloseW + 231                                                5B89D587 8 Bytes  [ 8B, 4C, 24, 08, F7, C2, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcCloseW + 23A                                                5B89D590 78 Bytes  [ 00, 75, 3D, 8B, 02, 3A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetAnyDCName + 1E                                               5B89D5DF 14 Bytes  [ 41, 0A, C0, 74, DF, F7, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetAnyDCName + 2D                                               5B89D5EE 119 Bytes  [ 02, 83, C2, 02, 3A, 01, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsValidateSubnetNameW + 3D                                         5B89D666 113 Bytes  [ FF, FE, FE, 7E, 03, D0, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesA + 66                                         5B89D6D8 29 Bytes  [ 53, 74, 0F, 8A, 07, 47, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesA + 84                                         5B89D6F6 24 Bytes  [ 33, C2, 83, C7, 04, A9, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesA + 9D                                         5B89D70F 8 Bytes  [ 00, FF, 00, 74, 0A, A9, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesA + A6                                         5B89D718 36 Bytes  [ FF, 75, CF, 4F, EB, 0D, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesA + CB                                         5B89D73D 141 Bytes  [ 20, EB, 4E, EB, 1C, 8A, 16, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExA + AE                                       5B89DA37 78 Bytes  [ 75, F2, 83, 7C, 24, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExA + FD                                       5B89DA86 50 Bytes  [ 75, F0, 5D, 5B, C3, 90, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExA + 130                                      5B89DAB9 21 Bytes  [ 8B, 45, 00, 89, 03, 8D, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExA + 146                                      5B89DACF 32 Bytes  JMP B115B55F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExA + 167                                      5B89DAF0 13 Bytes  JMP 644C3652 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExW + 19                                       5B89DC6A 34 Bytes  [ 4C, 24, 0C, 33, C0, FC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExW + 3D                                       5B89DC8E 150 Bytes  [ 00, 05, 00, 00, 00, 00, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExW + D4                                       5B89DD25 22 Bytes  [ 46, 08, 8B, 5E, 0C, 0F, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExW + EB                                       5B89DD3C 126 Bytes  [ 0F, C3, 5F, 14, 8B, 46, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsAddressToSiteNamesExW + 16A                                      5B89DDBB 27 Bytes  [ 5E, 1C, 0F, C3, 47, 18, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageA + 13F                                         5B89DF90 4 Bytes  [ 7D, 08, 8B, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageA + 144                                         5B89DF95 71 Bytes  [ 8B, 06, FC, 8B, D1, 83, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageA + 18C                                         5B89DFDD 55 Bytes  [ F3, A5, B9, 10, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageW + 24                                          5B89E015 12 Bytes  [ 90, 8B, 44, 24, 04, F7, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageW + 31                                          5B89E022 47 Bytes  [ 8B, 44, 24, 04, F7, 64, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageW + 61                                          5B89E052 57 Bytes  [ 44, 24, 10, 8B, 54, 24, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageW + 9B                                          5B89E08C 26 Bytes  [ 05, 5E, C2, 10, 00, 90, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcSiteCoverageW + B6                                          5B89E0A7 262 Bytes  [ 00, 8B, FF, 55, 8B, EC, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountA + A5                                       5B89E1AE 39 Bytes  [ 8B, 54, 24, 04, 33, C0, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountA + CE                                       5B89E1D7 188 Bytes  [ 44, 24, 08, 33, D2, D3, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountA + 18B                                      5B89E294 105 Bytes  [ 00, 00, 00, FF, 75, 14, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountA + 1F5                                      5B89E2FE 40 Bytes  [ 41, 08, 89, 02, B8, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameWithAccountA + 21E                                      5B89E327 36 Bytes  [ AC, 00, 00, 00, 89, 93, A8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDCName + 31                                                  5B89E478 10 Bytes  [ 95, 1C, 05, 00, 0E, 1C, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDCName + 3C                                                  5B89E483 36 Bytes  [ 00, ED, 01, 03, 00, B5, E2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDCName + 61                                                  5B89E4A8 7 Bytes  [ AA, 1E, 05, 00, 6E, 1D, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDCName + 69                                                  5B89E4B0 19 Bytes  [ 69, 1E, 05, 00, 0B, 1E, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetDCName + 7D                                                  5B89E4C4 10 Bytes  [ 12, 12, 00, 00, 10, E5, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsValidateSubnetNameA + 3B                                         5B89E664 72 Bytes  [ 1E, 12, 00, 00, EE, D1, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetSiteNameA + 44                                                5B89E6AD 74 Bytes  [ D2, 00, 00, 0E, D3, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetDcNameA + 16                                                  5B89E6F8 34 Bytes  [ 2E, D4, 00, 00, 3E, D4, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerReqChallenge + 10                                       5B89E71B 15 Bytes  [ 00, BE, D4, 00, 00, CE, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerReqChallenge + 21                                       5B89E72C 14 Bytes  [ FE, D4, 00, 00, 0E, D5, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerReqChallenge + 30                                       5B89E73B 7 Bytes  [ 00, 3E, D5, 00, 00, 4E, D5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerReqChallenge + 38                                       5B89E743 32 Bytes  [ 00, 5E, D5, 00, 00, 6E, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerReqChallenge + 59                                       5B89E764 58 Bytes  [ DE, DF, 00, 00, DE, D5, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate + 27                                       5B89E7A0 14 Bytes  [ BE, D6, 00, 00, CE, D6, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate + 36                                       5B89E7AF 40 Bytes  [ 00, FE, D6, 00, 00, 0E, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate + 5F                                       5B89E7D8 58 Bytes  [ 9E, D7, 00, 00, AE, D7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate2 + 2A                                      5B89E813 16 Bytes  [ 00, 8E, D8, 00, 00, 9E, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate2 + 3B                                      5B89E824 38 Bytes  [ BE, D8, 00, 00, CE, D8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate2 + 62                                      5B89E84B 83 Bytes  [ 00, 5E, D9, 00, 00, 6E, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerAuthenticate3 + 3E                                      5B89E89F 99 Bytes  [ 00, 9E, DA, 00, 00, AE, DA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet + 2A                                        5B89E903 16 Bytes  [ 00, 2E, DC, 00, 00, 3E, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet + 3B                                        5B89E914 38 Bytes  [ 6E, DC, 00, 00, 7E, DC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet + 62                                        5B89E93B 63 Bytes  [ 00, 0E, DD, 00, 00, 1E, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet2 + 2A                                       5B89E97B 16 Bytes  [ 00, 0E, DE, 00, 00, 1E, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet2 + 3B                                       5B89E98C 38 Bytes  [ 4E, DE, 00, 00, 5E, DE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordSet2 + 62                                       5B89E9B3 43 Bytes  [ 00, EE, DE, 00, 00, FE, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseDeltas + 16                                           5B89E9DF 127 Bytes  [ 00, 8E, DF, 00, 00, 9E, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseSync + 16                                             5B89EA5F 26 Bytes  [ 00, 61, FD, 01, 00, 62, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseSync + 31                                             5B89EA7A 129 Bytes  [ 01, 00, 51, 9B, 01, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseSync2 + 33                                            5B89EAFC 15 Bytes  [ FE, F6, 05, 00, A0, 72, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseSync2 + 43                                            5B89EB0C 69 Bytes  [ C7, 96, 05, 00, F3, 32, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetAccountDeltas + 9                                             5B89EB52 97 Bytes  [ 05, 00, 5F, D8, 02, 00, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetAccountDeltas + 6B                                            5B89EBB4 127 Bytes  [ FD, 20, 03, 00, 43, 2B, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetAccountSync + 6B                                              5B89EC34 83 Bytes  [ 50, 46, 05, 00, 87, 34, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonControl + 3F                                             5B89EC88 159 Bytes  [ 31, 18, 06, 00, FF, 3C, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonControl2 + 67                                            5B89ED28 103 Bytes  [ 94, 43, 06, 00, 11, 49, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonControl2 + CF                                            5B89ED90 38 Bytes  [ A1, 3C, 01, 00, FB, 8F, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseRedo + 16                                             5B89EDB7 40 Bytes  [ 00, C6, 95, 01, 00, 89, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDatabaseRedo + 3F                                             5B89EDE0 91 Bytes  [ 55, 4F, 01, 00, 35, 96, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateTrustedDomains + 23                                    5B89EE3C 67 Bytes  [ C8, 04, 03, 00, D1, CB, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateTrustedDomains + 67                                    5B89EE80 75 Bytes  [ 02, E0, 02, 00, 7A, E0, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateTrustedDomains + B3                                    5B89EECC 11 Bytes  [ 2B, D5, 05, 00, 9A, 80, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateTrustedDomains + BF                                    5B89EED8 38 Bytes  [ DD, 32, 01, 00, CE, 33, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateTrustedDomains + E7                                    5B89EF00 42 Bytes  [ E0, 10, 00, 00, 3A, 7A, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsA + 3D                                      5B89F080 31 Bytes  [ 37, A0, 01, 00, 4D, 66, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsA + 5D                                      5B89F0A0 59 Bytes  [ 6A, 36, 05, 00, A9, A6, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsA + 99                                      5B89F0DC 46 Bytes  [ 32, 0C, 02, 00, 36, 4C, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsA + C8                                      5B89F10B 140 Bytes  [ 00, 34, AF, 02, 00, FD, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsEnumerateDomainTrustsA + 155                                     5B89F198 51 Bytes  [ 02, 3D, 03, 00, DD, 49, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonGetDomainInfo + 3A                                       5B89F404 26 Bytes  [ BE, D5, 00, 00, CE, D5, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonGetDomainInfo + 55                                       5B89F41F 87 Bytes  [ 00, 1E, D6, 00, 00, 2E, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonSetServiceBits + 1E                                        5B89F477 16 Bytes  [ 00, 7E, D7, 00, 00, 8E, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonSetServiceBits + 2F                                        5B89F488 38 Bytes  [ BE, D7, 00, 00, CE, D7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetLogonSetServiceBits + 56                                        5B89F4AF 47 Bytes  [ 00, 5E, D8, 00, 00, 6E, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonGetTrustRid + 1E                                         5B89F4DF 16 Bytes  [ 00, 0E, D9, 00, 00, 1E, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonGetTrustRid + 2F                                         5B89F4F0 94 Bytes  [ 4E, D9, 00, 00, 5E, D9, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonComputeServerDigest + 27                                 5B89F550 14 Bytes  [ BE, DA, 00, 00, CE, DA, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonComputeServerDigest + 36                                 5B89F55F 95 Bytes  [ 00, FE, DA, 00, 00, 0E, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonComputeClientDigest + 27                                 5B89F5C0 14 Bytes  [ 7E, DC, 00, 00, 8E, DC, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetlogonComputeClientDigest + 36                                 5B89F5CF 99 Bytes  [ 00, BE, DC, 00, 00, CE, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordGet + 2A                                        5B89F633 16 Bytes  [ 00, 4E, DE, 00, 00, 5E, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordGet + 3B                                        5B89F644 38 Bytes  [ 8E, DE, 00, 00, 9E, DE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerPasswordGet + 62                                        5B89F66B 83 Bytes  [ 00, 2E, DF, 00, 00, FE, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerTrustPasswordsGet + 3E                                  5B89F6BF 108 Bytes  [ 00, E5, 14, 00, 00, C4, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerGetTrustInfo + 33                                       5B89F72C 15 Bytes  [ 64, 2E, 01, 00, 50, 1A, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerGetTrustInfo + 43                                       5B89F73C 24 Bytes  [ AA, 1A, 07, 00, F7, 1A, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetServerGetTrustInfo + 5C                                       5B89F755 70 Bytes  [ 02, 03, 00, 09, 1B, 07, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsDeregisterDnsHostRecordsW + 23                                   5B89F79C 15 Bytes  [ F0, 13, 07, 00, B4, 12, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsDeregisterDnsHostRecordsW + 33                                   5B89F7AC 175 Bytes  [ 60, 14, 07, 00, 1F, 13, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsDeregisterDnsHostRecordsA + 7B                                   5B89F85C 39 Bytes  [ BC, 1A, 07, 00, 4B, 38, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetForestTrustInformationW + 10                                  5B89F884 3 Bytes  [ 60, 2F, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetForestTrustInformationW + 14                                  5B89F888 79 Bytes  [ 61, AE, 02, 00, 4A, FE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsGetForestTrustInformationW + 64                                  5B89F8D8 54 Bytes  [ 68, 68, 00, 00, 7D, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetForestTrustInformation + 27                                5B89F910 14 Bytes  [ 5D, 69, 00, 00, 6F, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetForestTrustInformation + 36                                5B89F91F 40 Bytes  [ 00, B6, 69, 00, 00, D0, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetForestTrustInformation + 5F                                5B89F948 131 Bytes  [ 84, 6A, 00, 00, A3, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsMergeForestTrustInformationW + 73                                5B89F9CC 70 Bytes  [ AA, 6D, 00, 00, BD, 6D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsMergeForestTrustInformationW + BA                                5B89FA13 3 Bytes  [ 00, 5C, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsMergeForestTrustInformationW + BF                                5B89FA18 3 Bytes  [ 6B, 6F, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsMergeForestTrustInformationW + C3                                5B89FA1C 26 Bytes  [ 7F, 6F, 00, 00, 97, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsMergeForestTrustInformationW + DF                                5B89FA38 38 Bytes  [ 17, 70, 00, 00, 2F, 70, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetDCList + 13                                                5B89FB1D 34 Bytes  [ 74, 00, 00, 20, 74, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetDCList + 36                                                5B89FB40 26 Bytes  [ A7, 74, 00, 00, BF, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetDCList + 51                                                5B89FB5B 10 Bytes  [ 00, 2F, 75, 00, 00, 4B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetDCList + 5C                                                5B89FB66 36 Bytes  [ 00, 00, 79, 75, 00, 00, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetGetDCList + 82                                                5B89FB8C 10 Bytes  [ 09, 76, 00, 00, 25, 76, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogon + 34                                            5B89FBE3 32 Bytes  [ 00, B9, 77, 00, 00, C7, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogon + 55                                            5B89FC04 47 Bytes  [ 45, 78, 00, 00, 59, 78, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogoff + 1B                                           5B89FC34 3 Bytes  [ 38, 79, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogoff + 1F                                           5B89FC38 15 Bytes  [ 50, 79, 00, 00, 65, 79, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogoff + 2F                                           5B89FC48 34 Bytes  [ AA, 79, 00, 00, B8, 79, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonUasLogoff + 52                                           5B89FC6B 47 Bytes  [ 00, 73, 7A, 00, 00, 8B, 7A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogon + 1A                                            5B89FC9B 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogon + 1C                                            5B89FC9D 30 Bytes  [ 7B, 00, 00, 84, 7B, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogon + 3B                                            5B89FCBC 23 Bytes  [ 2E, 7C, 00, 00, 3B, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogon + 53                                            5B89FCD4 46 Bytes  [ A5, 7C, 00, 00, B6, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogon + 82                                            5B89FD03 47 Bytes  [ 00, 89, 7D, 00, 00, 95, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonWithFlags + 1A                                   5B89FD33 35 Bytes  [ 00, 64, 7E, 00, 00, 71, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonWithFlags + 3F                                   5B89FD58 22 Bytes  [ F0, 7E, 00, 00, 03, 7F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonWithFlags + 56                                   5B89FD6F 24 Bytes  [ 00, 69, 7F, 00, 00, 74, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonWithFlags + 6F                                   5B89FD88 130 Bytes  [ EA, 7F, 00, 00, 04, 80, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonEx + 5A                                          5B89FE0B 28 Bytes  [ 00, 98, 82, 00, 00, AA, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogonEx + 77                                          5B89FE28 53 Bytes  [ 00, 83, 00, 00, 0D, 83, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogoff + D                                            5B89FE5E 32 Bytes  [ 00, 00, 09, 84, 00, 00, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogoff + 2E                                           5B89FE7F 16 Bytes  [ 00, 98, 84, 00, 00, AA, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogoff + 3F                                           5B89FE90 38 Bytes  [ FC, 84, 00, 00, 1B, 85, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSamLogoff + 66                                           5B89FEB7 55 Bytes  [ 00, F7, 85, 00, 00, 0D, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSendToSam + 27                                           5B89FEF0 14 Bytes  [ 39, 87, 00, 00, 49, 87, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSendToSam + 36                                           5B89FEFF 40 Bytes  [ 00, 9A, 87, 00, 00, B2, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetLogonSendToSam + 5F                                           5B89FF28 58 Bytes  [ 87, 88, 00, 00, 97, 88, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingAddServerToCache + 2A                                     5B89FF63 24 Bytes  [ 00, A0, 89, 00, 00, B6, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingAddServerToCache + 43                                     5B89FF7C 14 Bytes  [ 15, 8A, 00, 00, 27, 8A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingAddServerToCache + 53                                     5B89FF8C 3 Bytes  [ 6F, 8A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingAddServerToCache + 57                                     5B89FF90 29 Bytes  [ 8D, 8A, 00, 00, A9, 8A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingAddServerToCache + 75                                     5B89FFAE 28 Bytes  [ 00, 00, 79, 8B, 00, 00, 95, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingSetAuthInfo + 28                                          5B8A0063 74 Bytes  [ 00, 8B, 45, E4, 89, B8, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingSetAuthInfo + 73                                          5B8A00AE 8 Bytes  [ 45, E4, 39, B8, 80, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingSetAuthInfo + 7C                                          5B8A00B7 65 Bytes  [ 27, C6, 80, 86, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingSetAuthInfo + BE                                          5B8A00F9 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingSetAuthInfo + C0                                          5B8A00FB 13 Bytes  [ FF, 64, BF, 93, 7C, 77, BF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingRemoveServerFromCache + 114                               5B8A0221 263 Bytes  [ 03, 03, 03, 03, 03, 03, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingRemoveServerFromCache + 21D                               5B8A032A 91 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingRemoveServerFromCache + 27A                               5B8A0387 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingRemoveServerFromCache + 292                               5B8A039F 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NlBindingRemoveServerFromCache + 294                               5B8A03A1 8 Bytes  [ EC, 83, EC, 24, 8B, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameEnum + 35                                            5B8A0E5A 93 Bytes  [ 02, 01, 02, 01, 02, 01, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameEnum + 93                                            5B8A0EB8 7 Bytes  [ 59, 0F, 84, 82, D7, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameEnum + 9B                                            5B8A0EC0 33 Bytes  [ 45, FC, 66, 83, 78, 06, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameEnum + BD                                            5B8A0EE2 31 Bytes  [ 84, C0, 0F, 85, 92, 3C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameEnum + DD                                            5B8A0F02 17 Bytes  JMP 5B8A4B7C C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameGetInfo + 5B                                         5B8A0FA4 11 Bytes  [ 06, 00, 08, 00, 38, 5F, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameGetInfo + 67                                         5B8A0FB0 59 Bytes  [ 30, 5F, 92, 7C, 06, 00, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameGetInfo + A3                                         5B8A0FEC 47 Bytes  [ 89, 45, A0, C7, 45, FC, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameGetInfo + D3                                         5B8A101C 5 Bytes  [ FF, F6, 46, 05, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageNameGetInfo + D9                                         5B8A1022 41 Bytes  [ 84, 6A, 0D, 01, 00, 56, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetAuditWrite + 6                                                  5B8A1093 21 Bytes  [ 89, 55, D8, 89, 55, DC, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!DsRoleAbortDownlevelServerUpgrade + 6                              5B8A10A9 239 Bytes  [ 8B, 4D, 10, 8D, 71, F8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateLocalPartition + 28                                  5B8A1199 42 Bytes  [ FF, FF, 83, E1, 07, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateLocalPartition + 53                                  5B8A11C4 136 Bytes  [ 4A, 04, 89, 4D, 88, 89, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteLocalPartition + 4                                   5B8A124D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteLocalPartition + 6                                   5B8A124F 75 Bytes  CALL 5B889904 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteLocalPartition + 54                                  5B8A129D 23 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteLocalPartition + 6C                                  5B8A12B5 22 Bytes  [ 4D, F8, 51, 8D, 4D, F6, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteLocalPartition + 83                                  5B8A12CC 204 Bytes  [ 8D, 4D, EC, 51, 8D, 4E, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetLocalVolumeState + 88                                   5B8A1399 1 Byte  [ 5F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetLocalVolumeState + 8A                                   5B8A139B 8 Bytes  [ F9, 25, 0F, 85, 7A, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetLocalVolumeState + 93                                   5B8A13A4 16 Bytes  [ D7, 66, 8B, 02, 66, 3B, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetLocalVolumeState + A4                                   5B8A13B5 74 Bytes  [ 8B, 02, 66, 83, F8, 30, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetServerInfo + 1F                                         5B8A1400 81 Bytes  [ FF, 66, 8B, 0B, C1, E0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetServerInfo + 71                                         5B8A1452 41 Bytes  [ 20, 00, 28, 00, 28, 00, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetServerInfo + 9B                                         5B8A147C 19 Bytes  [ 20, 00, 20, 00, 20, 00, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsSetServerInfo + AF                                         5B8A1490 33 Bytes  [ 10, 00, 10, 00, 10, 00, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateExitPoint + 11                                       5B8A14B2 1 Byte  [ 84 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateExitPoint + 13                                       5B8A14B4 3 Bytes  [ 84, 00, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateExitPoint + 17                                       5B8A14B8 3 Bytes  [ 10, 00, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateExitPoint + 1B                                       5B8A14BC 21 Bytes  [ 10, 00, 10, 00, 10, 00, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsCreateExitPoint + 31                                       5B8A14D2 7 Bytes  [ 01, 00, 01, 00, 01, 00, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteExitPoint + 13                                       5B8A1584 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteExitPoint + 17                                       5B8A1588 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteExitPoint + 1B                                       5B8A158C 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteExitPoint + 2C                                       5B8A159D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsDeleteExitPoint + 34                                       5B8A15A5 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsModifyPrefix + 32                                          5B8A166B 16 Bytes  [ FC, 8B, 40, 04, 89, 45, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsModifyPrefix + 43                                          5B8A167C 51 Bytes  [ D0, 66, 83, 38, 3D, 75, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsModifyPrefix + 77                                          5B8A16B0 35 Bytes  [ C6, 05, F4, E1, 97, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsModifyPrefix + 9B                                          5B8A16D4 65 Bytes  [ 8B, 40, 30, 8B, 40, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsFixLocalVolume + 1D                                        5B8A1716 55 Bytes  [ 9C, 66, 89, 75, 9E, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsFixLocalVolume + 55                                        5B8A174E 74 Bytes  [ 9E, 03, F9, 89, 7D, D0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsFixLocalVolume + A0                                        5B8A1799 59 Bytes  [ 0F, 8D, 68, FF, FF, FF, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsManagerReportSiteInfo + 4                                  5B8A17D5 43 Bytes  [ 66, 8B, 06, 66, 3B, 45, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsManagerReportSiteInfo + 30                                 5B8A1801 50 Bytes  [ 43, 43, 89, 5D, D4, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsManagerReportSiteInfo + 63                                 5B8A1834 2 Bytes  [ 1B, A3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsManagerReportSiteInfo + 67                                 5B8A1838 52 Bytes  [ C7, 45, FC, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsManagerReportSiteInfo + 9C                                 5B8A186D 11 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsGetFtServers + 1                                           5B8A1A62 2 Bytes  [ 45, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsGetFtServers + 4                                           5B8A1A65 50 Bytes  [ 40, 0C, 8B, 50, 20, 83, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsGetFtServers + 37                                          5B8A1A98 67 Bytes  [ B4, FD, FF, FF, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsGetFtServers + 7B                                          5B8A1ADC 4 Bytes  [ 84, 65, A3, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetDfsGetFtServers + 80                                          5B8A1AE1 30 Bytes  [ 68, 78, E1, 97, 7C, E8, 15, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConnectionEnum + 64                                             5B8A2129 7 Bytes  [ EC, 51, 51, 64, A1, 18, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConnectionEnum + 6D                                             5B8A2132 20 Bytes  [ 8B, 40, 24, 6A, 00, 6A, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConnectionEnum + 82                                             5B8A2147 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConnectionEnum + 84                                             5B8A2149 35 Bytes  [ 6A, 00, FF, 35, 70, F9, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetConnectionEnum + A8                                             5B8A216D 102 Bytes  CALL EC1AB202 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileClose + 37                                                  5B8A2218 12 Bytes  [ 00, FE, 7F, 8B, 02, F7, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileClose + 44                                                  5B8A2225 196 Bytes  [ 4D, 08, 8B, D0, 8B, 41, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileEnum + 41                                                   5B8A22EA 17 Bytes  [ 55, 8B, EC, 8B, 4D, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileEnum + 53                                                   5B8A22FC 103 Bytes  [ 08, 8B, 50, 04, 89, 0A, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileEnum + BB                                                   5B8A2364 79 Bytes  [ 5D, C2, 04, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileEnum + 10B                                                  5B8A23B4 70 Bytes  [ 00, 83, 0B, FF, 8B, 46, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetFileGetInfo + 32                                                5B8A23FB 194 Bytes  [ 0F, 84, 29, 5B, 00, 00, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionDel + 1D                                                 5B8A24BE 75 Bytes  [ F4, 8B, 37, A1, 80, E4, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionDel + 69                                                 5B8A250A 106 Bytes  CALL 5B8A22E4 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionEnum + C                                                 5B8A2575 54 Bytes  [ 55, 8B, EC, 56, 8B, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionEnum + 43                                                5B8A25AC 14 Bytes  JMP 5B8A23B8 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionEnum + 52                                                5B8A25BB 11 Bytes  [ 84, 9B, 29, 00, 00, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionEnum + 5E                                                5B8A25C7 16 Bytes  [ 85, 74, FF, FF, FF, 39, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionEnum + 6F                                                5B8A25D8 44 Bytes  [ 64, A1, 18, 00, 00, 00, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionGetInfo + 51                                             5B8A26DA 156 Bytes  JMP 5B89716E C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionGetInfo + EE                                             5B8A2777 38 Bytes  [ 66, 89, 5C, DF, 02, E9, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSessionGetInfo + 115                                            5B8A279E 26 Bytes  [ C0, 0F, 84, 2C, C9, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareCheck + 8                                                  5B8A27B9 3 Bytes  [ 23, 99, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareCheck + C                                                  5B8A27BD 51 Bytes  JMP 5B88C104 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareCheck + 40                                                 5B8A27F1 47 Bytes  JMP 5B8A1F11 C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareCheck + 72                                                 5B8A2823 138 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDelSticky + D                                              5B8A28AE 1 Byte  [ 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDelSticky + F                                              5B8A28B0 62 Bytes  [ 80, E1, 04, 80, F9, 04, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDelSticky + 4E                                             5B8A28EF 22 Bytes  [ 33, C9, EB, E2, 0F, B7, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDelSticky + 65                                             5B8A2906 50 Bytes  [ D1, 83, E1, 07, B3, 01, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareDelSticky + 98                                             5B8A2939 56 Bytes  [ 0F, B7, C0, 50, 56, E8, AE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnumSticky + 38                                            5B8A29C1 21 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnumSticky + 4F                                            5B8A29D8 22 Bytes  [ 8B, 40, 30, 33, F6, 46, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnumSticky + 66                                            5B8A29EF 31 Bytes  [ 00, 8D, 85, FC, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnumSticky + 86                                            5B8A2A0F 8 Bytes  JMP 5B88F6AB C:\WINDOWS\system32\NETAPI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetShareEnumSticky + 90                                            5B8A2A19 123 Bytes  JMP 5B88F6AB C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerDiskEnum + 16                                             5B8A2AAF 114 Bytes  [ 66, 8B, 03, 56, 57, 8B, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerDiskEnum + 89                                             5B8A2B22 10 Bytes  [ 00, 8B, 45, 10, 85, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerDiskEnum + 94                                             5B8A2B2D 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerDiskEnum + 96                                             5B8A2B2F 92 Bytes  [ F6, 74, 34, 5F, 8B, C6, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerDiskEnum + F7                                             5B8A2B90 44 Bytes  [ 6A, 18, 68, 20, 7C, 92, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerSetInfo + 1C                                              5B8A2BBD 52 Bytes  [ FF, 84, C0, 0F, 85, 82, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerSetInfo + 51                                              5B8A2BF2 20 Bytes  [ 74, 8E, 89, 7D, E4, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerSetInfo + 66                                              5B8A2C07 100 Bytes  [ FC, FF, FF, 75, 08, E8, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerSetInfo + CB                                              5B8A2C6C 61 Bytes  [ 8D, 45, D8, 50, 6A, 09, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerSetInfo + 109                                             5B8A2CAA 50 Bytes  CALL 5B889906 C:\WINDOWS\system32\NETAPI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAdd + 48                                         5B8A2DA9 150 Bytes  [ 8B, 77, 08, 8B, 4F, 0C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAdd + DF                                         5B8A2E40 8 Bytes  [ 00, 89, 5D, E4, 89, 7D, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAdd + E8                                         5B8A2E49 4 Bytes  [ EC, 89, 5D, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAdd + ED                                         5B8A2E4E 20 Bytes  [ 12, CD, FE, FF, 3B, C3, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAdd + 102                                        5B8A2E63 49 Bytes  [ 15, C0, 8B, 7D, 10, 81, 3F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportDel + 10                                         5B8A2EF9 131 Bytes  [ 39, 43, 08, 0F, 85, 72, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportDel + 94                                         5B8A2F7D 29 Bytes  [ 5D, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportDel + B2                                         5B8A2F9B 70 Bytes  [ 15, B0, 04, 91, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportEnum + 31                                        5B8A2FE2 148 Bytes  [ 31, 68, 18, 9F, 91, 7C, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportEnum + C6                                        5B8A3077 8 Bytes  [ 55, 8B, EC, 6A, 01, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportEnum + CF                                        5B8A3080 3 Bytes  [ F5, DD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportEnum + D3                                        5B8A3084 156 Bytes  [ 59, 85, C0, 0F, B7, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteTOD + 70                                                  5B8A3121 45 Bytes  [ F8, F6, 44, 42, FF, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteTOD + 9E                                                  5B8A314F 119 Bytes  [ 00, 2D, 00, 20, 00, 00, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteTOD + 116                                                 5B8A31C7 72 Bytes  [ 55, A8, 2B, C6, 01, 45, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteTOD + 15F                                                 5B8A3210 97 Bytes  [ 83, FF, 1A, 0F, 84, 48, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoteTOD + 1C2                                                 5B8A3273 35 Bytes  [ 0F, AF, 45, EC, 3B, 45, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAddEx + 12                                       5B8A36B3 21 Bytes  [ 0F, 84, 93, FE, FF, FF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAddEx + 28                                       5B8A36C9 1 Byte  [ C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAddEx + 2B                                       5B8A36CC 49 Bytes  [ DC, 3B, C3, 7D, 45, EB, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAddEx + 5D                                       5B8A36FE 28 Bytes  [ 89, 5D, FC, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerTransportAddEx + 7B                                       5B8A371C 19 Bytes  [ 0C, FF, 75, 08, FF, 15, EC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameAdd + 5                                       5B8A3776 81 Bytes  [ 51, 8D, 45, FC, 50, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameAdd + 58                                      5B8A37C9 6 Bytes  [ FF, 8B, D8, E9, 8D, E7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameAdd + 5F                                      5B8A37D0 241 Bytes  [ FF, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameAdd + 152                                     5B8A38C3 167 Bytes  [ FF, EB, 8D, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameAdd + 1FA                                     5B8A396B 25 Bytes  [ AB, B8, 00, 00, 8B, 45, 28, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameDel + 34                                      5B8A39FA 3 Bytes  [ 8B, 4D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameDel + 38                                      5B8A39FE 100 Bytes  [ C9, 0F, 86, 89, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameDel + 9D                                      5B8A3A63 1 Byte  [ 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameDel + A0                                      5B8A3A66 9 Bytes  [ FF, 5D, C2, 0C, 00, 89, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetServerComputerNameDel + AB                                      5B8A3A71 9 Bytes  [ C0, EB, CB, 90, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetFileSecurity + 19                                           5B8A3D0D 3 Bytes  [ 85, 60, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetFileSecurity + 1D                                           5B8A3D11 57 Bytes  [ FF, 50, 6A, FF, FF, B5, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetFileSecurity + 57                                           5B8A3D4B 36 Bytes  [ FF, 80, F9, 97, 7C, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetFileSecurity + 7C                                           5B8A3D70 5 Bytes  [ 89, BD, 70, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpGetFileSecurity + 82                                           5B8A3D76 29 Bytes  [ 89, BD, 74, FD, FF, FF, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSetFileSecurity + 23                                           5B8A3E10 57 Bytes  [ 44, 9E, 1C, 8B, 08, 89, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSetFileSecurity + 5D                                           5B8A3E4A 18 Bytes  [ FF, 50, 8D, 84, 9E, 20, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSetFileSecurity + 70                                           5B8A3E5D 23 Bytes  [ 46, 14, 8B, 4D, FC, 89, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSetFileSecurity + 89                                           5B8A3E76 9 Bytes  [ 5B, F6, 47, 18, 04, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetpSetFileSecurity + 94                                           5B8A3E81 30 Bytes  [ FF, 77, 2C, FF, 77, 28, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaSetInfo + 12                                               5B8A4C8B 167 Bytes  [ 52, 74, 6C, 49, 6E, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaSetInfo + BA                                               5B8A4D33 320 Bytes  [ 00, 52, 74, 6C, 49, 6E, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserEnum + 12B                                             5B8A4E74 103 Bytes  [ 79, 53, 4C, 69, 73, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaUserSetInfo + 3F                                           5B8A4EDC 273 Bytes  [ 52, 74, 6C, 49, 70, 76, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportEnum + 7D                                         5B8A4FEE 7 Bytes  [ 52, 74, 6C, 49, 70, 76, 36 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportEnum + 85                                         5B8A4FF6 148 Bytes  [ 74, 72, 69, 6E, 67, 54, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportEnum + 11A                                        5B8A508B 60 Bytes  [ 65, 72, 69, 63, 54, 61, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportAdd + 1B                                          5B8A50C8 16 Bytes  [ 52, 74, 6C, 49, 73, 54, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportAdd + 2C                                          5B8A50D9 30 Bytes  [ 52, 74, 6C, 49, 73, 54, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportAdd + 4B                                          5B8A50F8 90 Bytes  [ 52, 74, 6C, 49, 73, 56, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportAdd + A6                                          5B8A5153 42 Bytes  [ 6C, 4C, 61, 72, 67, 65, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportDel + 5                                           5B8A517E 151 Bytes  [ 74, 6C, 4C, 61, 72, 67, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportDel + 9D                                          5B8A5216 4 Bytes  [ 63, 75, 72, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetWkstaTransportDel + A2                                          5B8A521B 92 Bytes  [ 79, 44, 65, 73, 63, 72, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageBufferSend + 37                                          5B8A5278 37 Bytes  [ 6D, 6F, 72, 79, 53, 74, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageBufferSend + 5D                                          5B8A529E 115 Bytes  [ 52, 74, 6C, 4C, 6F, 6F, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageBufferSend + D2                                          5B8A5313 71 Bytes  [ 65, 72, 69, 63, 4D, 61, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageBufferSend + 11A                                         5B8A535B 38 Bytes  [ 52, 74, 6C, 4D, 75, 6C, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetMessageBufferSend + 141                                         5B8A5382 43 Bytes  [ 6C, 74, 69, 42, 79, 74, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetWkstaResetDfsCache + 96                                       5B8A54C7 253 Bytes  [ 75, 6D, 62, 65, 72, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetWkstaResetDfsCache + 194                                      5B8A55C5 52 Bytes  [ 72, 6F, 74, 65, 63, 74, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetWkstaResetDfsCache + 1C9                                      5B8A55FA 127 Bytes  [ 65, 72, 79, 44, 65, 70, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetWkstaResetDfsCache + 249                                      5B8A567A 171 Bytes  [ 52, 74, 6C, 51, 75, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!I_NetWkstaResetDfsCache + 2F5                                      5B8A5726 137 Bytes  [ 52, 74, 6C, 51, 75, 65, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetJoinDomain + 155                                                5B8A59C7 55 Bytes  [ 63, 65, 31, 39, 38, 30, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnjoinDomain + 1E                                               5B8A59FF 158 Bytes  [ 74, 65, 53, 44, 00, 52, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnjoinDomain + BD                                               5B8A5A9E 5 Bytes  [ 6C, 53, 65, 74, 43 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnjoinDomain + C3                                               5B8A5AA4 36 Bytes  [ 72, 72, 65, 6E, 74, 44, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetUnjoinDomain + E8                                               5B8A5AC9 463 Bytes  [ 6D, 65, 6E, 74, 00, 52, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetValidateName + C8                                               5B8A5C99 137 Bytes  [ 54, 69, 6D, 65, 5A, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetValidateName + 152                                              5B8A5D23 300 Bytes  [ 6D, 6F, 72, 79, 53, 74, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinableOUs + 117                                            5B8A5E50 11 Bytes  [ 52, 74, 6C, 54, 72, 61, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetGetJoinableOUs + 124                                            5B8A5E5D 328 Bytes  [ 61, 73, 65, 44, 65, 73, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoveAlternateComputerName + 3D                                5B8A5FA6 72 Bytes  [ 64, 4F, 65, 6D, 53, 74, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoveAlternateComputerName + 86                                5B8A5FEF 88 Bytes  [ 53, 74, 72, 69, 6E, 67, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetRemoveAlternateComputerName + DF                                5B8A6048 65 Bytes  [ 52, 74, 6C, 55, 6E, 69, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetSetPrimaryComputerName + 31                                     5B8A608A 392 Bytes  [ 52, 74, 6C, 55, 6E, 6C, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + CA                                     5B8A6213 175 Bytes  [ 52, 74, 6C, 56, 61, 6C, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + 17A                                    5B8A62C3 33 Bytes  [ 52, 74, 6C, 57, 72, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + 19C                                    5B8A62E5 79 Bytes  [ 52, 74, 6C, 5A, 65, 72, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + 1EC                                    5B8A6335 421 Bytes  [ 65, 72, 53, 69, 7A, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] NETAPI32.dll!NetEnumerateComputerNames + 392                                    5B8A64DB 171 Bytes  [ 65, 63, 6B, 42, 79, 54, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + FFFF4FC9                                           77FE1185 693 Bytes  [ 8D, 84, 06, 99, 79, 82, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + FFFF53B4                                           77FE1570 170 Bytes  [ 00, 00, 8D, 94, 15, A1, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + FFFF545F                                           77FE161B 357 Bytes  [ 00, 03, D6, 8B, F0, 23, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + FFFF55C5                                           77FE1781 120 Bytes  [ 00, 03, FE, 8B, F3, 23, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + FFFF563E                                           77FE17FA 841 Bytes  [ 03, DE, 8B, F2, 23, F7, 81, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetUserNameExW + 35                                                 77FE1CC5 264 Bytes  [ F1, 33, F2, 23, F3, 33, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetUserNameExW + 13E                                                77FE1DCE 330 Bytes  [ 75, 34, 0F, CE, 89, 74, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredMarshalTargetInfo + A                                           77FE1F19 5 Bytes  [ 6C, 24, 18, 33, F5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredMarshalTargetInfo + 10                                          77FE1F1F 158 Bytes  [ 6C, 24, 30, 33, F5, 8B, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredMarshalTargetInfo + AF                                          77FE1FBE 13 Bytes  [ 6C, 24, 3C, 33, F5, 8B, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredMarshalTargetInfo + BD                                          77FE1FCC 26 Bytes  JMP 0503E592 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredMarshalTargetInfo + D8                                          77FE1FE7 4 Bytes  [ DD, 8B, 74, 24 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaFreeReturnBuffer + 1A                                            77FE219A 32 Bytes  CALL 77FE1891 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaCallAuthenticationPackage + 14                                   77FE21BC 13 Bytes  [ 76, 22, 6A, 02, 59, 8D, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaCallAuthenticationPackage + 23                                   77FE21CB 17 Bytes  [ 33, D2, F3, A7, 0F, 84, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaCallAuthenticationPackage + 36                                   77FE21DE 29 Bytes  [ 72, DE, 8D, 85, A0, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaCallAuthenticationPackage + 55                                   77FE21FD 28 Bytes  [ 6A, 04, 59, 33, C0, F3, A7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaCallAuthenticationPackage + 72                                   77FE221A 1 Byte  [ 1C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!FreeContextBuffer + A5                                              77FE28ED 457 Bytes  [ 0C, 10, 83, C1, 20, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesW + 88                                     77FE2AB7 41 Bytes  [ 00, 00, EB, EC, 0F, B7, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesW + B2                                     77FE2AE1 19 Bytes  [ E7, 0F, 03, DF, 66, 8B, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesW + C6                                     77FE2AF5 13 Bytes  [ 7D, 0C, 88, 57, F4, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesW + D4                                     77FE2B03 50 Bytes  [ 7E, 1C, 0F, B7, 14, 57, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesW + 108                                    77FE2B37 22 Bytes  [ 1C, 5A, 89, 7D, 18, C1, EF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!FreeCredentialsHandle + 162                                         77FE2D0C 162 Bytes  [ 7D, 0C, 88, 57, F9, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityContext + 89                                          77FE2DAF 3 Bytes  [ E0, 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityContext + 8D                                          77FE2DB3 77 Bytes  [ DF, C1, EB, 08, 0F, B7, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityContext + DB                                          77FE2E01 121 Bytes  [ 1C, EB, 41, 66, 83, 7D, 1C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityContext + 156                                         77FE2E7C 145 Bytes  [ EB, EC, 0F, B7, 7D, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityContext + 1E8                                         77FE2F0E 60 Bytes  [ 83, E7, 0F, 03, DF, 66, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcquireCredentialsHandleW + 9E                                      77FE31BA 331 Bytes  [ 65, 61, 70, 0A, 00, CC, CC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!MakeSignature + 16                                                  77FE3306 13 Bytes  [ 71, 24, FF, 70, 20, 68, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!MakeSignature + 24                                                  77FE3314 46 Bytes  JMP 77FC3199 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!MakeSignature + 53                                                  77FE3343 51 Bytes  JMP 77FC3FF9 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!MakeSignature + 87                                                  77FE3377 46 Bytes  [ 80, 3D, C1, E1, 97, 7C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!VerifySignature + 2                                                 77FE33A6 19 Bytes  [ 3B, DF, 0F, 84, B6, FF, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!VerifySignature + 16                                                77FE33BA 13 Bytes  [ FF, FF, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!VerifySignature + 24                                                77FE33C8 87 Bytes  [ 8D, 56, 2C, 52, FF, 71, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLogonUser + 2F                                                   77FE3420 50 Bytes  [ FD, FF, 80, 3D, C1, E1, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLogonUser + 63                                                   77FE3454 9 Bytes  [ FF, 53, 83, C6, 24, 56, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLogonUser + 6D                                                   77FE345E 16 Bytes  [ 70, 20, 68, 26, C6, 93, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLogonUser + 7E                                                   77FE346F 18 Bytes  CALL 77FB5A78 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLogonUser + 91                                                   77FE3482 111 Bytes  [ FE, FD, FF, 90, 4C, 64, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryCredentialsAttributesW + 11                                    77FE34F2 123 Bytes  [ 5B, 25, 78, 2C, 25, 78, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryCredentialsAttributesW + 8D                                    77FE356E 83 Bytes  [ 4C, 44, 52, 3A, 20, 25, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryCredentialsAttributesW + E1                                    77FE35C2 112 Bytes  [ 20, 2D, 20, 43, 61, 6C, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryCredentialsAttributesW + 152                                   77FE3633 103 Bytes  [ 44, 4C, 4C, 5F, 50, 52, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryCredentialsAttributesW + 1BA                                   77FE369B 27 Bytes  [ 45, B8, 83, F8, FF, 0F, 84, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityPackageInfoW + E                                       77FE388B 84 Bytes  [ 71, 24, FF, 70, 20, 68, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityPackageInfoW + 63                                      77FE38E0 67 Bytes  [ 85, A0, FD, FF, FF, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityPackageInfoW + A7                                      77FE3924 221 Bytes  [ 97, 7C, 83, C2, 24, 52, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityPackageInfoW + 185                                     77FE3A02 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityPackageInfoW + 187                                     77FE3A04 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterPolicyChangeNotification + C                             77FE4AB9 67 Bytes  [ 55, 8B, EC, 8B, 55, 0C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterPolicyChangeNotification + 50                            77FE4AFD 101 Bytes  [ 85, C0, 7C, 46, 8B, 4E, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterPolicyChangeNotification + B7                            77FE4B64 70 Bytes  [ 00, 73, 0B, 8B, 94, C8, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLookupAuthenticationPackage + 21                                 77FE4BAB 47 Bytes  [ 55, 8B, EC, 51, 83, 65, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLookupAuthenticationPackage + 51                                 77FE4BDB 47 Bytes  [ C8, 8B, 01, 0F, B6, 40, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLookupAuthenticationPackage + 81                                 77FE4C0B 114 Bytes  [ 03, DF, FF, 45, FC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLookupAuthenticationPackage + F4                                 77FE4C7E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaLookupAuthenticationPackage + F6                                 77FE4C80 11 Bytes  [ 6A, 20, 59, 39, 08, 89, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterLogonProcess + 4                                         77FE4D03 27 Bytes  [ 85, 68, FF, FF, FF, 89, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterLogonProcess + 20                                        77FE4D1F 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterLogonProcess + 24                                        77FE4D23 32 Bytes  [ 89, 46, 1C, 33, C0, EB, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterLogonProcess + 45                                        77FE4D44 23 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaRegisterLogonProcess + 5D                                        77FE4D5C 16 Bytes  [ C0, 40, EB, 02, 33, C0, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaConnectUntrusted + B                                             77FE4E8E 22 Bytes  [ 00, 00, 8B, 0D, 34, E2, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaConnectUntrusted + 22                                            77FE4EA5 74 Bytes  CALL 77F970C2 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaConnectUntrusted + 6D                                            77FE4EF0 95 Bytes  [ 74, 04, 3C, 04, 74, 21, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaConnectUntrusted + CD                                            77FE4F50 95 Bytes  [ 83, C2, 0C, 8B, FA, F3, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaConnectUntrusted + 12D                                           77FE4FB0 13 Bytes  [ 00, 66, 89, 48, 02, C6, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcceptSecurityContext + 31                                          77FE5372 29 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcceptSecurityContext + 4F                                          77FE5390 4 Bytes  [ 28, 33, DB, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcceptSecurityContext + 54                                          77FE5395 29 Bytes  [ F4, C7, 45, F8, 00, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcceptSecurityContext + 72                                          77FE53B3 133 Bytes  [ 75, 2C, 50, 8D, 45, F8, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryContextAttributesW + A                                         77FE5439 110 Bytes  CALL CB1299C9 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryContextAttributesW + 79                                        77FE54A8 69 Bytes  [ 8B, 7E, 08, 8B, C7, 83, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryContextAttributesW + BF                                        77FE54EE 36 Bytes  [ C9, C2, 10, 00, 85, FF, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImpersonateSecurityContext + 4                                      77FE5513 18 Bytes  [ 5D, F0, 8B, 5B, 0C, 3B, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImpersonateSecurityContext + 17                                     77FE5526 53 Bytes  [ 39, 3B, 38, 75, B6, 8B, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!RevertSecurityContext + 9                                           77FE555C 90 Bytes  [ 04, 41, 8D, 7E, 0C, 8D, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!RevertSecurityContext + 64                                          77FE55B7 52 Bytes  [ C6, 45, F8, 00, C6, 45, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!RevertSecurityContext + 99                                          77FE55EC 28 Bytes  [ 85, F0, FE, FF, FF, 39, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!RevertSecurityContext + B6                                          77FE5609 14 Bytes  CALL 2DF23E61 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!RevertSecurityContext + C5                                          77FE5618 6 Bytes  [ FF, B0, 01, E9, C3, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextW + 60                                     77FE5C23 37 Bytes  [ 40, 01, 10, 74, 51, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextW + 87                                     77FE5C4A 40 Bytes  [ 14, 00, 50, FF, 75, D0, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextW + B0                                     77FE5C73 106 Bytes  [ C8, 83, E1, 03, F3, A4, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextW + 11B                                    77FE5CDE 45 Bytes  [ 00, 89, 7D, E4, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextW + 149                                    77FE5D0C 148 Bytes  [ 80, 00, 00, 89, 55, 0C, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecCacheSspiPackages + A                                            77FE5F4E 43 Bytes  [ 89, 55, F0, 89, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecCacheSspiPackages + 36                                           77FE5F7A 68 Bytes  [ 00, 00, 23, D6, EB, 02, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecCacheSspiPackages + 7C                                           77FE5FC0 27 Bytes  [ 14, 00, 50, FF, 75, E0, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecCacheSspiPackages + 98                                           77FE5FDC 151 Bytes  [ 00, 00, 6A, 01, 52, E8, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecCacheSspiPackages + 131                                          77FE6075 47 Bytes  [ 00, 4C, 44, 52, 3A, 20, 55, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitSecurityInterfaceA + 15                                         77FE6A41 12 Bytes  [ 07, 83, E0, 02, 33, C9, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitSecurityInterfaceA + 23                                         77FE6A4F 127 Bytes  [ 8D, 85, 8C, FE, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitSecurityInterfaceA + A3                                         77FE6ACF 41 Bytes  CALL 77FB70C1 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitSecurityInterfaceA + CD                                         77FE6AF9 7 Bytes  [ FF, 76, 18, E8, 2C, 04, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitSecurityInterfaceA + D5                                         77FE6B01 37 Bytes  JMP 77FCA4D2 C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaDeregisterLogonProcess + 1                                       77FE7C9E 176 Bytes  [ 45, 08, 53, 56, 33, F6, A9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaDeregisterLogonProcess + B2                                      77FE7D4F 30 Bytes  [ C8, 83, E1, 03, F3, A4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaDeregisterLogonProcess + D1                                      77FE7D6E 43 Bytes  [ 8B, 45, F4, 89, 47, 04, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaDeregisterLogonProcess + FD                                      77FE7D9A 34 Bytes  CALL 77FE7DA8 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaDeregisterLogonProcess + 120                                     77FE7DBD 183 Bytes  [ FE, FF, FF, 85, C0, 8B, 4D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredUnmarshalTargetInfo + 3E                                        77FE85AA 64 Bytes  [ 8B, CA, 8B, D3, 8B, D9, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredUnmarshalTargetInfo + 7F                                        77FE85EB 55 Bytes  [ D8, 8B, 44, 24, 08, F7, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredUnmarshalTargetInfo + B7                                        77FE8623 120 Bytes  [ 00, 73, EC, 2B, C8, 8B, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredUnmarshalTargetInfo + 130                                       77FE869C 234 Bytes  [ 44, 24, 0C, D1, EB, D1, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!CredUnmarshalTargetInfo + 21B                                       77FE8787 33 Bytes  [ 4E, 33, D2, 8B, C6, 5E, 5B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetSecurityUserInfo + 2                                             77FE8B01 131 Bytes  [ 07, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecGetLocaleSpecificEncryptionRules + 76                            77FE8B85 107 Bytes  [ 00, 83, EC, 10, 89, 54, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddSecurityPackageW + 2C                                            77FE8BF1 91 Bytes  [ 1D, 40, 1C, 90, 7C, 66, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddSecurityPackageA + 49                                            77FE8C4D 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddSecurityPackageA + 4C                                            77FE8C50 6 Bytes  [ FF, 07, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddSecurityPackageA + 53                                            77FE8C57 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DeleteSecurityPackageA + E                                          77FE8C6A 48 Bytes  [ 54, 24, 08, 33, DB, 8A, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SupportsChannelBinding + 22                                         77FE8C9B 160 Bytes  [ FB, C1, E3, 10, 03, DF, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SupportsChannelBinding + C3                                         77FE8D3C 36 Bytes  [ 8A, 4E, 01, 8A, 57, 01, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SupportsChannelBinding + E8                                         77FE8D61 66 Bytes  [ 27, 8B, 4E, FC, 8B, 57, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SupportsChannelBinding + 12B                                        77FE8DA4 3 Bytes  [ 00, 81, E2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SupportsChannelBinding + 12F                                        77FE8DA8 88 Bytes  [ 00, FF, 00, 3B, D1, 75, CD, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecInitUserModeContext + 1B                                         77FE9FF8 20 Bytes  [ 50, 58, 02, 00, 8B, 85, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecInitUserModeContext + 30                                         77FEA00D 37 Bytes  [ FF, 89, 85, 80, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecDeleteUserModeContext + A                                        77FEA034 76 Bytes  [ 57, 0F, 85, 8D, E6, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecDeleteUserModeContext + 57                                       77FEA081 5 Bytes  [ FF, 50, E8, C5, 6B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecDeleteUserModeContext + 5D                                       77FEA087 37 Bytes  [ FF, 53, 8D, 85, 7C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecDeleteUserModeContext + 83                                       77FEA0AD 67 Bytes  [ 84, C0, 0F, 85, 8C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecDeleteUserModeContext + C7                                       77FEA0F1 21 Bytes  [ 45, 8D, 85, 7C, FE, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaUnregisterPolicyChangeNotification + B                           77FEA258 12 Bytes  [ 00, 00, 00, 00, 00, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaUnregisterPolicyChangeNotification + 18                          77FEA265 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaUnregisterPolicyChangeNotification + 1A                          77FEA267 8 Bytes  [ 00, 10, 33, 92, 7C, 40, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaUnregisterPolicyChangeNotification + 23                          77FEA270 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaEnumerateLogonSessions + 7                                       77FEA27C 18 Bytes  [ 40, 34, 92, 7C, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaEnumerateLogonSessions + 1A                                      77FEA28F 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaGetLogonSessionData + 8                                          77FEA29C 17 Bytes  [ 6F, 00, 66, 00, 74, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaGetLogonSessionData + 1A                                         77FEA2AE 31 Bytes  [ 6F, 00, 6C, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaGetLogonSessionData + 3A                                         77FEA2CE 11 Bytes  [ 74, 00, 5C, 00, 57, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!LsaGetLogonSessionData + 46                                         77FEA2DA 99 Bytes  [ 6F, 00, 77, 00, 73, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddCredentialsW + 32                                                77FEA33E 43 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddCredentialsA + 9                                                 77FEA36A 33 Bytes  [ 74, 00, 5C, 00, 43, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AddCredentialsA + 2B                                                77FEA38C 107 Bytes  [ 74, 00, 5C, 00, 4F, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ApplyControlToken + 42                                              77FEA3F8 11 Bytes  [ 6F, 00, 73, 00, 6F, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesA + 7                                      77FEA404 21 Bytes  [ 57, 00, 69, 00, 6E, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesA + 1D                                     77FEA41A 11 Bytes  [ 65, 00, 72, 00, 5C, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EnumerateSecurityPackagesA + 29                                     77FEA426 127 Bytes  [ 65, 00, 49, 00, 64, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityContextToken + 15                                      77FEA4A6 7 Bytes  [ 00, 64, A1, 18, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QuerySecurityContextToken + 1D                                      77FEA4AE 88 Bytes  [ 70, 30, 89, B5, C0, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!QueryContextAttributesA + 1E                                        77FEA507 54 Bytes  [ FF, 00, 01, 8D, 85, B4, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SetContextAttributesW + B                                           77FEA53E 9 Bytes  [ 93, 7C, 8E, F8, 93, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SetContextAttributesW + 15                                          77FEA548 71 Bytes  [ E0, F8, 93, 7C, F3, F8, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SetContextAttributesW + 5D                                          77FEA590 30 Bytes  [ 8D, 73, F0, 89, 75, D4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SetContextAttributesA + 1A                                          77FEA5AF 158 Bytes  [ 46, 36, 08, 74, CE, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!EncryptMessage                                                      77FEA651 121 Bytes  [ 90, 68, 78, E1, 97, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DecryptMessage + 2B                                                 77FEA6CB 4 Bytes  [ 0C, 83, 78, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!DecryptMessage + 31                                                 77FEA6D1 74 Bytes  [ 06, 33, C0, 5D, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ExportSecurityContext + 2D                                          77FEA71C 1 Byte  [ 97 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ExportSecurityContext + 2F                                          77FEA71E 3 Bytes  CALL 77FE1759 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ExportSecurityContext + 33                                          77FEA722 5 Bytes  [ FF, FF, D0, E8, B8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ExportSecurityContext + 39                                          77FEA728 30 Bytes  [ FF, FF, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ExportSecurityContext + 58                                          77FEA747 87 Bytes  [ 00, 00, 8B, 40, 24, A3, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImportSecurityContextW + 53                                         77FEA79F 2 Bytes  [ FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImportSecurityContextW + 56                                         77FEA7A2 34 Bytes  [ FF, FF, 00, 00, 00, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImportSecurityContextA                                              77FEA7C7 39 Bytes  [ 90, 90, 80, 3D, 58, FF, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImportSecurityContextA + 28                                         77FEA7EF 16 Bytes  [ 44, D9, 02, 00, A1, A0, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!ImportSecurityContextA + 39                                         77FEA800 76 Bytes  [ A1, A8, FF, 97, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcquireCredentialsHandleA + B                                       77FEA84D 20 Bytes  [ 55, 8B, EC, 83, EC, 10, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!AcquireCredentialsHandleA + 20                                      77FEA862 22 Bytes  [ 6A, 02, 89, 45, F4, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextA + 7                                      77FEA879 135 Bytes  [ 00, 85, C0, 0F, 8C, 9A, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextA + 8F                                     77FEA901 141 Bytes  [ F2, C1, EE, 08, 0F, B7, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextA + 11D                                    77FEA98F 10 Bytes  [ 0F, B7, 55, 18, 8B, 0D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextA + 128                                    77FEA99A 8 Bytes  [ F2, C1, EE, 08, 0F, B7, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!InitializeSecurityContextA + 131                                    77FEA9A3 117 Bytes  [ DA, C1, EB, 04, 83, E3, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageA + 4                                          77FEAE7F 34 Bytes  [ 15, C0, E0, 97, 7C, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageA + 27                                         77FEAEA2 12 Bytes  [ 89, 4D, 18, 0F, B7, 4D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageW + 8                                          77FEAEAF 107 Bytes  [ 88, 4A, FC, 0F, B7, 4F, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageW + 74                                         77FEAF1B 120 Bytes  [ 4D, 18, 0F, B7, 4D, 18, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageW + ED                                         77FEAF94 7 Bytes  [ 84, C0, 0F, 84, 2A, D5, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageW + F5                                         77FEAF9C 105 Bytes  [ 85, DB, 89, 7D, 10, BF, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslGetProfilePackageW + 15F                                        77FEB006 183 Bytes  CALL CA3FB498 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageA + 16                                           77FEB1BA 12 Bytes  [ FF, FF, 75, 10, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageA + 23                                           77FEB1C7 120 Bytes  [ 00, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageW + 6E                                           77FEB240 49 Bytes  [ FF, 68, 42, 43, 92, 7C, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageW + A0                                           77FEB272 13 Bytes  [ 56, 8D, 45, EC, 50, 56, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageW + AE                                           77FEB280 76 Bytes  CALL 77FE0155 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslIdentifyPackageW + FB                                           77FEB2CD 215 Bytes  [ 75, F0, A3, E0, E3, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextW + 5B                                 77FEB3A6 236 Bytes  [ 41, 41, 66, 83, 39, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextA + 3F                                 77FEB493 58 Bytes  [ 47, FE, 00, 75, 01, 48, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextA + 7A                                 77FEB4CE 19 Bytes  [ 83, A5, EC, FB, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextA + 8E                                 77FEB4E2 20 Bytes  [ FF, 8A, 08, 84, C9, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextA + A3                                 77FEB4F7 21 Bytes  [ 44, 4E, 01, 80, 0F, 85, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslInitializeSecurityContextA + BA                                 77FEB50E 79 Bytes  JMP 77FE2748 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslAcceptSecurityContext + 1                                       77FEB55E 24 Bytes  [ 7D, 08, 8D, 45, 08, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslAcceptSecurityContext + 1A                                      77FEB577 44 Bytes  CALL 77FEB586 C:\WINDOWS\system32\Secur32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslAcceptSecurityContext + 47                                      77FEB5A4 28 Bytes  [ 50, 56, FF, 56, 1C, 8B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslAcceptSecurityContext + 64                                      77FEB5C1 5 Bytes  [ 51, 04, 8D, 43, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SaslAcceptSecurityContext + 6A                                      77FEB5C7 11 Bytes  [ 08, 89, 50, 04, 89, 02, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpFreeMemory + 4                                                  77FEB7F0 8 Bytes  [ 46, 08, EB, 21, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpFreeMemory + D                                                  77FEB7F9 9 Bytes  [ 8B, FF, 55, 8B, EC, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpFreeMemory + 17                                                 77FEB803 27 Bytes  [ 7E, 04, 00, 74, 06, 83, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpFreeMemory + 33                                                 77FEB81F 54 Bytes  [ 89, 00, 5E, 5D, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpFreeMemory + 6A                                                 77FEB856 251 Bytes  [ 00, 00, EB, B4, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateNameEx + A                                             77FEBB7C 15 Bytes  [ 0F, B6, D2, 66, 8B, 14, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateNameEx + 1A                                            77FEBB8C 73 Bytes  [ 8A, 51, 0A, 80, FA, 20, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateName + D                                               77FEBBD6 43 Bytes  [ 8A, 51, 14, 80, FA, 20, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateName + 39                                              77FEBC02 36 Bytes  [ 50, 26, 8A, 51, 12, 80, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateName + 5E                                              77FEBC27 68 Bytes  [ 0F, B6, D2, 66, 8B, 14, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateName + A3                                              77FEBC6C 22 Bytes  [ 0F, B6, D2, 66, 8B, 14, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!SecpTranslateName + BA                                              77FEBC83 191 Bytes  [ 0F, B6, D2, 66, 8B, 14, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetComputerObjectNameW + 4                                          77FEBF3C 64 Bytes  [ 45, E4, 2B, C8, 66, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetComputerObjectNameW + 45                                         77FEBF7D 49 Bytes  [ 89, 40, 04, 89, 00, 83, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetComputerObjectNameW + 77                                         77FEBFAF 2 Bytes  [ 87, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetComputerObjectNameW + 7A                                         77FEBFB2 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!GetComputerObjectNameW + 7D                                         77FEBFB5 6 Bytes  [ 45, E0, 8B, 4D, 10, 03 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + B7                                                 77FEC273 63 Bytes  JMP 77FCEEFF C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + F7                                                 77FEC2B3 20 Bytes  [ F8, 10, 74, 10, FF, 45, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + 10C                                                77FEC2C8 5 Bytes  [ 45, D4, E9, 70, 2C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + 112                                                77FEC2CE 10 Bytes  [ FF, 8B, 7B, 18, 03, FB, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] Secur32.dll!TranslateNameA + 11D                                                77FEC2D9 123 Bytes  [ 8B, 75, D8, 6A, 10, 56, 57, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + FFE2596A                                                  7C9C217D 50 Bytes  [ 7C, 66, 39, 1C, 77, 74, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + FFE2599D                                                  7C9C21B0 1 Byte  [ 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + FFE2599F                                                  7C9C21B2 13 Bytes  [ 00, 85, 37, 0F, 84, A1, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + FFE259AD                                                  7C9C21C0 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + FFE259AF                                                  7C9C21C2 89 Bytes  [ 00, 3B, C3, 76, 02, 8B, C3, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceExW + 19                                          7C9EA8AA 41 Bytes  [ 8B, 5E, 1C, 2B, 5E, 28, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceExW + 43                                          7C9EA8D4 16 Bytes  [ 90, 90, 90, 90, 90, 6A, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceExW + 54                                          7C9EA8E5 17 Bytes  [ 6A, 04, 8B, 5D, 08, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceExW + 66                                          7C9EA8F7 36 Bytes  [ 75, 07, B8, 17, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceExW + 8B                                          7C9EA91C 14 Bytes  [ 0F, 8C, 90, 01, 00, 00, F6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFree + 145                                                        7C9EAD6F 19 Bytes  [ 90, 90, 90, 90, 90, 80, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFree + 159                                                        7C9EAD83 52 Bytes  CALL 7C9970E0 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFree + 18E                                                        7C9EADB8 5 Bytes  [ 63, 00, 74, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFree + 194                                                        7C9EADBE 8 Bytes  [ 3E, 00, 25, 00, 34, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFree + 19D                                                        7C9EADC7 209 Bytes  [ 00, 4F, 00, 62, 00, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFree + 6D                                                         7C9EAE99 137 Bytes  [ 66, 8B, 56, FA, 66, 89, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFree + F7                                                         7C9EAF23 18 Bytes  [ FF, 83, 4D, FC, FF, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFree + 10B                                                        7C9EAF37 16 Bytes  JMP 7C9EAE43 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFree + 11C                                                        7C9EAF48 3 Bytes  [ 05, 4F, 95 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFree + 120                                                        7C9EAF4C 141 Bytes  [ 4E, 54, 44, 4C, 4C, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadOLE + 59                                                      7C9EAFDA 16 Bytes  [ FF, 7F, 75, 39, 8D, 45, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadOLE + 6A                                                      7C9EAFEB 145 Bytes  [ 8D, 45, F8, 50, C7, 45, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadOLE + FC                                                      7C9EB07D 120 Bytes  [ F8, 3B, FB, 7D, 20, 57, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetSize + 26                                                      7C9EB0F6 94 Bytes  [ 45, BC, 3B, C3, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILClone + 20                                                        7C9EB155 44 Bytes  [ FF, 3B, C3, 89, 45, FC, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILClone + 4D                                                        7C9EB182 102 Bytes  [ 00, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILClone + B4                                                        7C9EB1E9 30 Bytes  [ 5D, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILClone + D3                                                        7C9EB208 3 Bytes  [ C2, 0C, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILClone + DA                                                        7C9EB20F 13 Bytes  [ 90, 8B, FF, 55, 8B, EC, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCloneFirst + 6C                                                   7C9EB410 58 Bytes  [ 55, 8B, EC, 6A, 14, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCloneFirst + A7                                                   7C9EB44B 42 Bytes  [ FF, 55, 8B, EC, 6A, 16, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCombine + 21                                                      7C9EB476 23 Bytes  CALL 7C9EB186 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCombine + 39                                                      7C9EB48E 59 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCombine + 75                                                      7C9EB4CA 11 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCombine + 82                                                      7C9EB4D7 69 Bytes  [ 5D, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCombine + C8                                                      7C9EB51D 42 Bytes  [ FF, 55, 8B, EC, 6A, 1D, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDesktopFolder + 8E                                             7C9EBB36 17 Bytes  [ FF, 55, 8B, EC, 56, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDesktopFolder + A0                                             7C9EBB48 163 Bytes  CALL 7C9A60C1 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDesktopFolder + 144                                            7C9EBBEC 6 Bytes  [ 8B, 40, 30, 6A, 24, 57 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDesktopFolder + 14B                                            7C9EBBF3 6 Bytes  [ 70, 18, E8, CA, A4, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDesktopFolder + 152                                            7C9EBBFA 60 Bytes  [ 8B, F0, 3B, F7, 74, 41, 6A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRestricted + 2                                                    7C9EC3DF 32 Bytes  [ FF, 89, 85, D8, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRestricted + 23                                                   7C9EC400 19 Bytes  [ 50, 8D, 85, D4, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRestricted + 37                                                   7C9EC414 125 Bytes  [ 6A, 01, 89, 9D, D0, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRestricted + B5                                                   7C9EC492 37 Bytes  [ C4, FD, FF, FF, 56, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRestricted + DB                                                   7C9EC4B8 18 Bytes  [ 8B, 85, E4, FD, FF, FF, 39, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILRemoveLastID + 3C                                                 7C9EC577 3 Bytes  [ E4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILRemoveLastID + 40                                                 7C9EC57B 38 Bytes  [ 89, 85, F0, FD, FF, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILRemoveLastID + 67                                                 7C9EC5A2 55 Bytes  [ 41, 56, 52, 46, 3A, 20, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILRemoveLastID + 9F                                                 7C9EC5DA 2 Bytes  [ 40, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILRemoveLastID + A2                                                 7C9EC5DD 27 Bytes  [ 40, 0C, 8B, 40, 0C, 8B, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetSettings + 30                                               7C9EC764 30 Bytes  [ 75, 2C, FF, 75, 28, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetSettings + 4F                                               7C9EC783 55 Bytes  CALL 7C9C61ED C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetSettings + 87                                               7C9EC7BB 218 Bytes  [ FF, 75, 2C, FF, 75, 28, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetSettings + 162                                              7C9EC896 123 Bytes  [ 45, 52, 52, 4F, 52, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetSettings + 1DE                                              7C9EC912 616 Bytes  [ 00, 00, 0A, 0A, 3D, 3D, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCLSIDFromString + 44                                              7C9ECB7B 13 Bytes  CALL 7C9AB7C7 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCLSIDFromString + 52                                              7C9ECB89 71 Bytes  [ EF, FD, FF, FF, 74, 0C, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCLSIDFromString + 9A                                              7C9ECBD1 7 Bytes  [ 00, 00, 8B, 85, E8, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCLSIDFromString + A2                                              7C9ECBD9 9 Bytes  CALL 669ECBDB 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCLSIDFromString + AC                                              7C9ECBE3 63 Bytes  [ 00, 33, C0, 39, 5F, 14, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindLastID                                                        7C9ECD00 5 Bytes  [ 90, 90, 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindLastID + 6                                                    7C9ECD06 219 Bytes  JMP 7CA02577 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindLastID + E6                                                   7C9ECDE6 52 Bytes  [ 8B, FF, 55, 8B, EC, F6, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindLastID + 11B                                                  7C9ECE1B 38 Bytes  JMP 085F0122 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindLastID + 143                                                  7C9ECE43 3 Bytes  [ 8B, FF, 55 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHParseDisplayName + 1FF                                            7C9EE0F3 15 Bytes  [ F8, 83, F8, 01, A3, 18, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHParseDisplayName + 20F                                            7C9EE103 83 Bytes  [ 98, 7C, 83, F8, 40, 0F, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHParseDisplayName + 263                                            7C9EE157 32 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHParseDisplayName + 284                                            7C9EE178 10 Bytes  [ FF, C7, 00, 05, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHParseDisplayName + 28F                                            7C9EE183 6 Bytes  [ FF, 90, 90, 90, 90, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHILCreateFromPath + 46                                             7C9EE50A 32 Bytes  [ 8D, A5, FE, FF, FF, EB, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHILCreateFromPath + 67                                             7C9EE52B 136 Bytes  [ 09, 89, 8D, 98, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHILCreateFromPath + F0                                             7C9EE5B4 5 Bytes  [ 00, FF, B0, B4, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHILCreateFromPath + F6                                             7C9EE5BA 5 Bytes  [ 00, FF, B0, B8, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHILCreateFromPath + FC                                             7C9EE5C0 14 Bytes  [ 00, 68, 50, 86, 93, 7C, 51, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPath + 4B                                               7C9EE6AA 18 Bytes  [ 45, 0C, 56, 89, 85, F0, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPath + 5E                                               7C9EE6BD 68 Bytes  [ 89, 85, F8, FE, FF, FF, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPath + A3                                               7C9EE702 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPath + A5                                               7C9EE704 3 Bytes  [ 78, 87, 93 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPath + A9                                               7C9EE708 32 Bytes  [ 8D, 85, F4, FE, FF, FF, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathW + 2                                                7C9EF0E4 26 Bytes  [ 01, 74, 07, 68, 48, 92, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathW + 1D                                               7C9EF0FF 81 Bytes  CALL 7C9B42B3 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathW + 6F                                               7C9EF151 77 Bytes  [ 75, 07, BE, 17, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathW + BD                                               7C9EF19F 294 Bytes  [ 8B, 4D, FC, 5F, 8B, C6, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathW + 1E4                                              7C9EF2C6 79 Bytes  [ 00, 00, 53, 58, 53, 3A, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderLocation + 15                                            7C9EF5E2 35 Bytes  [ 0E, 00, C0, 93, 95, 7C, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderLocation + 39                                            7C9EF606 11 Bytes  [ 61, 00, 73, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderLocation + 45                                            7C9EF612 5 Bytes  [ 79, 00, 70, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderLocation + 4B                                            7C9EF618 9 Bytes  [ 6F, 00, 67, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderLocation + 55                                            7C9EF622 5 Bytes  [ 68, 00, 69, 00, 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderLocation + 4                                      7C9EF653 37 Bytes  [ 45, 08, 85, C0, 74, 24, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderLocation + 2A                                     7C9EF679 7 Bytes  [ 36, EB, E2, 5E, 5D, C2, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderLocation + 32                                     7C9EF681 11 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderLocation + 3E                                     7C9EF68D 15 Bytes  [ 7D, 08, 85, FF, 74, 2A, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderLocation + 4E                                     7C9EF69D 37 Bytes  [ FF, 64, A1, 18, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCoCreateInstance + E3                                             7C9EFA35 143 Bytes  [ DB, 74, 09, 3B, 46, 10, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCoCreateInstance + 173                                            7C9EFAC5 191 Bytes  [ 3B, C3, 7D, 07, 3D, 23, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetClassObject + 7C                                              7C9EFB85 43 Bytes  [ 75, 08, 56, 8D, 45, F4, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetClassObject + A8                                              7C9EFBB1 106 Bytes  [ 8D, 45, EC, 50, FF, 36, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetClassObject + 114                                             7C9EFC1D 22 Bytes  [ 14, FF, 75, 10, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetClassObject + 12B                                             7C9EFC34 20 Bytes  CALL 7C9A4902 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetClassObject + 140                                             7C9EFC49 77 Bytes  [ 74, 08, FF, 75, E4, E8, 30, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBindToParent + A1                                                 7C9EFE50 3 Bytes  [ F3, AB, C7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBindToParent + A5                                                 7C9EFE54 20 Bytes  [ D0, FC, FF, FF, 09, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBindToParent + BA                                                 7C9EFE69 23 Bytes  [ FF, FF, 89, 45, F8, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBindToParent + D2                                                 7C9EFE81 11 Bytes  [ FF, A1, 20, 00, 98, 7C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBindToParent + DE                                                 7C9EFE8D 150 Bytes  CALL 7C9FD883 C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsNetDrive + 2                                                      7C9F0E62 40 Bytes  CALL 7C9860C2 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsNetDrive + 2B                                                     7C9F0E8B 71 Bytes  [ 00, A1, 60, 17, 98, 7C, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsNetDrive + 73                                                     7C9F0ED3 2 Bytes  [ 46, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsNetDrive + 76                                                     7C9F0ED6 119 Bytes  [ 4E, 10, F6, 46, 2E, 02, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsNetDrive + EE                                                     7C9F0F4E 5 Bytes  [ FF, 74, 42, BB, 80 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DriveType + 1E                                                      7C9F1710 13 Bytes  [ 61, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DriveType + 2C                                                      7C9F171E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DriveType + 2E                                                      7C9F1720 29 Bytes  [ 20, 00, 74, 00, 72, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DriveType + 4C                                                      7C9F173E 15 Bytes  [ 73, 00, 68, 00, 69, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DriveType + 5C                                                      7C9F174E 35 Bytes  [ 77, 00, 65, 00, 65, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDListW + 10                                           7C9F1858 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDListW + 12                                           7C9F185A 3 Bytes  [ 61, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDListW + 16                                           7C9F185E 15 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDListW + 26                                           7C9F186E 43 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDListW + 52                                           7C9F189A 35 Bytes  [ 6C, 00, 65, 00, 64, 00, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsEqual + 7                                                       7C9F1A3A 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsEqual + 9                                                       7C9F1A3C 17 Bytes  [ 68, 00, 65, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsEqual + 1B                                                      7C9F1A4E 19 Bytes  [ 01, 00, 41, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsEqual + 2F                                                      7C9F1A62 51 Bytes  [ 74, 00, 20, 00, 77, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsEqual + 63                                                      7C9F1A96 1 Byte  [ 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSimpleIDListFromPath + B                                          7C9F1B48 33 Bytes  [ 6F, 00, 6E, 00, 2C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSimpleIDListFromPath + 2D                                         7C9F1B6A 3 Bytes  [ 67, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSimpleIDListFromPath + 31                                         7C9F1B6E 45 Bytes  [ 6E, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSimpleIDListFromPath + 5F                                         7C9F1B9C 35 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSimpleIDListFromPath + 83                                         7C9F1BC0 51 Bytes  [ 20, 00, 61, 00, 63, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderPathW + 29                                        7C9F1BF4 39 Bytes  [ 7B, 00, 45, 00, 58, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderPathW + 51                                        7C9F1C1C 17 Bytes  [ 65, 00, 20, 00, 64, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderPathW + 63                                        7C9F1C2E 29 Bytes  [ 6B, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowW + 19                                                    7C9F1C4C 23 Bytes  [ A0, 01, 01, 00, 4D, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowW + 31                                                    7C9F1C64 5 Bytes  [ 6F, 00, 6E, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowW + 37                                                    7C9F1C6A 53 Bytes  [ 65, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowW + 6D                                                    7C9F1CA0 15 Bytes  [ 65, 00, 64, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowW + 7D                                                    7C9F1CB0 67 Bytes  [ 72, 00, 63, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsParent + 1D                                                     7C9F1D16 53 Bytes  [ 2C, 00, 20, 00, 61, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsParent + 53                                                     7C9F1D4C 61 Bytes  [ 63, 00, 74, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsParent + 91                                                     7C9F1D8A 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsParent + 93                                                     7C9F1D8C 39 Bytes  [ 68, 00, 65, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILIsParent + BB                                                     7C9F1DB4 19 Bytes  [ 72, 00, 65, 00, 73, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindChild + F                                                     7C9F1DC8 32 Bytes  [ 6E, 00, 64, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindChild + 30                                                    7C9F1DE9 6 Bytes  [ 00, 00, 00, 10, 01, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindChild + 37                                                    7C9F1DF0 1 Byte  [ 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindChild + 39                                                    7C9F1DF2 9 Bytes  [ 6E, 00, 20, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILFindChild + 43                                                    7C9F1DFC 25 Bytes  [ 65, 00, 6D, 00, 70, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyDeregister + 1D                                       7C9F596B 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyDeregister + 2D                                       7C9F597B 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyDeregister + 6A                                       7C9F59B8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyDeregister + 70                                       7C9F59BE 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyDeregister + 7F                                       7C9F59CD 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetImageLists + 38                                            7C9F6358 97 Bytes  [ C9, C2, 14, 00, 2C, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetImageLists + 9A                                            7C9F63BA 124 Bytes  [ 00, 00, 42, 72, 65, 61, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetImageLists + 117                                           7C9F6437 26 Bytes  [ CC, CC, CC, CC, CC, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetImageLists + 132                                           7C9F6452 29 Bytes  CALL 7C9F6231 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetImageLists + 150                                           7C9F6470 40 Bytes  [ F0, 0F, C1, 08, 8B, 75, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetCachedImageIndex + 19                                      7C9F65FE 36 Bytes  [ 8B, F0, 3B, F3, 7D, 0F, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetCachedImageIndex + 3E                                      7C9F6623 293 Bytes  CALL 7C9C7BCB C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetCachedImageIndex + 164                                     7C9F6749 75 Bytes  [ 84, C0, 74, 2D, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetCachedImageIndex + 1B0                                     7C9F6795 85 Bytes  [ 90, 90, 90, 90, 6A, 24, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_GetCachedImageIndex + 206                                     7C9F67EB 24 Bytes  [ F8, 89, 7D, D4, 8B, 30, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyRegister + 170                                        7C9F74FF 50 Bytes  [ 00, 4C, 44, 52, 3A, 20, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyRegister + 1A3                                        7C9F7532 19 Bytes  CALL 7C9C3F0E C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyRegister + 1B7                                        7C9F7546 32 Bytes  [ C7, 45, FC, 7B, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyRegister + 1D8                                        7C9F7567 20 Bytes  JMP 7C9D28F7 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifyRegister + 1EE                                        7C9F757D 30 Bytes  [ 50, 6A, 50, 8D, 45, AC, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_MergeMenus + 30                                               7C9F7ABC 69 Bytes  CALL 812790C0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_MergeMenus + 76                                               7C9F7B02 275 Bytes  [ 45, 08, 66, 39, 18, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_MergeMenus + 18A                                              7C9F7C16 51 Bytes  [ 74, 65, 50, 72, 69, 76, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_MergeMenus + 1BE                                              7C9F7C4A 244 Bytes  [ 52, 65, 73, 6F, 6C, 76, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_MergeMenus + 2B4                                              7C9F7D40 17 Bytes  JMP 7C9CF14A C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderView + 2                                         7C9F90F4 44 Bytes  CALL 7C9A657F C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderView + 2F                                        7C9F9121 7 Bytes  [ FF, 50, 8D, 85, B4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderView + 37                                        7C9F9129 76 Bytes  CALL 7C997294 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderView + 84                                        7C9F9176 28 Bytes  [ 85, C8, FD, FF, FF, 40, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderView + A2                                        7C9F9194 130 Bytes  [ 00, 89, 9D, F0, FD, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapIDListToImageListIndexAsync + B                                7C9FB609 28 Bytes  [ 00, 65, 00, 6C, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapIDListToImageListIndexAsync + 28                               7C9FB626 5 Bytes  [ 74, 00, 20, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapIDListToImageListIndexAsync + 2E                               7C9FB62C 37 Bytes  [ 75, 00, 72, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapIDListToImageListIndexAsync + 54                               7C9FB652 5 Bytes  [ 20, 00, 25, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapIDListToImageListIndexAsync + 5A                               7C9FB658 7 Bytes  [ 73, 00, 2C, 00, 20, 00, 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 1A                                7C9FC33A 33 Bytes  [ 74, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 3C                                7C9FC35C 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 3E                                7C9FC35E 7 Bytes  [ 61, 00, 73, 00, 20, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 46                                7C9FC366 3 Bytes  [ 78, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMapPIDLToSystemImageListIndex + 4A                                7C9FC36A 7 Bytes  [ 65, 00, 64, 00, 69, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetImageList + 75                                                 7C9FE5B6 99 Bytes  [ 8B, 7F, 08, 53, 68, A2, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetImageList + D9                                                 7C9FE61A 68 Bytes  CALL 7C9FE10C C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetImageList + 11E                                                7C9FE65F 16 Bytes  [ 85, DB, 89, 77, 04, 89, 5F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetImageList + 12F                                                7C9FE670 122 Bytes  [ 89, 4D, EC, 8D, 5F, 0C, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetImageList + 1AA                                                7C9FE6EB 23 Bytes  [ 73, 0C, 8D, 0C, 30, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconW + 13                                              7C9FE8FE 83 Bytes  [ 14, 8D, 54, 02, 18, 74, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconW + 67                                              7C9FE952 18 Bytes  [ 0F, B7, 48, 06, 0F, B7, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconW + 7A                                              7C9FE965 34 Bytes  [ 55, 18, 89, 0A, 77, 3F, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconW + 9D                                              7C9FE988 7 Bytes  [ 84, C0, 5F, 5E, 74, 04, 33 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconW + A5                                              7C9FE990 43 Bytes  [ EB, 32, 68, C8, 89, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHExtractIconsW + 20                                                7C9FE9BC 173 Bytes  [ 83, C4, 14, B8, 23, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHExtractIconsW + CE                                                7C9FEA6A 38 Bytes  [ C3, 8B, CB, 0F, A4, F1, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHExtractIconsW + F8                                                7C9FEA94 75 Bytes  [ 8B, FF, 55, 8B, EC, 51, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHExtractIconsW + 144                                               7C9FEAE0 70 Bytes  [ 5D, FC, 8B, 5B, 50, 8B, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHExtractIconsW + 18B                                               7C9FEB27 27 Bytes  [ 8B, F8, 85, FF, 0F, 84, A3, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetVersion + 5B                                                  7C9FF6AE 7 Bytes  JMP 7C9E6639 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetVersion + 63                                                  7C9FF6B6 65 Bytes  JMP 7C9E6637 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetVersion + A5                                                  7C9FF6F8 15 Bytes  JMP 7C9DEA66 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetVersion + B5                                                  7C9FF708 35 Bytes  [ 80, FA, 04, 0F, 85, 89, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllGetVersion + D9                                                  7C9FF72C 34 Bytes  [ 83, FE, 18, 0F, 82, 33, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathResolve + 46                                                    7CA021B0 13 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathResolve + 54                                                    7CA021BE 13 Bytes  [ 74, 00, 61, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathResolve + 62                                                    7CA021CC 11 Bytes  [ 6A, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathResolve + 6E                                                    7CA021D8 5 Bytes  [ 0A, 00, 00, 00, CC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathResolve + 74                                                    7CA021DE 43 Bytes  [ 01, 00, 41, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteExW + 23                                                7CA025F6 9 Bytes  [ 76, 00, 61, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteExW + 2D                                                7CA02600 5 Bytes  [ 20, 00, 76, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteExW + 33                                                7CA02606 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteExW + 35                                                7CA02608 11 Bytes  [ 75, 00, 65, 00, 20, 00, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteExW + 41                                                7CA02614 21 Bytes  [ 6E, 00, 69, 00, 6D, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHTestTokenMembership + 1E                                          7CA04C59 26 Bytes  [ 00, 6F, 00, 72, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHTestTokenMembership + 39                                          7CA04C74 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHTestTokenMembership + 3B                                          7CA04C76 7 Bytes  [ 73, 00, 20, 00, 65, 00, 78 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHTestTokenMembership + 43                                          7CA04C7E 35 Bytes  [ 68, 00, 61, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHTestTokenMembership + 67                                          7CA04CA2 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenRegStream + 52                                                  7CA051EC 211 Bytes  [ 00, 00, 01, 00, 50, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenRegStream + 126                                                 7CA052C0 114 Bytes  [ CC, 35, D0, 35, D4, 35, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenRegStream + 199                                                 7CA05333 423 Bytes  [ 00, 60, 30, C9, 31, 21, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenRegStream + 341                                                 7CA054DB 170 Bytes  [ 3C, 57, 3D, 7C, 3D, 8E, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenRegStream + 3EC                                                 7CA05586 1 Byte  [ 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILLoadFromStream + 5D                                               7CA06080 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILLoadFromStream + 5F                                               7CA06082 21 Bytes  [ 74, 00, 68, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILLoadFromStream + 75                                               7CA06098 3 Bytes  [ 69, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILLoadFromStream + 79                                               7CA0609C 13 Bytes  [ 65, 00, 20, 00, 64, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILLoadFromStream + 87                                               7CA060AA 53 Bytes  [ 69, 00, 73, 00, 20, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_ShowDragImage + A                                               7CA08396 29 Bytes  [ 00, 00, C4, 00, 01, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_ShowDragImage + 28                                              7CA083B4 15 Bytes  [ 61, 00, 73, 00, 20, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_ShowDragImage + 38                                              7CA083C4 5 Bytes  [ 74, 00, 6F, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_ShowDragImage + 3E                                              7CA083CA 31 Bytes  [ 65, 00, 78, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_ShowDragImage + 5E                                              7CA083EA 73 Bytes  [ 20, 00, 6F, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirW + 4C                                      7CA0A904 3 Bytes  CALL 7C9A60C3 C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirW + 50                                      7CA0A908 70 Bytes  [ F9, FF, 8B, F0, 3B, F7, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExW + 15                                           7CA0A94F 30 Bytes  [ 40, 30, 89, 70, 04, A1, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExW + 34                                           7CA0A96E 2 Bytes  [ 35, 9C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExW + 37                                           7CA0A971 22 Bytes  CALL 7C9A5F2B C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExW + 4E                                           7CA0A988 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExW + 55                                           7CA0A98F 54 Bytes  [ 55, 8B, EC, 56, 8B, 75, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateRecycleBinIcon + 4                                          7CA0B3D4 35 Bytes  [ 8B, D0, 3B, D3, 74, 4E, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateRecycleBinIcon + 28                                         7CA0B3F8 102 Bytes  [ C1, 06, EB, 2C, 8B, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateRecycleBinIcon + 90                                         7CA0B460 33 Bytes  [ 89, 45, F4, 73, 07, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateRecycleBinIcon + B2                                         7CA0B482 10 Bytes  [ C7, C1, E0, 02, 50, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateRecycleBinIcon + BD                                         7CA0B48D 6 Bytes  [ 97, 7C, E8, 30, AC, F9 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsUserAnAdmin + B                                                   7CA0D256 108 Bytes  CALL 7C9A339C C:\WINDOWS\system32\ntdll.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsUserAnAdmin + 78                                                  7CA0D2C3 6 Bytes  [ EB, 05, E8, D4, 60, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsUserAnAdmin + 7F                                                  7CA0D2CA 22 Bytes  [ 3D, 03, 01, 00, 00, 75, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsUserAnAdmin + 96                                                  7CA0D2E1 55 Bytes  [ DC, 3B, C3, 7C, 0A, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsUserAnAdmin + CE                                                  7CA0D319 2 Bytes  [ FF, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathProcessCommand + 31                                             7CA0DBAC 31 Bytes  [ 59, 59, 83, C8, FF, EB, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathProcessCommand + 51                                             7CA0DBCC 198 Bytes  [ 00, 83, 4D, FC, FF, E8, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathProcessCommand + 118                                            7CA0DC93 12 Bytes  [ 83, BE, 94, 0F, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathProcessCommand + 125                                            7CA0DCA0 27 Bytes  [ 00, 00, 8B, 0D, F0, 29, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathProcessCommand + 141                                            7CA0DCBC 79 Bytes  [ 85, C0, 89, 86, 94, 0F, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileW + 18                                                 7CA10FD2 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileW + 1A                                                 7CA10FD4 3 Bytes  [ 61, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileW + 1E                                                 7CA10FD8 15 Bytes  [ 20, 00, 73, 00, 75, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileAorW + B                                               7CA10FE8 28 Bytes  [ 20, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileAorW + 29                                              7CA11006 43 Bytes  [ 74, 77, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileAorW + 55                                              7CA11032 5 Bytes  [ FF, 3B, FB, 0F, 84 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileAorW + 5B                                              7CA11038 8 Bytes  [ 8B, 02, 00, 8D, 85, 60, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFileAorW + 64                                              7CA11041 50 Bytes  [ 50, 57, BE, 04, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListA + 5                                        7CA1B016 3 Bytes  [ 00, 00, 9C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListA + 9                                        7CA1B01A 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListA + B                                        7CA1B01C 9 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListA + 15                                       7CA1B026 5 Bytes  [ 65, 00, 71, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListA + 1B                                       7CA1B02C 7 Bytes  [ 65, 00, 73, 00, 74, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetFolderCustomSettingsW + B                                   7CA1D2C0 33 Bytes  [ 65, 00, 6C, 00, 2E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetFolderCustomSettingsW + 2D                                  7CA1D2E2 7 Bytes  [ 72, 00, 6F, 00, 63, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetFolderCustomSettingsW + 35                                  7CA1D2EA 3 Bytes  [ 73, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetFolderCustomSettingsW + 39                                  7CA1D2EE 53 Bytes  [ 6F, 00, 72, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSetFolderCustomSettingsW + 6F                                  7CA1D324 9 Bytes  [ 73, 00, 74, 00, 72, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetLocalizedName + C9                                             7CA20DFD 11 Bytes  [ 83, 4D, E4, FF, FF, 75, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetLocalizedName + D5                                             7CA20E09 46 Bytes  [ 8B, F0, 89, 75, E0, 85, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetLocalizedName + 104                                            7CA20E38 17 Bytes  [ FF, 89, 45, DC, 85, C0, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetLocalizedName + 116                                            7CA20E4A 42 Bytes  [ EB, 03, 8B, 40, 14, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushSFCache + 10                                                 7CA20E76 21 Bytes  CALL 7C9E5BFE C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushSFCache + 26                                                 7CA20E8C 1 Byte  [ F6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushSFCache + 28                                                 7CA20E8E 14 Bytes  [ 0C, 04, 74, 0A, 68, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushSFCache + 37                                                 7CA20E9D 6 Bytes  [ 45, E4, E8, 62, 3A, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushSFCache + 3E                                                 7CA20EA4 39 Bytes  [ C2, 0C, 00, 90, FF, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIcon + A                                                7CA218C8 19 Bytes  [ 75, 00, 6E, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIcon + 1E                                               7CA218DC 59 Bytes  [ 64, 00, 73, 00, 6B, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIcon + 5A                                               7CA21918 9 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIcon + 64                                               7CA21922 11 Bytes  [ 01, 00, 4F, 00, 62, 00, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIcon + 70                                               7CA2192E 5 Bytes  [ 74, 00, 20, 00, 4E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Lock + F                                       7CA21FDC 15 Bytes  [ 65, 00, 20, 00, 73, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Lock + 1F                                      7CA21FEC 9 Bytes  [ 61, 00, 63, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Lock + 29                                      7CA21FF6 41 Bytes  [ 73, 00, 20, 00, 66, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Lock + 53                                      7CA22020 33 Bytes  [ C0, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Lock + 75                                      7CA22042 9 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractVersionResource16W + 17                                      7CA22340 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractVersionResource16W + 19                                      7CA22342 7 Bytes  [ 6F, 00, 6E, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractVersionResource16W + 21                                      7CA2234A 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractVersionResource16W + 23                                      7CA2234C 21 Bytes  [ 74, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractVersionResource16W + 39                                      7CA22362 25 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllCanUnloadNow + 27                                                7CA22F9C 15 Bytes  [ 73, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllCanUnloadNow + 37                                                7CA22FAC 77 Bytes  [ 70, 00, 65, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllCanUnloadNow + 85                                                7CA22FFA 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllCanUnloadNow + 87                                                7CA22FFC 45 Bytes  [ 72, 00, 65, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllCanUnloadNow + B5                                                7CA2302A 9 Bytes  [ 00, 00, 48, 00, 01, 00, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Unlock + 33                                    7CA231B4 69 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Unlock + 79                                    7CA231FA 5 Bytes  [ 20, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Unlock + 7F                                    7CA23200 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Unlock + 81                                    7CA23202 27 Bytes  [ 77, 00, 6F, 00, 72, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotification_Unlock + 9D                                    7CA2321E 13 Bytes  [ 78, 00, 69, 00, 73, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotify + A                                                  7CA23684 69 Bytes  [ 48, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotify + 51                                                 7CA236CB 16 Bytes  [ 00, 5C, 00, 01, 00, 4E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotify + 62                                                 7CA236DC 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotify + 64                                                 7CA236DE 5 Bytes  [ 74, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotify + 6A                                                 7CA236E4 29 Bytes  [ 20, 00, 73, 00, 65, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconExW + 44                                                 7CA2502B 87 Bytes  [ 00, 7E, F4, 87, 7C, AB, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconExW + 9C                                                 7CA25083 15 Bytes  [ 00, 10, F4, 87, 7C, C3, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconExW + AD                                                 7CA25094 14 Bytes  [ D2, 60, 82, 7C, F1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconExW + BC                                                 7CA250A3 15 Bytes  [ 00, F8, EC, 87, 7C, 03, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconExW + CC                                                 7CA250B3 8 Bytes  [ 00, D0, EA, 87, 7C, 0E, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCloneSpecialIDList + 32                                           7CA253AD 34 Bytes  [ BB, 2C, 47, 88, 7C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCloneSpecialIDList + 55                                           7CA253D0 79 Bytes  [ 55, 8B, EC, 83, EC, 20, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCloneSpecialIDList + A6                                           7CA25421 8 Bytes  [ 83, FE, 02, 0F, 8D, 72, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCloneSpecialIDList + AF                                           7CA2542A 17 Bytes  [ FF, 75, E0, 6B, F6, 1C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCloneSpecialIDList + C1                                           7CA2543C 53 Bytes  [ 00, 8B, 4D, FC, 5F, 5E, 5B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsExe + 21                                                      7CA258A7 238 Bytes  [ 6A, 1C, 68, B8, E4, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsExe + 110                                                     7CA25996 80 Bytes  [ FF, 8B, 40, 30, 39, 78, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsExe + 163                                                     7CA259E9 8 Bytes  [ F6, C3, 02, 0F, 84, B9, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsExe + 16C                                                     7CA259F2 99 Bytes  [ 89, BD, CC, FB, FF, FF, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsExe + 1D0                                                     7CA25A56 61 Bytes  CALL 7CA19921 C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDrive + 26                                                     7CA25B9F 73 Bytes  [ 8B, 45, 14, 3B, C7, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDrive + 70                                                     7CA25BE9 25 Bytes  [ 8B, 45, 1C, 3B, C3, 74, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDrive + 8A                                                     7CA25C03 38 Bytes  [ 45, E4, 3B, 45, 08, 5E, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDrive + B1                                                     7CA25C2A 15 Bytes  [ 40, 04, 85, C0, 89, 4D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDrive + C1                                                     7CA25C3A 2 Bytes  [ 8D, 45 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIconW + 3E                                              7CA262E3 715 Bytes  [ 35, 70, 35, BA, 35, EC, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIconW + 30A                                             7CA265AF 358 Bytes  [ 34, 80, 35, 8B, 35, DB, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIconW + 471                                             7CA26716 12 Bytes  [ 00, 00, 27, 30, 73, 30, 8E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIconW + 47E                                             7CA26723 159 Bytes  [ 31, 8F, 31, A6, 31, C1, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Shell_NotifyIconW + 51E                                             7CA267C3 124 Bytes  [ 00, 20, 00, 00, 00, A8, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListW + 13                                           7CA26840 5 Bytes  [ 00, C0, 04, 00, 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListW + 1A                                           7CA26847 229 Bytes  [ 00, 0B, 30, 4E, 30, 7A, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListW + 100                                          7CA2692D 89 Bytes  [ 3D, 3E, 3D, 44, 3D, DF, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathA + 2                                                7CA26987 51 Bytes  [ 35, 1D, 36, 7D, 36, 50, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathA + 37                                               7CA269BC 426 Bytes  [ C8, 30, CC, 30, D0, 30, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathA + 1E2                                              7CA26B67 11 Bytes  [ 3A, 00, 3B, 04, 3B, 08, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathA + 1EE                                              7CA26B73 205 Bytes  [ 3B, 18, 3B, 1C, 3B, 20, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathA + 2BC                                              7CA26C41 266 Bytes  [ 70, 05, 00, 08, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfoW + B                                                  7CA2B073 28 Bytes  [ 00, E4, 00, 01, 00, 49, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfoW + 28                                                 7CA2B090 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfoW + 2A                                                 7CA2B092 5 Bytes  [ 74, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfoW + 30                                                 7CA2B098 3 Bytes  [ 68, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfoW + 36                                                 7CA2B09E 13 Bytes  [ 73, 00, 74, 00, 61, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragAcceptFiles + 14                                                7CA2B232 83 Bytes  [ 66, 00, 69, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragAcceptFiles + 68                                                7CA2B286 109 Bytes  [ 6F, 00, 72, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragAcceptFiles + D6                                                7CA2B2F4 43 Bytes  [ 68, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragAcceptFiles + 102                                               7CA2B320 43 Bytes  [ 66, 00, 20, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragAcceptFiles + 12E                                               7CA2B34C 23 Bytes  [ 69, 00, 73, 00, 20, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetMalloc + 13                                                    7CA2B41C 47 Bytes  [ 61, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetMalloc + 43                                                    7CA2B44C 5 Bytes  [ 69, 00, 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetMalloc + 49                                                    7CA2B452 11 Bytes  [ 70, 00, 72, 00, 6F, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetMalloc + 55                                                    7CA2B45E 17 Bytes  [ 73, 00, 73, 00, 2C, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetMalloc + 67                                                    7CA2B470 7 Bytes  [ 20, 00, 72, 00, 65, 00, 71 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILSaveToStream + 14                                                 7CA2F4B0 43 Bytes  [ 67, 00, 68, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILSaveToStream + 40                                                 7CA2F4DC 71 Bytes  [ 65, 00, 20, 00, 73, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILSaveToStream + 88                                                 7CA2F524 7 Bytes  [ 73, 00, 74, 00, 6F, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILSaveToStream + 90                                                 7CA2F52C 53 Bytes  [ 65, 00, 20, 00, 61, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILSaveToStream + C6                                                 7CA2F562 13 Bytes  [ 20, 00, 61, 00, 6E, 00, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddToRecentDocs + A                                               7CA2FD9C 27 Bytes  [ 7D, 00, 0D, 00, 0A, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddToRecentDocs + 26                                              7CA2FDB8 27 Bytes  [ 73, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddToRecentDocs + 42                                              7CA2FDD4 13 Bytes  [ 64, 00, 69, 00, 73, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddToRecentDocs + 50                                              7CA2FDE2 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddToRecentDocs + 52                                              7CA2FDE4 39 Bytes  [ 20, 00, 49, 00, 44, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Win32DeleteFile + 5A                                                7CA3058F 37 Bytes  [ FF, 3B, F3, 74, 38, 68, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Win32DeleteFile + 80                                                7CA305B5 4 Bytes  [ 89, 85, B8, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Win32DeleteFile + 86                                                7CA305BB 22 Bytes  [ 3B, C3, 75, 07, C6, 85, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Win32DeleteFile + 9D                                                7CA305D2 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Win32DeleteFile + 9F                                                7CA305D4 3 Bytes  [ 85, 34, F8 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathYetAnotherMakeUniqueName + 49                                   7CA30942 14 Bytes  [ 90, 90, 90, 90, 90, 68, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathYetAnotherMakeUniqueName + 58                                   7CA30951 20 Bytes  CALL 7CA198E6 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathYetAnotherMakeUniqueName + 6D                                   7CA30966 9 Bytes  [ FF, 8B, 45, 0C, 89, 85, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathYetAnotherMakeUniqueName + 77                                   7CA30970 22 Bytes  [ 8B, 45, 10, 89, 85, E0, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathYetAnotherMakeUniqueName + 8E                                   7CA30987 10 Bytes  [ 38, F7, FF, FF, 8B, 45, 24, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathCleanupSpec + 2                                                 7CA30ADE 120 Bytes  [ FF, 89, 9D, 1C, F7, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathCleanupSpec + 7B                                                7CA30B57 4 Bytes  [ 89, 9D, 24, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathCleanupSpec + 80                                                7CA30B5C 8 Bytes  [ FF, A8, 40, 0F, 85, 35, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathCleanupSpec + 89                                                7CA30B65 96 Bytes  [ F6, C4, 40, 0F, 85, 38, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfoW + 4C                                              7CA30BC6 30 Bytes  [ 22, 8F, 02, 00, 85, 7D, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfoW + 6C                                              7CA30BE6 29 Bytes  [ C0, 0F, 85, 07, 8F, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfoW + 8A                                              7CA30C04 8 Bytes  [ FF, 8B, C1, 89, 8D, 18, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfoW + 93                                              7CA30C0D 13 Bytes  [ 38, 18, 0F, 84, 05, F5, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfoW + A2                                              7CA30C1C 203 Bytes  [ 00, 00, 00, 00, 27, E0, 81, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrIW + D                                                        7CA311E4 47 Bytes  [ C7, 46, 20, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrIW + 3E                                                       7CA31215 80 Bytes  [ 8D, 04, 42, 89, 46, 34, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrIW + 8F                                                       7CA31266 6 Bytes  [ EB, EE, C7, 46, 28, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrIW + 96                                                       7CA3126D 56 Bytes  JMP 7CA0F821 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrIW + CF                                                       7CA312A6 62 Bytes  [ 90, 90, 90, 90, 8B, 45, EC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfo + 57                                                  7CA31618 29 Bytes  [ 22, 00, 00, 24, E4, 88, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfo + 75                                                  7CA31636 39 Bytes  [ 75, 14, 83, 65, F8, 00, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfo + 9D                                                  7CA3165E 35 Bytes  [ 80, 7D, 0C, 00, 75, 0A, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfo + C1                                                  7CA31682 103 Bytes  [ 75, 0A, 80, 7D, FA, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFileInfo + 12A                                                 7CA316EB 54 Bytes  [ 83, 7D, D0, 00, 74, 0A, F6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconW + 32                                                   7CA318E0 16 Bytes  [ FF, 66, 0F, B6, 45, F4, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconW + 43                                                   7CA318F1 67 Bytes  [ 89, 45, D4, 8A, C1, 24, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconW + 87                                                   7CA31935 87 Bytes  [ 75, 0A, 80, 7D, 0A, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconW + DF                                                   7CA3198D 11 Bytes  [ 75, 11, 8A, 45, FA, 3A, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconW + EB                                                   7CA31999 11 Bytes  [ 24, FE, 04, 03, 88, 45, 0E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetNext + 13                                                      7CA344F2 45 Bytes  [ 98, 27, FE, FF, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetNext + 41                                                      7CA34520 46 Bytes  [ 89, 85, 5C, FF, FF, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetNext + 70                                                      7CA3454F 52 Bytes  [ 66, C7, 03, 21, 00, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetNext + A5                                                      7CA34584 62 Bytes  [ 00, 00, 89, 85, 6C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILGetNext + E4                                                      7CA345C3 4 Bytes  [ 0F, 84, 88, 98 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ReadCabinetState + 33                                               7CA34774 57 Bytes  CALL 7CA28912 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ReadCabinetState + 6D                                               7CA347AE 29 Bytes  [ 00, 01, 4D, E0, 66, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ReadCabinetState + 8B                                               7CA347CC 45 Bytes  [ 00, 00, 80, 0F, 85, 45, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ReadCabinetState + B9                                               7CA347FA 57 Bytes  [ C0, 74, 0B, 3D, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ReadCabinetState + F3                                               7CA34834 23 Bytes  JMP 7CA07D9F C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDList + 9                                             7CA34CAA 105 Bytes  [ C6, 03, 88, C7, 85, 58, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDList + 74                                            7CA34D15 5 Bytes  [ 50, 8D, 85, 10, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDList + 7B                                            7CA34D1C 10 Bytes  [ 50, FF, 15, 88, 10, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDList + 86                                            7CA34D27 15 Bytes  [ FF, FF, 85, C0, 0F, 8C, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetPathFromIDList + 96                                            7CA34D37 1 Byte  [ 89 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgReadMultiple + 20                                          7CA37AF1 56 Bytes  [ 00, 4F, 00, 55, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgReadMultiple + 59                                          7CA37B2A 117 Bytes  [ 77, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgReadMultiple + CF                                          7CA37BA0 5 Bytes  [ 65, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgReadMultiple + D5                                          7CA37BA6 7 Bytes  [ 65, 00, 72, 00, 66, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgReadMultiple + DD                                          7CA37BAE 17 Bytes  [ 72, 00, 6D, 00, 65, 00, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetRealIDL + B                                                    7CA38E2C 33 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetRealIDL + 2D                                                   7CA38E4E 25 Bytes  [ 72, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetRealIDL + 47                                                   7CA38E68 55 Bytes  [ 74, 00, 20, 00, 73, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetRealIDL + 7F                                                   7CA38EA0 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetRealIDL + 81                                                   7CA38EA2 19 Bytes  [ 69, 00, 6E, 00, 74, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableA + A                                                 7CA3FA76 45 Bytes  [ 68, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableA + 38                                                7CA3FAA4 15 Bytes  [ 38, 00, 6C, 00, 78, 00, 22, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableA + 48                                                7CA3FAB4 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableA + 4A                                                7CA3FAB6 19 Bytes  [ 72, 00, 65, 00, 6E, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableA + 5E                                                7CA3FACA 25 Bytes  [ 6F, 00, 72, 00, 79, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableW + A                                                 7CA3FB08 13 Bytes  [ 75, 00, 6C, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableW + 18                                                7CA3FB16 37 Bytes  [ 20, 00, 62, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableW + 3E                                                7CA3FB3C 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableW + 40                                                7CA3FB3E 17 Bytes  [ 6E, 00, 73, 00, 74, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExecutableW + 52                                                7CA3FB50 39 Bytes  [ 6E, 00, 20, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSettings + 3B                                                  7CA3FC58 14 Bytes  [ 6C, 00, 78, 00, 22, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSettings + 4A                                                  7CA3FC67 8 Bytes  [ 00, 78, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSettings + 53                                                  7CA3FC70 45 Bytes  [ 65, 00, 20, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSettings + 81                                                  7CA3FC9E 9 Bytes  [ 65, 00, 20, 00, 70, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSettings + 8B                                                  7CA3FCA8 45 Bytes  [ 63, 00, 65, 00, 73, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteW + A                                          7CA40A14 25 Bytes  [ 0D, 00, 0A, 00, 41, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteW + 24                                         7CA40A2E 151 Bytes  [ 77, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteW + BC                                         7CA40AC6 23 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteW + D4                                         7CA40ADE 59 Bytes  [ 20, 00, 6D, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteW + 110                                        7CA40B1A 5 Bytes  [ 63, 00, 6B, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstW + 47                                            7CA40E16 11 Bytes  [ 67, 00, 72, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstW + 53                                            7CA40E22 7 Bytes  [ 64, 00, 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstW + 5B                                            7CA40E2A 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstW + 5D                                            7CA40E2C 31 Bytes  [ 73, 00, 65, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstW + 7D                                            7CA40E4C 37 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteEx + 9                                                  7CA40E9E 27 Bytes  [ 6F, 00, 6F, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteEx + 25                                                 7CA40EBA 61 Bytes  [ 6E, 00, 74, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteEx + 63                                                 7CA40EF8 7 Bytes  [ 20, 00, 68, 00, 61, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteEx + 6B                                                 7CA40F00 7 Bytes  [ 20, 00, 62, 00, 65, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteEx + 73                                                 7CA40F08 7 Bytes  [ 6E, 00, 20, 00, 77, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteA + 3C                                                  7CA411FC 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteA + 3E                                                  7CA411FE 5 Bytes  [ 6C, 00, 65, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteA + 44                                                  7CA41204 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteA + 46                                                  7CA41206 7 Bytes  [ 64, 00, 20, 00, 62, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteA + 4E                                                  7CA4120E 11 Bytes  [ 66, 00, 6F, 00, 72, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CommandLineToArgvW + A                                              7CA413C2 23 Bytes  [ 64, 00, 61, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CommandLineToArgvW + 22                                             7CA413DA 5 Bytes  [ 20, 00, 74, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CommandLineToArgvW + 28                                             7CA413E0 9 Bytes  [ 61, 00, 6E, 00, 73, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CommandLineToArgvW + 32                                             7CA413EA 9 Bytes  [ 74, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CommandLineToArgvW + 3C                                             7CA413F4 19 Bytes  [ 61, 00, 69, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + A                              7CA41FF0 73 Bytes  [ 79, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + 54                             7CA4203A 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + 5B                             7CA42041 41 Bytes  [ 55, 8B, EC, 51, 56, E8, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + 85                             7CA4206B 49 Bytes  [ FF, 15, 18, 12, 80, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateQueryCancelAutoPlayMoniker + B7                             7CA4209D 79 Bytes  [ 8B, 45, FC, A8, 01, 75, 05, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutW + 22                                                    7CA62DF5 46 Bytes  [ 18, 38, 5D, F3, 74, 13, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutA + 2                                                     7CA62E24 83 Bytes  [ 15, 10, 10, 80, 7C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutA + 56                                                    7CA62E78 19 Bytes  [ FD, FF, FF, 89, 85, CC, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutA + 6A                                                    7CA62E8C 50 Bytes  [ 70, F9, FF, FF, 50, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutA + 9D                                                    7CA62EBF 33 Bytes  [ 83, C0, 02, 3D, FE, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellAboutA + BF                                                    7CA62EE1 5 Bytes  [ 8B, 03, 89, 46, 04 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinW + 2                                              7CA66836 20 Bytes  [ FF, EB, D8, 89, BD, 24, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinW + 17                                             7CA6684B 50 Bytes  [ 55, 8B, EC, 83, EC, 10, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinW + 4A                                             7CA6687E 124 Bytes  [ 55, 8B, EC, A1, 48, 40, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinA + 35                                             7CA668FB 102 Bytes  [ FF, 15, 70, 10, 80, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinA + 9C                                             7CA66962 20 Bytes  CALL 7CA6697A C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinA + B1                                             7CA66977 128 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinA + 132                                            7CA669F8 10 Bytes  [ FF, FF, 52, 51, 6A, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHQueryRecycleBinA + 13D                                            7CA66A03 149 Bytes  [ 4D, F0, 51, 8B, CE, 80, E1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEmptyRecycleBinA + 36                                             7CA66C65 72 Bytes  [ 55, 8B, EC, FF, 75, 08, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEmptyRecycleBinA + 7F                                             7CA66CAE 34 Bytes  [ 90, 8B, FF, 55, 8B, EC, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEmptyRecycleBinA + A2                                             7CA66CD1 79 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEmptyRecycleBinA + F2                                             7CA66D21 160 Bytes  [ 70, 18, FF, 15, 0C, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateStdEnumFmtEtc + 35                                          7CA66DC3 8 Bytes  [ 0C, 00, 00, 0F, 85, 96, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateStdEnumFmtEtc + 3E                                          7CA66DCC 19 Bytes  [ 66, 83, 65, 16, 00, E9, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateStdEnumFmtEtc + 52                                          7CA66DE0 19 Bytes  [ D7, 01, 00, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateStdEnumFmtEtc + 66                                          7CA66DF4 61 Bytes  [ FB, FF, FF, 8D, 85, FC, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateStdEnumFmtEtc + A4                                          7CA66E32 62 Bytes  CALL EFA966BA 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WriteCabinetState + 69                                              7CA670F3 182 Bytes  [ 63, 65, 33, 32, 00, 57, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WriteCabinetState + 122                                             7CA671AC 98 Bytes  [ 57, 53, 41, 53, 74, 72, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WriteCabinetState + 185                                             7CA6720F 76 Bytes  [ 90, 57, 53, 41, 49, 6F, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WriteCabinetState + 1D2                                             7CA6725C 51 Bytes  [ 22, E5, 87, 7C, 48, FE, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WriteCabinetState + 206                                             7CA67290 111 Bytes  [ 44, 00, 52, 00, 4D, 00, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFreeNameMappings + 26                                             7CA69056 4 Bytes  CALL 7CA40F77 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFreeNameMappings + 2B                                             7CA6905B 158 Bytes  [ 3B, FB, 0F, 85, 70, 33, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFreeNameMappings + CA                                             7CA690FA 41 Bytes  [ 55, 8B, EC, 83, EC, 30, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFreeNameMappings + F4                                             7CA69124 65 Bytes  [ 72, 44, 00, 00, 8B, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFreeNameMappings + 136                                            7CA69166 19 Bytes  [ 08, 8B, 40, 04, 89, 4D, E0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectory + B                                               7CA6A83C 70 Bytes  [ 15, 80, 11, 80, 7C, A1, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExA + 37                                           7CA6A883 39 Bytes  [ 15, 7C, 11, 80, 7C, 8B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExA + 5F                                           7CA6A8AB 2 Bytes  [ 10, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExA + 62                                           7CA6A8AE 34 Bytes  [ 85, C0, 0F, 8C, 96, C4, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExA + 85                                           7CA6A8D1 38 Bytes  [ 15, 70, 11, 80, 7C, E9, B2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateDirectoryExA + AC                                           7CA6A8F8 44 Bytes  [ D6, 8B, 3D, 88, 10, 80, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperationW + 98                                               7CA70853 39 Bytes  JMP 7CA706BB C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperationW + C0                                               7CA7087B 72 Bytes  CALL 7CA70172 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperationW + 109                                              7CA708C4 18 Bytes  [ 75, 08, 83, C8, FF, E9, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperationW + 11C                                              7CA708D7 1 Byte  [ 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperationW + 11E                                              7CA708D9 55 Bytes  [ FA, EB, 33, FF, 75, 0C, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperation + 52                                                7CA70AF5 17 Bytes  [ F4, 83, C4, 18, 8D, 85, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperation + 65                                                7CA70B08 27 Bytes  [ 5F, 5E, 7D, 0A, 50, E8, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperation + 81                                                7CA70B24 47 Bytes  CALL 7CA20B38 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperation + B1                                                7CA70B54 14 Bytes  [ 15, DC, 10, 80, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFileOperation + C0                                                7CA70B63 24 Bytes  [ 33, F6, 8B, C6, 5E, C9, C2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLL + 10                                       7CA715F7 12 Bytes  [ 66, 8B, 36, 66, 3B, 72, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLL + 1D                                       7CA71604 127 Bytes  [ 8B, 55, 20, 33, F6, 46, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLL + 9D                                       7CA71684 82 Bytes  [ FF, FF, 33, DB, 88, 01, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLL + F0                                       7CA716D7 19 Bytes  [ 39, 3D, A4, 47, 88, 7C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLLW + F                                       7CA716EB 50 Bytes  [ 4A, 56, FF, D3, 39, 3D, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLLW + 42                                      7CA7171E 10 Bytes  [ 56, FF, 15, 7C, 11, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLLW + 4E                                      7CA7172A 3 Bytes  JMP 7CA717FF C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLLW + 53                                      7CA7172F 23 Bytes  [ 56, FF, 15, 7C, 11, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_FillCache_RunDLLW + 6B                                      7CA71747 4 Bytes  [ FF, 8D, 85, E0 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHRunControlPanel + 8                                               7CA722AD 29 Bytes  [ B5, F4, FD, FF, FF, 8B, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLL + B                                                  7CA722CB 10 Bytes  [ 00, A0, 74, 30, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLL + 16                                                 7CA722D6 21 Bytes  [ 40, 30, 57, 53, FF, 70, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLL + 2C                                                 7CA722EC 72 Bytes  [ D6, FF, B5, F0, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLW + 1D                                                7CA72336 79 Bytes  [ 66, 8B, 50, 02, 66, 83, FA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLAsUserW + 14                                          7CA72386 112 Bytes  [ 0F, 85, 51, 01, 00, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLAsUserW + 85                                          7CA723F7 83 Bytes  [ FF, B5, 70, FD, FF, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLAsUserW + D9                                          7CA7244B 94 Bytes  [ FF, 8B, 95, 70, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLAsUserW + 138                                         7CA724AA 96 Bytes  [ B5, 70, FD, FF, FF, 66, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Control_RunDLLAsUserW + 199                                         7CA7250B 12 Bytes  [ FF, 64, A1, 18, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DuplicateIcon + 10                                                  7CA729E7 34 Bytes  [ 55, 8B, EC, 81, EC, 1C, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DuplicateIcon + 33                                                  7CA72A0A 159 Bytes  [ 33, FF, EB, 13, 6A, 01, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FreeIconList + 1D                                                   7CA72AAA 50 Bytes  [ 66, 8B, 85, 08, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FreeIconList + 50                                                   7CA72ADD 40 Bytes  [ 50, 6A, 00, FF, B5, E8, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoW + 18                                            7CA72B06 3 Bytes  [ 85, FC, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoW + 1C                                            7CA72B0A 4 Bytes  [ FF, 50, 6A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoW + 21                                            7CA72B0F 5 Bytes  [ B5, F4, FD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoW + 27                                            7CA72B15 5 Bytes  [ B5, F8, FD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoW + 2D                                            7CA72B1B 74 Bytes  [ D7, 3B, C6, 0F, 85, 72, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoA + 2                                             7CA72FF9 28 Bytes  [ 75, F8, 56, FF, 75, E4, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoA + 1F                                            7CA73016 17 Bytes  [ 00, 8D, 85, 1C, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoA + 32                                            7CA73029 5 Bytes  [ 50, 68, 00, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoA + 38                                            7CA7302F 12 Bytes  [ 8D, 85, 0C, FC, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconResInfoA + 45                                            7CA7303C 39 Bytes  [ FF, B5, 10, FC, FF, FF, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExW + 1                                        7CA73064 44 Bytes  [ 40, 30, 03, C9, 51, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExW + 2E                                       7CA73091 11 Bytes  [ B5, 18, FC, FF, FF, 89, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExW + 3A                                       7CA7309D 25 Bytes  [ B5, 10, FC, FF, FF, 57, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExW + 54                                       7CA730B7 20 Bytes  [ 8B, 45, 1C, 85, C0, 74, 32, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExW + 69                                       7CA730CC 30 Bytes  [ FF, 7D, 10, 6A, 7A, E8, 16, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExA + 5                                        7CA73233 193 Bytes  [ 85, D2, 75, 21, 8B, C1, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExA + C7                                       7CA732F5 14 Bytes  [ 89, 9D, A4, FD, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExA + D6                                       7CA73304 3 Bytes  [ 26, FE, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconExA + DA                                       7CA73308 81 Bytes  [ 85, C0, 74, 0C, 68, F1, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconW + 39                                         7CA7335A 1 Byte  [ B5 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconW + 3B                                         7CA7335C 3 Bytes  [ FD, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconW + 40                                         7CA73361 3 Bytes  [ 3C, 10, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconW + 44                                         7CA73365 4 Bytes  [ 89, 9D, A4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconW + 49                                         7CA7336A 69 Bytes  [ FF, 3B, F3, 74, 07, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractIconA + 32                                                   7CA733B1 60 Bytes  [ 50, 6A, 0A, 8D, 85, 8C, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListW + B                                        7CA733EE 40 Bytes  [ 74, 21, 39, 9D, A0, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListW + 34                                       7CA73417 96 Bytes  [ 8B, 4D, FC, 5F, 5E, 5B, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!InternalExtractIconListW + 95                                       7CA73478 143 Bytes  [ 33, D2, 6A, 1E, 5E, F7, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconA + 1B                                         7CA73508 11 Bytes  [ 45, EA, 66, 89, 4D, EC, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconA + 27                                         7CA73514 135 Bytes  [ 45, F0, 66, 89, 4D, F2, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconA + B0                                         7CA7359D 3 Bytes  [ 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconA + B4                                         7CA735A1 25 Bytes  [ EC, 83, EC, 34, 53, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ExtractAssociatedIconA + CE                                         7CA735BB 30 Bytes  [ 00, C7, 45, D4, 3B, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstA + 38                                            7CA7366A 48 Bytes  [ 2B, F0, 8D, 45, CC, 3B, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstA + 6B                                            7CA7369D 6 Bytes  [ 90, 90, 8B, FF, 55, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstA + 72                                            7CA736A4 37 Bytes  [ 83, EC, 1C, 53, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstA + 98                                            7CA736CA 22 Bytes  [ 85, C0, 0F, 84, 98, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DoEnvironmentSubstA + AF                                            7CA736E1 34 Bytes  [ FF, 33, C9, 8A, 88, 59, C4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceA + 23                                            7CA7374B 108 Bytes  [ 0B, 6A, 01, 66, 89, 45, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceA + 90                                            7CA737B8 12 Bytes  [ 4D, F4, 0F, B6, 55, 0B, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceA + 9D                                            7CA737C5 68 Bytes  [ FE, 6B, C0, 0E, 05, 38, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceA + E2                                            7CA7380A 43 Bytes  [ CB, 74, 5B, 33, D2, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDiskFreeSpaceA + 10E                                           7CA73836 1 Byte  [ 06 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHObjectProperties + 134                                            7CA73A96 85 Bytes  [ 0F, 02, 19, 06, 06, 03, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHObjectProperties + 18A                                            7CA73AEC 123 Bytes  [ 09, 03, 13, 06, 1E, 02, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHObjectProperties + 206                                            7CA73B68 208 Bytes  [ 04, 03, 10, 02, 1A, 06, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHObjectProperties + 2D7                                            7CA73C39 363 Bytes  [ 03, 19, 04, 06, 02, 10, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellMessageBoxA + 24                                               7CA73DA5 31 Bytes  [ 01, 19, 06, 06, 02, 11, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellMessageBoxA + 44                                               7CA73DC5 69 Bytes  [ 02, 16, 06, 02, 03, 0E, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellMessageBoxA + 8A                                               7CA73E0B 181 Bytes  [ 01, 12, 06, 21, 02, 09, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushClipboard + 72                                               7CA73EC1 219 Bytes  [ 55, 8B, EC, 83, EC, 24, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushClipboard + 14E                                              7CA73F9D 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushClipboard + 150                                              7CA73F9F 14 Bytes  [ EB, 38, BA, DC, 05, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushClipboard + 15F                                              7CA73FAE 25 Bytes  [ 2A, BA, E0, 05, 00, 00, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFlushClipboard + 17A                                              7CA73FC9 13 Bytes  [ EB, 0E, BA, E6, 05, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowA + 1                                                     7CA74B02 41 Bytes  [ EC, 83, EC, 10, 53, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowA + 2B                                                    7CA74B2C 5 Bytes  [ 10, E8, C8, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowA + 31                                                    7CA74B32 48 Bytes  [ 83, F8, 02, 75, 14, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowA + 62                                                    7CA74B63 50 Bytes  [ FF, 33, C9, 38, 4D, F0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathIsSlowA + 95                                                    7CA74B96 157 Bytes  [ 00, 66, 3D, 00, AC, 73, 05, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathGetShortPath + 42                                               7CA74F40 76 Bytes  [ 57, FF, D6, 8D, 85, 74, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathGetShortPath + 8F                                               7CA74F8D 10 Bytes  [ FF, FF, 57, FF, D6, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathGetShortPath + 9A                                               7CA74F98 23 Bytes  [ 50, 8D, 04, 1B, 50, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathGetShortPath + B2                                               7CA74FB0 117 Bytes  [ B5, 2C, FF, FF, FF, E9, 19, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathGetShortPath + 128                                              7CA75026 93 Bytes  [ 15, 58, 10, 80, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDriveA + A                                                     7CA75084 9 Bytes  [ 78, E7, 84, 7C, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDriveA + 14                                                    7CA7508E 25 Bytes  [ FF, 55, 8B, EC, 83, EC, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDriveA + 2E                                                    7CA750A8 3 Bytes  [ 45, F8, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!IsLFNDriveA + 32                                                    7CA750AC 74 Bytes  [ 75, 08, FF, 15, 18, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathQualify + 33                                                    7CA750F7 45 Bytes  [ 0F, 01, FF, D6, 5E, C9, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathQualify + 61                                                    7CA75125 71 Bytes  [ 70, 18, FF, 15, 0C, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathQualify + A9                                                    7CA7516D 5 Bytes  [ 15, 10, 10, 80, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathQualify + AF                                                    7CA75173 43 Bytes  [ 75, 08, EB, 37, 0F, B7, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathQualify + DB                                                    7CA7519F 4 Bytes  [ 56, FF, 70, 18 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathMakeUniqueName + 17                                             7CA754C3 73 Bytes  [ F6, 00, 00, 00, 8B, 45, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathMakeUniqueName + 61                                             7CA7550D 103 Bytes  [ 8D, 45, C4, 50, 56, 56, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathMakeUniqueName + C9                                             7CA75575 54 Bytes  [ FF, FF, 89, 75, D8, 8D, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathMakeUniqueName + 100                                            7CA755AC 9 Bytes  CALL 7CA7508B C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PathMakeUniqueName + 10A                                            7CA755B6 4 Bytes  [ FF, FF, 90, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PickIconDlg + 1                                                     7CA76348 4 Bytes  [ B5, 44, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PickIconDlg + 6                                                     7CA7634D 5 Bytes  [ 89, B5, BC, FC, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PickIconDlg + C                                                     7CA76353 55 Bytes  [ 83, 7E, 04, 02, 0F, 86, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PickIconDlg + 44                                                    7CA7638B 28 Bytes  [ B5, 24, FD, FF, FF, FF, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PickIconDlg + 61                                                    7CA763A8 25 Bytes  [ 3B, C3, 0F, 84, 82, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandW + 4                                         7CA77135 11 Bytes  [ 4D, 10, 33, D2, 3B, CA, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandW + 10                                        7CA77141 63 Bytes  [ 08, A9, F8, FF, FF, FF, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandA + 1C                                        7CA77182 8 Bytes  [ 8D, 85, C4, F9, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandA + 25                                        7CA7718B 2 Bytes  [ E4, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandA + 29                                        7CA7718F 89 Bytes  [ 50, 8D, 85, E0, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandA + 83                                        7CA771E9 6 Bytes  [ 15, B4, 12, 80, 7C, 89 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHInvokePrinterCommandA + 8A                                        7CA771F0 22 Bytes  [ 0C, F6, FF, FF, 3B, C3, 0F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLL + C                                       7CA772FF 58 Bytes  [ FF, 83, C1, 20, 51, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLL + 48                                      7CA7733B 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLL + 4A                                      7CA7733D 4 Bytes  [ B5, 94, F9, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLL + 4F                                      7CA77342 16 Bytes  [ FF, 15, 18, 12, 80, 7C, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLL + 60                                      7CA77353 51 Bytes  [ FF, 33, C9, 3B, D7, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLLW + 10                                     7CA77388 3 Bytes  [ 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLLW + 14                                     7CA7738C 76 Bytes  [ FF, 55, 8B, EC, 81, EC, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLLW + 61                                     7CA773D9 28 Bytes  [ 15, 34, 10, 80, 7C, 83, BD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLLW + 7E                                     7CA773F6 8 Bytes  [ C9, C2, 10, 00, C7, 45, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PrintersGetCommand_RunDLLW + 87                                     7CA773FF 13 Bytes  JMP 7CA68450 C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAddFromPropSheetExtArray + 41                                     7CA777D7 99 Bytes  [ 02, 66, 83, 7C, 19, FE, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHReplaceFromPropSheetExtArray + 4D                                 7CA7783B 28 Bytes  [ FF, FF, 15, 3C, 10, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHReplaceFromPropSheetExtArray + 6A                                 7CA77858 55 Bytes  CALL 7CA60B37 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHReplaceFromPropSheetExtArray + A4                                 7CA77892 19 Bytes  [ 90, 90, 5F, 00, 43, 00, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHReplaceFromPropSheetExtArray + B8                                 7CA778A6 42 Bytes  [ 4E, 00, 45, 00, 54, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHReplaceFromPropSheetExtArray + E3                                 7CA778D1 14 Bytes  [ 00, 54, 00, 45, 00, 52, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreatePropSheetExtArray + 1A                                      7CA779E0 15 Bytes  [ 5C, 00, 52, 00, 65, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreatePropSheetExtArray + 2A                                      7CA779F0 23 Bytes  [ 79, 00, 5C, 00, 4D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreatePropSheetExtArray + 42                                      7CA77A08 15 Bytes  [ 73, 00, 74, 00, 65, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreatePropSheetExtArray + 52                                      7CA77A18 5 Bytes  [ 72, 00, 65, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreatePropSheetExtArray + 59                                      7CA77A1F 12 Bytes  [ 00, 43, 00, 6F, 00, 6E, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFile + A                                                   7CA77BB3 15 Bytes  [ 4D, 10, 8B, 45, 0C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFile + 1A                                                  7CA77BC3 4 Bytes  [ FF, 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFile + 20                                                  7CA77BC9 3 Bytes  [ 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFile + 24                                                  7CA77BCD 34 Bytes  [ EC, 51, 51, 53, 8B, 5D, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DragQueryFile + 47                                                  7CA77BF0 40 Bytes  [ 45, FC, 6A, 5C, D1, E9, 5A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialogEx + 85                                                7CA7839D 7 Bytes  [ C9, C7, 45, 10, 01, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialogEx + 8D                                                7CA783A5 17 Bytes  [ 74, 03, 40, 89, 01, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialogEx + 9F                                                7CA783B7 21 Bytes  [ 70, 18, FF, D6, 8B, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialogEx + B6                                                7CA783CE 18 Bytes  [ 00, 0F, 85, F0, 43, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialogEx + C9                                                7CA783E1 10 Bytes  [ 75, 08, 8B, 40, 30, 6A, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialog + 7                                                   7CA78C0C 43 Bytes  JMP 7CA7F5FF C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialog + 33                                                  7CA78C38 21 Bytes  [ 33, F6, 3B, C6, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialog + 49                                                  7CA78C4E 69 Bytes  [ 89, 75, F4, 39, 75, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialog + 8F                                                  7CA78C94 18 Bytes  [ 70, 04, FF, 75, EC, E8, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RestartDialog + A2                                                  7CA78CA7 2 Bytes  [ 00, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHOpenPropSheetW + D4                                               7CA79695 130 Bytes  [ 43, 41, 54, 41, 64, 6D, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHOpenPropSheetW + 157                                              7CA79718 63 Bytes  [ C4, 29, 82, 7C, D2, 60, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHOpenPropSheetW + 197                                              7CA79758 39 Bytes  [ 44, 29, 82, 7C, 21, EB, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHOpenPropSheetW + 1BF                                              7CA79780 3 Bytes  CALL D72419AD 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHOpenPropSheetW + 1C3                                              7CA79784 23 Bytes  [ 5A, EB, 87, 7C, D4, 28, 82, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CheckEscapesW + 86                                                  7CA7B2AE 17 Bytes  [ 68, CE, 00, 00, 00, E8, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CheckEscapesW + 98                                                  7CA7B2C0 62 Bytes  JMP 7CA4A29A C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CheckEscapesA + 2E                                                  7CA7B2FF 74 Bytes  CALL 7CA407A4 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CheckEscapesA + 79                                                  7CA7B34A 3 Bytes  [ 59, 54, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CheckEscapesA + 7D                                                  7CA7B34E 376 Bytes  JMP 7CA67D09 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCmpW + 85                                                       7CA7B4C8 221 Bytes  [ 54, 65, 72, 6D, 73, 72, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCmpIW + 65                                                      7CA7B5A6 55 Bytes  [ 42, 84, 7C, 8D, 85, E0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCmpIA + 30                                                      7CA7B5DE 21 Bytes  [ FF, 33, DB, 50, 53, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCmpIA + 46                                                      7CA7B5F4 31 Bytes  [ D6, 3B, C3, 0F, 8C, 9A, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCmpIA + 66                                                      7CA7B614 19 Bytes  [ 57, FF, 15, 4C, 12, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCpyW + 2                                                        7CA7B628 43 Bytes  [ FF, 59, 59, 8D, 85, E8, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCpyW + 2E                                                       7CA7B654 16 Bytes  [ 13, 80, 7C, 66, 89, 1C, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCpyW + 3F                                                       7CA7B665 35 Bytes  [ 1D, 4C, 10, 80, 7C, 59, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrNCpyA + 18                                                       7CA7B689 99 Bytes  [ D6, 57, FF, D3, 83, C4, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrW + 2C                                                       7CA7B6ED 83 Bytes  [ 3D, 70, 14, 80, 7C, 6A, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrA + 13                                                       7CA7B741 58 Bytes  [ 0F, 84, FC, A8, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrA + 4E                                                       7CA7B77C 31 Bytes  [ FF, 51, FF, B5, C4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrA + 6E                                                       7CA7B79C 12 Bytes  CALL 7CA99A75 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrA + 7B                                                       7CA7B7A9 6 Bytes  [ 00, 00, 8D, 85, C8, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrRStrA + 82                                                       7CA7B7B0 42 Bytes  [ FF, 50, 8D, 85, D0, FD, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirW + 2                                                      7CA7B86C 79 Bytes  [ FF, 50, 8D, 85, E0, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirW + 53                                                     7CA7B8BD 48 Bytes  [ 51, 53, 8D, 4E, 20, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirW + 84                                                     7CA7B8EE 8 Bytes  [ 50, C7, 85, 84, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirW + 8E                                                     7CA7B8F8 5 Bytes  [ 00, 89, 9D, 88, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirW + 94                                                     7CA7B8FE 15 Bytes  [ FF, C7, 85, 90, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirA + 2                                                      7CA7B90E 57 Bytes  [ FF, 89, 9D, 98, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirA + 3C                                                     7CA7B948 9 Bytes  [ FF, 8B, 46, 2C, 89, 85, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirA + 46                                                     7CA7B952 18 Bytes  [ 8B, 46, 30, 89, 85, 70, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirA + 59                                                     7CA7B965 7 Bytes  [ 46, 4C, 89, 85, E4, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirA + 61                                                     7CA7B96D 9 Bytes  [ 8B, 46, 50, 89, 85, E0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirW + 1                                                   7CA7B977 34 Bytes  [ 46, 54, 89, 85, 80, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirW + 25                                                  7CA7B99B 21 Bytes  [ 00, 88, 5E, 48, 88, 5E, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirW + 3B                                                  7CA7B9B1 52 Bytes  [ FF, 15, 3C, 10, 80, 7C, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirW + 71                                                  7CA7B9E7 53 Bytes  [ FF, 15, 3C, 10, 80, 7C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirW + A7                                                  7CA7BA1D 16 Bytes  [ 89, 46, 34, 8B, 85, E4, FD, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirA + 28                                                  7CA7BB82 125 Bytes  [ 70, 18, FF, 15, 10, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheSetCurDrive + 27                                                 7CA7BC00 6 Bytes  [ 6A, 0F, 59, E9, 6B, E2 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheSetCurDrive + 2F                                                 7CA7BC08 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheSetCurDrive + 36                                                 7CA7BC0F 149 Bytes  [ 55, 8B, EC, 81, EC, 1C, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheFullPathA + 7C                                                   7CA7BCA6 9 Bytes  [ 00, 00, FF, D7, 8B, D8, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheFullPathA + 86                                                   7CA7BCB0 13 Bytes  [ FB, FF, 75, 0F, 68, 17, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheFullPathA + 94                                                   7CA7BCBE 66 Bytes  JMP 7CA4A21F C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheFullPathW + 25                                                   7CA7BD01 79 Bytes  [ B6, 50, 01, 00, 00, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheFullPathW + 75                                                   7CA7BD51 92 Bytes  [ 81, F9, 40, 04, 00, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirExW + 1A                                                   7CA7BDAE 21 Bytes  [ 0D, D4, 46, 88, 7C, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirExW + 30                                                   7CA7BDC4 6 Bytes  [ 0C, 10, 80, 7C, 85, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirExW + 37                                                   7CA7BDCB 42 Bytes  [ 86, 94, 0F, 00, 00, 75, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirExW + 62                                                   7CA7BDF6 19 Bytes  [ 68, 0D, 00, 00, C0, E8, A7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheGetDirExW + 76                                                   7CA7BE0A 45 Bytes  [ 89, 7D, DC, 81, FF, 00, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExW + 73                                                7CA7BF04 42 Bytes  JMP 7CA67493 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExW + 9E                                                7CA7BF2F 13 Bytes  [ 15, 10, 10, 80, 7C, EB, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExW + AC                                                7CA7BF3D 13 Bytes  JMP 7CA673B4 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExW + BA                                                7CA7BF4B 63 Bytes  [ 33, C0, C3, 8B, 40, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExW + FA                                                7CA7BF8B 44 Bytes  CALL 7CA522D9 C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExA + 9                                                 7CA7C11E 22 Bytes  [ 2E, 0F, 85, 08, AA, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExA + 20                                                7CA7C135 2 Bytes  [ CE, A9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExA + 24                                                7CA7C139 144 Bytes  CALL C5A7C13C 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExA + B5                                                7CA7C1CA 2 Bytes  [ 70, 18 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheChangeDirExA + B8                                                7CA7C1CD 75 Bytes  [ 15, 0C, 10, 80, 7C, 8B, D8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RegenerateUserEnvironment + A8                                      7CA7D30E 303 Bytes  [ 69, 6F, 6E, 00, 90, 90, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RegenerateUserEnvironment + 1D8                                     7CA7D43E 213 Bytes  [ 90, 90, 47, 65, 74, 53, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RegenerateUserEnvironment + 2AE                                     7CA7D514 23 Bytes  [ FB, E2, 87, 7C, 20, 22, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RegenerateUserEnvironment + 2C6                                     7CA7D52C 91 Bytes  [ 1F, E3, 87, 7C, 88, 63, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RegenerateUserEnvironment + 322                                     7CA7D588 35 Bytes  [ 8C, 62, 82, 7C, 43, E3, 87, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CallCPLEntry16 + 83                                                 7CA7D715 70 Bytes  [ 5A, 43, 45, 61, 70, 6F, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CallCPLEntry16 + CA                                                 7CA7D75C 207 Bytes  [ 57, 5A, 43, 45, 61, 70, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CallCPLEntry16 + 19A                                                7CA7D82C 119 Bytes  [ 0C, E7, 87, 7C, 54, 22, 82, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CallCPLEntry16 + 212                                                7CA7D8A4 200 Bytes  [ 72, 6F, 76, 53, 69, 67, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CallCPLEntry16 + 2DB                                                7CA7D96D 12 Bytes  [ ED, 87, 7C, 00, 72, 82, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_CloseProperties + 4C                                         7CA82AA8 129 Bytes  [ 50, 08, 66, 8B, 5A, 04, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_CloseProperties + CE                                         7CA82B2A 62 Bytes  [ 83, A8, 06, FC, FF, 3B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_CloseProperties + 10D                                        7CA82B69 55 Bytes  [ EB, 0B, 8A, 12, 88, 11, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_CloseProperties + 145                                        7CA82BA1 25 Bytes  [ C1, EB, 08, 84, DB, 74, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_CloseProperties + 15F                                        7CA82BBB 33 Bytes  [ 8B, FA, EB, 03, 83, CF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_GetProperties + 5B                                           7CA831D3 18 Bytes  [ 8B, F8, 33, C0, 8A, 82, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_GetProperties + 6E                                           7CA831E6 19 Bytes  [ 83, E0, 0F, C1, E0, 10, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_GetProperties + 83                                           7CA831FB 31 Bytes  [ 00, EB, 13, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_GetProperties + A4                                           7CA8321C 16 Bytes  [ 00, 3B, 05, A8, 43, 88, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_GetProperties + B5                                           7CA8322D 18 Bytes  [ 00, 00, 66, F7, 80, C6, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_SetProperties + 17                                           7CA83A0E 5 Bytes  [ 03, D9, 33, C9, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_SetProperties + 1D                                           7CA83A14 54 Bytes  [ 0C, 58, 66, 03, CA, 66, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_SetProperties + 54                                           7CA83A4B 106 Bytes  [ 89, 7D, F0, 8B, 45, F8, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_SetProperties + BF                                           7CA83AB6 50 Bytes  [ 66, 83, F8, 66, 0F, 87, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_SetProperties + F2                                           7CA83AE9 36 Bytes  [ 66, 83, F8, 41, 72, 0B, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_OpenProperties + 51                                          7CA83F46 93 Bytes  [ 83, 7D, 24, 00, 74, 07, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_OpenProperties + AF                                          7CA83FA4 141 Bytes  [ 10, 66, 85, D2, 75, EF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_OpenProperties + 13D                                         7CA84032 29 Bytes  [ 0D, 66, C7, 00, 30, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_OpenProperties + 15B                                         7CA84050 54 Bytes  CALL 7CA41700 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!PifMgr_OpenProperties + 192                                         7CA84087 33 Bytes  CALL 0878CBCC 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheRemoveQuotesA + 39                                               7CA8BF34 19 Bytes  [ 20, F8, 87, 7C, BC, 4C, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheRemoveQuotesA + 4D                                               7CA8BF48 23 Bytes  [ 98, 4C, 85, 7C, 6F, F8, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheRemoveQuotesA + 66                                               7CA8BF61 14 Bytes  [ 4C, 85, 7C, 6F, F8, 87, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheRemoveQuotesA + 75                                               7CA8BF70 124 Bytes  [ 44, 4C, 85, 7C, 34, F8, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathW + 3B                                                7CA8BFED 102 Bytes  [ 52, 6F, 6F, 74, 49, 6E, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathW + A2                                                7CA8C054 269 Bytes  [ 61, 64, 67, 65, 74, 42, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathW + 1B2                                               7CA8C164 115 Bytes  [ 46, 69, 6E, 64, 53, 74, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathA + 73                                                7CA8C1D8 138 Bytes  [ 43, 72, 65, 61, 74, 65, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathA + FE                                                7CA8C263 148 Bytes  [ 7C, B8, EB, 87, 7C, 70, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathA + 193                                               7CA8C2F8 32 Bytes  [ 44, 68, 63, 70, 41, 63, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathA + 1B4                                               7CA8C319 148 Bytes  [ 90, 90, 90, 44, 68, 63, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheShortenPathA + 249                                               7CA8C3AE 13 Bytes  [ 00, 00, F8, EC, 87, 7C, 2A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheConvertPathW + 30                                                7CA8C54A 24 Bytes  [ 85, 7C, B6, E6, 87, 7C, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheConvertPathW + 49                                                7CA8C563 403 Bytes  [ 7C, EA, E6, 87, 7C, 50, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheConvertPathW + 1DE                                               7CA8C6F8 217 Bytes  [ 43, 72, 79, 70, 74, 49, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheConvertPathW + 2B8                                               7CA8C7D2 96 Bytes  [ 90, 90, 43, 65, 72, 74, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SheConvertPathW + 319                                               7CA8C833 75 Bytes  [ 43, 65, 72, 74, 69, 66, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLL + 2D                                                  7CA8DF9E 135 Bytes  [ 55, 8B, EC, 51, 51, 53, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLL + B5                                                  7CA8E026 6 Bytes  [ 00, 00, E9, DD, 53, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLLW + 2                                                  7CA8E02D 110 Bytes  [ C7, 45, A8, 03, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLLW + 71                                                 7CA8E09C 3 Bytes  [ 46, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLLW + 76                                                 7CA8E0A1 26 Bytes  [ 90, 90, 90, 68, EC, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLLW + 91                                                 7CA8E0BC 17 Bytes  [ 7D, 08, 89, BD, B8, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!OpenAs_RunDLLW + A3                                                 7CA8E0CE 50 Bytes  [ 45, 10, 89, 85, C0, FC, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Activate_RunDLL + 1                                                 7CA8F04D 25 Bytes  [ C3, 5B, C9, C2, 0C, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Activate_RunDLL + 1B                                                7CA8F067 60 Bytes  [ 57, FF, 75, 0C, 89, 7D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Activate_RunDLL + 58                                                7CA8F0A4 6 Bytes  [ 00, FF, 75, 10, 8B, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Activate_RunDLL + 5F                                                7CA8F0AB 22 Bytes  [ D6, 03, 45, FC, 59, 8D, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Activate_RunDLL + 76                                                7CA8F0C2 51 Bytes  [ 15, 0C, 10, 80, 7C, 8B, F8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHIsFileAvailableOffline                                            7CA920E4 36 Bytes  [ 90, 8B, FF, 55, 8B, EC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHIsFileAvailableOffline + 25                                       7CA92109 1 Byte  [ 24 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHIsFileAvailableOffline + 27                                       7CA9210B 25 Bytes  [ 83, AF, 87, 7C, 8B, 45, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHIsFileAvailableOffline + 41                                       7CA92125 26 Bytes  [ 8B, 45, 10, C7, 00, 44, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHIsFileAvailableOffline + 5C                                       7CA92140 32 Bytes  [ F8, C0, 81, 7C, 8B, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEnumerateUnreadMailAccountsW                                      7CA924CE 42 Bytes  [ 90, 8B, FF, 55, 8B, EC, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 2B                                 7CA924F9 4 Bytes  [ 45, 18, 57, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 30                                 7CA924FE 10 Bytes  [ 7C, 13, 80, 7C, 75, 68, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 3B                                 7CA92509 35 Bytes  [ 8D, 5C, FF, FF, FF, 51, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHEnumerateUnreadMailAccountsW + 5F                                 7CA9252D 18 Bytes  [ FF, FF, 50, FF, D6, 8D, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetAttributesFromDataObject + 2D                                  7CA92972 31 Bytes  [ 40, 40, 33, D2, 66, 8B, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetAttributesFromDataObject + 4D                                  7CA92992 207 Bytes  JMP 68A92995 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetAttributesFromDataObject + 11D                                 7CA92A62 28 Bytes  [ D7, 2B, D1, 66, 89, 04, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetAttributesFromDataObject + 13A                                 7CA92A7F 27 Bytes  [ FF, FF, 6A, 02, 66, C7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetAttributesFromDataObject + 156                                 7CA92A9B 57 Bytes  [ 13, 66, 85, D2, 75, EF, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteA + A                                          7CA948CE 17 Bytes  [ 65, 00, 6E, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteA + 1C                                         7CA948E0 51 Bytes  [ 65, 00, 20, 00, 68, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteA + 50                                         7CA94914 15 Bytes  [ 63, 00, 65, 00, 64, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteA + 60                                         7CA94924 11 Bytes  [ 61, 00, 6C, 00, 6C, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPathPrepareForWriteA + 6C                                         7CA94930 35 Bytes  [ 00, 00, 00, 00, 80, 00, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetUnreadMailCountW + A                                           7CA94BEA 53 Bytes  [ 69, 00, 76, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetUnreadMailCountW + 40                                          7CA94C20 7 Bytes  [ 6C, 00, 69, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetUnreadMailCountW + 48                                          7CA94C28 9 Bytes  [ 20, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetUnreadMailCountW + 52                                          7CA94C32 4 Bytes  [ 20, 00, 62, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetUnreadMailCountW + 57                                          7CA94C37 4 Bytes  [ 00, 66, 00, 66 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetUnreadMailCountW + A                                           7CA94DFE 33 Bytes  [ 61, 00, 63, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetUnreadMailCountW + 2C                                          7CA94E20 33 Bytes  [ 77, 00, 6F, 00, 72, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetUnreadMailCountW + 4E                                          7CA94E42 29 Bytes  [ 20, 00, 72, 00, 65, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetUnreadMailCountW + 6C                                          7CA94E60 13 Bytes  [ 0A, 00, 00, 00, AC, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHSetUnreadMailCountW + 7A                                          7CA94E6E 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetShellStyleHInstance + 53                                       7CA952CF 106 Bytes  [ 7F, 0F, 87, 89, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetShellStyleHInstance + BE                                       7CA9533A 75 Bytes  [ 8A, 0B, 88, 0C, 30, 40, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetShellStyleHInstance + 10A                                      7CA95386 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetShellStyleHInstance + 10C                                      7CA95388 11 Bytes  [ 6A, 06, 5F, 39, 7D, 08, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetShellStyleHInstance + 119                                      7CA95395 42 Bytes  [ 13, 3B, 45, 14, 7D, 1A, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFormatDrive + 53                                                  7CA981F0 70 Bytes  JMP 7CA62899 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFormatDrive + 9A                                                  7CA98237 6 Bytes  [ 6A, 7A, E8, AE, 84, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFormatDrive + A1                                                  7CA9823E 48 Bytes  JMP 7CA6A630 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFormatDrive + D2                                                  7CA9826F 8 Bytes  [ 90, 90, 90, 90, 90, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFormatDrive + DC                                                  7CA98279 1 Byte  [ 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!AppCompat_RunDLLW + 41                                              7CA98928 65 Bytes  [ D6, 89, 45, E0, 3B, C3, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!AppCompat_RunDLLW + 83                                              7CA9896A 3 Bytes  [ 5C, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!AppCompat_RunDLLW + 87                                              7CA9896E 5 Bytes  [ 6A, 6F, E9, C4, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!AppCompat_RunDLLW + 8D                                              7CA98974 26 Bytes  [ 00, FF, B5, 2C, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!AppCompat_RunDLLW + A8                                              7CA9898F 41 Bytes  [ 83, F8, FF, 0F, 85, 2E, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create + 2                                           7CA9A018 14 Bytes  [ 3B, C3, 75, 16, 8B, 85, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create + 11                                          7CA9A027 40 Bytes  [ FF, 50, FF, D6, 59, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create + 3A                                          7CA9A050 8 Bytes  [ B5, A8, F7, FF, FF, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create + 43                                          7CA9A059 15 Bytes  [ 00, 00, 89, 85, 98, F6, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create + 53                                          7CA9A069 77 Bytes  [ 40, 30, FF, 70, 18, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create2 + 2                                          7CA9A0B7 52 Bytes  [ FF, 50, FF, D6, 8B, 85, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create2 + 37                                         7CA9A0EC 3 Bytes  [ B5, 28, F8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create2 + 3B                                         7CA9A0F0 5 Bytes  [ FF, 53, 8B, 40, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create2 + 41                                         7CA9A0F6 48 Bytes  [ 70, 18, 8B, 35, 10, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!CDefFolderMenu_Create2 + 72                                         7CA9A127 45 Bytes  JMP 7CA70229 C:\WINDOWS\system32\SHELL32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_AutoScroll + 35                                                 7CAA5410 13 Bytes  [ 74, 00, 72, 00, 6F, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_AutoScroll + 43                                                 7CAA541E 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_AutoScroll + 45                                                 7CAA5420 21 Bytes  [ 20, 00, 62, 00, 65, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_AutoScroll + 5B                                                 7CAA5436 13 Bytes  [ 74, 00, 6F, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_AutoScroll + 69                                                 7CAA5444 5 Bytes  [ 72, 00, 76, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_DragEnterEx2 + 2B                                               7CAAE742 56 Bytes  [ B6, 3C, 04, 00, 00, 68, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_DragEnterEx + B                                                 7CAAE77B 72 Bytes  [ 55, 8B, EC, 56, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_DragEnterEx + 54                                                7CAAE7C4 91 Bytes  [ A8, 10, 74, 04, 83, 4D, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_SetDragImage + 17                                               7CAAE820 62 Bytes  [ B6, 3C, 04, 00, 00, 6A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_SetDragImage + 56                                               7CAAE85F 8 Bytes  [ FF, 55, 8B, EC, 83, EC, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_SetDragImage + 5F                                               7CAAE868 132 Bytes  [ 75, 10, 8B, 75, 0C, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_DragLeave + 49                                                  7CAAE8ED 4 Bytes  [ 8B, F0, 8D, 7B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DAD_DragLeave + 4E                                                  7CAAE8F2 122 Bytes  [ F3, A5, 8B, CA, 83, E1, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDoDragDrop + 68                                                   7CAAE96D 12 Bytes  CALL 7CA60F73 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDoDragDrop + 75                                                   7CAAE97A 88 Bytes  [ 85, F6, 7D, 08, 56, E8, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDoDragDrop + CE                                                   7CAAE9D3 118 Bytes  [ 45, 14, 89, 45, F4, 88, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDoDragDrop + 145                                                  7CAAEA4A 147 Bytes  [ 14, 50, 8D, 45, F0, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDoDragDrop + 1D9                                                  7CAAEADE 247 Bytes  [ EB, 59, 8D, 45, F0, 50, 56, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllInstall + A                                                      7CAB193E 31 Bytes  [ 63, 00, 6F, 00, 6D, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllInstall + 2A                                                     7CAB195E 97 Bytes  [ 61, 00, 74, 00, 65, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllInstall + 8C                                                     7CAB19C0 25 Bytes  [ 75, 00, 74, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllInstall + A6                                                     7CAB19DA 15 Bytes  [ 6E, 00, 20, 00, 6F, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!DllInstall + B6                                                     7CAB19EA 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconA + A                                               7CAB49C0 17 Bytes  [ 65, 00, 78, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconA + 1D                                              7CAB49D3 35 Bytes  [ 00, 68, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconA + 41                                              7CAB49F7 20 Bytes  [ 00, 69, 00, 63, 00, 6B, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconA + 56                                              7CAB4A0C 67 Bytes  [ 6F, 00, 6C, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHDefExtractIconA + 9A                                              7CAB4A50 49 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHValidateUNC + A                                                   7CAB4F8A 41 Bytes  [ 6F, 00, 74, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHValidateUNC + 34                                                  7CAB4FB4 51 Bytes  [ 66, 00, 65, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHValidateUNC + 68                                                  7CAB4FE8 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHValidateUNC + 6A                                                  7CAB4FEA 27 Bytes  [ 6F, 00, 72, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHValidateUNC + 86                                                  7CAB5006 113 Bytes  [ 65, 00, 20, 00, 70, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SignalFileOpen + 17                                                 7CAB5747 32 Bytes  [ 00, 68, 00, 69, 00, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SignalFileOpen + 38                                                 7CAB5768 97 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SignalFileOpen + 9A                                                 7CAB57CA 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SignalFileOpen + 9C                                                 7CAB57CC 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SignalFileOpen + 9E                                                 7CAB57CE 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExA + 40                                            7CAB5858 7 Bytes  [ EC, 00, 01, 00, 54, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExA + 48                                            7CAB5860 91 Bytes  [ 65, 00, 20, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExA + A4                                            7CAB58BC 19 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExW + F                                             7CAB58D0 47 Bytes  [ 6E, 00, 63, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExW + 3F                                            7CAB5900 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExW + 41                                            7CAB5902 3 Bytes  [ 74, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExW + 45                                            7CAB5906 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteExW + 47                                            7CAB5908 20 Bytes  [ 6E, 00, 66, 00, 6F, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteA + 2E                                              7CAB5998 11 Bytes  [ 64, 00, 65, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!RealShellExecuteW + 7                                               7CAB59A4 107 Bytes  [ 00, 00, 00, 00, 84, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteW + 40                                                  7CAB5A10 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteW + 42                                                  7CAB5A12 7 Bytes  [ 20, 00, 73, 00, 65, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteW + 4A                                                  7CAB5A1A 7 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteW + 52                                                  7CAB5A22 11 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExecuteW + 5E                                                  7CAB5A2E 1 Byte  [ 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!GetFileNameFromBrowse + 1                                           7CAB7084 19 Bytes  [ 40, 30, FF, 70, 18, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!GetFileNameFromBrowse + 15                                          7CAB7098 17 Bytes  CALL 7CA5991F C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!GetFileNameFromBrowse + 27                                          7CAB70AA 10 Bytes  [ FF, FF, 00, 00, 00, 00, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!GetFileNameFromBrowse + 32                                          7CAB70B5 98 Bytes  [ 00, 00, 00, 1A, FC, 85, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!GetFileNameFromBrowse + 95                                          7CAB7118 18 Bytes  CALL 8521706D 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILAppendID + 21                                                     7CAB7482 19 Bytes  [ FF, 55, 8B, EC, 83, EC, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILAppendID + 35                                                     7CAB7496 113 Bytes  [ 15, D4, 10, 80, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILAppendID + A7                                                     7CAB7508 24 Bytes  [ 33, C0, EB, 3A, 8A, 4D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILAppendID + C0                                                     7CAB7521 78 Bytes  [ FF, 8B, 74, F5, 80, 23, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILAppendID + 10F                                                    7CAB7570 147 Bytes  [ FF, FF, FF, 50, 6A, 37, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPathA + 24                                              7CAB76E4 178 Bytes  [ FF, 3B, FB, 76, 04, 89, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPathA + D8                                              7CAB7798 15 Bytes  CALL 7CA607A6 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPathA + E8                                              7CAB77A8 3 Bytes  [ 45, CC, 3B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPathA + EC                                              7CAB77AC 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ILCreateFromPathA + EE                                              7CAB77AE 58 Bytes  [ 8D, 1C, 85, 98, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetSpecialFolderPathA + 16                                        7CAB9804 48 Bytes  [ 3B, FE, 0F, 8C, B3, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirA + 19                                      7CAB9835 75 Bytes  [ FF, 15, A0, 10, 80, 7C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirA + 65                                      7CAB9881 70 Bytes  [ 0F, B7, 18, 6A, 04, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirA + AD                                      7CAB98C9 61 Bytes  [ 2B, C7, 50, 8B, C3, D1, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirA + EB                                      7CAB9907 70 Bytes  [ 4D, 10, 8B, 11, 89, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetFolderPathAndSubDirA + 133                                     7CAB994F 1 Byte  [ 8D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHHandleUpdateImage + 21                                            7CABABA6 114 Bytes  [ 89, 85, 68, FA, FF, FF, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHHandleUpdateImage + 94                                            7CABAC19 78 Bytes  CALL 7CABA43A C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHHandleUpdateImage + E3                                            7CABAC68 21 Bytes  [ DC, 89, 9D, 2C, FA, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHHandleUpdateImage + F9                                            7CABAC7E 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHHandleUpdateImage + FB                                            7CABAC80 14 Bytes  [ B5, A0, FA, FF, FF, 56, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifySuspendResume + 57                                    7CABB1A3 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifySuspendResume + 75                                    7CABB1C1 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifySuspendResume + 81                                    7CABB1CD 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifySuspendResume + 8E                                    7CABB1DA 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHChangeNotifySuspendResume + 96                                    7CABB1E2 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageW + B                                                  7CABB238 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageW + 2A                                                 7CABB257 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageW + 5A                                                 7CABB287 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageW + 80                                                 7CABB2AD 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageW + 88                                                 7CABB2B5 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageA + B                                                  7CABB377 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageA + 15                                                 7CABB381 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageA + 4A                                                 7CABB3B6 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageA + 63                                                 7CABB3CF 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHUpdateImageA + 7C                                                 7CABB3E8 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListA + A                                            7CAC221A 26 Bytes  [ 65, 00, 63, 00, 69, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListA + 25                                           7CAC2235 26 Bytes  [ 00, 72, 00, 20, 00, 43, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListA + 40                                           7CAC2250 87 Bytes  [ 66, 00, 69, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListA + 98                                           7CAC22A8 33 Bytes  [ 65, 00, 72, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetDataFromIDListA + BA                                           7CAC22CA 61 Bytes  [ 65, 00, 6D, 00, 61, 00, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfo + B                                                7CAC249A 131 Bytes  [ 74, 00, 20, 00, 6F, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfo + 8F                                               7CAC251E 31 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfo + AF                                               7CAC253E 33 Bytes  [ 72, 00, 6F, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfo + D1                                               7CAC2560 67 Bytes  [ 64, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetNewLinkInfo + 115                                              7CAC25A4 55 Bytes  [ 6C, 00, 72, 00, 65, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellItem + B0                                              7CAC2996 149 Bytes  [ 20, 00, 74, 00, 79, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellItem + 146                                             7CAC2A2C 47 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateFileExtractIconW + A                                        7CAC2A5C 26 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateFileExtractIconW + 25                                       7CAC2A77 8 Bytes  [ 00, 70, 00, 01, 00, 43, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateFileExtractIconW + 2E                                       7CAC2A80 5 Bytes  [ 6E, 00, 6E, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateFileExtractIconW + 34                                       7CAC2A86 11 Bytes  [ 74, 00, 20, 00, 63, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateFileExtractIconW + 40                                       7CAC2A92 30 Bytes  [ 74, 00, 65, 00, 20, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAppBarMessage + 11                                                7CAC3CA0 19 Bytes  [ 5C, 00, 01, 00, 54, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAppBarMessage + 25                                                7CAC3CB4 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAppBarMessage + 27                                                7CAC3CB6 9 Bytes  [ 70, 00, 6F, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAppBarMessage + 31                                                7CAC3CC0 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHAppBarMessage + 33                                                7CAC3CC2 61 Bytes  [ 77, 00, 65, 00, 72, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadInProc + 13                                                   7CAC3DFA 80 Bytes  [ 64, 00, 20, 00, 6F, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetInstanceExplorer + 15                                          7CAC3E4B 14 Bytes  [ 00, 68, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetInstanceExplorer + 24                                          7CAC3E5A 32 Bytes  [ 65, 00, 6D, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetInstanceExplorer + 45                                          7CAC3E7B 62 Bytes  [ 00, 6D, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetInstanceExplorer + 84                                          7CAC3EBA 3 Bytes  [ 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetInstanceExplorer + 88                                          7CAC3EBE 9 Bytes  [ 74, 00, 68, 00, 69, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolderW + 4F                                             7CAC6E20 81 Bytes  [ 62, 00, 65, 00, 20, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolderW + A1                                             7CAC6E72 55 Bytes  [ 6F, 00, 72, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolderW + D9                                             7CAC6EAA 27 Bytes  [ 73, 00, 20, 00, 73, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolderW + F5                                             7CAC6EC6 15 Bytes  [ 20, 00, 69, 00, 6E, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolder + B                                               7CAC6ED6 11 Bytes  [ 69, 00, 7A, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolder + 17                                              7CAC6EE2 39 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolder + 3F                                              7CAC6F0A 80 Bytes  [ 6C, 00, 6C, 00, 20, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolder + 90                                              7CAC6F5B 2 Bytes  [ 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHBrowseForFolder + 93                                              7CAC6F5E 59 Bytes  [ 74, 00, 20, 00, 77, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WOWShellExecute + 44                                                7CAC8434 14 Bytes  [ 73, 00, 65, 00, 74, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WOWShellExecute + 54                                                7CAC8444 11 Bytes  [ EC, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WOWShellExecute + 60                                                7CAC8450 37 Bytes  [ 72, 00, 65, 00, 70, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WOWShellExecute + 86                                                7CAC8476 5 Bytes  [ 6E, 00, 69, 00, 7A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!WOWShellExecute + 8C                                                7CAC847C 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLL + A                                                7CAC8590 31 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLL + 2A                                               7CAC85B0 11 Bytes  [ 74, 00, 65, 00, 64, 00, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLL + 36                                               7CAC85BC 27 Bytes  [ 75, 00, 74, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLL + 52                                               7CAC85D8 29 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLLW + A                                               7CAC85F6 31 Bytes  [ 63, 00, 6F, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLLW + 2A                                              7CAC8616 13 Bytes  [ 69, 00, 6F, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLLW + 38                                              7CAC8624 27 Bytes  [ 65, 00, 72, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLLW + 54                                              7CAC8640 87 Bytes  [ 6F, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellExec_RunDLLW + AC                                              7CAC8698 3 Bytes  [ 20, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateProcessAsUserW + C                                          7CAC91B8 15 Bytes  [ 66, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateProcessAsUserW + 1C                                         7CAC91C8 60 Bytes  [ 65, 00, 63, 00, 69, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateProcessAsUserW + 59                                         7CAC9205 34 Bytes  [ 00, 00, 00, 74, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateProcessAsUserW + 7C                                         7CAC9228 41 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateProcessAsUserW + A6                                         7CAC9252 5 Bytes  [ 20, 00, 6E, 00, 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHShellFolderView_Message + 6C                                      7CACA8F0 45 Bytes  [ 20, 00, 53, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHShellFolderView_Message + 9A                                      7CACA91E 9 Bytes  [ 0A, 00, 00, 00, 00, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHShellFolderView_Message + A4                                      7CACA928 86 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHShellFolderView_Message + FB                                      7CACA97F 32 Bytes  [ 00, 65, 00, 20, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHShellFolderView_Message + 11C                                     7CACA9A0 7 Bytes  [ 69, 00, 73, 00, 20, 00, 6E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderViewEx + 10                                      7CACAD3C 13 Bytes  [ 6D, 00, 20, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderViewEx + 1E                                      7CACAD4A 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderViewEx + 20                                      7CACAD4C 16 Bytes  [ 73, 00, 74, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderViewEx + 31                                      7CACAD5D 16 Bytes  [ 00, 0A, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateShellFolderViewEx + 42                                      7CACAD6E 33 Bytes  [ 72, 00, 6F, 00, 67, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFind_InitMenuPopup + 4A                                           7CACCAE0 21 Bytes  [ 2C, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFind_InitMenuPopup + 60                                           7CACCAF6 35 Bytes  [ 72, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFind_InitMenuPopup + 84                                           7CACCB1A 5 Bytes  [ 20, 00, 61, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFind_InitMenuPopup + 8A                                           7CACCB20 9 Bytes  [ 70, 00, 6F, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFind_InitMenuPopup + 94                                           7CACCB2A 155 Bytes  [ 79, 00, 20, 00, 72, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFindFiles + C                                                     7CACE09A 12 Bytes  [ 5D, C2, 1C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFindFiles + 19                                                    7CACE0A7 16 Bytes  [ EC, 81, EC, 10, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFindFiles + 2A                                                    7CACE0B8 13 Bytes  [ FF, 00, 53, 8B, 5D, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFindFiles + 38                                                    7CACE0C6 103 Bytes  [ BF, 48, 8F, 83, 7C, 57, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHFindFiles + A0                                                    7CACE12E 19 Bytes  [ F8, 0C, 0F, 87, 92, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHStartNetConnectionDialogW + B                                     7CAD17A0 17 Bytes  [ 20, 00, 6D, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHStartNetConnectionDialogW + 1D                                    7CAD17B2 13 Bytes  [ 65, 00, 20, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHStartNetConnectionDialogW + 2B                                    7CAD17C0 5 Bytes  [ 64, 00, 20, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHStartNetConnectionDialogW + 31                                    7CAD17C6 15 Bytes  [ 61, 00, 6C, 00, 75, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHStartNetConnectionDialogW + 41                                    7CAD17D6 31 Bytes  [ 00, 00, 74, 00, 01, 00, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexW + B                                          7CAD3736 45 Bytes  [ 0A, 00, 00, 00, 00, 00, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexW + 39                                         7CAD3764 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexW + 3B                                         7CAD3766 27 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexW + 57                                         7CAD3782 123 Bytes  [ 20, 00, 69, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexW + D3                                         7CAD37FE 15 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexA + B                                          7CAD380E 27 Bytes  [ 74, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexA + 27                                         7CAD382A 41 Bytes  [ 72, 00, 20, 00, 75, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexA + 51                                         7CAD3854 65 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexA + 93                                         7CAD3896 15 Bytes  [ 6E, 00, 73, 00, 74, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHGetIconOverlayIndexA + A3                                         7CAD38A6 21 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgCreate + F                                                 7CAD4382 9 Bytes  [ 72, 00, 20, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgCreate + 19                                                7CAD438C 93 Bytes  [ 65, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgCreate + 77                                                7CAD43EA 23 Bytes  [ 6D, 00, 65, 00, 6F, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgCreate + 8F                                                7CAD4402 59 Bytes  [ 68, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgCreate + CB                                                7CAD443E 35 Bytes  [ 64, 00, 20, 00, 63, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgWriteMultiple + 11                                         7CAD4FE4 49 Bytes  [ 73, 00, 75, 00, 70, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgWriteMultiple + 43                                         7CAD5016 3 Bytes  [ 01, 00, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgWriteMultiple + 47                                         7CAD501A 145 Bytes  [ 68, 00, 65, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgWriteMultiple + D9                                         7CAD50AC 19 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHPropStgWriteMultiple + ED                                         7CAD50C0 93 Bytes  [ 74, 00, 65, 00, 64, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLimitInputEdit + 49                                               7CAD5CF0 159 Bytes  [ 72, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLimitInputEdit + E9                                               7CAD5D90 55 Bytes  [ 65, 00, 72, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLimitInputEdit + 121                                              7CAD5DC8 17 Bytes  [ 73, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLimitInputEdit + 133                                              7CAD5DDA 45 Bytes  [ 69, 00, 66, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLimitInputEdit + 161                                              7CAD5E08 13 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMultiFileProperties + 2A                                          7CAD60D6 49 Bytes  [ 6F, 00, 6D, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMultiFileProperties + 5C                                          7CAD6108 25 Bytes  [ 73, 00, 65, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMultiFileProperties + 76                                          7CAD6122 84 Bytes  [ 61, 00, 63, 00, 6B, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMultiFileProperties + CB                                          7CAD6177 70 Bytes  [ 00, 43, 00, 20, 00, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHMultiFileProperties + 112                                         7CAD61BE 75 Bytes  [ 69, 00, 6E, 00, 76, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 3                           7CAD6852 31 Bytes  [ 66, 00, 6F, 00, 75, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 23                          7CAD6872 11 Bytes  [ 62, 00, 6A, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 2F                          7CAD687E 25 Bytes  [ 72, 00, 65, 00, 73, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 49                          7CAD6898 63 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHLoadNonloadedIconOverlayIdentifiers + 89                          7CAD68D8 1 Byte  [ 6D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExeDlgProc + 5                                                  7CADD374 10 Bytes  [ 00, 00, 01, 00, 09, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExeDlgProc + 10                                                 7CADD37F 32 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExeDlgProc + 31                                                 7CADD3A0 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExeDlgProc + 37                                                 7CADD3A6 1 Byte  [ 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!FindExeDlgProc + 39                                                 7CADD3A8 6 Bytes  [ 09, 04, 00, 00, 98, 0E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLL + 1E                                                 7CB5C41B 7 Bytes  [ 8B, 4D, 10, 29, 4D, FC, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLL + 26                                                 7CB5C423 155 Bytes  [ 59, 89, 4D, 10, 0F, 85, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLLW + 96                                                7CB5C4BF 8 Bytes  [ 00, 00, 84, C0, 0F, 84, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLLW + A0                                                7CB5C4C9 2 Bytes  [ 85, DB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLLW + A3                                                7CB5C4CC 4 Bytes  [ 8C, 62, 83, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLLW + A8                                                7CB5C4D1 169 Bytes  [ 8B, 46, 04, 8B, 4D, 0C, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!Options_RunDLLW + 152                                               7CB5C57B 15 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateLocalServerRunDll + 19                                      7CB5E3B3 48 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateLocalServerRunDll + 4A                                      7CB5E3E4 140 Bytes  [ FF, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateLocalServerRunDll + D7                                      7CB5E471 25 Bytes  [ 68, 14, E2, 97, 7C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateLocalServerRunDll + F1                                      7CB5E48B 9 Bytes  [ 3D, 08, 00, 15, C0, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!SHCreateLocalServerRunDll + FC                                      7CB5E496 105 Bytes  [ C7, 45, DC, 35, 01, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!ShellMessageBoxW + 1                                                7CB9C759 43 Bytes  [ FF, FF, FF, 03, 43, 97, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrChrW + 1                                                         7CB9C785 159 Bytes  CALL 7CBA0027 C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + 15                                                        7CB9C828 1 Byte  [ FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + 17                                                        7CB9C82A 70 Bytes  [ FF, FF, 00, 00, 00, 00, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + 5E                                                        7CB9C871 104 Bytes  [ 8B, 70, 30, 89, 75, DC, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + C7                                                        7CB9C8DA 16 Bytes  CALL 7CB9C8EC C:\WINDOWS\system32\SHELL32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHELL32.dll!StrStrW + D9                                                        7CB9C8EC 14 Bytes  [ FF, 35, 38, 17, 98, 7C, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + FFF99D35                                    77F61820 4 Bytes  JMP 77F61A51 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + FFF99D3A                                    77F61825 8 Bytes  [ C7, 85, B4, FD, FF, FF, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + FFF99D44                                    77F6182F 34 Bytes  [ 80, C3, 20, 83, 8D, F0, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + FFF9AAD1                                    77F625BC 6 Bytes  [ C7, 45, B8, 01, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + FFF9AAD8                                    77F625C3 31 Bytes  [ 33, C0, 8D, 7D, BC, AB, AB, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathBuildRootW + 39                                                 77F64077 42 Bytes  [ D1, 33, C0, F0, 0F, B1, 13, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathBuildRootW + 64                                                 77F640A2 2 Bytes  [ E0, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathBuildRootW + 67                                                 77F640A5 48 Bytes  [ D8, 8B, C7, F0, 0F, B1, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathBuildRootW + 9A                                                 77F640D8 13 Bytes  JMP 87B77BDF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathBuildRootW + A8                                                 77F640E6 37 Bytes  CALL 77F3C34A C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetValueW + 4A                                                 77F64369 63 Bytes  [ C2, 04, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetValueW + 8A                                                 77F643A9 49 Bytes  [ 89, 7D, E0, 39, 3D, 68, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetValueW + BD                                                 77F643DC 31 Bytes  [ 89, 7D, FC, 8B, 46, 0C, A9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetValueW + DD                                                 77F643FC 61 Bytes  CALL 77F2D41F C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetValueW + 11C                                                77F6443B 1 Byte  [ FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueW + 11                                                    77F64598 601 Bytes  [ FF, C7, 00, 05, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueW + 26B                                                   77F647F2 21 Bytes  [ 8B, 45, 08, 85, C0, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueW + 283                                                   77F6480A 8 Bytes  [ F6, 45, F4, CC, 0F, 85, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueW + 28D                                                   77F64814 301 Bytes  [ 33, C0, 40, 8B, C8, BA, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueW + 3BE                                                   77F64945 135 Bytes  [ 8B, 45, EC, 8B, 08, 8B, 09, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderW + 37                                          77F64AE6 44 Bytes  CALL ABF64AE9 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderW + 64                                          77F64B13 35 Bytes  CALL 77F40CC6 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderW + 88                                          77F64B37 16 Bytes  [ F3, 0F, 8C, 5A, 6D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderW + 99                                          77F64B48 17 Bytes  CALL 77F420D7 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderW + AB                                          77F64B5A 13 Bytes  [ 00, 39, 1D, 70, 0B, 98, 7C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrW + 1                                                         77F6667E 30 Bytes  [ 6C, 24, 2C, D1, C8, 33, F1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrW + 20                                                        77F6669D 112 Bytes  [ 24, 30, D1, CF, 33, EB, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrW + 91                                                        77F6670E 36 Bytes  JMP 6F824F36 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrDupW + 1                                                         77F66733 41 Bytes  [ EA, C1, C5, 05, 23, F7, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrDupW + 2B                                                        77F6675D 66 Bytes  [ 24, 48, D1, CA, 33, E8, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeW + E                                                 77F667A0 16 Bytes  [ 74, 24, 50, 8D, BC, 3D, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeW + 1F                                                77F667B1 23 Bytes  JMP 3EB85F41 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeW + 37                                                77F667C9 48 Bytes  CALL 672A3DD1 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCpyW + 10                                                        77F667FA 228 Bytes  [ 74, 24, 5C, 8D, 9C, 1D, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCW + 6                                                        77F668DF 11 Bytes  [ F7, C1, C6, 05, D1, C8, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCW + 12                                                       77F668EB 19 Bytes  [ 24, 7C, 8D, 94, 15, A1, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCW + 26                                                       77F668FF 113 Bytes  [ C6, 05, D1, CF, 03, CE, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCW + 98                                                       77F66971 29 Bytes  [ 8D, BC, 3D, A1, EB, D9, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCW + B6                                                       77F6698F 84 Bytes  [ 00, 00, 00, 8D, 94, 15, A1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpIW + 60                                                       77F66AAE 5 Bytes  [ B4, 24, B0, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpIW + 66                                                       77F66AB4 21 Bytes  [ 03, C6, 8B, F1, 23, F2, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpIW + 7C                                                       77F66ACA 10 Bytes  [ F0, C1, C6, 05, 0B, E9, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpIW + 87                                                       77F66AD5 128 Bytes  [ B4, 24, B4, 00, 00, 00, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffW + 46                                                    77F66B56 34 Bytes  [ F2, 23, F7, 81, C3, DC, BC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffW + 69                                                    77F66B79 61 Bytes  [ 00, 00, 03, C6, 8B, F1, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetDriveNumberW + 1D                                            77F66BB7 96 Bytes  CALL 3EB86347 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetDriveNumberW + 7F                                            77F66C19 38 Bytes  [ 00, 03, DE, 8B, F2, 23, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupW + 1F                                                      77F66C42 2 Bytes  [ 03, C6 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupW + 22                                                      77F66C45 25 Bytes  [ F1, 23, F2, 05, DC, BC, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupW + 3C                                                      77F66C5F 9 Bytes  [ FE, 23, EA, 8B, B4, 24, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupW + 46                                                      77F66C69 42 Bytes  [ 03, FE, 8B, F3, 23, F1, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupW + 71                                                      77F66C94 74 Bytes  [ F0, 23, F3, 81, C2, DC, BC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufW + 1D                                                   77F66D0C 103 Bytes  [ F1, 23, F2, 05, DC, BC, 1B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufW + 85                                                   77F66D74 9 Bytes  [ 00, 00, 8D, 8C, 0D, D6, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufW + 8F                                                   77F66D7E 150 Bytes  [ EF, 03, CE, 33, EA, 33, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrW + 49                                                        77F66E15 145 Bytes  [ B4, 24, 0C, 01, 00, 00, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashW + 5A                                              77F66EA7 56 Bytes  CALL 672A44AF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashW + 93                                              77F66EE0 32 Bytes  [ 00, 8D, 9C, 1D, D6, C1, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryValueExW + 13                                                77F66F01 150 Bytes  [ 00, 8D, 84, 05, D6, C1, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpICW + 30                                                      77F66F98 24 Bytes  [ C6, 05, D1, C9, 03, C6, D1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpICA + 1                                                       77F66FB1 24 Bytes  [ B4, 24, 54, 01, 00, 00, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpICA + 1A                                                      77F66FCA 73 Bytes  [ CD, 8B, 6E, 0C, 03, D5, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpICA + 64                                                      77F67014 23 Bytes  [ 72, 00, 65, 00, 5C, 00, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpICA + 7C                                                      77F6702C 97 Bytes  [ 5C, 00, 57, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameW + 57                                              77F6708E 119 Bytes  [ 73, 00, 00, 00, 00, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpW + 20                                                        77F67106 79 Bytes  [ C0, 30, EB, 03, 83, C0, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpW + 70                                                        77F67156 13 Bytes  [ 53, FB, FF, 85, C0, 74, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpW + 7E                                                        77F67164 282 Bytes  [ 00, 00, 00, EB, 43, A1, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpW + 199                                                       77F6727F 148 Bytes  [ DC, EB, 16, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpW + 22E                                                       77F67314 2 Bytes  [ 46, 06 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveBackslashW + A                                            77F67489 27 Bytes  [ 88, FE, FF, FF, 33, C0, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveBackslashW + 26                                           77F674A5 4 Bytes  [ 89, 85, 94, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveBackslashW + 2C                                           77F674AB 29 Bytes  [ 8D, 45, A4, 50, FF, 75, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveBackslashW + 4A                                           77F674C9 221 Bytes  CALL 77F66DE7 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCommonPrefixW + BD                                              77F675A7 90 Bytes  [ 85, A4, FE, FF, FF, 50, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerW + 35                                               77F67602 57 Bytes  [ A0, FE, FF, FF, 50, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerW + 6F                                               77F6763C 64 Bytes  [ B5, A0, FE, FF, FF, 6A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerW + B0                                               77F6767D 6 Bytes  [ 8D, 85, 80, FE, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerW + B7                                               77F67684 15 Bytes  [ FF, B5, 9C, FE, FF, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerW + C8                                               77F67695 37 Bytes  [ 74, 0B, FF, B5, 9C, FE, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeW + 2                                               77F67843 68 Bytes  [ FF, 84, C0, 74, E0, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeW + 47                                              77F67888 11 Bytes  [ 15, 8D, 4D, F8, 51, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeW + 53                                              77F67894 80 Bytes  [ F6, D8, 1B, C0, 40, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeW + A4                                              77F678E5 2 Bytes  [ 80, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeW + A8                                              77F678E9 34 Bytes  [ 5E, C9, C2, 10, 00, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineW + 93                                                   77F67A1C 3 Bytes  [ 86, 82, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineW + 98                                                   77F67A21 7 Bytes  [ 83, EE, 10, 83, C0, 10, 83 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineW + A0                                                   77F67A29 5 Bytes  [ 20, E9, 1F, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineW + A6                                                   77F67A2F 26 Bytes  [ 85, FF, 8B, 4D, 0C, 8B, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineW + C1                                                   77F67A4A 8 Bytes  [ 4D, 1C, D1, E0, 89, 7D, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAppendW + 7                                                     77F67A94 175 Bytes  [ 0C, 41, 41, 8B, 45, 14, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAppendW + B7                                                    77F67B44 42 Bytes  [ 77, 07, FF, 24, BD, 44, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAppendW + E2                                                    77F67B6F 170 Bytes  [ 0F, B7, 58, 04, 8A, 1C, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecW + 4                                             77F67C1A 102 Bytes  [ 14, 46, 83, 45, 18, 02, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecW + 6B                                            77F67C81 127 Bytes  [ B7, 95, 7C, 81, B7, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecW + EB                                            77F67D01 148 Bytes  [ B6, 14, 02, 8B, 7E, 1C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsNetworkPathW + 13                                             77F67D96 110 Bytes  [ 00, 00, EB, EC, 0F, B7, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrIW + 5                                                        77F67E05 43 Bytes  [ 0F, B7, 7D, 1C, 8B, 15, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrIW + 31                                                       77F67E31 274 Bytes  [ 14, 5A, 66, 01, 55, 1C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerW + 21                                               77F67F44 73 Bytes  [ EB, EC, 0F, B7, 7D, 1C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerShareW + 45                                          77F67F8E 139 Bytes  [ 7E, 1C, 0F, B7, 14, 57, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfA + 58                                                    77F6801A 45 Bytes  [ FF, 75, 18, 8D, 45, F8, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfA + 86                                                    77F68048 192 Bytes  [ C8, 83, E1, 03, F3, A4, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfA + 148                                                   77F6810A 36 Bytes  CALL C9F68106 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfA + 16D                                                   77F6812F 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfA + 170                                                   77F68132 4 Bytes  [ 87, 27, 01, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfA + 1                                                      77F6823D 21 Bytes  JMP 6BEA0D44 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfA + 17                                                     77F68253 268 Bytes  CALL 77EF940D C:\WINDOWS\system32\RPCRT4.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfA + 124                                                    77F68360 5 Bytes  [ 65, 00, 6E, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfA + 12A                                                    77F68366 184 Bytes  [ 56, 00, 65, 00, 72, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripToRootW + 6A                                               77F6841F 5 Bytes  [ 90, 90, 90, 90, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripToRootW + 70                                               77F68425 26 Bytes  [ FF, 55, 8B, EC, 81, EC, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripToRootW + 8B                                               77F68440 14 Bytes  [ 97, 7C, 89, 45, FC, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripToRootW + 9A                                               77F6844F 144 Bytes  [ 91, 40, F9, FF, 8B, D8, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpLogicalW + 8B                                                 77F684E0 31 Bytes  [ FF, 6A, 00, FF, 35, 9C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpLogicalW + AB                                                 77F68500 12 Bytes  [ 85, FC, F7, FF, FF, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpLogicalW + B9                                                 77F6850E 39 Bytes  CALL 77F67FE4 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpLogicalW + E1                                                 77F68536 112 Bytes  [ 56, 68, 80, C2, 97, 7C, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpLogicalW + 152                                                77F685A7 77 Bytes  [ 0F, 8C, B4, 00, 00, 00, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCloseUSKey + 35                                                77F68ACD 2 Bytes  [ 48, 14 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCloseUSKey + 38                                                77F68AD0 29 Bytes  [ 8D, E4, E7, FF, FF, 0F, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCloseUSKey + 56                                                77F68AEE 55 Bytes  [ B6, 09, 89, 48, 20, 8B, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyA + 1D                                                77F68B26 64 Bytes  [ F0, E7, FF, FF, 66, 89, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyA + 5F                                                77F68B68 1 Byte  [ 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyA + 61                                                77F68B6A 27 Bytes  [ D8, E7, FF, FF, 89, 85, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyA + 7D                                                77F68B86 16 Bytes  [ 10, 80, 8D, 85, D4, E7, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyA + 8E                                                77F68B97 5 Bytes  [ 04, C7, 85, B0, E7 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyW + 55                                                77F68C9F 5 Bytes  [ F3, A5, 8B, CA, D1 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegOpenUSKeyW + 5B                                                77F68CA5 87 Bytes  [ 83, E1, 03, F3, A4, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueW + 4B                                               77F68CFD 9 Bytes  [ 18, 00, 00, 00, 89, 9D, B4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueW + 55                                               77F68D07 5 Bytes  [ C7, 85, BC, E7, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueW + 5B                                               77F68D0D 15 Bytes  [ 40, 00, 00, 00, 89, 85, B8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueW + 6B                                               77F68D1D 38 Bytes  [ 89, 9D, C4, E7, FF, FF, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueW + 93                                               77F68D45 40 Bytes  [ 50, 68, 00, 00, 10, 80, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueW + 4                                              77F68E39 17 Bytes  [ B5, F4, E7, FF, FF, FF, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueW + 16                                             77F68E4B 152 Bytes  CALL FBF68E37 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueW + AF                                             77F68EE4 15 Bytes  [ 67, 00, 65, 00, 72, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueW + BF                                             77F68EF4 105 Bytes  [ 74, 00, 69, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueW + A                                            77F68F5E 29 Bytes  [ 63, 00, 73, 00, 69, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueW + 28                                           77F68F7C 9 Bytes  [ 69, 00, 20, 00, 42, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueW + 32                                           77F68F86 111 Bytes  [ 20, 00, 25, 00, 64, 00, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueW + A2                                           77F68FF6 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueW + A4                                           77F68FF8 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfW + 14                                                    77F691C5 180 Bytes  [ 25, 00, 00, 04, 00, F7, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfW + C9                                                    77F6927A 39 Bytes  [ 00, 00, 8B, 40, 30, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfW + F1                                                    77F692A2 69 Bytes  JMP 77F441E6 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfW + 137                                                   77F692E8 36 Bytes  [ 80, 00, 00, 8D, 45, F8, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wvnsprintfW + 15C                                                   77F6930D 19 Bytes  [ F6, 40, 05, 10, 74, 11, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfW + 26                                                     77F693CC 30 Bytes  [ 3B, C3, 0F, 84, 20, 32, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfW + 45                                                     77F693EB 4 Bytes  [ FF, FF, 20, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfW + 4A                                                     77F693F0 6 Bytes  [ 00, 8D, 85, 74, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfW + 51                                                     77F693F7 29 Bytes  [ 50, 8D, 45, 8C, 50, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!wnsprintfW + 70                                                     77F69416 11 Bytes  [ DA, 31, FD, FF, 8D, 41, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueW + 16                                                    77F69735 59 Bytes  [ BD, F0, FD, FF, FF, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueW + 52                                                    77F69771 29 Bytes  [ 89, 5D, B0, 89, 5D, BC, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueW + 72                                                    77F69791 82 Bytes  [ BC, 3B, CB, 0F, 84, DC, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueW + C5                                                    77F697E4 89 Bytes  [ 88, F4, 0B, 00, 00, 64, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueW + 11F                                                   77F6983E 6 Bytes  [ B8, 50, 8D, 45, B4, 50 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocCreate + F                                                     77F69E38 2 Bytes  [ B4, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocCreate + 12                                                    77F69E3B 40 Bytes  [ 8B, 4D, D4, 66, 8B, 0C, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocCreate + 3B                                                    77F69E64 29 Bytes  [ 4D, D0, 83, C1, FE, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocCreate + 59                                                    77F69E82 150 Bytes  [ 66, 83, FA, 2F, 74, 09, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocCreate + F0                                                    77F69F19 71 Bytes  JMP 77F3FA61 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyW + 24                                                 77F6A592 12 Bytes  [ C7, 45, E4, 33, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyW + 31                                                 77F6A59F 28 Bytes  [ 4D, 24, 85, C9, 74, 02, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyW + 4E                                                 77F6A5BC 19 Bytes  CALL 77F3AE98 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyW + 62                                                 77F6A5D0 6 Bytes  [ 4D, 18, 85, C9, 74, 12 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyW + 69                                                 77F6A5D7 225 Bytes  [ 45, E0, 85, C0, 74, 07, 2B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnquoteSpacesW + 51                                             77F6AFD0 105 Bytes  [ 53, 68, F2, EC, 93, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrW + 1C                                                       77F6B03A 11 Bytes  [ 8B, 7D, AC, 8B, 45, E4, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrW + 29                                                       77F6B047 123 Bytes  [ 51, 8B, 75, B4, 8B, 06, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathParseIconLocationW + 66                                         77F6B0C3 28 Bytes  [ 75, C8, 56, FF, 75, D0, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyW                                              77F6B0E0 41 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyW + 2A                                         77F6B10A 188 Bytes  [ 30, 8B, 40, 18, 8B, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyW + E7                                         77F6B1C7 22 Bytes  [ 00, F6, C4, 28, 8B, 7D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyW + FE                                         77F6B1DE 107 Bytes  [ 66, 39, 7D, 0C, 74, 0B, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyW + 16A                                        77F6B24A 35 Bytes  CALL 77F6AA41 C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHFreeShared + 9                                                    77F6B522 9 Bytes  [ 00, 10, 00, 74, 05, E8, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHFreeShared + 13                                                   77F6B52C 49 Bytes  [ 5D, C2, 04, 00, 48, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHFreeShared + 45                                                   77F6B55E 218 Bytes  CALL 77F1ACE7 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAllocShared + 88                                                  77F6B639 32 Bytes  [ 75, E0, 8B, 1B, 89, 5D, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAllocShared + A9                                                  77F6B65A 8 Bytes  [ 00, 89, 45, CC, 33, C0, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAllocShared + B7                                                  77F6B668 2 Bytes  [ 65, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAllocShared + BA                                                  77F6B66B 74 Bytes  [ 45, CC, 89, 45, D4, 83, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAllocShared + 105                                                 77F6B6B6 41 Bytes  [ 00, 00, 34, F2, 95, 7C, 47, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileW + 32                                          77F6B88B 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileW + 39                                          77F6B892 16 Bytes  [ 55, 8B, EC, 8B, 45, 08, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileW + 4A                                          77F6B8A3 9 Bytes  CALL 77F347E9 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileW + 54                                          77F6B8AD 11 Bytes  [ 02, 5D, C2, 04, 00, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileW + 60                                          77F6B8B9 82 Bytes  [ 55, 8B, EC, 53, 33, DB, 38, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLW + 17                                                     77F6BB68 39 Bytes  [ FF, 75, 08, 88, 45, 10, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLW + 3F                                                     77F6BB90 114 Bytes  [ EB, 16, 8A, 06, 8A, 0F, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLW + B2                                                     77F6BC03 15 Bytes  [ C0, 56, 57, 74, 40, 8D, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLW + C2                                                     77F6BC13 24 Bytes  [ 75, 08, 2B, C2, 8B, F8, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLW + DB                                                     77F6BC2C 52 Bytes  [ B8, 23, 00, 00, C0, EB, 17, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsW + 2A                                                         77F6BC96 19 Bytes  [ 83, C4, 0C, 66, 01, 3E, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsW + 3E                                                         77F6BCAA 2 Bytes  [ FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsW + 41                                                         77F6BCAD 31 Bytes  [ EC, 83, EC, 28, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsW + 61                                                         77F6BCCD 47 Bytes  [ 40, 04, 8A, 97, B0, 97, 91, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsW + 91                                                         77F6BCFD 31 Bytes  [ EB, 09, 8B, 45, 10, 8B, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLoadIndirectString + 24                                           77F6BE92 78 Bytes  [ 83, C8, FF, 5F, 5E, 5B, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLoadIndirectString + 73                                           77F6BEE1 1 Byte  [ D9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLoadIndirectString + 75                                           77F6BEE3 1 Byte  [ 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLoadIndirectString + 77                                           77F6BEE5 3 Bytes  [ 8B, 4D, F4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLoadIndirectString + 7B                                           77F6BEE9 40 Bytes  [ 0C, CB, 3B, CE, 72, 10, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameA + 34                                              77F6C190 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameA + 50                                              77F6C1AC 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameA + 74                                              77F6C1D0 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameA + 7B                                              77F6C1D7 172 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindFileNameA + 128                                             77F6C284 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartW + B                                                     77F6CC60 62 Bytes  [ 80, 00, 00, 00, C8, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartW + 4A                                                    77F6CC9F 135 Bytes  [ 00, E4, 17, 00, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartW + D3                                                    77F6CD28 79 Bytes  [ 1A, 00, 00, 80, 29, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartW + 123                                                   77F6CD78 77 Bytes  [ B8, 73, 01, 00, 7A, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartW + 171                                                   77F6CDC6 16 Bytes  [ 00, C0, 93, 02, 00, C0, 2C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueA + 37                                                    77F700BA 92 Bytes  [ FF, 8B, 45, 10, 85, C0, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueA + 94                                                    77F70117 17 Bytes  [ 55, 8B, EC, 51, 51, 53, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueA + A6                                                    77F70129 11 Bytes  [ 56, 57, 89, 5D, FC, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetValueA + B2                                                    77F70135 228 Bytes  [ 4D, 0C, 3B, D9, 73, 02, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryValueExA + 6F                                                77F7021A 184 Bytes  [ 00, 89, 4D, 18, 0F, B7, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrA + 13                                                       77F702D3 55 Bytes  [ B7, 4F, FA, 0F, B6, 0C, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrA + 4B                                                       77F7030B 7 Bytes  [ 88, 4A, FD, 0F, B7, 4F, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrA + 53                                                       77F70313 36 Bytes  [ B6, 0C, 01, 8B, 15, C0, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrA + 78                                                       77F70338 87 Bytes  [ 00, 00, 89, 4D, 18, 0F, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrA + D0                                                       77F70390 54 Bytes  [ 6A, 01, 56, BF, 44, 6A, 92, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatW + 34                                                        77F7047A 42 Bytes  [ 02, 00, 4C, 69, 92, 7C, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatW + 5F                                                        77F704A5 31 Bytes  [ FF, 81, C1, E0, FF, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatW + 7F                                                        77F704C5 18 Bytes  [ 0F, B6, 0C, 01, 8B, 15, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatW + 92                                                        77F704D8 9 Bytes  [ 4D, 18, 72, 11, 66, 83, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatW + 9C                                                        77F704E2 8 Bytes  [ 87, FB, F8, FF, FF, 81, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashA + 21                                              77F7052E 15 Bytes  [ 66, 83, 7D, 18, 7A, 0F, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashA + 32                                              77F7053F 57 Bytes  [ 89, 4D, 18, 0F, B7, 4D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashA + 6D                                              77F7057A 30 Bytes  [ 81, C1, E0, FF, 00, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashA + 8C                                              77F70599 5 Bytes  [ 55, 8B, EC, 51, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddBackslashA + 92                                              77F7059F 32 Bytes  [ FF, 75, 08, 8D, 45, F8, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyW + 19                                           77F70626 23 Bytes  [ D0, FD, FF, 56, 8D, 45, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyW + 31                                           77F7063E 14 Bytes  [ 68, 32, 43, 92, 7C, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyW + 40                                           77F7064D 99 Bytes  [ 8D, 45, F4, 50, 56, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyW + A4                                           77F706B1 139 Bytes  [ 90, CF, FD, FF, 56, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryInfoKeyW + 81                                                77F7073D 35 Bytes  [ 00, 53, 45, 5F, 49, 6E, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryInfoKeyW + A5                                                77F70761 7 Bytes  [ 00, 53, 45, 5F, 44, 6C, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNIA + 3                                                       77F70769 27 Bytes  [ 6E, 6C, 6F, 61, 64, 65, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNIA + 1F                                                      77F70785 166 Bytes  [ 00, 53, 45, 5F, 50, 72, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNIA + C6                                                      77F7082C 57 Bytes  [ D1, 74, 2A, 83, F9, 2B, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNIA + 100                                                     77F70866 93 Bytes  [ 55, 8B, EC, 56, 57, 8B, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNIA + 15E                                                     77F708C4 41 Bytes  [ 55, 8B, EC, 51, 83, 3D, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocGetPerceivedType + A                                           77F7106D 12 Bytes  [ FA, 20, 0F, 82, 26, 02, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocGetPerceivedType + 17                                          77F7107A 111 Bytes  [ 14, 56, 66, 89, 50, 1E, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocGetPerceivedType + 88                                          77F710EB 104 Bytes  [ 68, F8, 50, 92, 7C, E8, F6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocGetPerceivedType + F1                                          77F71154 104 Bytes  [ 00, 20, 00, 0F, 85, 5D, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocGetPerceivedType + 15A                                         77F711BD 115 Bytes  CALL 77F59D4A 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateShellPalette + 25                                           77F71925 2 Bytes  JMP 77F71854 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateShellPalette + 28                                           77F71928 128 Bytes  [ FF, FF, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateShellPalette + A9                                           77F719A9 54 Bytes  [ 00, 00, 8D, 46, 50, 8B, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateShellPalette + E0                                           77F719E0 42 Bytes  [ 8B, 7E, 40, 83, 66, 40, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateShellPalette + 10B                                          77F71A0B 39 Bytes  [ 8B, 07, 85, C0, 75, 19, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2W + 2C                                              77F724A6 18 Bytes  [ 74, 20, 62, 75, 74, 20, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2W + 40                                              77F724BA 21 Bytes  [ 52, 74, 6C, 51, 75, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2W + 56                                              77F724D0 110 Bytes  [ 69, 76, 61, 74, 69, 6F, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2W + C5                                              77F7253F 31 Bytes  [ CC, CC, CC, CC, CC, 53, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2W + E6                                              77F72560 116 Bytes  JMP 77F4B3CD C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrW + 2                                                    77F725D5 86 Bytes  [ 7D, 3C, 3D, 1A, 00, 00, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrW + 59                                                   77F7262C 24 Bytes  [ C7, 06, 06, 01, 00, C0, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrW + 72                                                   77F72645 20 Bytes  [ 8D, 85, EC, FD, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetThreadRef + 6                                                  77F7265A 32 Bytes  CALL 77F8540C C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetThreadRef + 27                                                 77F7267B 6 Bytes  [ 6A, 35, E8, 53, 80, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetThreadRef + 2E                                                 77F72682 114 Bytes  [ 83, C4, 14, 85, F6, C6, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetThreadRef + A1                                                 77F726F5 2 Bytes  [ 61, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetThreadRef + A4                                                 77F726F8 110 Bytes  [ 73, 20, 3D, 20, 30, 78, 30, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMatchSpecW + F                                                  77F727F5 220 Bytes  [ FF, 8B, D0, 3B, D7, 75, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMatchSpecW + EC                                                 77F728D2 63 Bytes  [ 8B, 56, 04, EB, 02, 33, D2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMatchSpecW + 12C                                                77F72912 8 Bytes  [ C4, 2C, BE, 0D, 00, 00, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMatchSpecW + 135                                                77F7291B 60 Bytes  [ 89, FD, FF, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsFileSpecW + 3A                                                77F72958 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsFileSpecW + 3C                                                77F7295A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsFileSpecW + 3E                                                77F7295C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsFileSpecW + 40                                                77F7295E 271 Bytes  [ 53, 58, 53, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsFileSpecW + 150                                               77F72A6E 101 Bytes  [ CC, CC, CC, CC, CC, CC, 66, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimW + 43                                                       77F72EEA 62 Bytes  [ 70, 0A, 53, 58, 53, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimW + 82                                                       77F72F29 50 Bytes  [ CC, CC, CC, CC, CC, 68, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimW + B5                                                       77F72F5C 37 Bytes  JMP 77F614C7 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimW + DB                                                       77F72F82 11 Bytes  [ 15, B0, 04, 91, 7C, 8B, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimW + EA                                                       77F72F91 44 Bytes  [ 75, 0A, BB, 17, 00, 00, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIW + 14                                                      77F73831 8 Bytes  [ EC, 83, EC, 14, 56, E8, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIW + 1D                                                      77F7383A 22 Bytes  [ FF, BE, A0, E4, 97, 7C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIW + 34                                                      77F73851 53 Bytes  [ 0D, 94, E4, 97, 7C, 05, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIW + 6A                                                      77F73887 44 Bytes  [ EC, A1, 80, E4, 97, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIW + 97                                                      77F738B4 23 Bytes  [ 38, 8B, 0F, 8B, 11, 8B, 49, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocIsDangerous + 12                                               77F73C65 53 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocIsDangerous + 48                                               77F73C9B 3 Bytes  [ 85, BC, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocIsDangerous + 4D                                               77F73CA0 110 Bytes  [ 3B, F0, 73, 0C, 8A, 0E, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocIsDangerous + BC                                               77F73D0F 20 Bytes  [ 33, C9, EB, E2, 0F, B7, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocIsDangerous + D3                                               77F73D26 75 Bytes  [ D1, 83, E1, 07, B3, 01, C1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveArgsW + 9                                                 77F741D4 24 Bytes  [ 78, 81, 1E, 00, 00, 83, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveArgsW + 22                                                77F741ED 11 Bytes  [ 00, 00, 00, F8, 8A, 1E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveArgsW + 2E                                                77F741F9 22 Bytes  [ 8E, 1E, 00, D8, 8F, 1E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveArgsW + 45                                                77F74210 85 Bytes  [ 60, 96, 1E, 00, D0, 97, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveArgsW + 9C                                                77F74267 16 Bytes  [ 00, 58, B6, 1E, 00, F8, B7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsPrefixW + 54                                                  77F74320 15 Bytes  [ 58, FC, 1E, 00, D8, FD, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsPrefixW + 64                                                  77F74330 39 Bytes  [ 00, 00, 00, 00, D8, 02, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsPrefixW + 8C                                                  77F74358 81 Bytes  [ D0, 11, 1F, 00, A8, 13, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsPrefixW + DE                                                  77F743AA 17 Bytes  [ 00, 00, 98, 32, 1F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsPrefixW + F0                                                  77F743BC 3 Bytes  CALL FFF762F9 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrA + 26                                                        77F74ECC 19 Bytes  [ E0, 82, 23, 00, 80, 84, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrA + 3A                                                        77F74EE0 3 Bytes  [ C0, 8A, 23 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrA + 3E                                                        77F74EE4 79 Bytes  [ 60, 8C, 23, 00, 00, 8E, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrA + 8E                                                        77F74F34 31 Bytes  CALL F7F772E4 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueW + 17                                             77F74F54 43 Bytes  [ 00, 00, 00, 00, 00, B8, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueW + 44                                             77F74F81 14 Bytes  [ C7, 23, 00, C0, C8, 23, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueW + 53                                             77F74F90 111 Bytes  [ F8, CD, 23, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueW + C3                                             77F75000 111 Bytes  [ 38, AE, 9B, 04, B0, AF, 9B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSKeyW + 4F                                                77F75070 9 Bytes  [ 80, BB, 9C, 04, F8, BC, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSKeyW + 59                                                77F7507A 110 Bytes  [ 00, 00, F0, BE, 9C, 04, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHEnumKeyExW + 31                                                   77F750E9 96 Bytes  [ 00, 00, 00, 28, E2, 88, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHEnumKeyExW + 92                                                   77F7514A 23 Bytes  [ 9A, 04, 98, 92, 9A, 04, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueA + 15                                             77F75163 98 Bytes  [ 00, 40, 9B, 9A, 04, E0, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueA + 78                                             77F751C6 202 Bytes  [ 9A, 04, E0, C1, 9A, 04, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryUSValueA + 143                                            77F75291 67 Bytes  [ 00, 00, 00, F8, 11, 9B, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionW + 2A                                              77F752D5 15 Bytes  [ D6, 9C, 04, 80, D7, 9C, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionW + 3A                                              77F752E5 72 Bytes  CALL 07FBEFC6 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionW + 83                                              77F7532E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionW + 85                                              77F75330 46 Bytes  [ 58, F6, 9C, 04, F8, F7, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionW + B4                                              77F7535F 36 Bytes  [ 00, C8, 08, 9D, 04, 70, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceW + 3A                                                   77F7589F 3 Bytes  [ 00, 10, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceW + 3F                                                   77F758A4 19 Bytes  [ 11, 01, 00, 00, 12, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceW + 53                                                   77F758B8 5 Bytes  [ 16, 01, 00, 00, 17 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceW + 5B                                                   77F758C0 15 Bytes  [ 18, 01, 00, 00, 19, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceW + 6B                                                   77F758D0 27 Bytes  [ 1C, 01, 00, 00, 1D, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineA + 46                                                    77F76676 85 Bytes  CALL 77F0C7BC 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineA + 9C                                                    77F766CC 6 Bytes  [ 75, E4, EB, 56, 3A, C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineA + A3                                                    77F766D3 22 Bytes  [ 45, DC, 50, 53, 53, 53, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineA + BA                                                    77F766EA 80 Bytes  [ 3D, 03, 01, 00, 00, 75, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineA + 10C                                                   77F7673C 13 Bytes  [ 81, 72, 97, 7C, 8A, 72, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCanonicalizeA + 49                                               77F7682E 10 Bytes  [ E4, 89, 4E, 08, 8B, 4D, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCanonicalizeA + 54                                               77F76839 63 Bytes  [ 4D, EC, 89, 4E, 10, 0F, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueA + 1E                                                    77F76879 70 Bytes  [ 00, 00, 89, 46, 18, EB, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueA + 66                                                    77F768C1 1 Byte  [ E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueA + 68                                                    77F768C3 38 Bytes  [ 46, 1C, 5F, 5E, C9, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueA + 90                                                    77F768EB 20 Bytes  CALL 77F0CD4A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetValueA + A5                                                    77F76900 20 Bytes  [ C7, 06, 20, 00, 00, 00, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntA + 2                                                       77F769F7 74 Bytes  [ 2B, 8D, A4, FE, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntA + 4D                                                      77F76A42 15 Bytes  [ 8D, 41, 01, 89, 46, 18, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntA + 5D                                                      77F76A52 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntA + 5F                                                      77F76A54 215 Bytes  [ 8B, 40, 30, FF, 70, 08, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntA + 137                                                     77F76B2C 15 Bytes  [ 00, 89, 45, D0, 8B, 48, 30, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyW + B                                                    77F76F5F 48 Bytes  [ 00, 6A, 00, 6A, 01, FF, B6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyW + 3C                                                   77F76F90 55 Bytes  [ 8B, 0D, F0, 29, 98, 7C, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyW + 74                                                   77F76FC8 3 Bytes  [ D0, 6E, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyW + 78                                                   77F76FCC 12 Bytes  [ 59, 59, 83, C8, FF, EB, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyW + 85                                                   77F76FD9 28 Bytes  [ 83, 24, B8, 00, 83, C7, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetMenuPosFromID + 7D                                               77F772F6 34 Bytes  [ 00, 00, 66, 8B, 45, EC, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetMenuPosFromID + A0                                               77F77319 71 Bytes  [ 66, 8B, 45, F2, 66, 89, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnW + 3E                                                       77F77361 49 Bytes  [ 00, 00, 33, C0, 8D, 7D, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThread + 2D                                                 77F77393 107 Bytes  [ F5, 74, 0D, 83, FE, F6, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThread + 99                                                 77F773FF 141 Bytes  [ C2, 0C, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThread + 127                                                77F7748D 16 Bytes  CALL 77F0D0BE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThread + 138                                                77F7749E 20 Bytes  [ 8B, FF, 55, 8B, EC, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThread + 14D                                                77F774B3 18 Bytes  [ 74, 14, 8B, 46, 10, 85, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyW + 26                                              77F7766D 61 Bytes  [ 35, 9C, FF, 97, 7C, E8, D6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyW + 64                                              77F776AB 6 Bytes  [ 83, 4D, FC, FF, 50, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyA + 3                                               77F776B2 70 Bytes  [ FE, FF, FF, 8B, 4D, E4, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyA + 4A                                              77F776F9 6 Bytes  [ 8B, 45, 0C, 89, 85, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyA + 51                                              77F77700 10 Bytes  [ FF, FF, 8B, 45, 10, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyA + 5C                                              77F7770B 16 Bytes  [ 8B, 45, 18, 89, 85, 70, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegCreateUSKeyA + 6D                                              77F7771C 25 Bytes  [ 20, 89, 85, 74, FF, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetThreadRef + F                                                  77F77C55 17 Bytes  [ FF, 89, 45, 94, 83, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSetThreadRef + 21                                                 77F77C67 26 Bytes  [ 00, C6, 45, A3, 01, 6A, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThreadRef + 2                                               77F77C82 14 Bytes  [ FF, 89, 45, AC, 8B, 85, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThreadRef + 11                                              77F77C91 23 Bytes  [ D4, 8D, 7D, BC, A5, A5, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThreadRef + 29                                              77F77CA9 65 Bytes  CALL 77F73FE8 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThreadRef + 6B                                              77F77CEB 12 Bytes  [ B5, 54, FF, FF, FF, 6A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateThreadRef + 78                                              77F77CF8 19 Bytes  [ 89, 45, 94, 83, 4D, FC, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyA + E                                                    77F784DF 5 Bytes  [ 03, E0, 0B, 84, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyA + 14                                                   77F784E5 155 Bytes  [ 0D, 84, 03, 50, 0F, 84, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyA + B0                                                   77F78581 41 Bytes  CALL CFFB0B61 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyA + DA                                                   77F785AB 15 Bytes  [ 03, 20, EB, 85, 03, 70, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteKeyA + EA                                                   77F785BB 27 Bytes  [ 03, 08, F0, 85, 03, 68, F1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathW + 16                                                77F786B5 60 Bytes  [ 00, 00, 00, 90, 47, 86, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathW + 55                                                77F786F4 252 Bytes  [ 68, 35, 88, 03, 00, 37, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathW + 152                                               77F787F1 91 Bytes  [ 92, 88, 03, 98, 93, 88, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathW + 1AE                                               77F7884D 13 Bytes  [ B3, 88, 03, 30, B5, 88, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathW + 1BD                                               77F7885C 107 Bytes  [ F0, 84, 89, 03, 70, 86, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueW + 11                                               77F78A5C 186 Bytes  [ 70, BE, 87, 03, 18, C0, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorRGBToHLS + 80                                                  77F78B17 19 Bytes  [ 00, D8, C5, 89, 03, 80, C7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorRGBToHLS + 94                                                  77F78B2B 11 Bytes  [ 03, 00, 00, 00, 00, 90, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorRGBToHLS + A0                                                  77F78B37 37 Bytes  [ 03, A0, D1, 89, 03, 38, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorHLSToRGB + 1C                                                  77F78B5E 25 Bytes  [ 00, 00, D0, DF, 89, 03, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorHLSToRGB + 36                                                  77F78B78 20 Bytes  CALL 62678F06 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorHLSToRGB + 4B                                                  77F78B8D 44 Bytes  [ 00, 00, 00, 70, F1, 89, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorHLSToRGB + 78                                                  77F78BBA 271 Bytes  [ 89, 03, 00, 00, 00, 00, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorHLSToRGB + 189                                                 77F78CCB 54 Bytes  [ 00, 18, 40, 87, 03, B0, 41, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCA + 40                                                     77F78F35 23 Bytes  [ 00, 00, 00, 10, 65, 9B, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCA + 58                                                     77F78F4D 181 Bytes  [ 00, 00, 00, 50, 6D, 9B, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeA + 59                                              77F79004 53 Bytes  JMP 77F96EC9 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeA + 8F                                              77F7903A 57 Bytes  [ 85, D8, 5E, 00, 00, F6, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCanonicalizeA + C9                                              77F79074 80 Bytes  CALL 77F754DE C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAppendA + 9                                                     77F790C5 22 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAppendA + 20                                                    77F790DC 37 Bytes  [ FE, FF, 5D, C2, 04, 00, 39, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineA + 2                                                    77F79102 22 Bytes  CALL 77F5940B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineA + 19                                                   77F79119 13 Bytes  CALL 77F5940D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineA + 27                                                   77F79127 50 Bytes  JMP 77F7E1E3 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineA + 5A                                                   77F7915A 42 Bytes  [ 2B, C7, D1, F8, D1, E0, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCombineA + 85                                                   77F79185 15 Bytes  [ FF, 66, 83, 3D, CE, E0, 97, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeA + 3B                                                77F7925C 74 Bytes  JMP 77F73A9F C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeA + 86                                                77F792A7 13 Bytes  JMP 77F751A3 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeA + 94                                                77F792B5 25 Bytes  [ 0F, 8C, D9, 1D, 02, 00, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeA + AE                                                77F792CF 18 Bytes  [ 08, 8D, 86, 70, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRelativeA + C1                                                77F792E2 31 Bytes  [ 05, C8, 00, 00, 00, 83, D2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileEx + 40                                         77F7A1A6 28 Bytes  [ 1B, 15, 01, 00, 89, 45, D0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileEx + 5D                                         77F7A1C3 14 Bytes  [ 00, 00, 25, 00, F0, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileEx + 6C                                         77F7A1D2 10 Bytes  [ 80, 7E, 07, FF, 75, 2C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileEx + 77                                         77F7A1DD 36 Bytes  CALL AB0E2CE5 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileEx + 9C                                         77F7A202 5 Bytes  [ EB, 03, 89, 4D, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringW + C2                                              77F7A810 16 Bytes  CALL 7DD7EDDC 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueA + F                                                77F7A821 178 Bytes  [ 90, 90, 90, 90, 90, 33, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueA + C2                                               77F7A8D4 126 Bytes  [ 02, 00, C0, 0F, 85, 8C, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetUSValueA + 141                                              77F7A953 92 Bytes  JMP 77F52C6B C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrA + 1E                                                        77F7A9B0 48 Bytes  [ D4, 66, 83, 20, 00, 40, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrA + 4F                                                        77F7A9E1 41 Bytes  [ 00, 89, 45, B0, 8B, 40, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrA + 79                                                        77F7AA0B 27 Bytes  CALL 77F397AA C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrA + 95                                                        77F7AA27 49 Bytes  [ C0, 0F, B7, 06, 8D, 4C, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrA + C8                                                        77F7AA5A 5 Bytes  [ 0F, 8C, F8, 81, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathW + 28                                                 77F7AAD5 6 Bytes  [ 40, 40, 89, 45, D4, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathW + 2F                                                 77F7AADC 18 Bytes  [ 74, 14, 8B, 4D, DC, 2B, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathW + 42                                                 77F7AAEF 50 Bytes  [ 83, C4, 0C, 8B, 45, 08, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathW + 75                                                 77F7AB22 66 Bytes  [ 40, 28, 68, 00, 80, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathW + B8                                                 77F7AB65 73 Bytes  [ 00, 89, 45, BC, 33, C0, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryW + 2C                                               77F7AE45 15 Bytes  [ C9, 89, 4A, 04, 74, 02, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryW + 3C                                               77F7AE55 13 Bytes  JMP 77F50AFB C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryW + 4A                                               77F7AE63 41 Bytes  [ 89, 30, 8B, 31, 8D, 7E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryW + 74                                               77F7AE8D 279 Bytes  JMP 77F50A6F C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryW + 18C                                              77F7AFA5 144 Bytes  [ C0, 74, 02, 89, 06, 8D, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2A + 11                                              77F7B055 220 Bytes  [ 1D, ED, 90, 7C, 13, ED, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2A + EE                                              77F7B132 112 Bytes  [ 7C, 0F, B6, 32, 66, 8B, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2A + 15F                                             77F7B1A3 17 Bytes  [ 34, 71, 66, 89, 70, 0A, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2A + 171                                             77F7B1B5 97 Bytes  [ 0F, B6, 72, 03, 66, 8B, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStream2A + 1D4                                             77F7B218 123 Bytes  [ 00, 00, E5, 03, EA, 00, 14, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetViewStatePropertyBag + 84                                      77F7B6B2 15 Bytes  [ 3B, 00, 17, 07, 6A, 04, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetViewStatePropertyBag + 94                                      77F7B6C2 1 Byte  [ 40 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetViewStatePropertyBag + 96                                      77F7B6C4 37 Bytes  [ 40, 00, 40, 00, 44, 00, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetViewStatePropertyBag + BC                                      77F7B6EA 3 Bytes  [ 2A, 02, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetViewStatePropertyBag + C0                                      77F7B6EE 107 Bytes  [ 2B, 02, 00, C0, D5, 04, 92, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntExW + 29                                                    77F7BAEC 20 Bytes  [ 7C, 0F, B7, 1C, CD, 34, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExW + 11                                                  77F7BB01 174 Bytes  JMP 77FBB662 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExW + C0                                                  77F7BBB0 15 Bytes  [ 01, 00, 00, 80, 06, 00, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExW + D0                                                  77F7BBC0 13 Bytes  [ 0D, 00, 00, 80, 0A, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExW + DE                                                  77F7BBCE 47 Bytes  [ 01, 00, 21, 00, 00, 80, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamA + 22                                               77F7BBFE 33 Bytes  [ 01, 00, 20, 03, 09, 80, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamA + 44                                               77F7BC20 33 Bytes  [ 10, 20, 09, 80, 01, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamA + 66                                               77F7BC42 35 Bytes  [ 00, C0, 0B, 00, 01, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamA + 8A                                               77F7BC66 59 Bytes  [ 01, 00, 37, 00, 00, C0, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamA + C6                                               77F7BCA2 33 Bytes  [ 00, C0, 12, 00, 01, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentW + 22                                         77F7BEBB 82 Bytes  [ C0, 01, 00, 01, 00, 21, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToW + 2D                                            77F7BF0E 7 Bytes  [ 01, 00, 22, 00, 0A, C0, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToW + 35                                            77F7BF16 7 Bytes  [ 01, 00, 24, 00, 0A, C0, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToW + 3D                                            77F7BF1E 3 Bytes  [ 01, 00, 26 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToW + 41                                            77F7BF22 3 Bytes  [ 0A, C0, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToW + 45                                            77F7BF26 55 Bytes  [ 01, 00, 2A, 00, 0A, C0, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeW + 25                                               77F7C1CB 7 Bytes  [ 68, 38, FE, 92, 7C, 8D, 85 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeW + 2D                                               77F7C1D3 104 Bytes  CALL 77F60C4E C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeW + 96                                               77F7C23C 12 Bytes  [ 00, 82, FF, B5, E4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLockShared + 2                                                    77F7C249 1 Byte  [ 5B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLockShared + 4                                                    77F7C24B 62 Bytes  CALL 77F5C293 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLockShared + 43                                                   77F7C28A 31 Bytes  [ 75, 18, 89, 46, 04, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHLockShared + 63                                                   77F7C2AA 97 Bytes  [ 00, 00, C0, 0F, 85, 1F, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueW + B                                                  77F7C30C 3 Bytes  [ 0F, 84, C0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueW + F                                                  77F7C310 47 Bytes  [ FF, FF, 83, 65, 0C, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueW + 3F                                                 77F7C340 16 Bytes  [ FF, 51, 0F, B6, 4D, FA, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueW + 50                                                 77F7C351 16 Bytes  [ 01, 00, 00, 51, 50, E8, EF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueW + 62                                                 77F7C363 155 Bytes  JMP 77F77C3F C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeW + 1E                                             77F7C489 67 Bytes  [ FF, F6, C1, 08, 0F, 84, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeW + 62                                             77F7C4CD 4 Bytes  [ 38, 85, DF, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeW + 67                                             77F7C4D2 5 Bytes  [ FF, 0F, 84, 66, B7 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeW + 6D                                             77F7C4D8 246 Bytes  JMP 77F7ACFF C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeW + 164                                            77F7C5CF 22 Bytes  CALL 77F80C26 C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathW + 44                                             77F7D3B6 77 Bytes  [ FF, 8B, 45, 9C, 8D, 3C, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathW + 92                                             77F7D404 22 Bytes  [ 83, B8, 70, 01, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathW + A9                                             77F7D41B 16 Bytes  [ 3B, F1, 0F, 85, B7, FA, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryW + 2                                                 77F7D42C 47 Bytes  [ 8B, 51, 04, 89, 95, 08, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueA + D                                            77F7D45C 34 Bytes  [ 7F, 07, 40, 0F, 83, FC, 5A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueA + 30                                           77F7D47F 56 Bytes  [ FF, 8B, 45, B8, 8D, 78, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueA + 69                                           77F7D4B8 12 Bytes  CALL 77F7D517 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueA + 76                                           77F7D4C5 4 Bytes  [ 85, 2A, 02, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetBoolUSValueA + 7B                                           77F7D4CA 23 Bytes  [ 8B, 87, 80, 05, 00, 00, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHEnumValueW + 26                                                   77F7D537 15 Bytes  [ 70, 04, 89, 06, 89, 42, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHEnumValueW + 36                                                   77F7D547 91 Bytes  [ 45, B0, 8A, 48, 05, F6, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHEnumValueW + 92                                                   77F7D5A3 109 Bytes  [ 4D, E4, 8D, B4, 08, 58, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAutoComplete + 12                                                 77F7D611 35 Bytes  [ A8, 3B, C6, 0F, 8C, E8, BF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAutoComplete + 36                                                 77F7D635 26 Bytes  [ 41, 10, 8B, 45, D4, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAutoComplete + 52                                                 77F7D651 42 Bytes  [ FF, 8B, 50, 04, 89, 95, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAutoComplete + 7D                                                 77F7D67C 33 Bytes  [ 8B, 45, E4, 8D, B0, 78, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHAutoComplete + 9F                                                 77F7D69E 112 Bytes  [ 00, 00, 8B, C8, 89, 8D, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlW + 1                                              77F7EF36 36 Bytes  [ 01, 6A, 00, 68, 46, 2B, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlW + 26                                             77F7EF5B 3 Bytes  [ CF, E6, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlW + 2A                                             77F7EF5F 75 Bytes  [ 33, C0, 40, 5D, C2, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlW + 76                                             77F7EFAB 149 Bytes  [ 6F, 63, 65, 73, 73, 28, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlW + 10C                                            77F7F041 68 Bytes  [ C0, 0F, 8C, 8A, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeW + 8                                                    77F7F4C4 60 Bytes  [ 90, 90, 90, 6A, 44, 68, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeW + 45                                                   77F7F501 36 Bytes  [ EB, 77, 8B, 45, B0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeW + 6A                                                   77F7F526 8 Bytes  [ 89, 45, D8, 3B, 45, 08, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeW + 73                                                   77F7F52F 379 Bytes  [ D0, 2B, 55, 08, 3B, D1, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCanonicalizeW + AB                                               77F7F6AC 47 Bytes  [ 41, 00, 44, 00, 56, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCanonicalizeW + DB                                               77F7F6DC 289 Bytes  [ 53, 61, 66, 65, 72, 43, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineW + F5                                                    77F7F7FE 3 Bytes  [ D7, 83, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineW + F9                                                    77F7F802 60 Bytes  [ 76, 10, 68, AA, 35, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineW + 136                                                   77F7F83F 32 Bytes  [ 89, 55, D8, 75, 03, 83, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineW + 157                                                   77F7F860 127 Bytes  [ 15, B0, 04, 91, 7C, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCombineW + 1D7                                                   77F7F8E0 54 Bytes  [ 00, 00, 89, 4D, F0, 76, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatKBSizeW + B                                                77F7FC4C 17 Bytes  [ FF, 71, 0C, 51, FF, 70, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatKBSizeW + 1D                                               77F7FC5E 208 Bytes  CALL 77F2D62C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatKBSizeW + EE                                               77F7FD2F 148 Bytes  [ 00, 74, 2B, 66, 85, 7B, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatKBSizeW + 183                                              77F7FDC4 95 Bytes  [ C0, 03, 23, C6, 89, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatKBSizeW + 1E4                                              77F7FE25 32 Bytes  [ 8B, 75, 10, 6A, 01, 56, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSkipJunction + 56                                                 77F801B6 18 Bytes  CALL 77F53E56 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSkipJunction + 69                                                 77F801C9 24 Bytes  CALL 77F53E57 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSkipJunction + 82                                                 77F801E2 3 Bytes  [ D8, F3, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSkipJunction + 86                                                 77F801E6 15 Bytes  [ 8D, 7C, 07, 30, 64, A1, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHSkipJunction + 96                                                 77F801F6 50 Bytes  CALL 77F3C4E2 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNA + 50                                                       77F80A75 36 Bytes  [ 83, EC, 1C, 53, 56, 8B, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNA + 76                                                       77F80A9B 10 Bytes  CALL 77F3940C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNA + 81                                                       77F80AA6 6 Bytes  [ 76, 1C, E8, C1, 98, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNA + 88                                                       77F80AAD 72 Bytes  [ 8B, D8, 3B, DF, 7C, 19, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpNA + D1                                                       77F80AF6 23 Bytes  [ 0C, 50, 6A, 00, C1, EE, 06, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyW + 53                                                77F80C9F 14 Bytes  [ 08, 8B, 51, 0C, 89, 50, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyW + 62                                                77F80CAE 36 Bytes  [ 91, 6A, 01, 00, 00, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyW + 87                                                77F80CD3 2 Bytes  [ 01, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyW + 8A                                                77F80CD6 19 Bytes  [ FF, 4D, 0C, 75, E6, 8B, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyW + 9E                                                77F80CEA 33 Bytes  [ 07, 33, C0, 5B, 5F, 5E, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindExtensionA + D                                              77F80F7B 56 Bytes  [ 8D, 46, 50, 89, 45, AC, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSearchAndQualifyW + 1                                           77F80FB4 9 Bytes  [ 4E, 14, 89, 08, 8B, 4E, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSearchAndQualifyW + B                                           77F80FBE 51 Bytes  [ 89, 58, 0C, FF, 47, 18, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSearchAndQualifyW + 40                                          77F80FF3 72 Bytes  JMP 77F80EEE C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkW + 23                                                       77F8103C 182 Bytes  [ 73, 24, 0F, 83, CE, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkW + DA                                                       77F810F3 22 Bytes  JMP 77F81036 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkW + F1                                                       77F8110A 9 Bytes  [ 12, C7, 45, E0, 17, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkW + FB                                                       77F81114 7 Bytes  [ D8, FE, 45, E7, E9, 29, FE ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkW + 103                                                      77F8111C 27 Bytes  [ FF, 66, C7, 40, 04, 00, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderA + 75                                            77F8145D 25 Bytes  [ 3B, C3, 0F, 8C, 37, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderA + 8F                                            77F81477 3 Bytes  [ 53, 53, 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderA + 93                                            77F8147B 2 Bytes  [ 01, 53 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderA + 96                                            77F8147E 22 Bytes  CALL 77F5AA38 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderA + AD                                            77F81495 42 Bytes  CALL 77F3A0CC C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatA + 5B                                                       77F815EA 29 Bytes  [ FF, 5D, C2, 0C, 00, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatA + 7A                                                       77F81609 46 Bytes  [ 5D, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatA + A9                                                       77F81638 5 Bytes  [ 75, 10, FF, 75, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatA + AF                                                       77F8163E 6 Bytes  [ 75, 08, E8, 63, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatA + B6                                                       77F81645 4 Bytes  [ 5D, C2, 0C, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeW + 1A                                                     77F81A0F 6 Bytes  [ FF, 55, 8B, EC, 6A, 24 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeW + 21                                                     77F81A16 9 Bytes  [ 75, 10, FF, 75, 0C, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeW + 2B                                                     77F81A20 22 Bytes  [ FB, FF, FF, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeW + 42                                                     77F81A37 8 Bytes  [ 75, 0C, FF, 75, 08, E8, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeW + 4B                                                     77F81A40 11 Bytes  [ FF, 5D, C2, 0C, 00, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationA + D8                                                77F81F55 47 Bytes  [ 8B, FF, 55, 8B, EC, 56, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationA + 108                                               77F81F85 16 Bytes  [ FE, F3, AB, 68, 46, 5C, 95, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationA + 119                                               77F81F96 57 Bytes  [ A1, 34, 1C, 98, 7C, 8B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationA + 153                                               77F81FD0 4 Bytes  [ 84, 83, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationA + 158                                               77F81FD5 58 Bytes  [ 66, 8B, 03, 66, 83, F8, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationW + 2C                                                77F82593 43 Bytes  CALL 77F3C755 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationW + 58                                                77F825BF 158 Bytes  [ 41, 0C, 3B, D0, 72, 09, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationW + F7                                                77F8265E 23 Bytes  [ 8B, C3, 8B, 1B, 89, 45, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationW + 10F                                               77F82676 88 Bytes  [ 74, 5B, 8B, FE, 8B, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetLocationW + 168                                               77F826CF 12 Bytes  [ 8B, F7, 75, A7, 8B, 45, EC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCA + C7                                                       77F82EE5 37 Bytes  [ 02, 00, 00, A1, C8, E0, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCmpCA + ED                                                       77F82F0B 112 Bytes  CALL 77F2D6B4 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlA + 47                                             77F82F7C 15 Bytes  [ 15, C0, 75, 02, 33, C0, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlA + 57                                             77F82F8C 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlA + 59                                             77F82F8E 4 Bytes  [ B5, F0, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlA + 5E                                             77F82F93 6 Bytes  [ 6A, 01, FF, B5, E4, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCreateFromUrlA + 65                                             77F82F9A 17 Bytes  CALL 77F41BE6 C:\WINDOWS\system32\GDI32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeW + 36                                             77F83097 6 Bytes  [ FF, 39, 18, 0F, 85, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeW + 3D                                             77F8309E 65 Bytes  [ FF, FF, B0, 01, 5F, 5E, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeW + 7F                                             77F830E0 4 Bytes  [ FF, 55, 8B, EC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeW + 84                                             77F830E5 6 Bytes  [ 75, 10, 8B, 45, 08, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeW + 8B                                             77F830EC 1 Byte  [ 0C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsOpaqueW + 13                                                   77F831E5 40 Bytes  [ 00, 8B, 40, 30, 53, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsOpaqueW + 3C                                                   77F8320E 37 Bytes  [ 02, 75, 45, 64, A1, 18, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsOpaqueW + 62                                                   77F83234 32 Bytes  [ 40, 74, 19, 8B, 4D, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffA + 9                                                     77F83255 23 Bytes  [ 00, A1, E0, 1B, 98, 7C, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffA + 21                                                    77F8326D 13 Bytes  [ 21, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffA + 2F                                                    77F8327B 76 Bytes  [ 75, 08, 8B, 40, 18, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffA + 7C                                                    77F832C8 83 Bytes  [ F6, D8, 1B, C0, F7, D0, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatBuffA + D0                                                    77F8331C 5 Bytes  [ 8B, FF, 55, 8B, EC ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerA                                                    77F835B9 444 Bytes  CALL 77007B49 C:\WINDOWS\system32\CLBCATQ.DLL
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerA + 1BE                                              77F83777 170 Bytes  [ 00, 41, 56, 52, 46, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!HashData + 20                                                       77F83822 39 Bytes  [ 8B, 36, 74, 55, 8B, F8, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!HashData + 48                                                       77F8384A 291 Bytes  [ 74, 1C, 64, A1, 18, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!HashData + 16C                                                      77F8396E 32 Bytes  [ C7, 06, 70, 6F, 95, 7C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareW + 2                                                     77F8398F 17 Bytes  [ 77, 30, 68, EC, 77, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareW + 14                                                    77F839A1 56 Bytes  [ 13, C7, 06, DF, 6C, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareW + 4D                                                    77F839DA 26 Bytes  [ 77, 30, 68, 58, 78, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareW + 68                                                    77F839F5 52 Bytes  [ 77, 30, 68, 78, 78, 95, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareW + 9D                                                    77F83A2A 77 Bytes  JMP 77F83B7A C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetInverseCMAP + 29                                               77F8425D 511 Bytes  [ FF, 35, 38, 1C, 98, 7C, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetInverseCMAP + 229                                              77F8445D 33 Bytes  [ 00, 72, 00, 46, 00, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetInverseCMAP + 24B                                              77F8447F 312 Bytes  [ 00, 62, 00, 75, 00, 67, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetInverseCMAP + 384                                              77F845B8 806 Bytes  [ 64, 3B, D1, 74, 21, 52, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHGetInverseCMAP + 6AB                                              77F848DF 59 Bytes  [ 64, 20, 73, 74, 72, 69, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ChrCmpIA + 1B                                                       77F8C410 35 Bytes  [ 69, 00, 63, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ChrCmpIA + 3F                                                       77F8C434 39 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrIA + 1F                                                       77F8C45C 7 Bytes  [ 20, 00, 69, 00, 64, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrIA + 27                                                       77F8C464 80 Bytes  [ 6E, 00, 74, 00, 69, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrIA + 27                                                       77F8C4B5 64 Bytes  [ 00, 6C, 00, 64, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrIA + 68                                                       77F8C4F6 7 Bytes  [ 64, 00, 69, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrIA + 70                                                       77F8C4FE 23 Bytes  [ 63, 00, 74, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrIA + 88                                                       77F8C516 23 Bytes  [ 65, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrIA + A0                                                       77F8C52E 15 Bytes  [ 20, 00, 6D, 00, 61, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesW + A                                             77F8CABC 37 Bytes  [ 65, 00, 63, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesW + 30                                            77F8CAE2 9 Bytes  [ 20, 00, 6E, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesW + 3A                                            77F8CAEC 19 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesW + 4E                                            77F8CB00 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesW + 50                                            77F8CB02 15 Bytes  [ 62, 00, 6C, 00, 65, 00, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatW + 13                                                       77F8CD28 33 Bytes  [ 72, 00, 65, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatW + 35                                                       77F8CD4A 33 Bytes  [ 20, 00, 76, 00, 6F, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatW + 57                                                       77F8CD6C 29 Bytes  [ 75, 00, 72, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatW + 75                                                       77F8CD8A 8 Bytes  [ 64, 00, 65, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrNCatW + 7F                                                       77F8CD94 11 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateW + 2A                                                77F8CEFF 2 Bytes  [ 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateW + 2D                                                77F8CF02 51 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateW + 61                                                77F8CF36 19 Bytes  [ 70, 00, 70, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateW + 75                                                77F8CF4A 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateW + 77                                                77F8CF4C 19 Bytes  [ 62, 00, 79, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorAdjustLuma + 2E                                                77FA1272 35 Bytes  [ 00, 8D, 43, 50, 50, 8D, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorAdjustLuma + 53                                                77FA1297 6 Bytes  [ 4B, 5A, 05, A8, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorAdjustLuma + 5A                                                77FA129E 18 Bytes  [ 03, C8, 3B, 4D, 08, 73, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorAdjustLuma + 6D                                                77FA12B1 103 Bytes  [ 75, 06, 66, 8B, 43, 5A, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!ColorAdjustLuma + D5                                                77FA1319 60 Bytes  [ 08, 89, 01, 73, 08, 83, C0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteValueA + 8                                                  77FA1579 98 Bytes  [ E4, 8B, 75, 08, 33, DB, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyA + 28                                                     77FA15DC 16 Bytes  [ 75, B8, FF, 55, AC, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyA + 39                                                     77FA15ED 69 Bytes  [ EB, 18, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyA + 7F                                                     77FA1633 112 Bytes  [ 55, 8B, EC, 83, EC, 2C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyA + F0                                                     77FA16A4 6 Bytes  [ 97, 7C, E8, A2, AC, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyA + F7                                                     77FA16AB 15 Bytes  JMP 77FA17B3 C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyW + 29                                                     77FA1843 76 Bytes  [ 89, 1A, 89, 5A, 28, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCopyKeyW + 76                                                     77FA1890 70 Bytes  [ 00, 00, 8D, 47, 01, 3B, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteEmptyKeyW + 32                                              77FA18D7 43 Bytes  [ 76, 4C, 50, FF, 35, 9C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHDeleteEmptyKeyW + 5E                                              77FA1903 87 Bytes  [ FF, 75, F4, 03, 45, F0, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryInfoKeyA + 1                                                 77FA195B 173 Bytes  [ 5D, FC, 89, 9E, A4, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHQueryInfoKeyA + AF                                                77FA1A09 125 Bytes  [ CE, 83, E1, 03, F3, AA, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteUSValueA + 30                                            77FA1A87 49 Bytes  [ AF, 55, FC, C1, E0, 14, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteUSValueA + 62                                            77FA1AB9 65 Bytes  [ 30, 89, 96, 8C, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteUSValueA + A4                                            77FA1AFB 33 Bytes  [ FF, 46, 74, EB, 1F, C7, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteUSValueW + 1D                                            77FA1B1D 27 Bytes  [ 00, 00, 33, C0, 89, 43, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteUSValueW + 39                                            77FA1B39 66 Bytes  [ 8B, 45, 0C, 5F, 5E, 5B, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteEmptyUSKeyA + 19                                         77FA1B7C 143 Bytes  [ FC, B8, 4C, 17, 98, 7C, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegDeleteEmptyUSKeyW + 2                                          77FA1C0C 127 Bytes  [ 35, 9C, FF, 97, 7C, 89, 1D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSKeyA + 1F                                                77FA1C8C 34 Bytes  [ 89, 08, 89, 50, 04, 89, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSKeyA + 42                                                77FA1CAF 51 Bytes  [ 73, 31, 8D, 46, 40, 39, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSKeyA + 76                                                77FA1CE3 51 Bytes  CALL 77F3940C C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueA + 20                                              77FA1D17 66 Bytes  [ 33, F6, 89, 45, D4, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueA + 64                                              77FA1D5B 31 Bytes  [ FC, 56, FF, 35, 9C, FF, 97, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueA + 85                                              77FA1D7C 81 Bytes  [ FC, 8D, 45, BC, 53, 6A, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueW + 37                                              77FA1DCE 73 Bytes  [ 8D, 0C, 07, 3B, 4D, 18, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueW + 81                                              77FA1E18 2 Bytes  JMP 77FA1D3E C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueW + 84                                              77FA1E1B 23 Bytes  [ FF, FF, C7, 45, 08, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegEnumUSValueW + 9E                                              77FA1E35 44 Bytes  [ 8B, FF, 53, 56, 8B, 35, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyA + 2B                                           77FA1E62 31 Bytes  [ 86, B0, 00, 00, 00, 57, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyA + 4C                                           77FA1E83 39 Bytes  [ 8B, 75, 08, 85, F6, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegQueryInfoUSKeyA + 74                                           77FA1EAB 66 Bytes  [ 0D, 83, 7F, 08, 00, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathW + 2E                                                  77FA1EEE 20 Bytes  [ 4F, 40, 8B, 51, 04, 89, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathW + 43                                                  77FA1F03 64 Bytes  [ 33, C0, 5B, 5F, 5E, C9, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathW + 84                                                  77FA1F44 42 Bytes  [ 01, 00, 00, 00, BB, 60, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathA + 21                                                  77FA1F6F 34 Bytes  [ FC, 00, 89, 46, 08, 8D, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathA + 44                                                  77FA1F92 3 Bytes  [ 83, 7D, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathA + 48                                                  77FA1F96 13 Bytes  [ 75, 0C, 6A, 00, 6A, 01, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathA + 56                                                  77FA1FA4 14 Bytes  [ 8B, 45, F8, 5F, 5E, 5B, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetPathA + 65                                                  77FA1FB3 32 Bytes  [ 55, 8B, EC, 81, EC, 8C, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueA + 4                                              77FA2031 25 Bytes  [ F8, F3, A5, 8B, CA, 83, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueA + 1E                                             77FA204B 89 Bytes  [ FF, 75, 98, 53, 68, 50, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueA + 78                                             77FA20A5 11 Bytes  [ 55, 8B, EC, 57, BF, 4C, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueA + 84                                             77FA20B1 90 Bytes  [ C7, 41, F0, 0F, C1, 08, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegWriteUSValueA + DF                                             77FA210C 9 Bytes  [ 34, A1, 54, 17, 98, 7C, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetPathW + B                                                   77FA22CC 54 Bytes  [ 83, 66, 08, 00, 8B, F8, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetPathW + 42                                                  77FA2303 147 Bytes  CALL 77FA1C35 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetPathW + D6                                                  77FA2397 14 Bytes  [ 8B, F8, 89, 7D, E0, 3B, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetPathW + E6                                                  77FA23A7 59 Bytes  JMP 77FA2617 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegGetPathW + 122                                                 77FA23E3 23 Bytes  [ 00, 8B, 43, 60, 89, 47, 30, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueA + 4                                                77FA26E3 36 Bytes  [ 46, 04, 83, 65, E0, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueA + 29                                               77FA2708 56 Bytes  [ FF, EB, 31, 56, 8D, 45, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueA + 62                                               77FA2741 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueA + 64                                               77FA2743 86 Bytes  [ 35, 9C, FF, 97, 7C, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegSetUSValueA + BB                                               77FA279A 89 Bytes  [ 75, E0, FF, 75, DC, 68, 54, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrChrNW + 5                                                        77FA4461 49 Bytes  CALL 77FA3D7E C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrIA + 4                                                       77FA4493 5 Bytes  [ C6, 5E, C9, C2, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrIA + A                                                       77FA4499 58 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrIA + 45                                                      77FA44D4 17 Bytes  [ 0C, 68, E4, 03, 00, 00, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRChrIA + 57                                                      77FA44E6 49 Bytes  [ 46, 04, 8B, 4D, 10, 89, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrPBrkA + 24                                                       77FA4518 45 Bytes  [ 45, 08, 5D, C2, 04, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExA + 2                                                   77FA4546 53 Bytes  CALL 77FA0662 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExA + 38                                                  77FA457C 30 Bytes  [ 00, 89, 7D, FC, 8B, 45, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExA + 57                                                  77FA459B 30 Bytes  CALL 77FA6A8A C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToInt64ExA + 76                                                  77FA45BA 14 Bytes  [ FF, FF, 83, 4D, FC, FF, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntExA + 6                                                     77FA45C9 4 Bytes  [ 8D, 4D, D4, 51 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntExA + B                                                     77FA45CE 14 Bytes  CALL 77FA585A C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrToIntExA + 1A                                                    77FA45DD 22 Bytes  [ 30, 89, 75, 84, 3B, 75, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrSpnA + 4                                                         77FA45F4 6 Bytes  [ 02, 89, 85, 68, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrSpnA + B                                                         77FA45FB 32 Bytes  [ 8B, 4A, 04, 89, 8D, 6C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrSpnA + 2C                                                        77FA461C 43 Bytes  [ 4B, 8B, 75, 94, 8B, C6, 0B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrSpnA + 58                                                        77FA4648 19 Bytes  [ D4, 8D, 7D, BC, A5, A5, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrSpnW + 2                                                         77FA465C 163 Bytes  [ 75, 88, 6A, 05, FF, 55, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnIA + 2                                                       77FA4700 9 Bytes  [ FF, FF, 8B, 45, 10, 89, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnIA + C                                                       77FA470A 63 Bytes  [ FF, 8B, 45, 18, 89, 85, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIA + 2                                                       77FA474A 7 Bytes  [ 3B, FB, 0F, 84, 0A, 07, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIA + A                                                       77FA4752 29 Bytes  [ 3B, F3, 0F, 84, 02, 07, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIA + 28                                                      77FA4770 86 Bytes  [ B5, 3C, FF, FF, FF, 3B, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIA + 80                                                      77FA47C8 3 Bytes  [ 39, 5D, 80 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRStrIA + 84                                                      77FA47CC 67 Bytes  [ 07, C7, 45, 80, 4C, 69, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNW + 34                                                       77FA4810 43 Bytes  CALL 77F3C4E2 C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNW + 60                                                       77FA483C 11 Bytes  [ 4D, 14, 89, 48, 10, 8D, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNW + 6C                                                       77FA4848 87 Bytes  [ 10, 08, 00, C7, 45, FC, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerA + 54                                               77FA48A1 25 Bytes  [ C1, E0, 05, 89, 85, 48, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerA + 6E                                               77FA48BB 24 Bytes  [ C3, 75, 08, FF, 75, 98, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerA + 87                                               77FA48D4 5 Bytes  [ 8B, F0, 89, B5, 58 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IntlStrEqWorkerA + 8D                                               77FA48DA 147 Bytes  [ FF, FF, 3B, F3, 75, 17, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimA + 2E                                                       77FA496E 2 Bytes  [ 97, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimA + 31                                                       77FA4971 3 Bytes  [ D8, 79, F9 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimA + 35                                                       77FA4975 53 Bytes  [ FF, 75, 9C, 53, FF, 35, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimA + 6B                                                       77FA49AB 45 Bytes  JMP 77FA4E64 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrTrimA + 9A                                                       77FA49DA 82 Bytes  CALL 77F3940D C:\WINDOWS\system32\GDI32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBSTR + 34                                                   77FA4A2D 78 Bytes  [ D0, 3B, D3, 0F, 84, 81, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBSTR + 83                                                   77FA4A7C 32 Bytes  CALL 77FA6EAB C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBSTR + A4                                                   77FA4A9D 6 Bytes  [ 75, 80, E8, 08, 24, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBSTR + AB                                                   77FA4AA4 41 Bytes  [ 8B, 8D, 48, FF, FF, FF, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufA + 1D                                                   77FA4ACE 7 Bytes  [ 14, 56, FF, B5, 7C, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufA + 25                                                   77FA4AD6 83 Bytes  [ 68, 50, 10, 98, 7C, E8, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToBufA + 79                                                   77FA4B2A 30 Bytes  [ C7, 45, FC, 02, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupA + 1A                                                      77FA4B4A 61 Bytes  [ FF, 8B, 12, 89, 95, 30, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHStrDupA + 58                                                      77FA4B88 23 Bytes  [ C1, E6, 05, 03, 75, 9C, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCatChainW + 14                                                   77FA4BA0 218 Bytes  [ FF, FF, 8B, 75, 90, 8D, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnIW + 14                                                      77FA4C7B 11 Bytes  [ 00, 00, 8B, 85, 68, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnIW + 20                                                      77FA4C87 2 Bytes  [ 85, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrCSpnIW + 23                                                      77FA4C8A 99 Bytes  [ FF, FF, 89, 45, B0, 8D, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNIW + 41                                                      77FA4CEE 90 Bytes  [ FF, FF, 6A, 04, FF, 95, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNIW + 9C                                                      77FA4D49 4 Bytes  CALL 77FA4522 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNIW + A2                                                      77FA4D4F 47 Bytes  [ FF, 75, 9C, 53, FF, 35, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNIW + D2                                                      77FA4D7F 91 Bytes  [ D6, 8B, 36, 8B, 02, 8B, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrStrNIW + 12E                                                     77FA4DDB 8 Bytes  [ 53, FF, 75, 88, E8, 4A, 52, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFormatByteSizeA + 13                                             77FA4F88 79 Bytes  [ 55, 8B, EC, 51, 53, 56, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrA + 7                                                    77FA4FD8 140 Bytes  [ 7D, 0C, 3B, FB, 74, 29, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrA + 95                                                   77FA5066 126 Bytes  [ 00, 00, 53, 58, 53, 3A, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrA + 114                                                  77FA50E5 113 Bytes  [ 3B, C7, C7, 45, F4, E5, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrA + 186                                                  77FA5157 147 Bytes  [ 00, 8B, 45, FC, 8B, 53, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrRetToStrA + 21A                                                  77FA51EB 37 Bytes  [ 41, 16, 8B, 4B, 08, 3B, CF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalA + 1                                            77FA5211 361 Bytes  [ 4B, 04, 89, 0E, 8B, 4A, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalW + 105                                          77FA5380 71 Bytes  [ 52, 74, 6C, 70, 51, 75, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalW + 14D                                          77FA53C8 60 Bytes  [ 53, 58, 53, 3A, 20, 25, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalW + 18A                                          77FA5405 19 Bytes  [ CC, CC, CC, CC, CC, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalW + 19F                                          77FA541A 100 Bytes  [ A1, C8, E0, 97, 7C, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!StrFromTimeIntervalW + 204                                          77FA547F 6 Bytes  [ 00, 89, 8D, C4, FD, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceA + 5C                                                   77FA6099 68 Bytes  [ 35, 9C, FF, 97, 7C, E8, AA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceA + A1                                                   77FA60DE 11 Bytes  [ 8B, 43, 30, 3D, 00, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceA + AD                                                   77FA60EA 36 Bytes  [ 00, FD, FF, FF, 00, 00, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceA + D2                                                   77FA610F 5 Bytes  [ F2, F3, A7, 0F, 94 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!IsCharSpaceA + D8                                                   77FA6115 60 Bytes  [ 85, C0, 89, 85, F0, FC, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetArgsA + C                                                    77FA6F9E 242 Bytes  [ 0C, 8B, 46, 30, 03, C6, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindSuffixArrayA + 16                                           77FA7091 71 Bytes  [ 6F, 72, 79, 41, 00, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindSuffixArrayA + 5E                                           77FA70D9 318 Bytes  [ 43, 6F, 6E, 73, 6F, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCommonPrefixA + B1                                              77FA7218 12 Bytes  [ 43, 6F, 6E, 73, 6F, 6C, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCommonPrefixA + BE                                              77FA7225 179 Bytes  [ 43, 50, 00, 47, 65, 74, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecA + D                                             77FA72D9 49 Bytes  [ 78, 00, 47, 65, 74, 43, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecA + 3F                                            77FA730B 20 Bytes  [ 72, 72, 65, 6E, 74, 44, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRemoveFileSpecA + 54                                            77FA7320 123 Bytes  [ 72, 72, 65, 6E, 74, 50, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerShareA + 1F                                          77FA739C 4 Bytes  [ 44, 65, 66, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsUNCServerShareA + 24                                          77FA73A1 182 Bytes  [ 6C, 74, 43, 6F, 6D, 6D, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSearchAndQualifyA + 1C                                          77FA7458 138 Bytes  [ 44, 72, 69, 76, 65, 54, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsRootA + 2A                                                    77FA74E3 503 Bytes  [ 72, 6F, 63, 65, 73, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathQuoteSpacesA + 4F                                               77FA76DB 16 Bytes  [ 47, 65, 74, 4C, 6F, 67, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentA + C                                          77FA76EC 95 Bytes  [ 72, 69, 6E, 67, 73, 57, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentA + 6C                                         77FA774C 115 Bytes  [ 4D, 6F, 64, 75, 6C, 65, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentA + E0                                         77FA77C0 18 Bytes  [ 4E, 61, 6D, 65, 64, 50, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentA + F3                                         77FA77D3 32 Bytes  [ 65, 57, 00, 47, 65, 74, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindNextComponentA + 114                                        77FA77F4 236 Bytes  [ 65, 6D, 49, 6E, 66, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSkipRootA + 39                                                  77FA78E1 61 Bytes  [ 6F, 6E, 74, 73, 00, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootA + 12                                                77FA791F 75 Bytes  [ 6F, 6E, 73, 00, 47, 65, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsURLA + 16                                                     77FA796B 43 Bytes  [ 72, 69, 76, 61, 74, 65, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeA + B                                              77FA7997 20 Bytes  [ 47, 65, 74, 50, 72, 69, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsContentTypeA + 20                                             77FA79AC 110 Bytes  [ 69, 6F, 6E, 4E, 61, 6D, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeA + F                                                77FA7A1B 8 Bytes  [ 72, 69, 6E, 67, 57, 00, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeA + 18                                               77FA7A24 44 Bytes  [ 50, 72, 69, 76, 61, 74, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeA + 45                                               77FA7A51 4 Bytes  [ 57, 00, 47, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeA + 4A                                               77FA7A56 59 Bytes  [ 50, 72, 6F, 63, 41, 64, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathGetCharTypeA + 86                                               77FA7A92 27 Bytes  [ 50, 72, 6F, 63, 65, 73, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnmakeSystemFolderA + 1D                                        77FA7C18 149 Bytes  [ 72, 69, 6E, 67, 54, 79, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecA + 55                                             77FA7CAE 142 Bytes  [ 47, 65, 74, 53, 79, 73, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateA + 85                                                77FA7D3D 133 Bytes  [ 53, 79, 73, 74, 65, 6D, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateA + 10B                                               77FA7DC3 129 Bytes  [ 47, 65, 74, 54, 61, 70, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateA + 18D                                               77FA7E45 43 Bytes  [ 47, 65, 74, 54, 68, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateA + 1B9                                               77FA7E71 244 Bytes  [ 72, 69, 6F, 72, 69, 74, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUndecorateA + 2AE                                               77FA7F66 229 Bytes  [ 47, 65, 74, 56, 65, 72, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyA + 2F                                                77FA804C 257 Bytes  [ 70, 44, 69, 43, 6C, 61, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyA + 131                                               77FA814E 3 Bytes  [ 5F, 49, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakePrettyA + 135                                               77FA8152 27 Bytes  [ 44, 6F, 63, 6B, 5F, 53, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRenameExtensionA + C                                            77FA816E 372 Bytes  [ 5F, 53, 69, 62, 6C, 69, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathStripPathA + C                                                  77FA82E3 107 Bytes  [ 79, 5F, 45, 78, 57, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryEmptyA + 4B                                          77FA834F 288 Bytes  [ 79, 5F, 4C, 6F, 67, 5F, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathA + A3                                               77FA8470 439 Bytes  [ 65, 74, 43, 6F, 6E, 66, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathA + 25B                                              77FA8628 43 Bytes  [ 68, F0, 7A, 82, 7C, E8, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathA + 287                                              77FA8654 8 Bytes  [ FF, 8B, 45, 14, 89, 85, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathA + 291                                              77FA865E 16 Bytes  [ 8B, 45, 18, 89, 85, 68, FD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathA + 2A2                                              77FA866F 23 Bytes  [ FF, 8B, 45, 28, 89, 85, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathA + 2                                             77FA8687 30 Bytes  [ 33, DB, 89, 9D, C4, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathA + 21                                            77FA86A6 107 Bytes  [ FF, 89, 9D, 84, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathA + 8D                                            77FA8712 16 Bytes  [ FF, 8B, 85, 64, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathA + 9F                                            77FA8724 4 Bytes  [ 89, 9D, E0, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathA + A5                                            77FA872A 5 Bytes  [ C7, 85, D4, FC, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathParseIconLocationA + 12                                         77FA876E 15 Bytes  [ FF, 83, FF, FF, 0F, 84, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathParseIconLocationA + 22                                         77FA877E 64 Bytes  [ 75, 52, C7, 85, E0, FC, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathParseIconLocationA + 63                                         77FA87BF 44 Bytes  [ FF, 0F, 85, BD, 80, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderA + 1A                                          77FA87EC 12 Bytes  [ 85, C8, FD, FF, FF, 3B, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderA + 27                                          77FA87F9 49 Bytes  [ 6A, 04, 6A, 28, 8D, 85, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderA + 59                                          77FA882B 19 Bytes  [ FF, 8B, 85, 58, FD, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderA + 6D                                          77FA883F 41 Bytes  [ FF, 89, 8D, A8, FC, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathMakeSystemFolderA + 98                                          77FA886A 34 Bytes  [ 89, 8D, BC, FC, FF, FF, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathA + 12                                                77FA8EBA 3 Bytes  [ FF, 40, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathFindOnPathA + 16                                                77FA8EBE 6 Bytes  [ 00, 8D, 85, 54, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionA + 2                                               77FA8EC5 58 Bytes  [ 89, 85, D4, FA, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionA + 3D                                              77FA8F00 24 Bytes  [ 85, E0, FA, FF, FF, 89, 9D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionA + 56                                              77FA8F19 32 Bytes  [ FF, FF, 50, 8D, 85, 64, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathAddExtensionA + 77                                              77FA8F3A 17 Bytes  [ B5, 94, FB, FF, FF, 3B, F3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToA + 2                                             77FA8F4C 31 Bytes  [ FF, 89, 85, 90, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToA + 23                                            77FA8F6D 2 Bytes  [ C8, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToA + 27                                            77FA8F71 114 Bytes  [ BE, 00, 00, 00, 40, 56, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToA + 9A                                            77FA8FE4 5 Bytes  [ FF, FF, B5, 6C, FB ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRelativePathToA + A0                                            77FA8FEA 84 Bytes  [ FF, FF, B5, 60, FB, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExA + 1                                              77FA90BA 21 Bytes  JMP FDEB93DC 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExA + 17                                             77FA90D0 77 Bytes  [ 72, 4B, 8B, 75, 0C, B9, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExA + 65                                             77FA911E 113 Bytes  [ 45, 0C, 03, 74, 43, 83, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExA + D7                                             77FA9190 19 Bytes  [ 55, FC, 85, DB, 74, 17, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExA + EB                                             77FA91A4 113 Bytes  [ F3, A5, 8B, CA, 83, E1, 03, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsA + 2E                                        77FA9465 113 Bytes  [ FF, 55, 8B, EC, 83, EC, 58, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsA + A1                                        77FA94D8 67 Bytes  [ 53, 8D, 45, B4, 50, 56, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsA + E5                                        77FA951C 81 Bytes  [ 55, 8B, EC, 8B, 55, 10, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsA + 137                                       77FA956E 3 Bytes  [ 00, 00, 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsA + 13D                                       77FA9574 47 Bytes  [ 5C, D1, 07, 00, 5C, C5, 07, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringA + 3C                                              77FAFE19 19 Bytes  CALL 77F5C8AF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringA + 50                                              77FAFE2D 11 Bytes  CALL 77F5C8AF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringA + 5C                                              77FAFE39 74 Bytes  CALL 77F5C8AF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringA + A7                                              77FAFE84 34 Bytes  [ 6E, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringA + CA                                              77FAFEA7 193 Bytes  [ 55, 8B, EC, 51, 53, 56, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyA + 51                                         77FAFF69 11 Bytes  [ 8B, 4D, 0C, 89, 01, 89, 51, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyA + 5D                                         77FAFF75 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyA + 64                                         77FAFF7C 59 Bytes  [ 55, 8B, EC, 83, EC, 30, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyA + A0                                         77FAFFB8 95 Bytes  [ 55, 8B, EC, 8B, 45, 08, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryStringByKeyA + 100                                        77FB0018 1 Byte  [ 55 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyA + AE                                                 77FB00DB 32 Bytes  [ D3, 4A, 8B, 00, 74, 25, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyA + CF                                                 77FB00FC 103 Bytes  [ 41, 04, 74, 06, 4A, 8B, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyA + 138                                                77FB0165 338 Bytes  [ 74, DE, EB, F5, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyA + 28B                                                77FB02B8 36 Bytes  [ 43, 08, 85, C0, 75, 14, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!AssocQueryKeyA + 2B0                                                77FB02DD 24 Bytes  [ 8B, 3B, 8A, 47, 0C, 3A, C2, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSkipRootW + 3D                                                  77FB10BF 41 Bytes  [ 80, 7D, 20, 00, 75, 08, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootW + A                                                 77FB10E9 29 Bytes  [ 30, FD, FF, FF, 50, 81, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootW + 28                                                77FB1107 58 Bytes  [ 8E, 00, 00, 00, 6A, 00, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootW + 63                                                77FB1142 17 Bytes  [ C1, E0, 02, 50, 2B, D8, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootW + 77                                                77FB1156 46 Bytes  CALL 77F5A3CE 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSameRootW + A6                                                77FB1185 19 Bytes  [ 8B, F0, 80, 7D, 20, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnmakeSystemFolderW + 38                                        77FB121E 28 Bytes  [ 02, 00, 00, B9, 89, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderW + 1D                                            77FB123D 16 Bytes  [ 8B, 4D, 08, 03, C8, 89, 4E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderW + 2E                                            77FB124E 1 Byte  [ 07 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsSystemFolderW + 31                                            77FB1251 101 Bytes  [ 8D, 7E, 6C, F3, AB, 8B, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecW + 5E                                             77FB12B8 88 Bytes  [ 5D, C2, 0C, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecW + B7                                             77FB1311 12 Bytes  [ 8B, 4E, 58, 57, 89, 4D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecW + C4                                             77FB131E 23 Bytes  [ 07, 83, C1, FC, 3B, C8, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecW + DD                                             77FB1337 23 Bytes  JMP 77FB13CF C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsLFNFileSpecW + F5                                             77FB134F 14 Bytes  CALL 77F5938B 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathRenameExtensionW + E                                            77FB13E0 176 Bytes  [ 27, 00, 83, 67, 04, 00, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathIsDirectoryEmptyW + 67                                          77FB1491 238 Bytes  [ 9C, 00, 00, 00, 66, 39, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathW + 8B                                               77FB1580 59 Bytes  [ 4D, F4, 75, DD, 8B, 45, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathW + C7                                               77FB15BC 121 Bytes  [ 8B, 7D, 08, 59, 03, D8, 59, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathW + 142                                              77FB1637 6 Bytes  [ 00, 66, 66, 66, 66, 3A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathW + 14A                                              77FB163F 117 Bytes  [ 00, 3A, 3A, 25, 68, 73, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathW + 1C0                                              77FB16B5 34 Bytes  [ 0F, 84, 8A, 00, 00, 00, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathW + 78                                            77FB1821 140 Bytes  [ D6, 39, 13, 73, 07, B8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathW + 106                                           77FB18AF 21 Bytes  [ 66, 8B, 4E, 08, 66, 3B, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathW + 11C                                           77FB18C5 229 Bytes  [ 75, 39, 66, 3B, C2, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathW + 202                                           77FB19AB 23 Bytes  [ EB, D7, 33, D2, 39, 5D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathSetDlgItemPathW + 21A                                           77FB19C3 127 Bytes  [ FF, 8B, 5D, 08, 59, 59, 4B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExW + 14                                             77FB1AC6 11 Bytes  [ CC, CC, CC, CC, CC, CC, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExW + 20                                             77FB1AD2 86 Bytes  [ FF, 55, 8B, EC, 81, EC, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExW + 77                                             77FB1B29 192 Bytes  CALL 77FB1867 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExW + 138                                            77FB1BEA 65 Bytes  [ E4, 89, 55, F0, 75, 07, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathCompactPathExW + 17A                                            77FB1C2C 152 Bytes  JMP 77FB1DEF C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsW + 21                                        77FB1E4A 62 Bytes  CALL 0207E2D2 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsW + 60                                        77FB1E89 1 Byte  [ 49 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsW + 62                                        77FB1E8B 26 Bytes  [ 4D, 10, 8B, 55, F0, 66, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsW + 7D                                        77FB1EA6 63 Bytes  [ D1, E1, 51, 8D, 44, 70, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!PathUnExpandEnvStringsW + BD                                        77FB1EE6 107 Bytes  [ 55, 8B, EC, 83, EC, 10, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegisterValidateTemplate + 3E                                     77FB611B 7 Bytes  [ 00, 3B, C8, 0F, 84, D1, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegisterValidateTemplate + 47                                     77FB6124 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegisterValidateTemplate + 49                                     77FB6126 62 Bytes  [ 55, F8, 66, 3B, 50, F8, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegisterValidateTemplate + 88                                     77FB6165 78 Bytes  [ 75, 20, FF, 75, 1C, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHRegisterValidateTemplate + D9                                     77FB61B6 3 Bytes  [ 49, 44, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHIsLowMemoryMachine + E                                            77FB6E97 38 Bytes  [ 6A, 00, 8B, 40, 30, FF, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHIsLowMemoryMachine + 35                                           77FB6EBE 5 Bytes  [ 00, 18, 00, 51, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHIsLowMemoryMachine + 3B                                           77FB6EC4 81 Bytes  CALL 77F9C4E0 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHIsLowMemoryMachine + 8D                                           77FB6F16 46 Bytes  [ 8B, 40, 30, FF, 70, 18, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHIsLowMemoryMachine + BC                                           77FB6F45 13 Bytes  [ C8, 83, E1, 03, F3, A4, 81, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesA + B9                                            77FBDE6E 199 Bytes  [ 45, FC, 83, C6, 28, 39, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesA + 182                                           77FBDF37 42 Bytes  [ 5E, 5F, C9, C2, 08, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesA + 1AD                                           77FBDF62 93 Bytes  [ 69, 6F, 6E, 20, 66, 6F, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesA + 20B                                           77FBDFC0 19 Bytes  CALL 77F79CAC C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!GetAcceptLanguagesA + 21F                                           77FBDFD4 5 Bytes  [ 75, 08, C6, 45, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareA + 13                                                    77FBED40 16 Bytes  JMP 77FAEE3F C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareA + 24                                                    77FBED51 31 Bytes  JMP 77FAEE7C C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareA + 44                                                    77FBED71 122 Bytes  [ A1, CC, 46, 88, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareA + BF                                                    77FBEDEC 20 Bytes  CALL 77FA34C2 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCompareA + D4                                                    77FBEE01 6 Bytes  [ 75, 10, 8D, 45, CC, 50 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlHashW + 1                                                        77FBEE7E 16 Bytes  [ 47, 04, 3B, C3, 0F, 85, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlHashW + 12                                                       77FBEE8F 10 Bytes  [ BE, 55, 02, 00, 8B, 47, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlHashW + 1D                                                       77FBEE9A 21 Bytes  [ 2F, 56, 02, 00, 89, 5D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlHashW + 33                                                       77FBEEB0 6 Bytes  [ 75, 30, 8D, 8D, 6C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlHashW + 3A                                                       77FBEEB7 8 Bytes  [ FF, 51, FF, 75, C8, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeA + 4C                                                     77FBF749 12 Bytes  [ 89, 5D, F4, 89, 5D, F8, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeA + 59                                                     77FBF756 17 Bytes  [ 70, 24, 8D, 45, EC, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeA + 6B                                                     77FBF768 8 Bytes  [ 15, 94, 11, 80, 7C, FF, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeA + 74                                                     77FBF771 36 Bytes  [ 15, 3C, 10, 80, 7C, 39, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlEscapeA + 99                                                     77FBF796 26 Bytes  [ 45, FC, 5E, 5B, C9, C2, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartA + 2F                                                    77FBF819 13 Bytes  [ 00, 8B, 45, F8, 3B, C7, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartA + 3F                                                    77FBF829 6 Bytes  [ 3B, C7, 74, 9A, B8, 34 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartA + 47                                                    77FBF831 21 Bytes  [ C0, 5F, 5E, 5B, C9, C2, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartA + 5D                                                    77FBF847 91 Bytes  [ 85, C0, 0F, 85, 22, CF, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlGetPartA + B9                                                    77FBF8A3 71 Bytes  [ 55, 8B, EC, 51, 51, 83, 7D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeA + 4                                                    77FBF8F4 73 Bytes  [ D0, 89, 55, 08, 33, DB, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeA + 4E                                                   77FBF93E 16 Bytes  [ 75, 04, 85, DB, 74, 73, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeA + 5F                                                   77FBF94F 45 Bytes  [ 3B, C8, 76, 0C, 8D, 79, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlUnescapeA + 8D                                                   77FBF97D 49 Bytes  [ 3B, D0, 8B, CA, 76, 0E, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathA + 2F                                             77FBF9B1 5 Bytes  [ 0F, 84, D8, FE, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathA + 35                                             77FBF9B7 11 Bytes  [ 8B, 7D, F8, 3B, D7, 8B, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathA + 42                                             77FBF9C4 25 Bytes  [ B8, 1A, 00, 00, 80, 5F, 5E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathA + 5C                                             77FBF9DE 45 Bytes  [ 56, 8B, 75, 08, 57, 6A, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlCreateFromPathA + 8A                                             77FBFA0C 37 Bytes  CALL 77FB076F C:\WINDOWS\system32\SHLWAPI.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeA + C6                                                77FBFB35 30 Bytes  [ 43, 50, 8D, 3C, 0A, 3B, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeW + A                                                 77FBFB54 31 Bytes  [ FF, 75, 10, 8D, 45, 0C, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeW + 2A                                                77FBFB74 25 Bytes  JMP 77FB092B C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeW + 44                                                77FBFB8E 39 Bytes  [ FF, B8, 0D, 00, 00, C0, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeW + 6D                                                77FBFBB7 38 Bytes  JMP 77FCB067 C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlApplySchemeW + 94                                                77FBFBDE 71 Bytes  [ FF, 33, DB, 57, 66, C7, 85, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsA + 4                                                          77FBFECD 31 Bytes  [ 46, 58, 85, C0, 0F, 84, AC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsA + 24                                                         77FBFEED 100 Bytes  [ C0, 0F, 8C, 9B, DD, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsA + 89                                                         77FBFF52 50 Bytes  [ FF, 38, 5E, 18, 0F, 84, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsA + BC                                                         77FBFF85 27 Bytes  [ 76, 14, FF, 15, AC, 11, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsOpaqueA + 13                                                   77FBFFA1 37 Bytes  [ 8B, 46, 1C, 6A, 14, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryA + 21                                                77FBFFC7 19 Bytes  CALL 77FBFFDE C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryA + 36                                                77FBFFDC 12 Bytes  [ 90, 90, 8B, 0D, 3C, 40, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryA + 43                                                77FBFFE9 1 Byte  [ 1A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryA + 46                                                77FBFFEC 47 Bytes  [ 0F, 95, C0, C3, 53, 53, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!UrlIsNoHistoryA + 76                                                77FC001C 141 Bytes  [ 9E, 68, 01, 00, 53, 56, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileA + 7A                                          77FC026B 6 Bytes  [ FF, 70, 04, 56, E8, 26 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileA + 81                                          77FC0272 15 Bytes  JMP 77FC018C C:\WINDOWS\system32\SHLWAPI.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileA + 91                                          77FC0282 10 Bytes  [ 00, 68, 70, F5, 81, 7C, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileA + 9C                                          77FC028D 50 Bytes  [ A1, CC, 46, 88, 7C, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamOnFileA + CF                                          77FC02C0 30 Bytes  [ FF, 89, 5D, FC, 89, 9D, 78, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamW + 11                                               77FC238F 12 Bytes  [ 00, 12, 24, 08, 00, 26, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamW + 1E                                               77FC239C 70 Bytes  [ 58, 24, 08, 00, 78, 24, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamW + 65                                               77FC23E3 43 Bytes  [ 00, 06, 26, 08, 00, 20, 26, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamW + 91                                               77FC240F 128 Bytes  [ 00, 1C, 27, 08, 00, 32, 27, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHOpenRegStreamW + 112                                              77FC2490 19 Bytes  [ F8, 29, 08, 00, 24, 2A, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DllGetVersion + 4                                                   77FC5AAD 98 Bytes  [ 8D, 04, FF, FF, FF, 2B, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DllGetVersion + 67                                                  77FC5B10 121 Bytes  [ 00, 8B, 43, 48, 85, C0, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DllGetVersion + E1                                                  77FC5B8A 45 Bytes  [ FF, 85, C0, 7C, 74, 8D, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DllGetVersion + 10F                                                 77FC5BB8 41 Bytes  [ 6A, 0E, 89, 85, 1C, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DllGetVersion + 139                                                 77FC5BE2 4 Bytes  [ 00, 8B, 85, 08 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DelayLoadFailureHook + F3                                           77FC6C48 314 Bytes  [ 46, 69, 6E, 64, 52, 65, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DelayLoadFailureHook + 22E                                          77FC6D83 190 Bytes  [ 46, 72, 65, 65, 55, 73, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DelayLoadFailureHook + 2ED                                          77FC6E42 319 Bytes  [ 47, 65, 74, 43, 50, 49, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DelayLoadFailureHook + 42D                                          77FC6F82 37 Bytes  [ 47, 65, 74, 43, 6F, 6E, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!DelayLoadFailureHook + 453                                          77FC6FA8 15 Bytes  [ 47, 65, 74, 43, 6F, 6E, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + F                                           77FC7AFA 20 Bytes  [ 90, 90, 53, 65, 74, 75, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + 24                                          77FC7B0F 22 Bytes  [ 90, 53, 65, 74, 75, 70, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + 3D                                          77FC7B28 73 Bytes  [ 53, 65, 74, 75, 70, 47, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + 87                                          77FC7B72 153 Bytes  [ 90, 90, 53, 65, 74, 75, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] SHLWAPI.dll!SHCreateStreamWrapper + 121                                         77FC7C0C 10 Bytes  [ 76, 69, 63, 65, 00, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + FFF712E6                             769C14DD 18 Bytes  [ 00, 74, 00, 61, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + FFF712F9                             769C14F0 131 Bytes  [ 65, 00, 20, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + FFF7137D                             769C1574 11 Bytes  [ 63, 00, 68, 00, 7D, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + FFF71389                             769C1580 9 Bytes  [ 68, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + FFF71393                             769C158A 3 Bytes  [ 61, 00, 67 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryW + 41                                       769C6390 275 Bytes  [ 48, 65, 61, 70, 20, 68, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryW + 155                                      769C64A4 77 Bytes  [ 00, 00, 55, 4E, 4B, 4E, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryW + 1A3                                      769C64F2 190 Bytes  [ 43, 55, 54, 45, 5F, 52, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryW + 262                                      769C65B1 7 Bytes  [ 89, 45, CC, E8, E5, 47, FA ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryW + 26A                                      769C65B9 43 Bytes  [ 53, 8D, 45, E4, 50, FF, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryW + 1                                    769C669A 101 Bytes  [ 45, FC, EB, 02, 33, C0, C9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryW + 67                                   769C6700 128 Bytes  [ BF, 00, 10, 00, 00, 6A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryW + E8                                   769C6781 16 Bytes  [ 75, 08, 68, 80, 93, 96, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryW + F9                                   769C6792 101 Bytes  [ 29, 7D, 08, 39, 5D, 08, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryW + 15F                                  769C67F8 13 Bytes  [ 8D, 45, 0C, 50, 8D, 45, 08, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CreateEnvironmentBlock + 1                                          769C698E 4 Bytes  [ 4D, 0C, 89, 11 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CreateEnvironmentBlock + 6                                          769C6993 11 Bytes  [ 78, 10, 00, 75, 03, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CreateEnvironmentBlock + 12                                         769C699F 11 Bytes  [ 48, 10, 8B, 49, 08, 01, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CreateEnvironmentBlock + 1E                                         769C69AB 141 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CreateEnvironmentBlock + AC                                         769C6A39 3 Bytes  [ FF, 7F, 33 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryW + 8                                 769C75AB 62 Bytes  [ 8B, 45, B0, 8B, 38, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryW + 48                                769C75EB 109 Bytes  JMP 769B0527 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryW + B6                                769C7659 114 Bytes  [ 00, 00, 77, 18, 0F, B7, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryW + 129                               769C76CC 104 Bytes  [ 6A, 01, 8D, 45, F4, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserW + A                                769C7735 20 Bytes  CALL 73956122 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserW + 1F                               769C774A 52 Bytes  [ 66, 85, 77, 02, 74, 10, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserW + 54                               769C777F 42 Bytes  [ 38, 8D, 45, 84, 50, 6A, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserW + 7F                               769C77AA 36 Bytes  JMP 769B1BCF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserW + A4                               769C77CF 81 Bytes  [ BE, 00, 80, 00, 00, E9, F7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DestroyEnvironmentBlock + 21                                        769C7CB6 21 Bytes  JMP 769B062A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DestroyEnvironmentBlock + 38                                        769C7CCD 47 Bytes  JMP 769B0669 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DestroyEnvironmentBlock + 68                                        769C7CFD 64 Bytes  [ FE, FF, 66, 8B, 46, 04, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DestroyEnvironmentBlock + A9                                        769C7D3E 40 Bytes  [ 0F, 85, D2, 83, FE, FF, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DestroyEnvironmentBlock + D2                                        769C7D67 10 Bytes  CALL C6A4C3F9 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RegisterGPNotification + 44                                         769C86A5 165 Bytes  [ 20, 25, 6C, 78, 20, 61, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnregisterGPNotification + 1A                                       769C874B 90 Bytes  [ 77, 61, 73, 20, 66, 72, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnregisterGPNotification + 75                                       769C87A6 9 Bytes  [ CC, CC, CC, CC, CC, CC, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnregisterGPNotification + 7F                                       769C87B0 17 Bytes  [ 00, 10, 0F, 85, DD, F6, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnregisterGPNotification + 91                                       769C87C2 9 Bytes  JMP 76998234 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnregisterGPNotification + 9B                                       769C87CC 3 Bytes  [ 00, B9, 17 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 2                        769C8A4C 135 Bytes  [ 50, 8D, 47, 10, 50, E8, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForMachinePolicyForegroundProcessing + 8A                       769C8AD4 25 Bytes  [ 00, 33, C9, 8A, 08, 33, CA, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForMachinePolicyForegroundProcessing + A4                       769C8AEE 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForMachinePolicyForegroundProcessing + A6                       769C8AF0 48 Bytes  [ 0F, B7, 0E, 8D, 0C, CD, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForMachinePolicyForegroundProcessing + D7                       769C8B21 8 Bytes  [ 3B, 45, A4, 74, 4E, 64, A1, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfileType + 22                                                 769C8F63 102 Bytes  [ 48, 04, 89, 58, 08, C7, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfileType + 89                                                 769C8FCA 76 Bytes  [ 41, 50, 5B, 25, 77, 5A, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfileType + D6                                                 769C9017 78 Bytes  [ 00, 00, 80, 76, 2A, 68, DC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfileType + 125                                                769C9066 20 Bytes  [ D8, 89, 5D, D4, 33, F6, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfileType + 13A                                                769C907B 15 Bytes  CALL 769C7BF5 C:\WINDOWS\system32\USERENV.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForUserPolicyForegroundProcessing + 4                           769C9153 12 Bytes  CALL 769C6654 C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForUserPolicyForegroundProcessing + 11                          769C9160 127 Bytes  [ 00, 8B, 45, DC, 8B, 8B, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForUserPolicyForegroundProcessing + 91                          769C91E0 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForUserPolicyForegroundProcessing + 93                          769C91E2 7 Bytes  [ 10, 74, 0D, 8B, 46, 04, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!WaitForUserPolicyForegroundProcessing + 9B                          769C91EA 1 Byte  [ 10 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetNextFgPolicyRefreshInfo + A                                      769C95D9 71 Bytes  [ 12, FF, 75, 14, FF, 75, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetNextFgPolicyRefreshInfo + 52                                     769C9621 19 Bytes  CALL 769C62AF C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetNextFgPolicyRefreshInfo + 66                                     769C9635 94 Bytes  [ 90, 90, 90, FF, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetNextFgPolicyRefreshInfo + C5                                     769C9694 20 Bytes  [ 75, 18, FF, 75, 14, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetNextFgPolicyRefreshInfo + DA                                     769C96A9 30 Bytes  [ 4D, 14, 3B, CB, 74, 05, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileW + 5                                                769CA2CC 71 Bytes  [ 65, 00, 20, 00, 41, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileW + 4D                                               769CA314 37 Bytes  [ 20, 00, 74, 00, 6F, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileW + 73                                               769CA33A 19 Bytes  [ 20, 00, 70, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileW + 87                                               769CA34E 7 Bytes  [ 72, 00, 6F, 00, 6C, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileW + 8F                                               769CA356 20 Bytes  [ 66, 00, 69, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopLoggingEnabled + 11                                             769CE708 122 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopLoggingEnabled + 8C                                             769CE783 30 Bytes  [ 00, 00, FF, 75, 08, E8, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopLoggingEnabled + AC                                             769CE7A3 22 Bytes  [ 5D, C3, 90, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopLoggingEnabled + C3                                             769CE7BA 162 Bytes  CALL 769D159A C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopLoggingEnabled + 166                                            769CE85D 179 Bytes  CALL 769D159C C:\WINDOWS\system32\USERENV.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!EnterCriticalPolicySection + 64                                     769CF253 27 Bytes  JMP 769C75F2 C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!EnterCriticalPolicySection + 80                                     769CF26F 115 Bytes  [ FF, 75, E0, FF, 15, 3C, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!EnterCriticalPolicySection + F4                                     769CF2E3 4 Bytes  CALL 769EEADF C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!EnterCriticalPolicySection + F9                                     769CF2E8 107 Bytes  [ 89, 45, D4, 3B, C6, 7D, 2A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!EnterCriticalPolicySection + 165                                    769CF354 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListW + 2                                                    769D1B39 109 Bytes  [ 3B, C3, 7C, 5B, F6, 85, CE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListW + 70                                                   769D1BA7 252 Bytes  [ FF, B5, C0, FD, FF, FF, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListW + 16D                                                  769D1CA4 23 Bytes  [ 74, 0A, C7, 85, 88, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListW + 185                                                  769D1CBC 3 Bytes  [ 53, 53, 8D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListW + 189                                                  769D1CC0 2 Bytes  [ A8, FD ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LeaveCriticalPolicySection + C4                                     769D451D 5 Bytes  [ 50, 72, 69, 6E, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LeaveCriticalPolicySection + CA                                     769D4523 67 Bytes  [ 72, 00, 90, 90, 90, 57, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LeaveCriticalPolicySection + 10F                                    769D4568 89 Bytes  [ 53, 70, 6F, 6F, 6C, 65, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LeaveCriticalPolicySection + 16B                                    769D45C4 115 Bytes  [ 53, 63, 68, 65, 64, 75, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LeaveCriticalPolicySection + 1DF                                    769D4638 8 Bytes  [ 47, 65, 74, 50, 72, 69, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryW + 1E                                          76A03667 94 Bytes  [ 72, 6C, 43, 61, 63, 68, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryW + 7E                                          76A036C7 17 Bytes  [ 90, 43, 6F, 6D, 6D, 69, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryW + 90                                          76A036D9 115 Bytes  [ 72, 79, 57, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryW + 104                                         76A0374D 15 Bytes  [ 74, 70, 53, 65, 74, 54, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryW + 114                                         76A0375D 43 Bytes  [ 69, 6E, 48, 74, 74, 70, 53, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileA + 24                                               76A0742F 38 Bytes  [ 00, 66, 00, 69, 00, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileA + 4B                                               76A07456 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileA + 4D                                               76A07458 173 Bytes  [ 65, 00, 6C, 00, 65, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileA + FB                                               76A07506 3 Bytes  [ 74, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!LoadUserProfileA + FF                                               76A0750A 1 Byte  [ 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryA + 31                                          76A07B80 147 Bytes  [ 20, 00, 70, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryA + C5                                          76A07C14 5 Bytes  [ 72, 00, 6C, 00, 79 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryA + CB                                          76A07C1A 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryA + CD                                          76A07C1C 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetProfilesDirectoryA + CF                                          76A07C1E 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryA + 18                                76A07CEB 24 Bytes  [ 00, 50, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryA + 31                                76A07D04 147 Bytes  [ 69, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryA + C5                                76A07D98 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryA + C7                                76A07D9A 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetDefaultUserProfileDirectoryA + C9                                76A07D9C 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryA + 31                                   76A07EA6 147 Bytes  [ 61, 00, 20, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryA + C5                                   76A07F3A 7 Bytes  [ 20, 00, 67, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryA + CD                                   76A07F42 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryA + CF                                   76A07F44 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAllUsersProfileDirectoryA + D1                                   76A07F46 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryA + 16                                       76A0802D 26 Bytes  [ 00, 0A, 00, 54, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryA + 31                                       76A08048 153 Bytes  [ 61, 00, 6C, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryA + CB                                       76A080E2 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryA + CD                                       76A080E4 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetUserProfileDirectoryA + CF                                       76A080E6 1 Byte  [ 61 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserA + B1                               76A083EA 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserA + B3                               76A083EC 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserA + B5                               76A083EE 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserA + B7                               76A083F0 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ExpandEnvironmentStringsForUserA + B9                               76A083F2 1 Byte  [ 75 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListA + 7D                                                    76A089A6 39 Bytes  [ 68, 00, 61, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListA + A5                                                    76A089CE 1 Byte  [ 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListA + A7                                                    76A089D0 1 Byte  [ 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListA + A9                                                    76A089D2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListA + AB                                                    76A089D4 1 Byte  [ A4 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!FreeGPOListA + 25                                                   76A08A32 157 Bytes  [ 63, 00, 61, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListA + 30                                             76A08AD0 67 Bytes  [ 61, 00, 74, 00, 65, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListA + 74                                             76A08B14 13 Bytes  [ 69, 00, 74, 00, 79, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListA + 82                                             76A08B22 7 Bytes  [ 75, 00, 65, 00, 20, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListA + 8A                                             76A08B2A 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListA + 8C                                             76A08B2C 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileA + 2F                                                 76A08BCA 1 Byte  [ 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileA + 31                                                 76A08BCC 95 Bytes  [ 0A, 00, 00, 00, 5C, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileA + 91                                                 76A08C2C 45 Bytes  [ 7C, 00, 01, 00, 49, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileA + BF                                                 76A08C5A 1 Byte  [ 59 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileA + C1                                                 76A08C5C 1 Byte  [ 5F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CheckXForestLogon + 1                                               76A107FE 141 Bytes  [ 45, 08, 66, 83, 20, 00, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CheckXForestLogon + 8F                                              76A1088C 111 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CheckXForestLogon + FF                                              76A108FC 2 Bytes  [ 00, 90 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CheckXForestLogon + 102                                             76A108FF 104 Bytes  [ 90, 90, 90, 8B, FF, 55, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!CheckXForestLogon + 16B                                             76A10968 19 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileW + 1F                                                 76A14B20 41 Bytes  [ 21, 08, 74, 0F, 83, 7D, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileW + 49                                                 76A14B4A 45 Bytes  [ 18, 8B, 45, 1C, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileW + 78                                                 76A14B79 10 Bytes  [ 7F, 76, 07, B8, 57, 00, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileW + 83                                                 76A14B84 62 Bytes  [ 75, 1C, 8D, 4D, FC, 51, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DeleteProfileW + C2                                                 76A14BC3 81 Bytes  [ 55, 8B, EC, 8B, 45, 0C, 53, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnloadUserProfile + 4B                                              76A1D4F2 7 Bytes  [ 20, 00, 73, 00, 79, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnloadUserProfile + 53                                              76A1D4FA 11 Bytes  [ 74, 00, 65, 00, 6D, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnloadUserProfile + 5F                                              76A1D506 7 Bytes  [ 6E, 00, 6E, 00, 6F, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnloadUserProfile + 67                                              76A1D50E 7 Bytes  [ 20, 00, 6D, 00, 6F, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!UnloadUserProfile + 6F                                              76A1D516 27 Bytes  [ 65, 00, 20, 00, 74, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicy + 1                                                   76A2E460 5 Bytes  [ 35, 8C, 10, 80, 7C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicy + 7                                                   76A2E466 101 Bytes  [ FF, 75, 0C, 8D, 45, F8, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicy + 6D                                                  76A2E4CC 79 Bytes  [ 23, 8B, 75, F4, EB, 02, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicy + BD                                                  76A2E51C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicy + BF                                                  76A2E51E 5 Bytes  [ 8D, B0, F8, 0B, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicyEx + 1D                                                76A2F440 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicyEx + 1F                                                76A2F442 7 Bytes  [ 73, 00, 73, 00, 20, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicyEx + 27                                                76A2F44A 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicyEx + 29                                                76A2F44C 19 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RefreshPolicyEx + 3D                                                76A2F460 57 Bytes  [ 20, 00, 69, 00, 6E, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompletedEx + B                                   76A2F6E0 33 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompletedEx + 2D                                  76A2F702 35 Bytes  [ 6E, 00, 73, 00, 74, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompletedEx + 51                                  76A2F726 89 Bytes  [ 65, 00, 61, 00, 64, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompletedEx + AB                                  76A2F780 15 Bytes  [ 20, 00, 62, 00, 65, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompletedEx + BB                                  76A2F790 17 Bytes  [ 70, 00, 72, 00, 6F, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompleted + 7                                     76A30312 17 Bytes  [ 20, 00, 6F, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompleted + 19                                    76A30324 16 Bytes  [ 20, 00, 56, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompleted + 2A                                    76A30335 58 Bytes  [ 00, 68, 00, 61, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompleted + 65                                    76A30370 17 Bytes  [ 61, 00, 6E, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ProcessGroupPolicyCompleted + 77                                    76A30382 31 Bytes  [ 79, 00, 6F, 00, 75, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetPreviousFgPolicyRefreshInfo + 24                                 76A3225D 97 Bytes  [ 85, C0, 7E, 4F, 33, C0, 8A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ForceSyncFgPolicy + 4D                                              76A322BF 46 Bytes  [ 00, 5F, 5E, 5D, C2, 08, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ForceSyncFgPolicy + 7C                                              76A322EE 79 Bytes  [ EB, 1C, 8D, 45, F8, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ForceSyncFgPolicy + CC                                              76A3233E 3 Bytes  [ 06, FD, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ForceSyncFgPolicy + D0                                              76A32342 34 Bytes  [ 5F, 5E, 5D, C2, 0C, 00, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!ForceSyncFgPolicy + F3                                              76A32365 59 Bytes  [ 85, C0, 7C, 12, FF, 75, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListW + CD                                             76A33C40 136 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListW + 157                                            76A33CCA 16 Bytes  [ 64, 00, 4E, 74, 43, 61, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListW + 169                                            76A33CDC 12 Bytes  [ 0A, 01, 4E, 74, 52, 65, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListW + 176                                            76A33CE9 2 Bytes  [ 63, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetAppliedGPOListW + 179                                            76A33CEC 5 Bytes  [ 74, 65, 72, 00, 67 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GenerateRsopPolicy + 4                                              76A364BD 55 Bytes  [ 01, 00, 00, 8D, 46, 20, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GenerateRsopPolicy + 3C                                             76A364F5 16 Bytes  [ 89, 46, 10, 8B, 85, E8, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GenerateRsopPolicy + 4D                                             76A36506 201 Bytes  [ FF, 89, 46, 18, 8B, 85, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GenerateRsopPolicy + 117                                            76A365D0 51 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GenerateRsopPolicy + 14C                                            76A36605 44 Bytes  [ 00, 53, 8D, 8D, D4, FB, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListW + B                                                     76A375BA 127 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListW + 8D                                                    76A3763C 173 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListW + 13C                                                   76A376EB 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListW + 146                                                   76A376F5 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!GetGPOListW + 14E                                                   76A376FD 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopAccessCheckByType + 15                                          76A4D232 103 Bytes  [ 74, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopAccessCheckByType + 7D                                          76A4D29A 5 Bytes  [ 70, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopAccessCheckByType + 83                                          76A4D2A0 59 Bytes  [ 64, 00, 20, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopAccessCheckByType + BF                                          76A4D2DC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopAccessCheckByType + C1                                          76A4D2DE 25 Bytes  [ 6E, 00, 6F, 00, 20, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopFileAccessCheck + 17                                            76A4DAE8 71 Bytes  [ 64, 00, 65, 00, 78, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopFileAccessCheck + 5F                                            76A4DB30 13 Bytes  [ 55, 00, 73, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopFileAccessCheck + 6D                                            76A4DB3E 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopFileAccessCheck + 6F                                            76A4DB40 67 Bytes  [ 69, 00, 76, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopFileAccessCheck + B3                                            76A4DB84 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllCanUnloadNow + 7                                                 76A4DFB4 33 Bytes  [ 6F, 00, 63, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllRegisterServer + B                                               76A4DFD6 89 Bytes  [ 62, 00, 65, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllRegisterServer + 65                                              76A4E030 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllRegisterServer + 67                                              76A4E032 5 Bytes  [ 48, 00, 69, 00, 6A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllRegisterServer + 6D                                              76A4E038 68 Bytes  [ 72, 00, 69, 00, 44, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllRegisterServer + B2                                              76A4E07D 55 Bytes  [ 74, 27, 8B, F7, 6B, F6, 0B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllUnregisterServer                                                 76A4E17B 6 Bytes  [ 90, 90, 8B, FF, 55, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllUnregisterServer + 7                                             76A4E182 120 Bytes  [ 83, EC, 34, 53, 8B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllUnregisterServer + 82                                            76A4E1FD 7 Bytes  [ 75, 0C, 8B, F0, E8, 83, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllUnregisterServer + 8A                                            76A4E205 28 Bytes  [ FF, 03, F0, 8D, 86, 3B, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllUnregisterServer + A8                                            76A4E223 256 Bytes  [ 3B, F0, 77, 03, 4F, EB, 13, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllGetClassObject + 8D                                              76A4E439 276 Bytes  [ 5E, 02, 89, 17, 85, C9, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllGetClassObject + 1A2                                             76A4E54E 83 Bytes  [ 1D, 06, 09, 03, 16, 04, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllGetClassObject + 1F6                                             76A4E5A2 52 Bytes  [ 0E, 03, 18, 06, 05, 02, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllGetClassObject + 22B                                             76A4E5D7 106 Bytes  [ 06, 0C, 01, 17, 06, 04, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllGetClassObject + 296                                             76A4E642 6 Bytes  [ 1B, 06, 09, 01, 13, 03 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllInstall + 2                                                      76A4EF0F 68 Bytes  [ FF, 50, 68, 14, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllInstall + 47                                                     76A4EF54 78 Bytes  [ 70, 18, FF, 15, 10, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllInstall + 96                                                     76A4EFA3 32 Bytes  CALL 769E935B C:\WINDOWS\system32\USERENV.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllInstall + B7                                                     76A4EFC4 17 Bytes  [ 00, 8B, 4D, FC, 8B, 15, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!DllInstall + C9                                                     76A4EFD6 71 Bytes  [ 00, 8B, 4D, FC, C1, E0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopSetPolicySettingStatus + 35                                     76A4F01E 7 Bytes  [ 20, 00, 43, 00, 4E, 00, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopSetPolicySettingStatus + 3D                                     76A4F026 7 Bytes  [ 4D, 00, 45, 00, 20, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopSetPolicySettingStatus + 45                                     76A4F02E 7 Bytes  [ 65, 00, 63, 00, 6F, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopSetPolicySettingStatus + 4D                                     76A4F036 103 Bytes  [ 64, 00, 20, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopSetPolicySettingStatus + B5                                     76A4F09E 47 Bytes  [ 44, 00, 4E, 00, 53, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + 15                                   76A5020C 11 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + 21                                   76A50218 7 Bytes  [ 78, 00, 69, 00, 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + 29                                   76A50220 53 Bytes  [ 20, 00, 69, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + 60                                   76A50257 8 Bytes  [ 00, A0, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] USERENV.dll!RsopResetPolicySettingStatus + 69                                   76A50260 9 Bytes  [ 65, 00, 20, 00, 61, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + FFF827F3                               77A8153D 12 Bytes  [ 00, 6C, 00, 20, 00, 66, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + FFF82800                               77A8154A 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + FFF82802                               77A8154C 22 Bytes  [ 61, 00, 6D, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + FFF82819                               77A81563 20 Bytes  [ 00, 72, 00, 73, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + FFF8282E                               77A81578 1 Byte  [ 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptDetachTls + 19                                               77A84214 45 Bytes  [ 68, 00, 65, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptDetachTls + 47                                               77A84242 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptDetachTls + 49                                               77A84244 31 Bytes  [ 6E, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptDetachTls + 69                                               77A84264 23 Bytes  [ 64, 00, 2E, 00, 20, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptDetachTls + 81                                               77A8427C 3 Bytes  [ 65, 00, 73 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFlushLruCache + 2D                                           77A842F8 31 Bytes  [ 72, 00, 65, 00, 71, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFlushLruCache + 4D                                           77A84318 19 Bytes  [ 20, 00, 6F, 00, 70, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruCache + A                                           77A8432C 23 Bytes  [ 20, 00, 63, 00, 6F, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruCache + 22                                          77A84344 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruCache + 24                                          77A84346 7 Bytes  [ 20, 00, 70, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruCache + 2C                                          77A8434E 3 Bytes  [ 66, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruCache + 30                                          77A84352 5 Bytes  [ 72, 00, 6D, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAllocTls + 2A                                                77A8440A 17 Bytes  [ 20, 00, 73, 00, 63, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAllocTls + 3C                                                77A8441C 7 Bytes  [ 61, 00, 73, 00, 20, 00, 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAllocTls + 44                                                77A84424 5 Bytes  [ 61, 00, 64, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAllocTls + 4A                                                77A8442A 5 Bytes  [ 73, 00, 79, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAllocTls + 50                                                77A84430 77 Bytes  [ 74, 00, 61, 00, 78, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallAsn1Module + 2F                                       77A8447E 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallAsn1Module + 31                                       77A84480 33 Bytes  [ 68, 00, 65, 00, 64, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallAsn1Module + 53                                       77A844A2 47 Bytes  [ 73, 00, 73, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallAsn1Module + 83                                       77A844D2 15 Bytes  [ 0A, 00, 00, 00, 00, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallAsn1Module + 93                                       77A844E2 15 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRegisterSmartCardStore + A                                   77A84C90 9 Bytes  [ 65, 00, 20, 00, 66, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRegisterSmartCardStore + 14                                  77A84C9A 33 Bytes  [ 6E, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRegisterSmartCardStore + 36                                  77A84CBC 65 Bytes  [ 6E, 00, 67, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRegisterSmartCardStore + 7A                                  77A84D00 13 Bytes  [ 70, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRegisterSmartCardStore + 88                                  77A84D0E 33 Bytes  [ 61, 00, 6D, 00, 69, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgSignCTL + 2                                                 77A8528F 109 Bytes  [ 5D, C2, 14, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgSignCTL + 70                                                77A852FD 18 Bytes  [ FF, 8B, 45, 10, 85, C0, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgSignCTL + 83                                                77A85310 116 Bytes  [ FF, FF, 89, 95, 78, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgSignCTL + F8                                                77A85385 87 Bytes  CALL B7905FF4 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgSignCTL + 150                                               77A853DD 288 Bytes  [ 00, 00, 8B, 45, 94, 89, 43, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIntendedKeyUsage + 2                                         77A86BA6 11 Bytes  [ FF, 50, FF, 15, 34, 10, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIntendedKeyUsage + E                                         77A86BB2 18 Bytes  [ FF, FF, 00, 7D, 16, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIntendedKeyUsage + 21                                        77A86BC5 18 Bytes  [ 03, 47, F9, FF, 33, C0, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIntendedKeyUsage + 34                                        77A86BD8 61 Bytes  [ C9, C2, 04, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIntendedKeyUsage + 72                                        77A86C16 60 Bytes  [ 89, 85, 70, FF, FF, FF, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInitOIDFunctionSet + 2A                                        77A87A37 141 Bytes  [ 57, 8D, 85, 14, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallOIDFunctionAddress + 6                                  77A87AC5 24 Bytes  [ BD, 1C, FF, FF, FF, 06, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallOIDFunctionAddress + 20                                 77A87ADF 56 Bytes  [ 56, FF, 15, 54, 10, 80, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallOIDFunctionAddress + 59                                 77A87B18 12 Bytes  [ FF, FF, 50, FF, 15, 34, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallOIDFunctionAddress + 66                                 77A87B25 51 Bytes  [ FF, FF, 3B, C3, 89, 85, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallOIDFunctionAddress + 9A                                 77A87B59 39 Bytes  [ FF, 50, FF, 15, C0, 13, 80, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStoreLocation + 58                                    77A8838E 9 Bytes  [ FF, 75, 0C, 8B, 7D, 18, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStoreLocation + 62                                    77A88398 1 Byte  [ 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStoreLocation + 64                                    77A8839A 10 Bytes  [ 89, B5, F8, FD, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStoreLocation + 6F                                    77A883A5 21 Bytes  CALL 77A5C468 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStoreLocation + 85                                    77A883BB 6 Bytes  [ 39, 4D, 1C, 0F, 8C, A8 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionAddress + 1                                      77A89BD9 59 Bytes  JMP 034E8EE0 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionAddress + 3D                                     77A89C15 54 Bytes  [ D8, 64, A1, 18, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionAddress + 74                                     77A89C4C 55 Bytes  [ 7D, FC, FF, 75, 08, E8, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionAddress + AC                                     77A89C84 17 Bytes  [ 00, FF, 75, 10, 8B, F8, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionAddress + BE                                     77A89C96 25 Bytes  [ 35, D4, 46, 88, 7C, 8B, 47, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFreeOIDFunctionAddress + 29                                    77A89D9A 21 Bytes  [ C0, EB, 7C, 8D, 45, FC, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFreeOIDFunctionAddress + 3F                                    77A89DB0 22 Bytes  [ FF, 15, 6C, 10, 80, 7C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFreeOIDFunctionAddress + 56                                    77A89DC7 76 Bytes  [ 3B, C3, 75, 18, 8D, 45, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProv + 2                                      77A89E14 154 Bytes  [ 15, 10, 10, 80, 7C, 5F, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuid + 3F                                    77A89EAF 83 Bytes  [ 00, 74, 13, B8, 0D, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuid + 93                                    77A89F03 62 Bytes  [ 8B, F0, 8D, 45, F8, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuid + D2                                    77A89F42 89 Bytes  [ 66, 39, 3B, 74, 33, 68, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuid + 12C                                   77A89F9C 41 Bytes  [ FF, 85, C0, 7D, 0A, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuid + 156                                   77A89FC6 24 Bytes  [ 69, 00, 6E, 00, 00, 00, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryInfoKeyU + 2F                                               77A8A34C 29 Bytes  [ 6E, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryInfoKeyU + 4D                                               77A8A36A 15 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryInfoKeyU + 5D                                               77A8A37A 13 Bytes  [ 74, 00, 2E, 00, 20, 00, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryInfoKeyU + 6B                                               77A8A388 15 Bytes  [ 61, 00, 79, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryInfoKeyU + 7B                                               77A8A398 49 Bytes  [ 64, 00, 79, 00, 20, 00, 68, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenHKCUKeyExU + C                                               77A8A4A0 21 Bytes  [ 20, 00, 70, 00, 72, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenHKCUKeyExU + 22                                              77A8A4B6 27 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenKeyExU + 12                                                  77A8A4D2 25 Bytes  [ 6C, 00, 79, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenKeyExU + 2C                                                  77A8A4EC 19 Bytes  [ 6F, 00, 75, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenKeyExU + 40                                                  77A8A500 79 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenKeyExU + 90                                                  77A8A550 3 Bytes  [ 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegOpenKeyExU + 95                                                  77A8A555 16 Bytes  [ 00, 00, 00, 50, 00, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry + 10              77A8A79D 17 Bytes  [ 00, 73, 00, 65, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry + 22              77A8A7AF 4 Bytes  [ 00, 6E, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry + 27              77A8A7B4 23 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry + 3F              77A8A7CC 7 Bytes  [ 6D, 00, 62, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry + 47              77A8A7D4 17 Bytes  [ 20, 00, 6F, 00, 66, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDFunction + B                                            77A8AA80 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDFunction + D                                            77A8AA82 63 Bytes  [ 20, 00, 75, 00, 70, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDFunction + 4D                                           77A8AAC2 5 Bytes  [ 70, 00, 72, 00, 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDFunction + 53                                           77A8AAC8 7 Bytes  [ 76, 00, 69, 00, 64, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDFunction + 5B                                           77A8AAD0 9 Bytes  [ 64, 00, 20, 00, 66, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegEnumValueU + 12                                                  77A8B0FE 21 Bytes  [ 20, 00, 6D, 00, 6F, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegEnumValueU + 28                                                  77A8B114 18 Bytes  [ 6F, 00, 6E, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegEnumValueU + 3B                                                  77A8B127 96 Bytes  [ 00, 70, 00, 72, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegEnumValueU + 9C                                                  77A8B188 9 Bytes  [ 20, 00, 74, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegEnumValueU + A6                                                  77A8B192 105 Bytes  [ 20, 00, 73, 00, 6F, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCloseStore + 20                                                 77A8C1BE 11 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCloseStore + 2C                                                 77A8C1CA 19 Bytes  [ 74, 00, 68, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCloseStore + 40                                                 77A8C1DE 9 Bytes  [ 68, 00, 61, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCloseStore + 4A                                                 77A8C1E8 9 Bytes  [ 73, 00, 20, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCloseStore + 54                                                 77A8C1F2 33 Bytes  [ 65, 00, 61, 00, 64, 00, 79, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCRLContext + 16                                        77A8C26C 11 Bytes  [ 6E, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCRLContext + 22                                        77A8C278 15 Bytes  [ B4, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCRLContext + 32                                        77A8C288 21 Bytes  [ 67, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCRLContext + 48                                        77A8C29E 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCRLContext + 4A                                        77A8C2A0 21 Bytes  [ 69, 00, 73, 00, 20, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetTls + 2C                                                  77A8C4E2 47 Bytes  [ 72, 00, 65, 00, 67, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetTls + 5C                                                  77A8C512 18 Bytes  [ 6D, 00, 70, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetTls + 6F                                                  77A8C525 108 Bytes  [ 00, 69, 00, 74, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetTls + DC                                                  77A8C592 17 Bytes  [ 64, 00, 61, 00, 74, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetTls + EE                                                  77A8C5A4 5 Bytes  [ 63, 00, 6F, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindExtension + 28                                              77A8E966 15 Bytes  [ 74, 00, 6F, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindExtension + 38                                              77A8E976 13 Bytes  [ 65, 00, 74, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindExtension + 46                                              77A8E984 5 Bytes  [ 20, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindExtension + 4C                                              77A8E98A 51 Bytes  [ 71, 00, 75, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindExtension + 80                                              77A8E9BE 5 Bytes  [ 66, 00, 69, 00, 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddStoreToCollection + 23                                       77A8EB5A 7 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddStoreToCollection + 2B                                       77A8EB62 3 Bytes  [ 0A, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddStoreToCollection + 2F                                       77A8EB66 17 Bytes  [ 00, 00, 78, 00, 01, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddStoreToCollection + 41                                       77A8EB78 9 Bytes  [ 70, 00, 65, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddStoreToCollection + 4B                                       77A8EB82 21 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindOIDInfo + 23                                               77A8F622 7 Bytes  [ 63, 00, 61, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindOIDInfo + 2B                                               77A8F62A 25 Bytes  [ 20, 00, 77, 00, 68, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindOIDInfo + 45                                               77A8F644 15 Bytes  [ 20, 00, 74, 00, 72, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindOIDInfo + 55                                               77A8F654 159 Bytes  [ 20, 00, 62, 00, 79, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateHKCUKeyExU + C                                             77A8F6F4 32 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateHKCUKeyExU + 2D                                            77A8F715 18 Bytes  [ 00, 73, 00, 74, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateHKCUKeyExU + 40                                            77A8F728 7 Bytes  [ 65, 00, 2E, 00, 0D, 00, 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateHKCUKeyExU + 49                                            77A8F731 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateHKCUKeyExU + 4B                                            77A8F733 4 Bytes  [ 00, 70, 00, 01 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryValueExU + 9                                                77A8FF9E 5 Bytes  [ 73, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryValueExU + F                                                77A8FFA4 17 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryValueExU + 21                                               77A8FFB6 17 Bytes  [ 68, 00, 65, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryValueExU + 33                                               77A8FFC8 43 Bytes  [ 65, 00, 64, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegQueryValueExU + 5F                                               77A8FFF4 39 Bytes  [ 6E, 00, 64, 00, 20, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObjectEx + 32                                            77A902B0 63 Bytes  [ 6C, 00, 20, 00, 63, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObjectEx + 72                                            77A902F0 97 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObjectEx + D4                                            77A90352 21 Bytes  [ 67, 00, 20, 00, 6D, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObjectEx + EA                                            77A90368 17 Bytes  [ 69, 00, 6E, 00, 73, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObjectEx + FC                                            77A9037A 27 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertControlStore + F                                                77A90396 11 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertControlStore + 1B                                               77A903A2 9 Bytes  [ 72, 00, 69, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertControlStore + 25                                               77A903AC 13 Bytes  [ 20, 00, 73, 00, 65, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertControlStore + 33                                               77A903BA 21 Bytes  [ 65, 00, 64, 00, 20, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertControlStore + 49                                               77A903D0 55 Bytes  [ 64, 00, 65, 00, 76, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateStore + 1A                                             77A90446 37 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateStore + 40                                             77A9046C 17 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateStore + 52                                             77A9047E 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateStore + 54                                             77A90480 6 Bytes  [ 2E, 00, 0D, 00, 0A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateStore + 5B                                             77A90487 30 Bytes  [ 00, 54, 00, 01, 00, 54, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashCertificate + 17                                           77A90554 17 Bytes  [ 76, 00, 69, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashCertificate + 29                                           77A90566 9 Bytes  [ 61, 00, 6E, 00, 63, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashCertificate + 33                                           77A90570 5 Bytes  [ 63, 00, 61, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashCertificate + 39                                           77A90576 15 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashCertificate + 49                                           77A90586 1 Byte  [ 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddSerializedElementToStore + 13                                77A90648 4 Bytes  [ 65, 00, 6C, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddSerializedElementToStore + 18                                77A9064D 54 Bytes  [ 00, 6D, 00, 65, 00, 6E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddSerializedElementToStore + 4F                                77A90684 3 Bytes  [ 73, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddSerializedElementToStore + 53                                77A90688 87 Bytes  [ 65, 00, 72, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddSerializedElementToStore + AB                                77A906E0 9 Bytes  [ 64, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCRLContext + 1C                                             77A90876 27 Bytes  [ 68, 00, 65, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenStore + 13                                                  77A90892 7 Bytes  [ 6C, 00, 6C, 00, 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenStore + 1B                                                  77A9089A 35 Bytes  [ 20, 00, 72, 00, 65, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenStore + 3F                                                  77A908BE 7 Bytes  [ 20, 00, 69, 00, 6E, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenStore + 47                                                  77A908C6 7 Bytes  [ 61, 00, 6C, 00, 69, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenStore + 4F                                                  77A908CE 1 Byte  [ 2E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfo + 1A                                       77A909A2 71 Bytes  [ 20, 00, 72, 00, 65, 00, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfoEx + 3E                                     77A909EA 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfoEx + 40                                     77A909EC 7 Bytes  [ 20, 00, 72, 00, 65, 00, 71 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfoEx + 48                                     77A909F4 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfoEx + 4A                                     77A909F6 21 Bytes  [ 69, 00, 72, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPublicKeyInfoEx + 60                                     77A90A0C 25 Bytes  [ 65, 00, 73, 00, 20, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCRLContextProperty + 55                                      77A90B9A 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCRLContextProperty + 57                                      77A90B9C 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCRLContextProperty + 59                                      77A90B9E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCRLContextProperty + 5B                                      77A90BA0 1 Byte  [ 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCRLContextProperty + 5D                                      77A90BA2 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Decoder + F                                           77A90D80 21 Bytes  [ 76, 00, 65, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Decoder + 25                                          77A90D96 43 Bytes  [ 20, 00, 66, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Decoder + 51                                          77A90DC2 5 Bytes  [ 61, 00, 74, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Decoder + 57                                          77A90DC8 33 Bytes  [ 6F, 00, 6E, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Decoder + 79                                          77A90DEA 23 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersignEncoded + A                                      77A90FCC 41 Bytes  [ 61, 00, 20, 00, 66, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersignEncoded + 34                                     77A90FF6 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersignEncoded + 36                                     77A90FF8 19 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersignEncoded + 4A                                     77A9100C 9 Bytes  [ 69, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersignEncoded + 54                                     77A91016 3 Bytes  [ 6F, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCertificateChain + 11                                        77A91254 3 Bytes  [ 6F, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCertificateChain + 15                                        77A91258 5 Bytes  [ 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCertificateChain + 1B                                        77A9125E 2 Bytes  [ 65, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCertificateChain + 1F                                        77A91262 5 Bytes  [ 73, 00, 79, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetCertificateChain + 25                                        77A91268 12 Bytes  [ 74, 00, 65, 00, 6D, 00, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOIDToAlgId + 2F                                                 77A91472 13 Bytes  [ 76, 00, 65, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOIDToAlgId + 3D                                                 77A91480 5 Bytes  [ 73, 00, 2E, 00, 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOIDToAlgId + 43                                                 77A91486 23 Bytes  [ 0A, 00, 00, 00, 00, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOIDToAlgId + 5B                                                 77A9149E 23 Bytes  [ 61, 00, 6C, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOIDToAlgId + 73                                                 77A914B6 31 Bytes  [ 6D, 00, 6D, 00, 75, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObject + 7D                                              77A92B0B 20 Bytes  [ 00, 4F, 00, 53, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObject + 92                                              77A92B20 17 Bytes  [ 72, 00, 2D, 00, 73, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObject + A4                                              77A92B32 37 Bytes  [ 63, 00, 20, 00, 62, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObject + CA                                              77A92B58 129 Bytes  [ 73, 00, 70, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeObject + 14C                                             77A92BDA 9 Bytes  [ 63, 00, 6B, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareIntegerBlob + 2D                                         77A92DC2 47 Bytes  [ 70, 00, 65, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareIntegerBlob + 5D                                         77A92DF2 7 Bytes  [ 72, 00, 20, 00, 61, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareIntegerBlob + 65                                         77A92DFA 69 Bytes  [ 72, 00, 65, 00, 61, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificate + 26                                         77A92E40 57 Bytes  [ 69, 00, 6E, 00, 20, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificate + 60                                         77A92E7A 45 Bytes  [ 0D, 00, 0A, 00, 00, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificate + 8E                                         77A92EA8 7 Bytes  [ 73, 00, 70, 00, 6F, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificate + 96                                         77A92EB0 9 Bytes  [ 74, 00, 20, 00, 6D, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificate + A0                                         77A92EBA 73 Bytes  [ 65, 00, 20, 00, 66, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCRLContextProperty + 11                                      77A9363C 57 Bytes  [ 20, 00, 61, 00, 74, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificateName + 15                                     77A93676 5 Bytes  [ 0A, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificateName + 1B                                     77A9367C 53 Bytes  [ 40, 00, 01, 00, 49, 00, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificateName + 51                                     77A936B2 55 Bytes  [ 73, 00, 73, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificateName + 89                                     77A936EA 13 Bytes  [ 72, 00, 6F, 00, 72, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCompareCertificateName + 97                                     77A936F8 5 Bytes  [ 34, 00, 01, 00, 4E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddRefLruEntry + 31                                          77A938E2 19 Bytes  [ 65, 00, 71, 00, 75, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddRefLruEntry + 45                                          77A938F6 13 Bytes  [ 20, 00, 69, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddRefLruEntry + 53                                          77A93904 23 Bytes  [ 75, 00, 65, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddRefLruEntry + 6B                                          77A9391C 57 Bytes  [ 0A, 00, 00, 00, 5C, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddRefLruEntry + A5                                          77A93956 5 Bytes  [ 6E, 00, 20, 00, 51 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSyncStore + 13                                                77A940B8 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSyncStore + 15                                                77A940BA 3 Bytes  [ 79, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSyncStore + 19                                                77A940BE 37 Bytes  [ 6F, 00, 61, 00, 64, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSyncStore + 3F                                                77A940E4 11 Bytes  [ 65, 00, 73, 00, 73, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSyncStore + 4B                                                77A940F0 9 Bytes  [ 20, 00, 4E, 00, 6F, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInStore + 2A                                     77A94FA2 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInStore + 2C                                     77A94FA4 41 Bytes  [ 61, 00, 20, 00, 52, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInStore + 56                                     77A94FCE 21 Bytes  [ 72, 00, 61, 00, 72, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInStore + 6C                                     77A94FE4 25 Bytes  [ 63, 00, 72, 00, 65, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInStore + 86                                     77A94FFE 55 Bytes  [ 72, 00, 66, 00, 6F, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReleaseLruEntry + C                                          77A9538A 29 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReleaseLruEntry + 2A                                         77A953A8 23 Bytes  [ 65, 00, 73, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReleaseLruEntry + 42                                         77A953C0 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReleaseLruEntry + 44                                         77A953C2 21 Bytes  [ 61, 00, 63, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptReleaseLruEntry + 5A                                         77A953D8 45 Bytes  [ 63, 00, 6F, 00, 6E, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInsertLruEntry + 12                                          77A956D4 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInsertLruEntry + 14                                          77A956D6 3 Bytes  [ 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInsertLruEntry + 18                                          77A956DA 65 Bytes  [ 65, 00, 20, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInsertLruEntry + 5A                                          77A9571C 71 Bytes  [ 61, 00, 70, 00, 70, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInsertLruEntry + A2                                          77A95764 35 Bytes  [ 64, 00, 69, 00, 73, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyRevocation + 16                                           77A95EF8 21 Bytes  [ 62, 00, 75, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyRevocation + 2C                                           77A95F0E 33 Bytes  [ 65, 00, 20, 00, 61, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyRevocation + 4E                                           77A95F30 43 Bytes  [ 74, 00, 79, 00, 20, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyRevocation + 7A                                           77A95F5C 42 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyRevocation + A5                                           77A95F87 38 Bytes  [ 00, 6D, 00, 69, 00, 73, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyTimeValidity + 22                                         77A96529 34 Bytes  [ 00, 68, 00, 61, 00, 72, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyTimeValidity + 45                                         77A9654C 33 Bytes  [ 0A, 00, 00, 00, 78, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyTimeValidity + 67                                         77A9656E 5 Bytes  [ 72, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyTimeValidity + 6D                                         77A96574 13 Bytes  [ 20, 00, 61, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyTimeValidity + 7B                                         77A96582 3 Bytes  [ 6F, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryData + F                                          77A965A6 47 Bytes  [ 67, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryData + 3F                                         77A965D6 27 Bytes  [ 6F, 00, 63, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryData + 5B                                         77A965F2 17 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryData + 6D                                         77A96604 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryData + 6F                                         77A96606 49 Bytes  [ 65, 00, 74, 00, 65, 00, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignatureEx + A                               77A96FBE 49 Bytes  [ 20, 00, 65, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignatureEx + 3C                              77A96FF0 7 Bytes  [ 6C, 00, 72, 00, 65, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignatureEx + 44                              77A96FF8 23 Bytes  [ 64, 00, 79, 00, 20, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignatureEx + 5C                              77A97010 19 Bytes  [ 73, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignatureEx + 70                              77A97024 31 Bytes  [ 6E, 00, 69, 00, 66, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruEntry + A                                           77A972C6 29 Bytes  [ 0A, 00, 00, 00, 00, 00, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruEntry + 28                                          77A972E4 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruEntry + 2A                                          77A972E6 7 Bytes  [ 72, 00, 73, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruEntry + 32                                          77A972EE 3 Bytes  [ 45, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptCreateLruEntry + 36                                          77A972F2 5 Bytes  [ 72, 00, 6F, 00, 72 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntry + 11                                            77A9739C 35 Bytes  [ 68, 00, 61, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntry + 35                                            77A973C0 33 Bytes  [ 61, 00, 6C, 00, 20, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnumMatchingLruEntries + 12                                  77A973E2 25 Bytes  [ 69, 00, 66, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnumMatchingLruEntries + 2C                                  77A973FC 21 Bytes  [ 72, 00, 72, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnumMatchingLruEntries + 42                                  77A97412 45 Bytes  [ 6C, 00, 69, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnumMatchingLruEntries + 70                                  77A97440 11 Bytes  [ 65, 00, 63, 00, 69, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnumMatchingLruEntries + 7C                                  77A9744C 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCTLsInStore + 10                                            77A9775C 25 Bytes  [ 20, 00, 69, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCTLsInStore + 2A                                            77A97776 5 Bytes  [ 63, 00, 75, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCTLsInStore + 30                                            77A9777C 14 Bytes  [ 65, 00, 6E, 00, 74, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCTLsInStore + 3F                                            77A9778B 32 Bytes  [ 00, 8C, 00, 01, 00, 4D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCTLsInStore + 60                                            77A977AC 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCRLInStore + 2B                                             77A9797A 31 Bytes  [ 01, 00, 4D, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCRLInStore + 4B                                             77A9799A 5 Bytes  [ 45, 00, 72, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCRLInStore + 51                                             77A979A0 63 Bytes  [ 6F, 00, 72, 00, 20, 00, 3A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCRLInStore + 91                                             77A979E0 29 Bytes  [ 65, 00, 20, 00, 75, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDDllList + F                                       77A979FE 13 Bytes  [ 61, 00, 72, 00, 6B, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDDllList + 1D                                      77A97A0C 9 Bytes  [ 65, 00, 63, 00, 6C, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDDllList + 27                                      77A97A16 45 Bytes  [ 61, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDDllList + 55                                      77A97A44 16 Bytes  [ 75, 00, 62, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDDllList + 66                                      77A97A55 8 Bytes  [ 00, 00, 00, 68, 00, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDFunctionAddress + 15                              77A97C52 9 Bytes  [ 45, 00, 72, 00, 72, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDFunctionAddress + 1F                              77A97C5C 5 Bytes  [ 20, 00, 3A, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDFunctionAddress + 25                              77A97C62 5 Bytes  [ 41, 00, 20, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDFunctionAddress + 2B                              77A97C68 25 Bytes  [ 65, 00, 63, 00, 6C, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetDefaultOIDFunctionAddress + 45                              77A97C82 23 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsValidCRLForCertificate + 30                                   77A97EE2 85 Bytes  [ 63, 00, 6F, 00, 64, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInCRL + 48                                       77A97F38 39 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInCRL + 70                                       77A97F60 39 Bytes  [ 20, 00, 45, 00, 72, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInCRL + 98                                       77A97F88 51 Bytes  [ 6D, 00, 6C, 00, 27, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInCRL + CC                                       77A97FBC 23 Bytes  [ 65, 00, 20, 00, 6C, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCertificateInCRL + E4                                       77A97FD4 91 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgClose + 12                                                  77A988CC 17 Bytes  [ 52, 00, 69, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgClose + 24                                                  77A988DE 23 Bytes  [ 62, 00, 6C, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgClose + 3C                                                  77A988F6 45 Bytes  [ 61, 00, 20, 00, 52, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgClose + 6A                                                  77A98924 15 Bytes  [ 63, 00, 61, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgClose + 7A                                                  77A98934 15 Bytes  [ 62, 00, 6C, 00, 69, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCertificateChain + 18                                       77A99336 20 Bytes  [ 61, 72, 61, 6D, 00, 90, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCertificateChain + 2E                                       77A9934C 484 Bytes  [ 43, 50, 47, 65, 74, 55, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCertificateChain + 213                                      77A99531 146 Bytes  [ FF, FF, FF, 3C, 02, E0, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCertificateChain + 2A6                                      77A995C4 33 Bytes  [ FF, 89, 45, E0, 8D, 45, D8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFreeCertificateChain + 2C8                                      77A995E6 22 Bytes  [ C2, 14, 00, 90, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertComparePublicKeyInfo + 2D                                       77A9988C 39 Bytes  [ FF, 68, 00, 00, 00, 80, 33, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertComparePublicKeyInfo + 56                                       77A998B5 91 Bytes  [ 53, 53, 53, 6A, 02, 53, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertComparePublicKeyInfo + B2                                       77A99911 18 Bytes  [ FF, FF, 81, 3F, 00, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertComparePublicKeyInfo + C5                                       77A99924 98 Bytes  [ 3F, 01, 00, 00, 3B, 45, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertComparePublicKeyInfo + 128                                      77A99987 57 Bytes  [ 7C, FF, FF, FF, 8B, 09, 8D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCertificateChainPolicy + 12                               77A99A5E 12 Bytes  [ FF, FF, FF, 15, 08, 10, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCertificateChainPolicy + 1F                               77A99A6B 38 Bytes  [ 15, 04, 12, DD, 77, FF, B5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCertificateChainPolicy + 46                               77A99A92 27 Bytes  [ C9, C2, 14, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCertificateChainPolicy + 63                               77A99AAF 12 Bytes  [ 15, BC, 11, DD, 77, 8B, F0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCertificateChainPolicy + 70                               77A99ABC 95 Bytes  [ 75, 08, FF, 15, C0, 11, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashToBeSigned + 5A                                            77A99B1C 83 Bytes  [ 89, 4D, BC, 33, FF, 89, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashToBeSigned + AE                                            77A99B70 62 Bytes  [ 01, 0B, 80, 83, FE, 7A, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashToBeSigned + EE                                            77A99BB0 81 Bytes  [ FF, FF, FF, FF, 89, 84, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashToBeSigned + 140                                           77A99C02 6 Bytes  [ 85, C0, 0F, 85, B2, FD ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashToBeSigned + 148                                           77A99C0A 37 Bytes  [ 83, 4D, FC, FF, FF, 75, E4, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetSubjectCertificateFromStore + 13                             77A9A04C 9 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetSubjectCertificateFromStore + 1D                             77A9A056 5 Bytes  [ 20, 00, 6D, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetSubjectCertificateFromStore + 23                             77A9A05C 7 Bytes  [ 63, 00, 68, 00, 69, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetSubjectCertificateFromStore + 2B                             77A9A064 37 Bytes  [ 65, 00, 20, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetSubjectCertificateFromStore + 51                             77A9A08A 43 Bytes  [ 64, 00, 20, 00, 69, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObjectEx + 33                                            77A9A124 5 Bytes  [ 61, 00, 67, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObjectEx + 39                                            77A9A12A 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObjectEx + 3B                                            77A9A12C 54 Bytes  [ 6E, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObjectEx + 72                                            77A9A163 8 Bytes  [ 00, 94, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObjectEx + 7B                                            77A9A16C 1 Byte  [ 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPGetSignedDataMsg + A                                        77A9A8EE 87 Bytes  [ 61, 00, 69, 00, 6C, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPGetSignedDataMsg + 62                                       77A9A946 13 Bytes  [ 65, 00, 72, 00, 66, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPGetSignedDataMsg + 70                                       77A9A954 33 Bytes  [ 73, 00, 75, 00, 70, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPGetSignedDataMsg + 92                                       77A9A976 31 Bytes  [ 61, 00, 6C, 00, 69, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPGetSignedDataMsg + B2                                       77A9A996 15 Bytes  [ 01, 00, 4F, 00, 70, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetParam + 4                                                77A9AFAE 51 Bytes  [ 64, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetParam + 38                                               77A9AFE2 11 Bytes  [ 6C, 00, 61, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetParam + 44                                               77A9AFEE 11 Bytes  [ 73, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetParam + 50                                               77A9AFFA 11 Bytes  [ 69, 00, 67, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetParam + 5C                                               77A9B006 27 Bytes  [ 72, 00, 69, 00, 74, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetEnhancedKeyUsage + 20                                        77A9B7E8 7 Bytes  [ 28, 00, 4B, 00, 65, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetEnhancedKeyUsage + 28                                        77A9B7F0 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetEnhancedKeyUsage + 2A                                        77A9B7F2 9 Bytes  [ 69, 00, 6E, 00, 67, 00, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetEnhancedKeyUsage + 34                                        77A9B7FC 7 Bytes  [ 49, 00, 73, 00, 6C, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetEnhancedKeyUsage + 3C                                        77A9B804 1 Byte  [ 6E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindAttribute + 9                                               77A9C116 27 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindAttribute + 25                                              77A9C132 9 Bytes  [ 64, 00, 77, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindAttribute + 2F                                              77A9C13C 69 Bytes  [ 20, 00, 49, 00, 73, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindAttribute + 75                                              77A9C182 123 Bytes  [ 61, 00, 00, 00, 00, 00, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindAttribute + F1                                              77A9C1FE 17 Bytes  [ 6B, 00, 73, 00, 20, 00, 61, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgControl + 18                                                77A9C4D2 22 Bytes  [ 20, 00, 2D, 00, 20, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgControl + 2F                                                77A9C4E9 9 Bytes  [ 00, 6E, 00, 74, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgControl + 39                                                77A9C4F3 2 Bytes  [ 00, 4D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgControl + 3C                                                77A9C4F6 1 Byte  [ 4F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgControl + 3E                                                77A9C4F8 17 Bytes  [ 29, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Encoder + 24                                          77A9D346 29 Bytes  [ 6D, 00, 65, 00, 6E, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Encoder + 42                                          77A9D364 1 Byte  [ 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Encoder + 44                                          77A9D366 11 Bytes  [ 7A, 00, 65, 00, 72, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Encoder + 50                                          77A9D372 1 Byte  [ 4C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetAsn1Encoder + 52                                          77A9D374 15 Bytes  [ 61, 00, 74, 00, 69, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgUpdate + 37                                                 77A9D8A2 9 Bytes  [ 44, 00, 49, 00, 43, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgUpdate + 41                                                 77A9D8AC 21 Bytes  [ 20, 00, 44, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgUpdate + 57                                                 77A9D8C2 11 Bytes  [ 72, 00, 77, 00, 61, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgUpdate + 63                                                 77A9D8CE 5 Bytes  [ 32, 00, 30, 00, 32 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgUpdate + 69                                                 77A9D8D4 5 Bytes  [ 37, 00, 37, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToDecode + 13                                           77A9DE26 7 Bytes  [ 72, 00, 61, 00, 71, 00, 29 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToDecode + 1B                                           77A9DE2E 1 Byte  [ 24 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToDecode + 1D                                           77A9DE30 5 Bytes  [ 49, 00, 72, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToDecode + 23                                           77A9DE36 9 Bytes  [ 71, 00, 00, 00, 00, 00, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToDecode + 2E                                           77A9DE41 2 Bytes  [ 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncodedEx + 29                        77A9DF60 5 Bytes  [ 64, 00, 6F, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncodedEx + 2F                        77A9DF66 1 Byte  [ 17 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncodedEx + 31                        77A9DF68 17 Bytes  [ 53, 00, 70, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncodedEx + 43                        77A9DF7A 27 Bytes  [ 4D, 00, 65, 00, 78, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncodedEx + 5F                        77A9DF96 27 Bytes  [ 00, 00, 18, 00, 46, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPLoad + A                                                    77A9EB18 45 Bytes  [ 69, 00, 6E, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPLoad + 38                                                   77A9EB46 33 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPLoad + 5A                                                   77A9EB68 5 Bytes  [ 72, 00, 61, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPLoad + 60                                                   77A9EB6E 57 Bytes  [ 65, 00, 74, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPLoad + 9A                                                   77A9EBA8 5 Bytes  [ 6D, 00, 61, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPVerifyIndirectData + A                                      77A9EBBE 41 Bytes  [ 01, 00, 55, 00, 6E, 00, 6B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPVerifyIndirectData + 34                                     77A9EBE8 35 Bytes  [ 20, 00, 6E, 00, 61, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPVerifyIndirectData + 58                                     77A9EC0C 39 Bytes  [ 0A, 00, 00, 00, 30, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPVerifyIndirectData + 80                                     77A9EC34 11 Bytes  [ 65, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPVerifyIndirectData + 8C                                     77A9EC40 1 Byte  [ 30 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptTouchLruEntry + 12                                           77A9ED88 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptTouchLruEntry + 14                                           77A9ED8A 3 Bytes  [ 70, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptTouchLruEntry + 18                                           77A9ED8E 21 Bytes  [ 69, 00, 6F, 00, 6E, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptTouchLruEntry + 2E                                           77A9EDA4 21 Bytes  [ 49, 00, 6E, 00, 76, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptTouchLruEntry + 44                                           77A9EDBA 11 Bytes  [ 6C, 00, 65, 00, 65, 00, 2E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptSetTls + 8                                                   77A9F01D 2 Bytes  [ 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptSetTls + B                                                   77A9F020 53 Bytes  [ 66, 00, 69, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptSetTls + 41                                                  77A9F056 19 Bytes  [ 6F, 00, 6D, 00, 61, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptSetTls + 55                                                  77A9F06A 1 Byte  [ 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptSetTls + 57                                                  77A9F06C 9 Bytes  [ 6F, 00, 6C, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCertificatesInStore + F                                     77A9FC2E 25 Bytes  [ 20, 00, 64, 00, 69, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCertificatesInStore + 29                                    77A9FC48 24 Bytes  [ 72, 00, 76, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCertificatesInStore + 42                                    77A9FC61 6 Bytes  [ 00, 64, 00, 65, 00, 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCertificatesInStore + 49                                    77A9FC68 5 Bytes  [ 69, 00, 6E, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCertificatesInStore + 4F                                    77A9FC6E 5 Bytes  [ 64, 00, 2E, 00, 0D ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateChainEngine + A                                77AA0786 5 Bytes  [ 20, 00, 72, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateChainEngine + 10                               77AA078C 1 Byte  [ 71 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateChainEngine + 12                               77AA078E 3 Bytes  [ 75, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateChainEngine + 16                               77AA0792 25 Bytes  [ 73, 00, 74, 00, 20, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateChainEngine + 30                               77AA07AC 5 Bytes  [ 65, 00, 64, 00, 2E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLsInStore + 10                                            77AA0C38 65 Bytes  [ 61, 00, 74, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLsInStore + 52                                            77AA0C7A 45 Bytes  [ 6F, 00, 6C, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLsInStore + 80                                            77AA0CA8 17 Bytes  [ 54, 00, 68, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLsInStore + 92                                            77AA0CBA 62 Bytes  [ 6E, 00, 6F, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLsInStore + D1                                            77AA0CF9 12 Bytes  [ 00, 00, 00, 40, 00, 01, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveStoreFromCollection + 1A                                  77AA0E0E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveStoreFromCollection + 1C                                  77AA0E10 31 Bytes  [ 72, 00, 65, 00, 6E, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveStoreFromCollection + 3C                                  77AA0E30 37 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertUpdateStore + 12                                              77AA0E56 11 Bytes  [ 20, 00, 75, 00, 6E, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertUpdateStore + 1E                                              77AA0E62 19 Bytes  [ 6C, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertUpdateStore + 32                                              77AA0E76 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertUpdateStore + 34                                              77AA0E78 29 Bytes  [ 63, 00, 65, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertUpdateStore + 52                                              77AA0E96 41 Bytes  [ 74, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRemoveLruEntry + 16                                          77AA0F3E 25 Bytes  [ 74, 00, 20, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRemoveLruEntry + 30                                          77AA0F58 12 Bytes  [ 65, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRemoveLruEntry + 3D                                          77AA0F65 16 Bytes  [ 00, 01, 00, 54, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRemoveLruEntry + 4E                                          77AA0F76 85 Bytes  [ 72, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptRemoveLruEntry + A4                                          77AA0FCC 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptQueryObject + 4                                                77AA0FF4 33 Bytes  [ 0D, 00, 0A, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptQueryObject + 26                                               77AA1016 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptQueryObject + 28                                               77AA1018 15 Bytes  [ 72, 00, 20, 00, 68, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptQueryObject + 38                                               77AA1028 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptQueryObject + 3A                                               77AA102A 9 Bytes  [ 75, 00, 72, 00, 72, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCRLToStore + A                                        77AA1294 35 Bytes  [ 20, 00, 6C, 00, 6F, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCRLToStore + 2E                                       77AA12B8 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCRLToStore + 30                                       77AA12BA 61 Bytes  [ 62, 00, 79, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCRLToStore + 6E                                       77AA12F8 99 Bytes  [ 65, 00, 66, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCRLToStore + D2                                       77AA135C 7 Bytes  [ 73, 00, 20, 00, 61, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegDeleteValueU + 11                                                77AA20A6 45 Bytes  [ 65, 00, 20, 00, 6F, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegDeleteValueU + 3F                                                77AA20D4 58 Bytes  [ 69, 00, 62, 00, 75, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegDeleteValueU + 7A                                                77AA210F 56 Bytes  [ 00, 62, 00, 65, 00, 63, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegDeleteValueU + B3                                                77AA2148 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegDeleteValueU + B5                                                77AA214A 23 Bytes  [ 74, 00, 68, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemAlloc + 14                                                  77AA2438 7 Bytes  [ 2C, 00, 20, 00, 65, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemAlloc + 1C                                                  77AA2440 25 Bytes  [ 74, 00, 68, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemAlloc + 36                                                  77AA245A 19 Bytes  [ 74, 00, 65, 00, 72, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemAlloc + 4A                                                  77AA246E 21 Bytes  [ 74, 00, 68, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemAlloc + 60                                                  77AA2484 1 Byte  [ 2E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSerializeCRLStoreElement + 1D                                   77AA28FC 47 Bytes  [ 6F, 00, 72, 00, 6D, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSerializeCRLStoreElement + 4D                                   77AA292C 13 Bytes  [ 74, 00, 65, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSerializeCRLStoreElement + 5B                                   77AA293A 19 Bytes  [ 20, 00, 6F, 00, 62, 00, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSerializeCRLStoreElement + 6F                                   77AA294E 51 Bytes  [ 00, 00, 4C, 00, 01, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSerializeCRLStoreElement + A3                                   77AA2982 45 Bytes  [ 6C, 00, 61, 00, 73, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegSetValueExU + 12                                                 77AA2FAC 43 Bytes  [ 00, 00, 00, 00, 94, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegSetValueExU + 3E                                                 77AA2FD8 26 Bytes  [ 64, 00, 20, 00, 74, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegSetValueExU + 59                                                 77AA2FF3 12 Bytes  [ 00, 74, 00, 72, 00, 69, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegSetValueExU + 66                                                 77AA3000 7 Bytes  [ 65, 00, 73, 00, 74, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegSetValueExU + 6E                                                 77AA3008 37 Bytes  [ 64, 00, 20, 00, 63, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetFileVersion + 5                                           77AA320A 11 Bytes  [ 6C, 00, 61, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetFileVersion + 11                                          77AA3216 71 Bytes  [ 6F, 00, 72, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetFileVersion + 59                                          77AA325E 17 Bytes  [ 64, 00, 20, 00, 70, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetFileVersion + 6B                                          77AA3270 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetFileVersion + 6D                                          77AA3272 33 Bytes  [ 6E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptProtectData + E                                                77AA3EC8 20 Bytes  [ 69, 00, 73, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptProtectData + 23                                               77AA3EDD 42 Bytes  [ 01, 01, 00, 53, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptProtectData + 4E                                               77AA3F08 7 Bytes  [ 66, 00, 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptProtectData + 56                                               77AA3F10 9 Bytes  [ 65, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptProtectData + 60                                               77AA3F1A 23 Bytes  [ 6F, 00, 75, 00, 72, 00, 63, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnprotectData + 41                                             77AA40E2 7 Bytes  [ 70, 00, 65, 00, 72, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnprotectData + 49                                             77AA40EA 9 Bytes  [ 74, 00, 69, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnprotectData + 53                                             77AA40F4 19 Bytes  [ 66, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnprotectData + 67                                             77AA4108 39 Bytes  [ 65, 00, 74, 00, 68, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnprotectData + 8F                                             77AA4130 5 Bytes  [ 6F, 00, 20, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeLruCache + 14                                            77AA4514 9 Bytes  [ 72, 00, 74, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeLruCache + 1E                                            77AA451E 4 Bytes  [ 0A, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeLruCache + 23                                            77AA4523 16 Bytes  [ 00, 64, 00, 01, 00, 41, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeLruCache + 34                                            77AA4534 11 Bytes  [ 61, 00, 6C, 00, 69, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeLruCache + 40                                            77AA4540 37 Bytes  [ 6F, 00, 6D, 00, 62, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptUninstallAsn1Module + E                                      77AA45D0 16 Bytes  [ 6F, 00, 63, 00, 69, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeTls + 7                                                  77AA45E1 20 Bytes  [ 00, 69, 00, 74, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeTls + 1C                                                 77AA45F6 23 Bytes  [ 72, 00, 61, 00, 6E, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeTls + 34                                                 77AA460E 29 Bytes  [ 72, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeTls + 52                                                 77AA462C 15 Bytes  [ 6F, 00, 6E, 00, 20, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFreeTls + 62                                                 77AA463C 45 Bytes  [ 65, 00, 72, 00, 2E, 00, 0D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CloseCertPerformanceData + 12                                       77AB1CD6 33 Bytes  [ 4C, 00, 1C, FF, 36, 5B, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CloseCertPerformanceData + 34                                       77AB1CF8 39 Bytes  [ 00, 00, 00, 00, 08, 0D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CloseCertPerformanceData + 5C                                       77AB1D20 89 Bytes  [ 5B, 08, 5C, 5B, 16, 03, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CreateFileU + 2B                                                    77AB1D7A 1 Byte  [ 04 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CreateFileU + 2D                                                    77AB1D7C 21 Bytes  [ 04, 00, 12, 00, 5E, EC, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CreateFileU + 43                                                    77AB1D92 51 Bytes  [ C2, FC, 11, 08, 08, 5C, 12, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CreateFileU + 77                                                    77AB1DC6 2 Bytes  [ FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CreateFileU + 7A                                                    77AB1DC9 13 Bytes  CALL 77AB1DD7 C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireContextU + 2F                                           77AB242C 33 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireContextU + 51                                           77AB244E 77 Bytes  [ 20, 00, 63, 00, 6F, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireContextU + 9F                                           77AB249C 47 Bytes  [ 65, 00, 20, 00, 64, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignHashU + 2B                                                 77AB24CC 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignHashU + 2D                                                 77AB24CE 25 Bytes  [ 72, 00, 65, 00, 74, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignHashU + 47                                                 77AB24E8 79 Bytes  [ 20, 00, 69, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignHashU + 97                                                 77AB2538 85 Bytes  [ 64, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifySignatureU + 51                                          77AB258E 25 Bytes  [ 65, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifySignatureU + 6B                                          77AB25A8 67 Bytes  [ 75, 00, 73, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifySignatureU + AF                                          77AB25EC 75 Bytes  [ 78, 00, 70, 00, 69, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetProviderU + 47                                              77AB2638 19 Bytes  [ 63, 00, 63, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetProviderU + 5B                                              77AB264C 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetProviderU + 5D                                              77AB264E 9 Bytes  [ 61, 00, 75, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetProviderU + 67                                              77AB2658 13 Bytes  [ 6F, 00, 66, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetProviderU + 75                                              77AB2666 161 Bytes  [ 72, 00, 20, 00, 63, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumProvidersU + 81                                            77AB2882 15 Bytes  [ 72, 00, 65, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumProvidersU + 91                                            77AB2892 79 Bytes  [ 70, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumProvidersU + E1                                            77AB28E2 126 Bytes  [ 73, 00, 65, 00, 20, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumProvidersU + 160                                           77AB2961 70 Bytes  [ 00, 64, 00, 79, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateKeyExU + 2A                                                77AB29A8 29 Bytes  [ 6F, 00, 72, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateKeyExU + 48                                                77AB29C6 22 Bytes  [ 6C, 00, 69, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateKeyExU + 5F                                                77AB29DD 96 Bytes  [ 00, 65, 00, 72, 00, 73, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateKeyExU + C1                                                77AB2A3F 108 Bytes  [ 00, A0, 00, 01, 00, 54, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!RegCreateKeyExU + 12E                                               77AB2AAC 45 Bytes  [ 6F, 00, 20, 00, 6C, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringA + 2F                                           77AB3518 7 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringA + 37                                           77AB3520 11 Bytes  [ 94, 00, 01, 00, 54, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringA + 43                                           77AB352C 73 Bytes  [ 65, 00, 20, 00, 77, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringA + 8D                                           77AB3576 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringA + 8F                                           77AB3578 49 Bytes  [ 20, 00, 63, 00, 61, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringW + 31                                           77AB3838 53 Bytes  [ 72, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringW + 67                                           77AB386E 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringW + 69                                           77AB3870 83 Bytes  [ 79, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringW + BD                                           77AB38C4 43 Bytes  [ 72, 00, 64, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptBinaryToStringW + E9                                           77AB38F0 1 Byte  [ 6E ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryA + 1F                                           77AB3A12 66 Bytes  [ 6D, 00, 6F, 00, 76, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryA + 62                                           77AB3A55 138 Bytes  [ 00, 20, 00, 66, 00, 75, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryA + ED                                           77AB3AE0 31 Bytes  [ 72, 00, 65, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryW + 1B                                           77AB3B00 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryW + 1D                                           77AB3B02 27 Bytes  [ 72, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryW + 39                                           77AB3B1E 57 Bytes  [ 72, 00, 6D, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryW + 73                                           77AB3B58 20 Bytes  [ 73, 00, 6D, 00, 61, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptStringToBinaryW + 88                                           77AB3B6D 58 Bytes  [ 00, 68, 00, 61, 00, 73, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInSortedCTL + 24                                     77AB6C32 15 Bytes  [ 72, 00, 20, 00, 3A, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInSortedCTL + 34                                     77AB6C42 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInSortedCTL + 36                                     77AB6C44 191 Bytes  [ 65, 00, 20, 00, 63, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInSortedCTL + F6                                     77AB6D04 18 Bytes  [ 69, 00, 64, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSubjectInSortedCTL + E                                      77AB6D17 24 Bytes  [ 00, 65, 00, 72, 00, 2E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSubjectInSortedCTL + 27                                     77AB6D30 1 Byte  [ 66 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSubjectInSortedCTL + 29                                     77AB6D32 9 Bytes  [ 65, 00, 73, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSubjectInSortedCTL + 33                                     77AB6D3C 61 Bytes  [ 61, 00, 72, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSubjectInSortedCTL + 71                                     77AB6D7A 138 Bytes  [ 20, 00, 61, 00, 6E, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLContextProperties + 53                                   77AB7046 29 Bytes  [ 20, 00, 6F, 00, 72, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLContextProperties + 71                                   77AB7064 7 Bytes  [ 20, 00, 63, 00, 6F, 00, 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLContextProperties + 79                                   77AB706C 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLContextProperties + 7B                                   77AB706E 7 Bytes  [ 6F, 00, 6E, 00, 65, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumCRLContextProperties + 83                                   77AB7076 35 Bytes  [ 74, 00, 73, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetStoreProperty + 10                                           77AB727E 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetStoreProperty + 12                                           77AB7280 17 Bytes  [ 63, 00, 6F, 00, 70, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetStoreProperty + 24                                           77AB7292 5 Bytes  [ 6F, 00, 20, 00, 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetStoreProperty + 2A                                           77AB7298 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetStoreProperty + 2C                                           77AB729A 3 Bytes  [ 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInCTL + 2F                                           77AB73C6 9 Bytes  [ 6E, 00, 20, 00, 6F, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInCTL + 39                                           77AB73D0 11 Bytes  [ 74, 00, 6F, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInCTL + 45                                           77AB73DC 7 Bytes  [ 20, 00, 62, 00, 61, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInCTL + 4D                                           77AB73E4 5 Bytes  [ 65, 00, 20, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindSubjectInCTL + 53                                           77AB73EA 23 Bytes  [ 61, 00, 72, 00, 74, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLEntryFromCertificateContextProperties + 3B             77AB787E 12 Bytes  [ 70, 00, 74, 00, 69, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLEntryFromCertificateContextProperties + 48             77AB788B 26 Bytes  [ 00, 57, 00, 69, 00, 6E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLEntryFromCertificateContextProperties + 63             77AB78A6 7 Bytes  [ 53, 00, 45, 00, 20, 00, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLEntryFromCertificateContextProperties + 6B             77AB78AE 16 Bytes  [ 50, 00, 49, 00, 20, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLEntryFromCertificateContextProperties + 7C             77AB78BF 14 Bytes  [ 00, 20, 00, 44, 00, 4C, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDeleteCRLFromStore + 12                                         77AB8152 28 Bytes  [ DB, 39, 1D, C0, 62, E4, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddCRLLinkToStore + D                                           77AB816F 29 Bytes  [ 39, 5D, 24, 0F, 84, 1B, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddCRLLinkToStore + 2B                                          77AB818D 42 Bytes  [ 0F, 84, 00, 04, 00, 00, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCTLInStore + 4                                              77AB81B8 85 Bytes  [ 3D, E0, 15, DD, 77, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCTLInStore + 5A                                             77AB820E 31 Bytes  [ 33, DB, 8B, 75, 0C, 39, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCTLInStore + 7A                                             77AB822E 16 Bytes  [ 90, 90, FF, FF, FF, FF, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCTLInStore + 8C                                             77AB8240 105 Bytes  [ 96, 5B, E0, 77, 9F, 5B, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindCTLInStore + F6                                             77AB82AA 48 Bytes  [ 6A, 57, 8B, 45, 10, 83, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateContext + 1                                               77AB847A 27 Bytes  JMP 77AA84C9 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateContext + 1D                                              77AB8496 119 Bytes  CALL 77AAD2E8 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateContext + 95                                              77AB850E 10 Bytes  [ FA, F3, A5, 8B, C8, 83, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateContext + A0                                              77AB8519 9 Bytes  [ 7B, 1C, 02, 0F, 85, 79, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateContext + AB                                              77AB8524 35 Bytes  [ F8, 8B, 4D, 0C, 89, 53, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSaveStore + 6                                                   77AB8944 88 Bytes  [ 69, 38, 33, C2, 03, F5, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSaveStore + 5F                                                  77AB899D 112 Bytes  [ 69, 2C, C1, C7, 09, 03, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSaveStore + D0                                                  77AB8A0E 15 Bytes  [ C3, 03, F5, 05, 81, E6, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToStore + 4                                77AB8A1E 77 Bytes  [ 69, 10, 03, F7, 33, C6, 23, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCertificateContext + 4                                    77AB8A6C 111 Bytes  [ C7, 33, C3, 23, C2, 33, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddCRLContextToStore + 4D                                       77AB8ADC 346 Bytes  [ 6F, 67, 03, F0, 8B, C7, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLContext + 2B                                           77AB8C37 25 Bytes  [ 69, 30, 33, C3, 05, E5, 99, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLContext + 45                                           77AB8C51 154 Bytes  [ C6, F8, 7C, A2, 1F, 33, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLContext + E0                                           77AB8CEC 121 Bytes  [ C6, 03, DD, 05, C3, 59, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLContext + 15A                                          77AB8D66 155 Bytes  [ 03, DA, 8B, 69, 3C, 0B, C3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateCTLContext + 1F6                                          77AB8E02 38 Bytes  [ 03, F7, 8B, 69, 24, 0B, C6, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetKeyIdentifierProperty + 42                                  77AB92B9 80 Bytes  [ EB, C7, 49, 83, C9, E0, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetKeyIdentifierProperty + 1                                   77AB930A 2 Bytes  [ 55, D0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetKeyIdentifierProperty + 4                                   77AB930D 35 Bytes  [ 35, 08, 10, DD, 77, 52, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetKeyIdentifierProperty + 28                                  77AB9331 35 Bytes  JMP 876C183A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetKeyIdentifierProperty + 4C                                  77AB9355 23 Bytes  JMP 77A9AC6F C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetKeyIdentifierProperty + 64                                  77AB936D 42 Bytes  [ 00, 80, 8D, 09, 0F, A4, CA, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumKeyIdentifierProperties + 1                                77AB95AE 56 Bytes  CALL 77900BB2 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumKeyIdentifierProperties + 3A                               77AB95E7 9 Bytes  [ 90, 90, 90, 90, 90, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumKeyIdentifierProperties + 44                               77AB95F1 17 Bytes  [ 8B, 00, 89, 45, E4, 33, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumKeyIdentifierProperties + 57                               77AB9604 36 Bytes  [ E4, FF, 15, 70, 16, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumKeyIdentifierProperties + 7C                               77AB9629 16 Bytes  CALL 778C0C2D 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIssuerCertificateFromStore + 3E                              77AB98D4 4 Bytes  [ BE, FF, FF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIssuerCertificateFromStore + 43                              77AB98D9 86 Bytes  JMP 77A99B7C C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetIssuerCertificateFromStore + 9A                              77AB9930 67 Bytes  [ 8B, 49, 04, 3B, C8, 0F, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifySubjectCertificateContext + 2C                            77AB9974 18 Bytes  [ 45, E0, 03, 00, 89, 45, E4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifySubjectCertificateContext + 42                            77AB998A 51 Bytes  [ 90, 33, C0, 40, C3, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifySubjectCertificateContext + 76                            77AB99BE 1 Byte  [ E0 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifySubjectCertificateContext + 78                            77AB99C0 41 Bytes  JMP 77A99C06 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifySubjectCertificateContext + A2                            77AB99EA 2 Bytes  [ 2C, 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireCertificatePrivateKey + 1B                              77AB9A39 17 Bytes  [ C1, 0F, 8D, 21, CB, FE, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireCertificatePrivateKey + 2D                              77AB9A4B 7 Bytes  [ D2, BB, 60, 78, E4, 77, 42 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireCertificatePrivateKey + 35                              77AB9A53 65 Bytes  [ FB, 87, 17, 85, D2, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireCertificatePrivateKey + 77                              77AB9A95 41 Bytes  [ 7C, 12, 8D, 0C, 95, 20, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptAcquireCertificatePrivateKey + A2                              77AB9AC0 77 Bytes  [ 8B, 41, 3C, 03, C1, 81, 38, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCertificateContextPropertiesFromCTLEntry + 2                 77AB9C43 61 Bytes  JMP 77AACFF5 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCertificateContextPropertiesFromCTLEntry + 40                77AB9C81 58 Bytes  CALL 77AECC53 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCertificateContextPropertiesFromCTLEntry + 7B                77AB9CBC 60 Bytes  [ 00, 01, 0D, 00, 00, 00, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCertificateContextPropertiesFromCTLEntry + B8                77AB9CF9 4 Bytes  [ FF, D3, 89, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetCertificateContextPropertiesFromCTLEntry + BD                77AB9CFE 97 Bytes  JMP 77A87E67 C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreA + B                                            77AB9E15 11 Bytes  [ 8D, 85, 6C, FE, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreA + 17                                           77AB9E21 14 Bytes  [ FF, 8D, 85, 78, FE, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreA + 26                                           77AB9E30 4 Bytes  CALL 77AECAD9 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreA + 2B                                           77AB9E35 53 Bytes  JMP 77AA712E C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreW + 23                                           77AB9E6C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreW + 25                                           77AB9E6E 16 Bytes  JMP 77A8AFF3 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertOpenSystemStoreW + 36                                           77AB9E7F 66 Bytes  [ 33, C9, 85, C0, 0F, 9D, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreA + 35                        77AB9EC2 37 Bytes  CALL 77AECC54 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreW + 11                        77AB9EE8 10 Bytes  [ FF, FF, 75, 0C, FF, D0, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreW + 1C                        77AB9EF3 68 Bytes  JMP 77A8FEF2 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreW + 61                        77AB9F38 16 Bytes  [ E4, 5F, FD, FF, 83, 7D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreW + 72                        77AB9F49 60 Bytes  [ 00, 0F, 84, D0, 5F, FD, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEncodedCertificateToSystemStoreW + B0                        77AB9F87 5 Bytes  [ 11, 8B, 85, E8, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetEnhancedKeyUsage + B                                         77ABA366 48 Bytes  [ 75, 00, 62, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetEnhancedKeyUsage + 3C                                        77ABA397 48 Bytes  [ 00, 67, 00, 61, 00, 6C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetEnhancedKeyUsage + 6D                                        77ABA3C8 41 Bytes  [ 24, 00, 24, 00, 24, 00, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetEnhancedKeyUsage + 97                                        77ABA3F2 84 Bytes  [ 49, 00, 6E, 00, 64, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertSetEnhancedKeyUsage + EC                                        77ABA447 12 Bytes  [ 00, 61, 00, 6C, 00, 61, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetValidUsages + B                                              77ABA536 81 Bytes  [ 6C, 00, 61, 00, 6E, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetValidUsages + 5D                                             77ABA588 23 Bytes  [ 24, 00, 24, 00, 52, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetValidUsages + 75                                             77ABA5A0 1 Byte  [ 6D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetValidUsages + 77                                             77ABA5A2 11 Bytes  [ 61, 00, 6E, 00, 69, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetValidUsages + 83                                             77ABA5AE 9 Bytes  [ 24, 00, 24, 00, 24, 00, 50, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEnhancedKeyUsageIdentifier + 34                              77ABA8A2 1 Byte  [ 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEnhancedKeyUsageIdentifier + 36                              77ABA8A4 15 Bytes  [ 75, 00, 62, 00, 6C, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEnhancedKeyUsageIdentifier + 46                              77ABA8B4 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEnhancedKeyUsageIdentifier + 48                              77ABA8B6 58 Bytes  [ 53, 00, 6C, 00, 6F, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAddEnhancedKeyUsageIdentifier + 83                              77ABA8F1 118 Bytes  [ 00, 62, 00, 6C, 00, 69, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveEnhancedKeyUsageIdentifier + 2F                           77ABA99C 29 Bytes  [ 53, 00, 69, 00, 6E, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveEnhancedKeyUsageIdentifier + 4D                           77ABA9BA 113 Bytes  [ 6F, 00, 6D, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveEnhancedKeyUsageIdentifier + BF                           77ABAA2C 33 Bytes  [ 61, 00, 69, 00, 6E, 00, 19, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveEnhancedKeyUsageIdentifier + E1                           77ABAA4E 7 Bytes  [ 24, 00, 53, 00, 61, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRemoveEnhancedKeyUsageIdentifier + E9                           77ABAA56 19 Bytes  [ 6E, 00, 74, 00, 20, 00, 4C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProvForEncrypt + C                            77ABABC6 11 Bytes  [ 61, 00, 62, 00, 20, 00, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProvForEncrypt + 18                           77ABABD2 13 Bytes  [ 72, 00, 61, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProvForEncrypt + 26                           77ABABE0 1 Byte  [ 24 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProvForEncrypt + 28                           77ABABE2 17 Bytes  [ 24, 00, 24, 00, 54, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetDefaultCryptProvForEncrypt + 3A                           77ABABF4 17 Bytes  [ 64, 00, 20, 00, 61, 00, 6E, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsRDNAttrsInCertificateName + 3C                                77ABAD28 15 Bytes  [ 24, 00, 54, 00, 6F, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsRDNAttrsInCertificateName + 4C                                77ABAD38 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsRDNAttrsInCertificateName + 4E                                77ABAD3A 17 Bytes  [ 20, 00, 52, 00, 65, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsRDNAttrsInCertificateName + 60                                77ABAD4C 13 Bytes  [ 46, 00, 24, 00, 24, 00, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertIsRDNAttrsInCertificateName + 6E                                77ABAD5A 1 Byte  [ 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignCertificate + A                                            77ABAE8C 55 Bytes  [ 61, 00, 6E, 00, 24, 00, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignCertificate + 42                                           77ABAEC4 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignCertificate + 44                                           77ABAEC6 3 Bytes  [ 70, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignCertificate + 48                                           77ABAECA 1 Byte  [ 62 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignCertificate + 4A                                           77ABAECC 33 Bytes  [ 6C, 00, 69, 00, 63, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncodeCertificate + 49                                  77ABB095 28 Bytes  [ 33, DB, 43, 89, 5D, E0, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncodeCertificate + 66                                  77ABB0B2 40 Bytes  [ 75, 10, FF, 75, 0C, FF, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncodeCertificate + 8F                                  77ABB0DB 64 Bytes  CALL 77ABB177 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncodeCertificate + D0                                  77ABB11C 58 Bytes  [ 86, 08, E0, 77, 8F, 08, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCRLTimeValidity + 25                                      77ABB157 200 Bytes  CALL 77AA7D51 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCRLRevocation + 3C                                        77ABB220 71 Bytes  [ C2, 04, 00, 90, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertAlgIdToOID + 24                                                 77ABB268 20 Bytes  [ 85, C0, 0F, 84, F0, 69, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindRDNAttr + B                                                 77ABB27D 42 Bytes  [ F6, 0F, 85, A2, 69, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindRDNAttr + 36                                                77ABB2A8 19 Bytes  [ 75, 14, 50, FF, 75, 0C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindRDNAttr + 4B                                                77ABB2BD 59 Bytes  [ 0E, 8B, 45, E4, 89, 48, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindRDNAttr + 87                                                77ABB2F9 16 Bytes  CALL 77AA7D52 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindRDNAttr + 98                                                77ABB30A 51 Bytes  [ FF, FF, 34, 08, E0, 77, 3D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashPublicKeyInfo + 1D                                         77ABB3AD 21 Bytes  [ DB, 43, 89, 5D, E4, 8B, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashPublicKeyInfo + 33                                         77ABB3C3 132 Bytes  [ 5D, DC, FF, 75, 18, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashPublicKeyInfo + B8                                         77ABB448 144 Bytes  CALL 77AA7D52 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashPublicKeyInfo + 149                                        77ABB4D9 102 Bytes  [ 85, C0, 74, 63, 33, DB, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashPublicKeyInfo + 1B0                                        77ABB540 46 Bytes  [ 83, 4D, FC, FF, EB, CD, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPublicKeyInfoEx + 8                                      77ABBE8A 242 Bytes  [ 1C, B5, A0, AF, DE, 77, C1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptCreateKeyIdentifierFromCSP + 5F                                77ABBF7D 5 Bytes  [ 00, 07, 89, 4D, 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptCreateKeyIdentifierFromCSP + 65                                77ABBF83 46 Bytes  [ DE, 81, E3, 00, 00, C0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptCreateKeyIdentifierFromCSP + 94                                77ABBFB2 104 Bytes  [ DE, 77, C1, EB, 0D, 0B, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallDefaultContext + 58                                     77ABC01B 129 Bytes  [ 8B, 14, BD, A0, B4, DE, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallDefaultContext + DA                                     77ABC09D 24 Bytes  [ FF, FF, 0F, 89, 55, 08, 81, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallDefaultContext + F3                                     77ABC0B6 80 Bytes  [ F9, 81, E7, 00, 00, C0, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptInstallDefaultContext + 144                                    77ABC107 79 Bytes  [ 14, B5, A0, AE, DE, 77, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUninstallDefaultContext + 30                                   77ABC157 115 Bytes  [ 8B, 7D, 08, 0B, F3, 8B, DF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUninstallDefaultContext + A4                                   77ABC1CB 58 Bytes  [ 20, 10, 00, 00, 20, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUninstallDefaultContext + DF                                   77ABC206 111 Bytes  [ 00, 00, 20, 00, 00, 20, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUninstallDefaultContext + 14F                                  77ABC276 20 Bytes  [ 09, 00, 00, 08, 09, 20, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUninstallDefaultContext + 164                                  77ABC28B 27 Bytes  [ 20, 30, 00, 08, 20, 20, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindCertificateKeyProvInfo + 11                                77ABC513 6 Bytes  [ 04, 08, 00, 10, 04, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindCertificateKeyProvInfo + 19                                77ABC51B 25 Bytes  [ 04, 08, 01, 10, 04, 00, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindCertificateKeyProvInfo + 33                                77ABC535 83 Bytes  [ 10, 10, 04, 08, 11, 00, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindCertificateKeyProvInfo + 87                                77ABC589 89 Bytes  [ 01, 02, 04, 00, 01, 12, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindCertificateKeyProvInfo + E1                                77ABC5E3 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignature + C                                 77ABC70B 21 Bytes  [ 00, 09, 00, 00, 08, 01, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyCertificateSignature + 22                                77ABC721 67 Bytes  [ 00, 02, 00, 01, 00, 02, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetPublicKeyLength + 30                                         77ABC765 4 Bytes  [ 00, 02, 0A, 08 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetPublicKeyLength + 35                                         77ABC76A 10 Bytes  [ 02, 02, 08, 00, 02, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetPublicKeyLength + 40                                         77ABC775 20 Bytes  [ 04, 02, 0A, 08, 04, 02, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetPublicKeyLength + 55                                         77ABC78A 12 Bytes  [ 00, 02, 09, 00, 00, 0A, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetPublicKeyLength + 62                                         77ABC797 22 Bytes  [ 0A, 09, 04, 00, 02, 09, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateSelfSignCertificate + 9A                                  77ABC927 51 Bytes  [ 04, 20, 20, 04, 00, 20, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateSelfSignCertificate + CF                                  77ABC95C 1 Byte  [ 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateSelfSignCertificate + D1                                  77ABC95E 128 Bytes  [ 04, 04, 00, 28, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateSelfSignCertificate + 152                                 77ABC9DF 78 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertCreateSelfSignCertificate + 1A1                                 77ABCA2E 12 Bytes  CALL 77ABBC24 C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterSystemStore + 2                                         77ABDE61 163 Bytes  [ 00, 00, 00, 8B, 9B, C8, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterPhysicalStore + F                                       77ABDF05 75 Bytes  [ 55, 44, 33, C6, 33, D6, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterPhysicalStore + 5B                                      77ABDF51 7 Bytes  [ 00, 00, 00, 81, E2, FF, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterPhysicalStore + 63                                      77ABDF59 330 Bytes  [ 00, 8B, 9B, C8, C4, DE, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterPhysicalStore + 1AE                                     77ABE0A4 31 Bytes  [ 67, 00, 61, 00, 6C, 00, 29, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRegisterPhysicalStore + 1CE                                     77ABE0C4 63 Bytes  [ 16, 00, 53, 00, 65, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterSystemStore + 3B                                      77ABE104 9 Bytes  [ 68, 00, 20, 00, 28, 00, 46, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterSystemStore + 45                                      77ABE10E 13 Bytes  [ 6E, 00, 6C, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterSystemStore + 53                                      77ABE11C 21 Bytes  [ 46, 00, 69, 00, 6E, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterSystemStore + 6B                                      77ABE134 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterSystemStore + 75                                      77ABE13E 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterPhysicalStore + 41                                    77ABE21E 21 Bytes  [ 6C, 00, 6C, 00, 69, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterPhysicalStore + 57                                    77ABE234 12 Bytes  [ 69, 00, 73, 00, 74, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterPhysicalStore + 64                                    77ABE241 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterPhysicalStore + 67                                    77ABE244 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertUnregisterPhysicalStore + 72                                    77ABE24F 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStore + 38                                            77ABE505 14 Bytes  [ 00, 74, 00, 72, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStore + 47                                            77ABE514 29 Bytes  [ 6F, 00, 75, 00, 6E, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStore + 65                                            77ABE532 23 Bytes  [ 4C, 00, 75, 00, 78, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStore + 7D                                            77ABE54A 9 Bytes  [ 4C, 00, 75, 00, 78, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumSystemStore + 87                                            77ABE554 11 Bytes  [ 62, 00, 6F, 00, 75, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumPhysicalStore + 13                                          77ABEB48 12 Bytes  [ 62, 00, 69, 00, 61, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumPhysicalStore + 20                                          77ABEB55 18 Bytes  [ 00, 00, 00, 16, 00, 24, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumPhysicalStore + 33                                          77ABEB68 1 Byte  [ 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumPhysicalStore + 35                                          77ABEB6A 11 Bytes  [ 20, 00, 28, 00, 4D, 00, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertEnumPhysicalStore + 41                                          77ABEB76 113 Bytes  [ 2D, 00, 20, 00, 52, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindChainInStore + 1A                                           77AC05DA 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindChainInStore + 1C                                           77AC05DC 125 Bytes  [ 74, 00, 65, 00, 63, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindChainInStore + 9A                                           77AC065A 115 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindChainInStore + 10E                                          77AC06CE 27 Bytes  [ 65, 00, 73, 00, 20, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertFindChainInStore + 12A                                          77AC06EA 95 Bytes  [ 6F, 00, 6E, 00, 64, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrW + 28                                             77AC086A 11 Bytes  [ 0D, 00, 0A, 00, 00, 00, 34, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrW + 34                                             77AC0876 7 Bytes  [ 6E, 00, 76, 00, 61, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrW + 3C                                             77AC087E 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrW + 3E                                             77AC0880 7 Bytes  [ 64, 00, 20, 00, 61, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrW + 46                                             77AC0888 29 Bytes  [ 76, 00, 69, 00, 73, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrW + 11                                                 77AC190E 194 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrA + 43                                                 77AC19D1 18 Bytes  [ 00, 61, 00, 20, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrA + 56                                                 77AC19E4 13 Bytes  [ 69, 00, 6E, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrA + 64                                                 77AC19F2 1 Byte  [ 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrA + 66                                                 77AC19F4 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertNameToStrA + 68                                                 77AC19F6 77 Bytes  [ 74, 00, 69, 00, 76, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameW + 8                                                  77AC1CB7 20 Bytes  [ 00, 6C, 00, 61, 00, 74, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameW + 1D                                                 77AC1CCC 53 Bytes  [ 61, 00, 20, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameW + 53                                                 77AC1D02 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameW + 55                                                 77AC1D04 3 Bytes  [ 65, 00, 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameW + 59                                                 77AC1D08 8 Bytes  [ 20, 00, 6E, 00, 6F, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameA + 2F                                                 77AC222C 1 Byte  [ 0D ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameA + 31                                                 77AC222E 4 Bytes  [ 0A, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameA + 37                                                 77AC2234 183 Bytes  [ 34, 00, 01, 00, 4F, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameA + EF                                                 77AC22EC 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertStrToNameA + F1                                                 77AC22EE 77 Bytes  [ 72, 00, 64, 00, 20, 00, 69, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringW + 33                                             77AC263C 41 Bytes  [ 6E, 00, 69, 00, 6B, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringW + 5D                                             77AC2666 39 Bytes  [ 76, 00, 65, 00, 72, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringW + 85                                             77AC268E 35 Bytes  [ 6F, 00, 65, 00, 73, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringW + A9                                             77AC26B2 55 Bytes  [ 74, 00, 6F, 00, 72, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringW + E1                                             77AC26EA 29 Bytes  [ 0A, 00, 00, 00, 00, 00, 48, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringA + 9                                              77AC28DA 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertGetNameStringA + B                                              77AC28DC 312 Bytes  [ 69, 00, 63, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrA + E3                                             77AC2A15 64 Bytes  [ 00, 61, 00, 70, 00, 70, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrA + 124                                            77AC2A56 65 Bytes  [ 65, 00, 67, 00, 69, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrA + 166                                            77AC2A98 59 Bytes  [ 72, 00, 65, 00, 67, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrA + 1A2                                            77AC2AD4 17 Bytes  [ 63, 00, 6F, 00, 6E, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertRDNValueToStrA + 1B4                                            77AC2AE6 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCTLUsage + 4E                                             77AC2C61 50 Bytes  [ 00, 72, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCTLUsage + 81                                             77AC2C94 39 Bytes  [ 20, 00, 71, 00, 75, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCTLUsage + A9                                             77AC2CBC 77 Bytes  [ 20, 00, 69, 00, 6E, 00, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCTLUsage + F7                                             77AC2D0A 71 Bytes  [ 20, 00, 73, 00, 74, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertVerifyCTLUsage + 13F                                            77AC2D52 32 Bytes  [ 20, 00, 77, 00, 61, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptCreateAsyncHandle + 26                                         77AC3754 677 Bytes  [ 0E, 30, 17, 30, 91, 30, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashMessage + 1A                                               77AC39FA 56 Bytes  [ 50, 3C, AA, 3C, C0, 3C, D5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashMessage + 53                                               77AC3A33 24 Bytes  [ 3E, 86, 3E, CF, 3E, 05, 3F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashMessage + 6C                                               77AC3A4C 1 Byte  [ 84 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashMessage + 6E                                               77AC3A4E 45 Bytes  [ 00, 00, 2E, 30, 74, 30, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptHashMessage + 9C                                               77AC3A7C 194 Bytes  [ 95, 36, C6, 36, 11, 37, 62, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncryptMessage + 4                                             77AC42AF 118 Bytes  [ 37, 96, 37, C3, 37, C9, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncryptMessage + 7B                                            77AC4326 1045 Bytes  [ 00, 00, 98, 30, 4A, 32, 5B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignatureWithKey + 1ED                            77AC473C 107 Bytes  [ EC, 38, F4, 38, FC, 38, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignatureWithKey + 259                            77AC47A8 169 Bytes  [ B8, 3A, BC, 3A, C0, 3A, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignatureWithKey + 303                            77AC4852 174 Bytes  [ 24, 33, 28, 33, 2C, 33, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignatureWithKey + 3B2                            77AC4901 318 Bytes  [ 37, 54, 37, 58, 37, 5C, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignatureWithKey + 4F1                            77AC4A40 13 Bytes  [ D0, 39, D4, 39, D8, 39, DC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncryptMessage + 19B                                    77AC4EFB 37 Bytes  [ 35, 20, 35, 24, 35, 28, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncryptMessage + 1C1                                    77AC4F21 193 Bytes  [ 35, 6C, 35, 70, 35, 74, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncryptMessage + 283                                    77AC4FE3 54 Bytes  [ 3C, 04, 3C, 08, 3C, 0C, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncryptMessage + 2BA                                    77AC501A 19 Bytes  [ 75, 00, 6E, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSignAndEncryptMessage + 2CE                                    77AC502E 37 Bytes  [ 64, 00, 72, 00, 65, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptVerifyMessageSignature + D                                     77AC51DF 138 Bytes  [ 00, 69, 00, 72, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecryptMessage + 2E                                            77AC526A 230 Bytes  [ 6E, 00, 64, 00, 20, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecryptAndVerifyMessageSignature + E2                          77AC5351 80 Bytes  [ 00, 6F, 00, 72, 00, 79, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptDecodeMessage + 3A                                             77AC53A2 17 Bytes  [ 61, 00, 62, 00, 6C, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObject + D                                               77AC53B4 1 Byte  [ 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObject + F                                               77AC53B6 17 Bytes  [ 74, 00, 65, 00, 72, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObject + 21                                              77AC53C8 30 Bytes  [ 68, 00, 65, 00, 20, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObject + 40                                              77AC53E7 60 Bytes  [ 00, 66, 00, 6C, 00, 6F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEncodeObject + 7D                                              77AC5424 33 Bytes  [ 6F, 00, 6E, 00, 20, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetOIDFunctionValue + 16                                       77ACB818 58 Bytes  [ F4, 66, C7, 45, F6, 3A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetOIDFunctionValue + 51                                       77ACB853 6 Bytes  [ FF, 8D, 85, B0, FB, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetOIDFunctionValue + 58                                       77ACB85A 8 Bytes  [ 50, 6A, 01, 8D, 85, D0, FB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSetOIDFunctionValue + 61                                       77ACB863 79 Bytes  [ 8D, 8D, A8, FB, FF, FF, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionValue + A                                        77ACB8B3 81 Bytes  [ 50, 8D, 85, D4, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionValue + 5C                                       77ACB905 27 Bytes  [ 50, 68, A8, B2, DD, 77, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionValue + 78                                       77ACB921 6 Bytes  [ 50, 68, 2C, A5, DD, 77 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptGetOIDFunctionValue + 7F                                       77ACB928 147 Bytes  [ 15, A0, 12, DD, 77, 84, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterOIDFunction + 78                                       77ACB9BC 95 Bytes  [ 54, 87, 02, 00, 39, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDFunction + 4A                                     77ACBA1C 2 Bytes  [ 65, E4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDFunction + 4D                                     77ACBA1F 72 Bytes  [ 89, 42, 20, 8B, 45, 14, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDFunction + 96                                     77ACBA68 125 Bytes  [ 0F, 84, DE, 86, 02, 00, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDFunction + 114                                    77ACBAE6 204 Bytes  [ EC, 20, A1, 88, 61, E4, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterDefaultOIDFunction + 6C                                77ACBBB3 9 Bytes  [ 33, FF, 3B, C7, 89, 85, 54, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterDefaultOIDFunction + 76                                77ACBBBD 62 Bytes  [ 89, 8D, 44, F9, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterDefaultOIDFunction + B6                                77ACBBFD 29 Bytes  [ 39, 78, 60, 0F, 84, C1, 28, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterDefaultOIDFunction + D4                                77ACBC1B 66 Bytes  [ 85, 58, F9, FF, FF, 50, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterDefaultOIDFunction + 117                               77ACBC5E 49 Bytes  [ FF, 00, 0F, 84, 09, 90, 02, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterDefaultOIDFunction + 56                              77ACBD0F 115 Bytes  JMP 77AF4D8F C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterDefaultOIDFunction + CA                              77ACBD83 101 Bytes  CALL DDB50313 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterDefaultOIDFunction + 130                             77ACBDE9 31 Bytes  [ 45, EC, 0F, B7, 4D, EC, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterDefaultOIDFunction + 151                             77ACBE0A 94 Bytes  [ 66, 8B, 0C, 4A, 66, 83, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterDefaultOIDFunction + 1B0                             77ACBE69 76 Bytes  [ 66, 83, 7D, 0C, 00, 53, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptRegisterOIDInfo + 94                                           77ACBFB7 46 Bytes  [ 5D, C2, 04, 00, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDInfo + E                                          77ACBFE6 39 Bytes  [ 15, 10, 14, DD, 77, 8B, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDInfo + 36                                         77ACC00E 67 Bytes  [ 65, 00, 6D, 00, 65, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDInfo + 7A                                         77ACC052 27 Bytes  [ 65, 00, 78, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDInfo + 96                                         77ACC06E 1 Byte  [ 0A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptUnregisterOIDInfo + 98                                         77ACC070 40 Bytes  [ 00, 00, 00, 00, 3C, 00, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindLocalizedName + 52                                         77ACC4AA 43 Bytes  [ 61, 00, 73, 00, 73, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindLocalizedName + 7E                                         77ACC4D6 9 Bytes  [ 66, 00, 69, 00, 63, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindLocalizedName + 88                                         77ACC4E0 93 Bytes  [ 69, 00, 6F, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindLocalizedName + E6                                         77ACC53E 13 Bytes  [ 61, 00, 72, 00, 61, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFindLocalizedName + F4                                         77ACC54C 88 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDInfo + 30                                               77ACCEAE 1 Byte  [ 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDInfo + 32                                               77ACCEB0 15 Bytes  [ 65, 00, 73, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDInfo + 42                                               77ACCEC0 77 Bytes  [ 61, 00, 69, 00, 6E, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDInfo + 90                                               77ACCF0E 28 Bytes  [ 6E, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptEnumOIDInfo + AD                                               77ACCF2B 72 Bytes  [ 00, 65, 00, 73, 00, 74, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFormatObject + 42                                              77ACD219 14 Bytes  [ 8B, 45, 08, 53, 83, C6, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFormatObject + 51                                              77ACD228 39 Bytes  [ FF, 33, C0, 5F, 5E, 5B, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFormatObject + 79                                              77ACD250 14 Bytes  [ 00, 00, 3B, C7, 0F, 84, AE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFormatObject + 88                                              77ACD25F 165 Bytes  [ 74, 2F, 3B, C1, 0F, 85, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptFormatObject + 12E                                             77ACD305 4 Bytes  [ 0F, 85, DC, 85 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemRealloc + 56                                                77AD5D28 100 Bytes  [ 39, 3D, B8, 65, E4, 77, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemRealloc + BB                                                77AD5D8D 50 Bytes  [ 3D, 54, 10, DD, 77, FF, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemRealloc + EE                                                77AD5DC0 27 Bytes  [ C7, 5F, 5E, C9, C2, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemRealloc + 10A                                               77AD5DDC 13 Bytes  [ 15, 70, 11, DD, 77, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMemRealloc + 118                                               77AD5DEA 6 Bytes  [ C2, 04, 00, 90, 90, 90 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertProtectFunction + FD                                          77AD729A 19 Bytes  [ 21, 45, FC, 8D, 45, E4, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertProtectFunction + 111                                         77AD72AE 15 Bytes  [ 00, 89, 45, DC, 83, 4D, FC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertProtectFunction + 121                                         77AD72BE 97 Bytes  CALL 77AC7D51 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertProtectFunction + 183                                         77AD7320 18 Bytes  [ 90, 90, 90, 90, 90, 6A, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertProtectFunction + 196                                         77AD7333 1 Byte  [ E4 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSrvProtectFunction + 52                                       77AD83D3 44 Bytes  [ 85, C0, 89, 45, F8, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSrvProtectFunction + 7F                                       77AD8400 31 Bytes  [ 8B, 45, 14, 03, C0, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSrvProtectFunction + 9F                                       77AD8420 1 Byte  [ 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSrvProtectFunction + A1                                       77AD8422 3 Bytes  [ 89, FB, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CertSrvProtectFunction + A5                                       77AD8426 16 Bytes  JMP 77AB534F C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindSmartCardCertInStore + 1                                 77AD84E5 22 Bytes  [ 4D, 10, 3B, CE, 74, 03, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindSmartCardCertInStore + 19                                77AD84FD 9 Bytes  [ 00, 39, 75, 10, 0F, 84, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindSmartCardCertInStore + 23                                77AD8507 48 Bytes  [ 8B, 4D, F8, 8B, 03, 3B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindSmartCardCertInStore + 56                                77AD853A 15 Bytes  JMP 77AB5793 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindSmartCardCertInStore + 67                                77AD854B 42 Bytes  JMP 6BA61052 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddSmartCardCertToStore + 58                                 77AD86C2 121 Bytes  [ 75, 10, FF, 75, 0C, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddSmartCardCertToStore + D2                                 77AD873C 45 Bytes  [ 3D, 60, 00, 00, 80, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddSmartCardCertToStore + 100                                77AD876A 4 Bytes  JMP 77AA8121 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptAddSmartCardCertToStore + 105                                77AD876F 72 Bytes  [ 6A, 00, 56, FF, 75, FC, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptInstallOssGlobal + F                                         77AD87B8 73 Bytes  [ 8B, 45, FC, 56, 57, 89, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetOssGlobal + 12                                            77AD8802 31 Bytes  [ 68, 00, 00, 10, 00, FF, D3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetOssGlobal + 33                                            77AD8823 37 Bytes  JMP 77AB7135 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetOssGlobal + 59                                            77AD8849 6 Bytes  [ 75, E4, E8, CF, F3, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetOssGlobal + 60                                            77AD8850 18 Bytes  JMP 77ABF496 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetOssGlobal + 73                                            77AD8863 113 Bytes  [ 90, 90, 90, 90, 90, 8B, 45, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCalculateEncodedLength + 183                                77AE144E 172 Bytes  [ 8C, 33, 94, 33, 9C, 33, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCalculateEncodedLength + 230                                77AE14FB 454 Bytes  [ 35, 04, 35, 08, 35, 0C, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCalculateEncodedLength + 3F7                                77AE16C2 131 Bytes  [ CF, 34, D9, 34, 67, 35, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCalculateEncodedLength + 47B                                77AE1746 259 Bytes  [ FC, 33, 3F, 34, 84, 34, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCalculateEncodedLength + 57F                                77AE184A 18 Bytes  [ 89, 3C, BE, 3C, EE, 3C, 9A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgDuplicate + 26                                              77AE3289 290 Bytes  [ 94, 02, 00, 1C, 4E, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgDuplicate + 149                                             77AE33AC 7 Bytes  [ F8, 07, 02, 00, CB, 79, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgDuplicate + 151                                             77AE33B4 27 Bytes  [ 82, 3F, 01, 00, 5A, 3F, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgDuplicate + 16D                                             77AE33D0 19 Bytes  [ A1, 6A, 06, 00, 29, 6C, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgDuplicate + 181                                             77AE33E4 19 Bytes  [ 74, 5E, 05, 00, 02, 32, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncoded + 436                         77AE4E19 80 Bytes  [ 43, 6F, 6E, 76, 65, 72, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncoded + 487                         77AE4E6A 281 Bytes  [ 72, 74, 53, 74, 72, 69, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncoded + 5A1                         77AE4F84 88 Bytes  [ 68, 4C, 6F, 67, 6F, 6E, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncoded + 5FA                         77AE4FDD 96 Bytes  [ 65, 6C, 6C, 4B, 6E, 6F, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgVerifyCountersignatureEncoded + 65B                         77AE503E 175 Bytes  [ 69, 00, 6E, 00, 65, 00, 20, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToEncode + D                                            77AE820A 3 Bytes  [ 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgOpenToEncode + 11                                           77AE820E 215 Bytes  [ 73, 00, 20, 00, 66, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersign + 2A                                            77AE82E6 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersign + 2C                                            77AE82E8 3 Bytes  [ 6F, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersign + 30                                            77AE82EC 1 Byte  [ 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersign + 32                                            77AE82EE 25 Bytes  [ 74, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgCountersign + 4C                                            77AE8308 1 Byte  [ 63 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetAndVerifySigner + 26                                     77AE8606 1 Byte  [ 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetAndVerifySigner + 28                                     77AE8608 130 Bytes  [ 6F, 00, 67, 00, 67, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgGetAndVerifySigner + AB                                     77AE868B 26 Bytes  [ 00, 48, 00, 01, 00, 43, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgEncodeAndSignCTL + 16                                       77AE86A6 15 Bytes  [ 74, 00, 68, 00, 20, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgEncodeAndSignCTL + 26                                       77AE86B6 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgEncodeAndSignCTL + 28                                       77AE86B8 13 Bytes  [ 6E, 00, 20, 00, 70, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgEncodeAndSignCTL + 36                                       77AE86C6 41 Bytes  [ 65, 00, 73, 00, 73, 00, 2E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptMsgEncodeAndSignCTL + 60                                       77AE86F0 89 Bytes  [ 61, 00, 73, 00, 20, 00, 6D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveProvider + A                                          77AEDC88 36 Bytes  [ 00, 00, 90, 90, 4E, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveProvider + 2F                                         77AEDCAD 68 Bytes  [ B5, 64, FF, FF, FF, 6A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveProvider + 74                                         77AEDCF2 1 Byte  [ E4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveProvider + 76                                         77AEDCF4 131 Bytes  [ 8B, 46, 08, 23, 45, 10, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveProvider + FA                                         77AEDD78 22 Bytes  [ 00, 00, 00, 0F, 82, 80, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPAddProvider + 2C                                            77AEDDCA 22 Bytes  [ 95, C0, 56, 8D, 04, C5, 88, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPAddProvider + 43                                            77AEDDE1 8 Bytes  [ 00, 00, 3B, C3, 0F, 85, 4B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPAddProvider + 4C                                            77AEDDEA 8 Bytes  [ 00, 38, 5D, FF, 0F, 85, 78, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPAddProvider + 55                                            77AEDDF3 26 Bytes  CALL 77AD5E60 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPAddProvider + 70                                            77AEDE0E 19 Bytes  [ 90, 90, 90, 90, 90, 68, 94, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPPutSignedDataMsg + 32                                       77AEDF95 10 Bytes  [ 03, 00, 00, 57, 8D, 83, A8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPPutSignedDataMsg + 3D                                       77AEDFA0 7 Bytes  [ 8D, 43, 78, 50, E8, 74, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPPutSignedDataMsg + 45                                       77AEDFA8 74 Bytes  [ 00, 33, C0, 38, 45, 0C, 53, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPPutSignedDataMsg + 90                                       77AEDFF3 51 Bytes  [ A1, 88, 61, E4, 77, 53, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveSignedDataMsg + 2F                                    77AEE027 7 Bytes  [ B8, 01, 0F, 85, F1, 71, 02 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveSignedDataMsg + 37                                    77AEE02F 36 Bytes  [ A1, 50, 65, E4, 77, E9, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRemoveSignedDataMsg + 5C                                    77AEE054 51 Bytes  [ 16, 00, 18, 00, 50, CC, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPCreateIndirectData + A                                      77AEE088 38 Bytes  [ 8B, 73, 28, 89, BD, 78, F9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPCreateIndirectData + 31                                     77AEE0AF 19 Bytes  [ FF, F3, AB, BF, 60, CF, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPCreateIndirectData + 45                                     77AEE0C3 29 Bytes  CALL 77AEE061 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPCreateIndirectData + 63                                     77AEE0E1 193 Bytes  [ 83, BD, 6C, F9, FF, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuidForCatalogFile + 96                      77AEE1A3 19 Bytes  [ FF, 3B, C6, 0F, 85, 8D, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuidForCatalogFile + AA                      77AEE1B7 101 Bytes  [ 00, 56, FF, B5, 8C, F9, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuidForCatalogFile + 110                     77AEE21D 9 Bytes  [ 02, 66, 39, 30, 89, 85, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuidForCatalogFile + 11A                     77AEE227 20 Bytes  CALL 77AE81D4 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptSIPRetrieveSubjectGuidForCatalogFile + 12F                     77AEE23C 142 Bytes  [ FF, 03, F8, D1, E7, 81, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPKCS8 + 27                                               77AEF0DD 6 Bytes  [ 9C, 81, FC, FF, 3B, C3 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPKCS8 + 2F                                               77AEF0E5 82 Bytes  [ F4, 74, 15, 6A, 14, BE, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPKCS8 + 82                                               77AEF138 19 Bytes  [ 64, 33, D2, 59, F7, F1, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPKCS8 + 96                                               77AEF14C 61 Bytes  CALL 77ABF9C3 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptImportPKCS8 + D4                                               77AEF18A 133 Bytes  [ F0, 3B, F7, 75, 22, 39, 3D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPKCS8 + 6                                                77AEF2FF 65 Bytes  [ C2, 30, 66, 89, 11, 41, 41, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPKCS8 + 48                                               77AEF341 145 Bytes  [ 83, 3D, 68, 8B, E4, 77, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPKCS8 + DA                                               77AEF3D3 43 Bytes  [ 75, 05, 6A, 0E, 58, EB, 26, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPKCS8 + 106                                              77AEF3FF 177 Bytes  [ 5B, 5F, 5E, 5D, C2, 0C, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CryptExportPKCS8 + 1B8                                              77AEF4B1 15 Bytes  CALL 77AC20E8 C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXImportCertStore + 25                                             77AEF76D 22 Bytes  [ 14, 56, 8B, 75, 0C, 57, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXImportCertStore + 3D                                             77AEF785 15 Bytes  CALL 77AEF2E5 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXImportCertStore + 4D                                             77AEF795 71 Bytes  [ 6A, 6B, FF, 75, E0, E8, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXImportCertStore + 95                                             77AEF7DD 26 Bytes  [ 03, 40, EB, 10, F6, C1, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXImportCertStore + B0                                             77AEF7F8 95 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStore + 35                                             77AEF8DC 27 Bytes  [ 53, 56, 8D, 85, 54, ED, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStore + 51                                             77AEF8F8 49 Bytes  [ 50, 0F, B7, 85, 60, ED, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStore + 83                                             77AEF92A 104 Bytes  [ 50, FF, 15, 40, 14, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStore + EC                                             77AEF993 58 Bytes  [ FF, 74, 65, 6A, 02, 57, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStore + 127                                            77AEF9CE 39 Bytes  [ B5, 6C, ED, FF, FF, FF, D7, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXIsPFXBlob + 17                                                   77AEFA34 5 Bytes  [ C9, C3, 90, 90, 41 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXIsPFXBlob + 1D                                                   77AEFA3A 23 Bytes  [ 50, 00, 50, 00, 4D, 00, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXVerifyPassword + 8                                               77AEFA52 59 Bytes  [ 78, 00, 29, 00, 20, 00, 25, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStoreEx + 20                                           77AEFA8E 60 Bytes  [ 70, 00, 70, 00, 6D, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStoreEx + 5D                                           77AEFACB 54 Bytes  [ 77, 75, 07, BE, 01, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStoreEx + 94                                           77AEFB02 28 Bytes  [ 3B, C3, 75, 07, BE, 25, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStoreEx + B1                                           77AEFB1F 16 Bytes  [ 8B, F0, 57, FF, 15, 14, 14, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!PFXExportCertStoreEx + C2                                           77AEFB30 90 Bytes  [ 8B, C6, 5E, 5B, 5D, C2, 14, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCertificateChain + D                                   77AF9F30 161 Bytes  [ 6F, 00, 20, 00, 6D, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCertificateChain + AF                                  77AF9FD2 17 Bytes  [ 20, 00, 6D, 00, 69, 00, 67, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCertificateChain + C1                                  77AF9FE4 19 Bytes  [ 61, 00, 6C, 00, 6C, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCertificateChain + D5                                  77AF9FF8 14 Bytes  [ 74, 00, 20, 00, 6F, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertDuplicateCertificateChain + E4                                  77AFA007 3 Bytes  [ BD, C4, FE ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertResyncCertificateChainEngine + 2                                77AFA044 80 Bytes  JMP 77ACE787 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertResyncCertificateChainEngine + 53                               77AFA095 23 Bytes  [ 76, 10, 8B, 46, 0C, 03, C6, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertResyncCertificateChainEngine + 6B                               77AFA0AD 62 Bytes  [ 66, 83, 24, 41, 00, 83, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertResyncCertificateChainEngine + AA                               77AFA0EC 12 Bytes  CALL 77B2F01B C:\WINDOWS\system32\MSASN1.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CertResyncCertificateChainEngine + B7                               77AFA0F9 11 Bytes  JMP 77ACE809 C:\WINDOWS\system32\CRYPT32.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptGetLruEntryIdentifier + 49                                   77AFA1BC 118 Bytes  [ 45, 0C, 83, E0, 08, 83, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntryData + B                                         77AFA233 128 Bytes  [ 15, D4, 15, DD, 77, B8, 9A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntryData + 8C                                        77AFA2B4 59 Bytes  [ 70, 18, FF, 15, E0, 15, DD, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntryData + C8                                        77AFA2F0 8 Bytes  [ 36, 8B, 40, 30, 51, FF, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptFindLruEntryData + D1                                        77AFA2F9 33 Bytes  CALL 03278013 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnableLruOfEntries + 1                                       77AFA31B 38 Bytes  [ 45, 10, 83, E1, 03, F3, A4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnableLruOfEntries + 28                                      77AFA342 12 Bytes  [ 40, 30, 51, FF, 70, 18, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnableLruOfEntries + 35                                      77AFA34F 8 Bytes  [ D8, 85, DB, 75, 0A, B8, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnableLruOfEntries + 3E                                      77AFA358 23 Bytes  JMP 77ACF001 C:\WINDOWS\system32\CRYPT32.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!I_CryptEnableLruOfEntries + 58                                      77AFA372 25 Bytes  [ 75, 04, 83, 65, FC, 00, 83, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!OpenCertPerformanceData + 6F                                        77AFEC5E 67 Bytes  [ FF, D6, 8D, 45, 0A, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!OpenCertPerformanceData + B3                                        77AFECA2 137 Bytes  [ C0, EB, 23, 8B, 7D, 10, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!OpenCertPerformanceData + 13D                                       77AFED2C 33 Bytes  [ BF, 0D, 00, 00, C0, E9, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + 4                                      77AFED4E 34 Bytes  [ 75, 14, 8D, 78, 04, F3, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + 27                                     77AFED71 54 Bytes  [ D3, 3B, C7, 89, 45, F8, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + 5E                                     77AFEDA8 27 Bytes  [ EB, 40, 8D, 04, F5, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + 7A                                     77AFEDC4 234 Bytes  [ 30, 8D, 0C, 36, 8B, 75, 24, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] CRYPT32.dll!CollectCertPerformanceData + 166                                    77AFEEB0 24 Bytes  [ EB, 08, 83, 7D, 10, 00, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + FFF66DD9                              3D931675 8 Bytes  [ 00, 74, 00, 68, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + FFF66DE2                              3D93167E 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + FFF66DE4                              3D931680 53 Bytes  [ 62, 00, 6A, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + FFF66E1A                              3D9316B6 1 Byte  [ 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + FFF66E1C                              3D9316B8 7 Bytes  [ 6E, 00, 61, 00, 74, 00, 69 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlW + 19                                              3D9340D9 93 Bytes  [ 88, DC, FD, FF, C6, 45, E7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlW + 77                                              3D934137 6 Bytes  [ 3B, C1, 0F, 85, A5, 99 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlW + 7E                                              3D93413E 11 Bytes  [ 00, 6A, 02, 58, 84, 45, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlW + 8A                                              3D93414A 2 Bytes  [ 00, 48 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlW + 8D                                              3D93414D 3 Bytes  [ 84, 84, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoA + 3F                                          3D934F4D 35 Bytes  CALL 3D91215A 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoA + 63                                          3D934F71 24 Bytes  [ 00, 00, 85, C0, 0F, 8C, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoA + 7C                                          3D934F8A 37 Bytes  [ EC, 10, 8B, 45, 08, 53, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoA + A2                                          3D934FB0 7 Bytes  [ 66, 3B, C7, 0F, 84, DC, 8A ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoA + AB                                          3D934FB9 102 Bytes  [ 8B, 5D, 14, 3B, DF, 0F, 84, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheHeaderData + 2                                           3D93525B 50 Bytes  [ 8B, F0, 85, F6, 7C, 99, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheHeaderData + 35                                          3D93528E 38 Bytes  [ 45, EC, 8B, 00, 8B, 00, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheHeaderData + 5C                                          3D9352B5 33 Bytes  [ 8B, F0, 83, 4D, FC, FF, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheHeaderData + 7E                                          3D9352D7 8 Bytes  [ 0C, FF, 75, 08, E8, E6, 2C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheHeaderData + 87                                          3D9352E0 16 Bytes  [ 8B, F0, 89, 75, DC, EB, 2F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExW + 3F                                        3D93BE82 239 Bytes  [ 8B, C6, 5E, C9, C3, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExW + 12F                                       3D93BF72 12 Bytes  [ 89, 5D, B0, 89, 5D, BC, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExW + 13D                                       3D93BF80 11 Bytes  [ 00, 00, 89, 5D, C4, 89, 5D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExW + 149                                       3D93BF8C 66 Bytes  [ B8, 50, 8D, 45, C0, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExW + 18C                                       3D93BFCF 30 Bytes  [ 47, 1C, EB, 1C, 39, 5D, A8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlW + 9C                                             3D93CA42 43 Bytes  [ FF, 75, 08, 8B, F0, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlW + C9                                             3D93CA6F 43 Bytes  [ E4, 00, 00, 00, 8D, 04, 76, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlW + F6                                             3D93CA9C 129 Bytes  [ 00, 8B, 5D, 0C, 8B, 7D, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlW + 178                                            3D93CB1E 2 Bytes  [ 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlW + 17C                                            3D93CB22 32 Bytes  [ 46, 0C, EB, 1C, 8D, 45, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionA + 36                                           3D94007F 17 Bytes  [ B8, 0D, 00, 00, C0, E9, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionA + 48                                           3D940091 12 Bytes  CALL 3D95C941 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionA + 55                                           3D94009E 138 Bytes  JMP 3D92CD71 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionA + E0                                           3D940129 10 Bytes  [ FF, 8D, 85, E4, FB, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionA + EB                                           3D940134 64 Bytes  [ 15, 50, 12, DD, 77, E9, 6C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateExW + 50                                   3D940732 18 Bytes  [ 45, EC, 83, C4, 0C, 66, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateExW + 63                                   3D940745 41 Bytes  [ 00, 00, 8D, 8C, 30, A8, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateExW + 8D                                   3D94076F 30 Bytes  [ 15, CC, 13, DD, 77, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateExW + AC                                   3D94078E 26 Bytes  [ 45, FC, 8B, 5D, F4, 8D, 84, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateExW + C7                                   3D9407A9 23 Bytes  [ 8B, 45, FC, 39, 45, 10, 8B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedState + A                                       3D9408B1 8 Bytes  [ 8B, 45, A4, 89, 85, 3C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedState + 13                                      3D9408BA 11 Bytes  [ 8D, 45, A4, 50, 8D, 85, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedState + 1F                                      3D9408C6 70 Bytes  [ B5, 60, FF, FF, FF, 6A, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedState + 66                                      3D94090D 73 Bytes  [ 45, 88, 89, 58, 04, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedState + B0                                      3D940957 40 Bytes  [ FF, 75, 94, FF, 15, 94, 14, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlW + C                                        3D940E04 7 Bytes  [ 19, 8B, 45, F0, 2B, F8, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlW + 14                                       3D940E0C 32 Bytes  [ F8, 8D, 34, 46, 8B, 45, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlW + 35                                       3D940E2D 230 Bytes  JMP 3D92CBB8 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoW + C4                                          3D940F14 9 Bytes  CALL 3D969997 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoW + CE                                          3D940F1E 42 Bytes  JMP 3D937DF1 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoW + F9                                          3D940F49 17 Bytes  [ 80, 4E, 0B, 01, 33, C0, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoW + 10B                                         3D940F5B 6 Bytes  [ 8D, 44, 00, 22, 50, E8 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoW + 112                                         3D940F62 23 Bytes  [ 70, FF, FF, 8B, F8, E9, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryA + 2                                            3D940F7A 392 Bytes  [ 15, 54, 10, DD, 77, E9, A2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryA + 18B                                          3D941103 12 Bytes  CALL 3D949034 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryA + 198                                          3D941110 126 Bytes  [ 45, FC, 83, F8, 01, 72, BE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryA + 217                                          3D94118F 25 Bytes  [ 89, 0B, 89, 43, 04, 89, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryA + 231                                          3D9411A9 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionA + 12                                             3D943314 23 Bytes  [ 74, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionA + 2A                                             3D94332C 7 Bytes  [ 65, 00, 20, 00, 6F, 00, 6E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionA + 32                                             3D943334 24 Bytes  [ 20, 00, 63, 00, 61, 00, 6C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionA + 4C                                             3D94334E 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionA + 4E                                             3D943350 9 Bytes  [ 38, 00, 01, 00, 54, 00, 72, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionW + A                                              3D94348A 95 Bytes  [ 6E, 00, 73, 00, 65, 00, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionW + 6A                                             3D9434EA 53 Bytes  [ 68, 00, 65, 00, 20, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionW + A0                                             3D943520 7 Bytes  [ 65, 00, 64, 00, 2E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionW + A8                                             3D943528 9 Bytes  [ 59, 00, 6F, 00, 75, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionW + B2                                             3D943532 7 Bytes  [ 6C, 00, 6F, 00, 67, 00, 6F ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetLockRequestFile + 3F                                        3D9463B5 60 Bytes  [ 5F, C7, 0D, 1C, 3C, 0F, 71, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetLockRequestFile + 7C                                        3D9463F2 117 Bytes  [ 01, 44, AE, 10, 4F, 10, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetLockRequestFile + F2                                        3D946468 45 Bytes  [ C2, 07, 0F, 0B, 07, 13, C2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetLockRequestFile + 120                                       3D946496 39 Bytes  [ 53, 42, A4, 47, 90, 97, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetLockRequestFile + 148                                       3D9464BE 405 Bytes  [ 27, 3B, 75, 38, F2, 6B, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFile + 109                                              3D946654 48 Bytes  [ D6, C0, 66, AC, F8, B3, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFile + 13A                                              3D946685 151 Bytes  CALL 725C2CCF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFile + 1D2                                              3D94671D 73 Bytes  [ 7E, 44, 83, D0, 51, 06, 37, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFile + 21C                                              3D946767 18 Bytes  [ 03, C5, 8C, 27, 44, F5, 93, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFile + 22F                                              3D94677A 29 Bytes  [ FB, D8, 03, 58, FB, FF, 1F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionW + 6D                                           3D947868 37 Bytes  [ 1C, 03, 30, E0, 6C, 16, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionW + 93                                           3D94788E 15 Bytes  [ 3F, 57, 98, C7, 18, C0, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionW + A3                                           3D94789E 5 Bytes  [ 89, 79, 8C, 01, 8E ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionW + AA                                           3D9478A5 98 Bytes  [ 23, 05, 3D, C6, 00, 34, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryOptionW + 10D                                          3D947908 160 Bytes  [ 00, 61, 8F, EF, 04, AB, BE, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoA + 17                                                 3D9487A4 71 Bytes  [ 48, 3C, 8B, 4A, 48, 89, 48, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoA + 5F                                                 3D9487EC 61 Bytes  [ F8, F3, A5, 89, 18, 8B, 4A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoA + 9D                                                 3D94882A 39 Bytes  [ 89, 48, 48, 8B, 4A, 40, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoA + C5                                                 3D948852 8 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoA + CE                                                 3D94885B 67 Bytes  [ EC, 8A, 45, 14, 53, 8B, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCloseHandle + 31                                            3D9490B9 73 Bytes  [ 45, 56, BF, 20, 72, E4, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCloseHandle + 7D                                            3D949105 26 Bytes  [ 00, 75, 07, 68, EA, 04, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCloseHandle + 98                                            3D949120 5 Bytes  [ 8B, 8D, 1C, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCloseHandle + 9E                                            3D949126 28 Bytes  [ 89, 01, 33, C0, 40, EB, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCloseHandle + BB                                            3D949143 28 Bytes  [ FC, FF, C9, C2, 0C, 00, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoW + 5B                                                 3D94BDF3 9 Bytes  [ 00, 8B, 40, 30, 8B, B0, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoW + 65                                                 3D94BDFD 60 Bytes  [ 8D, 45, F4, 50, 6A, 04, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoW + A2                                                 3D94BE3A 5 Bytes  [ 85, C0, 74, 11, 46 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoW + A8                                                 3D94BE40 3 Bytes  [ F4, 68, FC ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpQueryInfoW + AE                                                 3D94BE46 17 Bytes  JMP 3D94BFF6 C:\WINDOWS\system32\WININET.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryDataAvailable + 2                                      3D94BF85 59 Bytes  [ FF, 89, 06, 80, 7D, FF, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryDataAvailable + 3E                                     3D94BFC1 159 Bytes  CALL 3D94B3F7 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryDataAvailable + DE                                     3D94C061 14 Bytes  [ 85, C0, 0F, 8C, AA, E3, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryDataAvailable + ED                                     3D94C070 23 Bytes  [ 90, 90, 90, 90, 90, 6A, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetQueryDataAvailable + 105                                    3D94C088 212 Bytes  [ 8E, 74, 01, 00, 89, 45, FC, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetUnlockRequestFile + 71                                      3D94CB6F 24 Bytes  [ FF, 3B, C7, 89, 45, E4, 0F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetUnlockRequestFile + 8A                                      3D94CB88 122 Bytes  [ 3B, C7, 89, 45, E4, 0F, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetUnlockRequestFile + 105                                     3D94CC03 92 Bytes  [ 8B, 45, D8, 83, C3, 0C, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetUnlockRequestFile + 162                                     3D94CC60 63 Bytes  CALL 3D94C4C2 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetUnlockRequestFile + 1A2                                     3D94CCA0 51 Bytes  [ 8D, 34, 46, 76, 39, 8B, 5D, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersA + 21                                         3D94CF61 49 Bytes  [ 1F, FF, FF, FF, 6D, C6, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersA + 53                                         3D94CF93 56 Bytes  [ 9A, 52, 66, C7, 85, FA, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersA + 8C                                         3D94CFCC 6 Bytes  [ FF, FF, 72, C6, 85, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersA + 93                                         3D94CFD3 6 Bytes  [ FF, FF, EA, 89, B5, 50 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersA + 9A                                         3D94CFDA 14 Bytes  [ FF, FF, F3, AB, 89, B5, 40, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestA + 2B                                               3D94D533 96 Bytes  [ 45, D0, 3B, C3, 0F, 85, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestA + 8C                                               3D94D594 119 Bytes  [ D6, 8A, 01, 88, 02, 41, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestA + 104                                              3D94D60C 12 Bytes  CALL 3D919F43 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestA + 111                                              3D94D619 4 Bytes  [ 85, 20, 01, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestA + 116                                              3D94D61E 2 Bytes  [ C7, 45 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectA + 9                                                3D94DEB7 1 Byte  [ 0C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectA + C                                                3D94DEBA 4 Bytes  CALL 3D94D7C8 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectA + 11                                               3D94DEBF 136 Bytes  [ FF, 85, C0, 0F, 84, 9E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectA + 9B                                               3D94DF49 55 Bytes  [ 5D, E0, EB, 1D, 90, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectA + D3                                               3D94DF81 41 Bytes  [ 75, E4, FF, 15, 08, 10, DD, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlA + 51                                             3D94F379 206 Bytes  [ 31, 5C, 31, 60, 31, 64, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlA + 120                                            3D94F448 293 Bytes  [ 66, 30, 97, 33, B0, 34, E1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlA + 246                                            3D94F56E 79 Bytes  [ 2A, 38, 44, 38, 6B, 38, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlA + 297                                            3D94F5BF 111 Bytes  [ 00, 2A, 30, 33, 30, 89, 30, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCreateUrlA + 307                                            3D94F62F 132 Bytes  [ 00, 06, 30, 22, 30, 06, 31, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectW + 2F                                               3D94F891 101 Bytes  [ 3A, AC, 3A, 18, 3B, 5B, 3B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectW + 95                                               3D94F8F7 256 Bytes  [ 31, 7B, 31, 8C, 31, 92, 31, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectW + 196                                              3D94F9F8 27 Bytes  [ C1, 3D, FB, 3D, 02, 3E, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectW + 1B2                                              3D94FA14 25 Bytes  [ DB, 3E, FA, 3E, 35, 3F, 42, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConnectW + 1CE                                              3D94FA30 112 Bytes  [ 47, 30, A5, 30, C6, 30, 4A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestW + FD                                               3D94FBBB 620 Bytes  [ 35, 0D, 35, 79, 35, 77, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpOpenRequestW + 22D                                              3D94FE28 237 Bytes  [ 50, 3D, 76, 3D, 87, 3D, 98, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersW + CD                                         3D94FF16 90 Bytes  [ 1E, 34, 34, 34, 5D, 34, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersW + 128                                        3D94FF71 170 Bytes  [ 3F, B0, 3F, B8, 3F, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersW + 1D3                                        3D95001C 111 Bytes  [ 65, 6D, 53, 68, 75, 74, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersW + 243                                        3D95008C 54 Bytes  [ 74, 55, 6E, 69, 63, 6F, 64, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpAddRequestHeadersW + 27A                                        3D9500C3 23 Bytes  [ 49, 73, 56, 61, 6C, 69, 64, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetInitializeAutoProxyDll + 26                                 3D9514FE 6 Bytes  [ 65, 00, 0D, 00, 0A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetInitializeAutoProxyDll + 2D                                 3D951505 4 Bytes  [ 00, 00, 00, 6C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetInitializeAutoProxyDll + 32                                 3D95150A 17 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetInitializeAutoProxyDll + 44                                 3D95151C 7 Bytes  [ 6C, 00, 20, 00, 53, 00, 65 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetInitializeAutoProxyDll + 4C                                 3D951524 3 Bytes  [ 63, 00, 75 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlA + F                                               3D954937 13 Bytes  [ 15, 74, 14, DD, 77, 8B, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlA + 1D                                              3D954945 36 Bytes  [ D8, 74, 08, FF, 75, D8, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlA + 42                                              3D95496A 38 Bytes  [ 39, 5D, E4, 74, 08, FF, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlA + 69                                              3D954991 15 Bytes  CALL 3D954261 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCrackUrlA + 79                                              3D9549A1 74 Bytes  [ C2, 10, 00, 90, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ReadUrlCacheEntryStream + 8                                         3D95631B 63 Bytes  CALL 3D957E15 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamA + 15                                   3D95635B 191 Bytes  [ FC, FF, FF, 75, E0, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamA + D5                                   3D95641B 274 Bytes  [ 90, 90, 90, 90, 90, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamA + 1E8                                  3D95652E 55 Bytes  [ 10, 3B, C6, 7C, 07, 8B, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamA + 220                                  3D956566 8 Bytes  CALL 3D930482 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamA + 229                                  3D95656F 7 Bytes  CALL 3D911D54 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryA + 42                                           3D9567B1 3 Bytes  [ FF, 75, E4 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryA + 46                                           3D9567B5 20 Bytes  [ 15, 70, 16, DD, 77, 50, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryA + 5B                                           3D9567CA 1 Byte  [ 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryA + 5D                                           3D9567CC 49 Bytes  [ 90, 90, 90, 90, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryA + 8F                                           3D9567FE 18 Bytes  [ 2D, 15, 00, 00, 89, 45, E0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFileW + B                                        3D958BE1 24 Bytes  [ 50, FF, 15, 38, 7F, E4, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFileW + 24                                       3D958BFA 21 Bytes  [ 85, 7C, FF, FF, FF, 50, 57, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFileW + 3A                                       3D958C10 35 Bytes  [ F8, FF, 15, 34, 10, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFileW + 5E                                       3D958C34 2 Bytes  [ B5, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFileW + 61                                       3D958C37 146 Bytes  [ FF, FF, FF, B5, 64, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileW + 36                                     3D958CCA 19 Bytes  [ 00, 75, 42, 89, 5D, 9C, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileW + 4A                                     3D958CDE 12 Bytes  [ 74, 07, 0C, FF, 15, 58, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileW + 57                                     3D958CEB 39 Bytes  [ 9C, 74, DF, 3D, 59, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileW + 7F                                     3D958D13 6 Bytes  [ 75, 9C, 03, C7, FF, 30 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileW + 86                                     3D958D1A 28 Bytes  [ 70, 08, FF, 70, 04, 6A, 01, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateEx + 3F                                    3D958FBA 12 Bytes  [ AA, E0, 77, 68, 58, 26, DE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateEx + 4C                                    3D958FC7 46 Bytes  [ 83, C4, 0C, 5D, C2, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateEx + 7B                                    3D958FF6 208 Bytes  [ 90, 90, 90, 90, 8B, FF, 55, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateEx + 14C                                   3D9590C7 59 Bytes  [ 00, BE, 11, C0, 19, 17, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetConnectedStateEx + 188                                   3D959103 20 Bytes  [ 3F, 50, 58, C7, A5, C0, D8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExA + 70                                      3D95932A 15 Bytes  [ C6, B8, 80, C3, 69, E2, 5C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExA + 80                                      3D95933A 10 Bytes  [ 7F, F8, 60, 8D, 74, BE, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExA + 8B                                      3D959345 52 Bytes  [ 84, 1F, 3B, 18, 44, E8, B7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExA + C0                                      3D95937A 137 Bytes  [ E7, 2C, C0, C4, 89, 02, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExA + 14A                                     3D959404 59 Bytes  [ D1, 01, F6, 99, 01, 70, 71, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExA + 92                                       3D9598D4 20 Bytes  [ 15, 01, 86, 87, 04, DC, 2D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExA + A7                                       3D9598E9 7 Bytes  [ 0A, E3, 5B, 88, 87, F0, 54 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExA + AF                                       3D9598F1 311 Bytes  [ 96, 51, 87, 0A, 74, 1A, 21, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExA + 1E7                                      3D959A29 102 Bytes  [ 0F, C5, FC, 88, C3, EF, 47, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExA + 24E                                      3D959A90 117 Bytes  [ 5B, 21, C0, FF, FF, FF, B0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryFile + 9                                         3D95A5F2 146 Bytes  [ 98, DC, 00, D9, 35, E6, A1, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ReadUrlCacheEntryStreamEx + 4F                                      3D95A685 57 Bytes  [ 1F, 06, C0, 80, 74, 2E, B0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ReadUrlCacheEntryStreamEx + 89                                      3D95A6BF 285 Bytes  JMP 44B2AA24 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryStream + 114                                     3D95A7DD 160 Bytes  [ B0, B0, 71, F7, 0C, 5F, 35, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryStream + 1B5                                     3D95A87E 9 Bytes  [ DD, 81, 60, 50, 12, CE, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryStream + 1BF                                     3D95A888 91 Bytes  [ 16, 30, 4F, 23, CE, A3, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryStream + 21B                                     3D95A8E4 18 Bytes  [ FF, B0, E1, 1C, 7C, E1, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UnlockUrlCacheEntryStream + 22E                                     3D95A8F7 437 Bytes  [ F1, CC, 70, 0A, D5, 4D, 9C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTime + 7D                                     3D95ACDE 252 Bytes  [ 80, 91, 8C, 93, 00, F2, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTime + 17A                                    3D95ADDB 86 Bytes  [ 3F, D0, 00, A3, 73, 01, EE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTime + 1D1                                    3D95AE32 28 Bytes  [ FB, FF, 1F, D7, C0, 70, 9C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTime + 1EE                                    3D95AE4F 119 Bytes  [ 37, D1, 07, 86, 67, 14, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTime + 266                                    3D95AEC7 121 Bytes  [ FF, 99, 03, 18, 1E, CD, 70, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenA                                                       3D95D688 4 Bytes  [ 90, 90, 8B, 45 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenA + 5                                                   3D95D68D 21 Bytes  [ 8B, 00, 8B, 00, 89, 85, 7C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenA + 1B                                                  3D95D6A3 14 Bytes  [ 8B, 85, 7C, F9, FF, FF, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenA + 2A                                                  3D95D6B2 29 Bytes  [ 3D, C0, 78, E4, 77, 01, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenA + 48                                                  3D95D6D0 9 Bytes  [ 00, 68, 40, 46, DF, 77, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenW + 15                                                  3D95DB16 109 Bytes  [ 25, 28, 12, DD, 77, 90, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenW + 83                                                  3D95DB84 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenW + 9C                                                  3D95DB9D 5 Bytes  [ 60, 07, 00, CC, 27 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenW + A2                                                  3D95DBA3 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenW + AE                                                  3D95DBAF 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallback + 10                                      3D95DCD0 49 Bytes  [ F4, 28, 07, 00, 00, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallback + 42                                      3D95DD02 161 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallback + E4                                      3D95DDA4 11 Bytes  [ 86, 31, 07, 00, 96, 31, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallback + F0                                      3D95DDB0 83 Bytes  [ C8, 31, 07, 00, D8, 31, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallback + 144                                     3D95DE04 173 Bytes  [ 7E, 33, 07, 00, 8E, 33, 07, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestA + 5C                                               3D95EEDD 32 Bytes  [ 72, 69, 6E, 67, 00, D9, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestA + 7D                                               3D95EEFE 86 Bytes  [ 4E, 74, 51, 75, 65, 72, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestA + D4                                               3D95EF55 35 Bytes  [ 62, 6C, 65, 00, 00, 87, 02, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestA + F8                                               3D95EF79 247 Bytes  [ 00, 80, 02, 52, 74, 6C, 49, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestA + 1F1                                              3D95F072 155 Bytes  [ EB, 02, 52, 74, 6C, 51, 75, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlA + 44                                               3D95F3E0 37 Bytes  [ 4C, 03, 52, 74, 6C, 55, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlA + 6A                                               3D95F406 1 Byte  [ 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlA + 6C                                               3D95F408 51 Bytes  [ 67, 65, 4B, 65, 79, 00, 36, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlA + A0                                               3D95F43C 29 Bytes  [ B7, 04, 5F, 69, 74, 6F, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlA + BE                                               3D95F45A 19 Bytes  [ 4E, 74, 45, 6E, 75, 6D, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerW + 3C                                    3D960984 16 Bytes  [ 15, 54, 10, DD, 77, 83, F8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerW + 4E                                    3D960996 36 Bytes  [ 8D, 86, B8, 01, 00, 00, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerW + 73                                    3D9609BB 140 Bytes  [ FF, 83, 7D, F4, 00, 75, 07, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerW + 100                                   3D960A48 16 Bytes  [ EB, 13, 0F, B7, 47, 20, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerW + 111                                   3D960A59 92 Bytes  [ 0C, 89, 47, 68, 8B, 45, 0C, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlW + A0                                            3D960B8D 106 Bytes  [ 0E, 89, 46, 04, 89, 30, 89, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlW + 10B                                           3D960BF8 39 Bytes  [ 55, 8B, EC, 53, 56, 68, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlW + 133                                           3D960C20 46 Bytes  [ 00, 8B, 00, 75, 0B, 8B, 4D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlW + 163                                           3D960C50 12 Bytes  [ 01, 75, 07, BE, AA, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlW + 170                                           3D960C5D 48 Bytes  [ 4E, 04, 89, 01, 89, 48, 04, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryInfoA + 2B6                                         3D962709 108 Bytes  [ 20, 07, 00, 70, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryInfoA + 323                                         3D962776 7 Bytes  [ 00, 00, 00, 60, 07, 00, 5C ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryInfoA + 32D                                         3D962780 423 Bytes  [ 00, 30, 04, 30, 08, 30, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryInfoA + 4D5                                         3D962928 36 Bytes  [ CC, 39, 8C, 3A, 90, 3A, 94, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryInfoA + 4FB                                         3D96294E 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerA + 15                                     3D962DAC 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerA + 1D                                     3D962DB4 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerA + 3C                                     3D962DD3 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerA + 1F                                    3D962DF7 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerA + 27                                    3D962DFF 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerA + 46                                    3D962E1E 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerA + 6F                                    3D962E47 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheContainerA + 7B                                    3D962E53 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryW + 33                                           3D9630B0 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryW + 52                                           3D9630CF 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryW + 5B                                           3D9630D8 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryW + 64                                           3D9630E1 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CommitUrlCacheEntryW + 6D                                           3D9630EA 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExW + 23                                            3D963364 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExW + 2C                                            3D96336D 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExW + 33                                            3D963374 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExA + 23                                            3D96339C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExA + 29                                            3D9633A2 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExA + 2E                                            3D9633A7 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExA + 38                                            3D9633B1 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetReadFileExA + 82                                            3D9633FB 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExW + 5                                            3D964ACE 191 Bytes  [ 67, 24, 8F, 0F, 77, 18, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExW + C5                                           3D964B8E 367 Bytes  [ 7C, D0, 12, FC, FF, 9F, 7F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExA + 136                                          3D964CFE 27 Bytes  [ F3, 99, CC, C7, 32, 4F, F2, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExA + 152                                          3D964D1A 181 Bytes  [ 5E, F4, 26, 6B, C8, 50, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExA + 208                                          3D964DD0 72 Bytes  [ 23, 1B, 2F, F8, 8E, 97, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExA + 251                                          3D964E19 32 Bytes  [ 48, 87, 41, 9D, A2, 00, 2B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieExA + 272                                          3D964E3A 328 Bytes  [ E1, C7, D0, 30, 12, 76, 8A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieExW + 52                                           3D965FCF 81 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieExW + A6                                           3D966023 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieExW + AF                                           3D96602C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieExW + C2                                           3D96603F 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieExW + DE                                           3D96605B 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredW + 27                                        3D96638F 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredW + 33                                        3D96639B 112 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredW + A4                                        3D96640C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredW + AA                                        3D966412 47 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredW + DA                                        3D966442 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IncrementUrlCacheHeaderData + 7D                                    3D967260 32 Bytes  [ 0A, 3B, 0E, 3B, 12, 3B, 16, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IncrementUrlCacheHeaderData + 9E                                    3D967281 133 Bytes  [ 50, 02, 00, A4, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IncrementUrlCacheHeaderData + 124                                   3D967307 332 Bytes  [ 3B, 93, 3E, D5, 3E, ED, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IncrementUrlCacheHeaderData + 271                                   3D967454 1 Byte  [ 28 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IncrementUrlCacheHeaderData + 273                                   3D967456 3 Bytes  [ 00, 00, A9 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsHostInProxyBypassList + 17                                        3D967A44 15 Bytes  [ C2, 3E, D5, 3E, 78, 3F, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsHostInProxyBypassList + 27                                        3D967A54 94 Bytes  [ B4, 30, BB, 30, D5, 30, D9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsHostInProxyBypassList + 86                                        3D967AB3 39 Bytes  [ 3C, 12, 3C, 17, 3C, 28, 3C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsHostInProxyBypassList + AE                                        3D967ADB 132 Bytes  [ 3E, C6, 3E, D4, 3E, ED, 3E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsHostInProxyBypassList + 133                                       3D967B60 123 Bytes  [ B0, 00, 00, 00, 07, 30, 10, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntry + 56                                            3D967D84 289 Bytes  [ 6D, 3D, 7A, 3D, 7F, 3D, 92, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntry + 17A                                           3D967EA8 71 Bytes  [ 3F, 30, 60, 30, 85, 30, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntry + 1C2                                           3D967EF0 7 Bytes  [ 00, 60, 04, 00, 40, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntry + 1CA                                           3D967EF8 63 Bytes  [ 59, 31, CA, 31, 55, 32, 8F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntry + 20A                                           3D967F38 96 Bytes  [ 27, 30, 73, 30, 8E, 30, A8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossingW + 12F                                  3D968942 22 Bytes  [ 03, D0, 24, FA, 41, 11, 7D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossingW + 146                                  3D968959 45 Bytes  CALL 5E729A6F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossingW + 174                                  3D968987 8 Bytes  [ 9F, 66, 30, 57, 83, 37, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossingW + 17D                                  3D968990 195 Bytes  [ C3, 08, 14, E5, B9, 0F, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossingW + 241                                  3D968A54 69 Bytes  [ 69, 06, 78, C9, 3F, CA, A0, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerW + 35                                       3D96939A 49 Bytes  JMP 3D969870 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerW + 68                                       3D9693CD 79 Bytes  [ FF, 8B, 50, 30, 8B, 4D, C4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerW + B8                                       3D96941D 6 Bytes  [ FF, 50, FF, B5, 2C, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerW + BF                                       3D969424 33 Bytes  [ FF, FF, 15, 10, 13, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerW + E1                                       3D969446 40 Bytes  [ 50, 8D, 85, 04, FF, FF, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroupW + 38                                         3D969659 26 Bytes  [ B5, 1C, FF, FF, FF, FF, 15, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroupW + 53                                         3D969674 11 Bytes  [ FF, FF, 15, 10, 13, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroupW + 5F                                         3D969680 20 Bytes  [ F6, 43, 42, 01, 75, 7B, 6A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroupW + 74                                         3D969695 72 Bytes  [ FF, FF, 50, FF, B5, 1C, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroupW + BD                                         3D9696DE 5 Bytes  [ 89, 95, F4, FE, FF ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacyGetZonePreferenceW + 17                                      3D970E50 60 Bytes  JMP 3D96901A C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacyGetZonePreferenceW + 54                                      3D970E8D 11 Bytes  JMP 3D970A43 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacyGetZonePreferenceW + 60                                      3D970E99 53 Bytes  [ FF, 55, 8B, EC, 51, 51, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacyGetZonePreferenceW + 96                                      3D970ECF 10 Bytes  CALL 3D970FBE C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacyGetZonePreferenceW + A2                                      3D970EDB 11 Bytes  JMP 3D970FC6 C:\WINDOWS\system32\WININET.dll
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerA + 13                                       3D97260B 35 Bytes  [ 00, 2C, B7, E0, 77, 03, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerA + 37                                       3D97262F 53 Bytes  [ 00, 48, B7, E0, 77, 03, 80, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerA + 6D                                       3D972665 28 Bytes  [ 00, 2B, C3, 57, 8B, 7D, 18, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerA + 8A                                       3D972682 28 Bytes  CALL 3D93449F C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheContainerA + A8                                       3D9726A0 35 Bytes  [ 00, 33, FF, 39, 7D, 0C, 76, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamW + 4                                    3D972C09 43 Bytes  [ 45, 1C, 8D, 04, D8, 83, 60, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamW + 30                                   3D972C35 48 Bytes  [ 0C, 83, 45, F4, 0C, 83, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamW + 61                                   3D972C66 110 Bytes  CALL 3D972A8E C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamW + D0                                   3D972CD5 73 Bytes  [ 8D, 04, 31, 8B, 75, F4, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryStreamW + 11A                                  3D972D1F 35 Bytes  [ FF, 2B, 75, 08, 8B, 45, E8, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DetectAutoProxyUrl + 4D                                             3D976978 1 Byte  [ 67 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DetectAutoProxyUrl + 4F                                             3D97697A 7 Bytes  [ 54, 00, 72, 00, 61, 00, 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DetectAutoProxyUrl + 57                                             3D976982 7 Bytes  [ 65, 00, 4C, 00, 65, 00, 76 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DetectAutoProxyUrl + 5F                                             3D97698A 9 Bytes  [ 65, 00, 6C, 00, 00, 00, 44, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DetectAutoProxyUrl + 69                                             3D976994 1 Byte  [ 62 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryW + C                                            3D979876 3 Bytes  [ 68, 00, 69 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryW + 10                                           3D97987A 3 Bytes  [ 73, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryW + 14                                           3D97987E 3 Bytes  [ 6F, 00, 70 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryW + 18                                           3D979882 3 Bytes  [ 65, 00, 72 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateUrlCacheEntryW + 1C                                           3D979886 3 Bytes  [ 61, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExA + 3A                                        3D983F44 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExA + 46                                        3D983F50 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExA + 49                                        3D983F53 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExA + 6C                                        3D983F76 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheEntryInfoExA + A0                                        3D983FAA 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryW + 15                                        3D98477A 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryW + 17                                        3D98477C 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryW + 21                                        3D984786 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryW + 25                                        3D98478A 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExW + 24                                      3D9847B3 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExW + 31                                      3D9847C0 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExW + 3A                                      3D9847C9 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExW + 43                                      3D9847D2 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheEntryExW + 50                                      3D9847DF 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDialW + 5                                                   3D9A0434 1 Byte  [ 63 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDialW + 7                                                   3D9A0436 57 Bytes  [ 6F, 00, 6E, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDialW + 41                                                  3D9A0470 13 Bytes  [ 61, 00, 6E, 00, 79, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDialW + 4F                                                  3D9A047E 5 Bytes  [ 77, 00, 6E, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDialW + 55                                                  3D9A0484 25 Bytes  [ 63, 00, 6F, 00, 6E, 00, 74, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDial + B                                                    3D9A0938 31 Bytes  [ 65, 00, 20, 00, 6F, 00, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDial + 2B                                                   3D9A0958 11 Bytes  [ 73, 00, 75, 00, 70, 00, 70, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDial + 37                                                   3D9A0964 1 Byte  [ 74 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDial + 39                                                   3D9A0966 49 Bytes  [ 65, 00, 64, 00, 20, 00, 52, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetDial + 6B                                                   3D9A0998 25 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetHangUp + 15                                                 3D9A09B2 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetHangUp + 17                                                 3D9A09B4 11 Bytes  [ 62, 00, 6A, 00, 65, 00, 63, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetHangUp + 23                                                 3D9A09C0 1 Byte  [ 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetHangUp + 25                                                 3D9A09C2 7 Bytes  [ 61, 00, 73, 00, 20, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetHangUp + 2D                                                 3D9A09CA 1 Byte  [ 6C ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodial + 5                                                3D9A0AA0 23 Bytes  [ 62, 00, 6C, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodial + 1D                                               3D9A0AB8 55 Bytes  [ 20, 00, 52, 00, 50, 00, 43, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodial + 55                                               3D9A0AF0 11 Bytes  [ 6D, 00, 69, 00, 73, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodial + 61                                               3D9A0AFC 19 Bytes  [ 67, 00, 20, 00, 69, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodial + 75                                               3D9A0B10 109 Bytes  [ 79, 00, 73, 00, 74, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialHangup + B                                          3D9A0F44 66 Bytes  [ 46, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialHangup + 4E                                         3D9A0F87 44 Bytes  [ 00, 68, 00, 65, 00, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialHangup + 7B                                         3D9A0FB4 33 Bytes  [ 0D, 00, 0A, 00, 56, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialHangup + 9D                                         3D9A0FD6 5 Bytes  [ 69, 00, 67, 00, 75 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialHangup + A3                                         3D9A0FDC 33 Bytes  [ 72, 00, 65, 00, 64, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialCallback + A                                        3D9A0FFE 49 Bytes  [ 74, 00, DA, 05, 00, 00, DB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialCallback + 3C                                       3D9A1030 8 Bytes  [ E6, 05, 00, 00, E7, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialCallback + 45                                       3D9A1039 25 Bytes  JMP 279A1043 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialCallback + 60                                       3D9A1054 6 Bytes  [ EF, 05, 00, 00, F0, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAutodialCallback + 68                                       3D9A105C 19 Bytes  [ F1, 05, 00, 00, F2, 05, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnlineW + 2C                                              3D9A12B7 155 Bytes  [ 00, 88, 06, 00, 00, 89, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnlineW + C8                                              3D9A1353 15 Bytes  [ 00, AF, 06, 00, 00, B0, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnlineW + D8                                              3D9A1363 92 Bytes  [ 00, B3, 06, 00, 00, B4, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnline + 54                                               3D9A13C0 47 Bytes  [ CA, 06, 00, 00, CB, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnline + 84                                               3D9A13F0 50 Bytes  [ D6, 06, 00, 00, D7, 06, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnline + B7                                               3D9A1423 16 Bytes  [ 00, E3, 06, 00, 00, E4, 06, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnline + C8                                               3D9A1434 82 Bytes  CALL 269A143F 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGoOnline + 11B                                              3D9A1487 3 Bytes  [ 00, FC, 06 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DllInstall + B                                                      3D9A342B 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DllInstall + 19                                                     3D9A3439 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DllInstall + 2B                                                     3D9A344B 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DllInstall + 45                                                     3D9A3465 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DllInstall + 4A                                                     3D9A346A 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlA + D                                        3D9A59CF 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlA + 13                                       3D9A59D5 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlA + 1F                                       3D9A59E1 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlA + 29                                       3D9A59EB 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCanonicalizeUrlA + 2F                                       3D9A59F1 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlA + 1E                                            3D9A5A44 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlA + 23                                            3D9A5A49 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlA + 3C                                            3D9A5A62 30 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCombineUrlA + 5B                                            3D9A5A81 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCertByURL + 5                                            3D9A5A8B 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCertByURL + 33                                           3D9A5AB9 82 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCertByURL + 87                                           3D9A5B0D 54 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCertByURL + BE                                           3D9A5B44 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetFilePointer + 20                                         3D9A5B69 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetFilePointer + 25                                         3D9A5B6E 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetFilePointer + 42                                         3D9A5B8B 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetFilePointer + 65                                         3D9A5BAE 31 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetFilePointer + 85                                         3D9A5BCE 44 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoA + 13                                   3D9A5C3F 38 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoA + 3B                                   3D9A5C67 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoA + 49                                   3D9A5C75 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoA + 67                                   3D9A5C93 23 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoA + 80                                   3D9A5CAC 52 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAttemptConnect + 1C                                         3D9A5D98 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAttemptConnect + 26                                         3D9A5DA2 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAttemptConnect + 28                                         3D9A5DA4 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAttemptConnect + 3B                                         3D9A5DB7 16 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAttemptConnect + 4D                                         3D9A5DC9 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURL + C                                    3D9A61B1 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURL + 10                                   3D9A61B5 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURL + 21                                   3D9A61C6 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURL + 2E                                   3D9A61D3 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURL + 60                                   3D9A6205 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFile + 1D                                              3D9A626B 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFile + 27                                              3D9A6275 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFile + 2C                                              3D9A627A 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFile + 3F                                              3D9A628D 2 Bytes  [ 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFile + 44                                              3D9A6292 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileA + 1D                                          3D9A649D 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileA + 27                                          3D9A64A7 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileA + 2C                                          3D9A64AC 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileA + 3C                                          3D9A64BC 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileA + 41                                          3D9A64C1 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURL + B                                   3D9A666B 46 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURL + 3A                                  3D9A669A 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURL + 40                                  3D9A66A0 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURL + 48                                  3D9A66A8 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURL + 6C                                  3D9A66CC 19 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionA + B                                        3D9A67C7 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionA + 39                                       3D9A67F5 33 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionA + 5D                                       3D9A6819 3 Bytes  [ 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionA + 62                                       3D9A681E 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionA + 7D                                       3D9A6839 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookupExW + 18                                            3D9A6C63 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookupExW + 2F                                            3D9A6C7A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookupExW + 37                                            3D9A6C82 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookupExW + 3F                                            3D9A6C8A 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookup + 15                                               3D9A6CA4 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookup + 22                                               3D9A6CB1 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookup + 28                                               3D9A6CB7 37 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookup + 4F                                               3D9A6CDE 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ForceNexusLookup + 61                                               3D9A6CF0 43 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateMD5SSOHash + B                                                3D9A6DD3 58 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateMD5SSOHash + 46                                               3D9A6E0E 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateMD5SSOHash + 54                                               3D9A6E1C 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateMD5SSOHash + 64                                               3D9A6E2C 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!CreateMD5SSOHash + 6C                                               3D9A6E34 142 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlW + 8A                                               3D9A6FC1 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetOpenUrlW + B3                                               3D9A6FEA 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetWriteFileExA + D                                            3D9A6FFC 15 Bytes  [ 00, 00, 00, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileW + B                                           3D9A700C 27 Bytes  [ 65, 00, 61, 00, 64, 00, 79, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileW + 27                                          3D9A7028 69 Bytes  [ 6F, 00, 6E, 00, 6E, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileW + 6D                                          3D9A706E 69 Bytes  [ 70, 00, 74, 00, 2E, 00, 0D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFindNextFileW + B3                                          3D9A70B4 94 Bytes  [ 69, 00, 73, 00, 20, 00, 74, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetCheckConnectionW + 52                                       3D9A7113 42 Bytes  [ 00, 20, 00, 6F, 00, 63, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetStatusCallbackW + 16                                     3D9A713E 76 Bytes  [ 75, 00, 6D, 00, 62, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetShowSecurityInfoByURLW + 48                                 3D9A718B 132 Bytes  [ 00, 20, 00, 74, 00, 68, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURLW + 70                                  3D9A7210 13 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetSecurityInfoByURLW + 7E                                  3D9A721E 125 Bytes  [ 67, 00, 65, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoW + 77                                   3D9A729C 153 Bytes  [ 68, 00, 61, 00, 6E, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoW + 111                                  3D9A7336 7 Bytes  [ 20, 00, 61, 00, 6E, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoW + 119                                  3D9A733E 17 Bytes  [ 20, 00, 74, 00, 68, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoW + 12B                                  3D9A7350 37 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetLastResponseInfoW + 151                                  3D9A7376 15 Bytes  [ 00, 00, 20, 01, 01, 00, 7B, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExA + 2C                                           3D9A762A 53 Bytes  [ 0A, 00, 00, 00, 00, 00, 8C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExW + 31                                           3D9A7660 164 Bytes  [ 61, 00, 20, 00, 72, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExW + D6                                           3D9A7705 26 Bytes  [ 00, 20, 00, 62, 00, 65, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExW + F1                                           3D9A7720 5 Bytes  [ 20, 00, 74, 00, 68 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExW + F7                                           3D9A7726 27 Bytes  [ 65, 00, 20, 00, 64, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetOptionExW + 113                                          3D9A7742 15 Bytes  [ 6F, 00, 6C, 00, 6C, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ResumeSuspendedDownload + 45                                        3D9A966C 7 Bytes  [ 98, 00, 01, 00, 41, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ResumeSuspendedDownload + 4D                                        3D9A9674 89 Bytes  [ 6D, 00, 61, 00, 6C, 00, 66, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ResumeSuspendedDownload + A7                                        3D9A96CE 9 Bytes  [ 6E, 00, 67, 00, 20, 00, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ResumeSuspendedDownload + B1                                        3D9A96D8 9 Bytes  [ 20, 00, 75, 00, 6E, 00, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ResumeSuspendedDownload + BB                                        3D9A96E2 39 Bytes  [ 6E, 00, 64, 00, 20, 00, 6F, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DispatchAPICall + B                                                 3D9A9EFC 19 Bytes  [ 73, 00, 61, 00, 67, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DispatchAPICall + 1F                                                3D9A9F10 1 Byte  [ 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DispatchAPICall + 21                                                3D9A9F12 65 Bytes  [ 6E, 00, 6F, 00, 74, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DispatchAPICall + 63                                                3D9A9F54 33 Bytes  [ 49, 00, 44, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DispatchAPICall + 85                                                3D9A9F76 1 Byte  [ 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!_GetFileExtensionFromUrl + 24                                       3D9ABB48 9 Bytes  [ 70, 00, 65, 00, 63, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!_GetFileExtensionFromUrl + 2E                                       3D9ABB52 5 Bytes  [ 69, 00, 65, 00, 64 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!_GetFileExtensionFromUrl + 34                                       3D9ABB58 43 Bytes  [ 2E, 00, 0D, 00, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!_GetFileExtensionFromUrl + 60                                       3D9ABB84 15 Bytes  [ 61, 00, 64, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!_GetFileExtensionFromUrl + 70                                       3D9ABB94 141 Bytes  [ 73, 00, 74, 00, 61, 00, 62, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFortezzaCommand + D                                         3D9AC010 153 Bytes  [ 65, 00, 20, 00, 66, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFortezzaCommand + A7                                        3D9AC0AA 7 Bytes  [ 74, 00, 68, 00, 65, 00, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFortezzaCommand + AF                                        3D9AC0B2 115 Bytes  [ 4D, 00, 5A, 00, 20, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFortezzaCommand + 123                                       3D9AC126 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetFortezzaCommand + 125                                       3D9AC128 5 Bytes  [ 72, 00, 72, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileA + 2B                                                    3D9AEF73 9 Bytes  [ 80, 75, 08, 6A, 06, 58, E9, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileA + 36                                                    3D9AEF7E 50 Bytes  [ 53, 56, 8D, 45, FC, 50, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileA + 69                                                    3D9AEFB1 6 Bytes  [ 00, 8D, 45, F4, 50, 56 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileA + 70                                                    3D9AEFB8 10 Bytes  [ 15, D0, 15, DD, 77, 85, C0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileA + 7B                                                    3D9AEFC3 10 Bytes  [ 15, F4, 15, DD, 77, EB, 2A, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileA + 2E                                                    3D9AF075 96 Bytes  [ FC, FF, 33, DB, 39, 5D, E0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileA + 8F                                                    3D9AF0D6 1 Byte  [ 6F ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileA + 91                                                    3D9AF0D8 31 Bytes  [ 6E, 00, 61, 00, 74, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileA + B1                                                    3D9AF0F8 28 Bytes  [ 6C, 00, 73, 00, 65, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileA + CE                                                    3D9AF115 61 Bytes  [ 5B, E1, 77, 90, 90, 90, 90, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileSize + 29                                                 3D9B02F6 6 Bytes  [ 90, 90, 90, 90, 90, 8B ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileSize + 30                                                 3D9B02FD 74 Bytes  [ 55, 8B, EC, 53, 8B, 5D, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileSize + 7B                                                 3D9B0348 3 Bytes  [ 8B, 75, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileSize + 7F                                                 3D9B034C 21 Bytes  [ 8B, 7D, 08, 56, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileSize + 96                                                 3D9B0363 15 Bytes  [ 0C, 83, C7, 08, 57, E8, D5, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileA + 8                                                  3D9B0762 50 Bytes  [ 76, 2C, 03, F8, 53, E8, 62, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRemoveDirectoryA + 2                                             3D9B0795 47 Bytes  [ 03, F8, 8B, 46, 28, 8B, 4C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryA + 18                                        3D9B07C6 3 Bytes  [ 8B, FF, 55 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryA + 1C                                        3D9B07CA 137 Bytes  [ EC, 51, 51, 8B, 45, 14, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryA + A6                                        3D9B0854 115 Bytes  [ 48, 07, 83, E1, F8, 2B, C8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryA + 11A                                       3D9B08C8 49 Bytes  JMP 315B3BCF 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryA + 14C                                       3D9B08FA 23 Bytes  [ 4C, 08, 08, 8B, 72, 28, 89, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandA + 3C                                                    3D9B0981 16 Bytes  [ 10, 8B, 4D, 10, 83, C0, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandA + 4D                                                    3D9B0992 55 Bytes  [ FF, FF, 8B, 7D, 08, 8D, 45, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandA + 85                                                    3D9B09CA 35 Bytes  [ 00, 00, 8D, 45, FC, 50, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandA + A9                                                    3D9B09EE 6 Bytes  [ 5F, FC, FF, FF, 33, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandA + B0                                                    3D9B09F5 1 Byte  [ C7 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetCurrentDirectoryA                                             3D9B140A 198 Bytes  [ 90, 90, 8B, FF, 55, 8B, EC, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileA + 11                                              3D9B14D1 83 Bytes  [ 55, 8B, EC, 8D, 45, 04, 83, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileA + 3E                                                   3D9B1525 181 Bytes  [ 83, C0, 04, 50, 68, EE, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileA + F4                                                   3D9B15DB 122 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileA + 16F                                                  3D9B1656 50 Bytes  [ FF, 55, 8B, EC, 8D, 45, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileA + 1A2                                                  3D9B1689 59 Bytes  [ DE, 5A, DE, 77, 68, 48, 1E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileA + 1DE                                                  3D9B16C5 29 Bytes  [ 90, 90, 90, 90, 90, 8B, FF, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileW + 33                                              3D9B1788 94 Bytes  [ 8B, 45, 08, 33, DB, 83, FE, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileW + 92                                              3D9B17E7 28 Bytes  [ EC, 83, EC, 50, A1, 88, 61, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileW + AF                                              3D9B1804 79 Bytes  [ 45, 0C, 2B, D1, 83, FA, 08, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileW + FF                                              3D9B1854 41 Bytes  [ 8D, 46, 18, 8B, C8, 8B, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpFindFirstFileW + 129                                             3D9B187E 23 Bytes  [ 8B, 4D, FC, 5F, 5E, 5B, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpDeleteFileW + 12                                                 3D9B1896 22 Bytes  [ 55, 8B, EC, 8B, 4D, 10, 56, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpDeleteFileW + 29                                                 3D9B18AD 117 Bytes  [ 8B, 45, 0C, 8B, 4E, 10, 50, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpDeleteFileW + 9F                                                 3D9B1923 21 Bytes  [ 64, A1, 18, 00, 00, 00, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileW + 2                                                  3D9B1939 56 Bytes  CALL 3D9B1E1D C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileW + 3B                                                 3D9B1972 9 Bytes  [ C2, 08, 00, 90, 90, 90, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileW + 45                                                 3D9B197C 73 Bytes  [ 2A, 85, E3, 77, 3D, 85, E3, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileW + 8F                                                 3D9B19C6 107 Bytes  CALL 3D9B1E43 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRenameFileW + FC                                                 3D9B1A33 62 Bytes  CALL 3D9B1DCD C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileW                                                        3D9B1A75 106 Bytes  [ 90, 90, 90, FF, FF, FF, FF, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileW + 6B                                                   3D9B1AE0 51 Bytes  [ DC, FF, 15, 70, 16, DD, 77, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileW + 9F                                                   3D9B1B14 6 Bytes  [ C2, 08, 00, 90, FF, FF ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpOpenFileW + A6                                                   3D9B1B1B 94 Bytes  [ FF, A8, 86, E3, 77, BB, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCreateDirectoryW + 4B                                            3D9B1B7A 72 Bytes  CALL 3D9B1E6B C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCreateDirectoryW + 94                                            3D9B1BC3 177 Bytes  [ FF, 6B, 87, E3, 77, 7E, 87, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpRemoveDirectoryW + 93                                            3D9B1C75 30 Bytes  [ 83, 65, FC, 00, FF, 75, 0C, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryW + 1                                         3D9B1C94 109 Bytes  [ 00, 89, 45, E4, 33, C0, 40, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryW + 6F                                        3D9B1D02 7 Bytes  CALL 3D9B1EB9 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryW + 77                                        3D9B1D0A 43 Bytes  [ 24, 90, 90, 90, 90, 90, 8B, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpSetCurrentDirectoryW + A3                                        3D9B1D36 81 Bytes  [ 83, 7D, D8, 00, 7C, 11, 8D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetCurrentDirectoryW + 44                                        3D9B1D88 45 Bytes  [ 00, 89, 45, E0, EB, 24, 90, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetCurrentDirectoryW + 72                                        3D9B1DB6 166 Bytes  CALL 3D94FD54 C:\WINDOWS\system32\WININET.dll
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandW + 4A                                                    3D9B1E5D 3 Bytes  JMP 021F1E5B 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandW + 4E                                                    3D9B1E61 234 Bytes  [ 83, C4, 0C, 5D, C2, 14, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandW + 139                                                   3D9B1F4C 159 Bytes  [ 75, 0C, FF, 71, 04, E8, A0, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandW + 1D9                                                   3D9B1FEC 17 Bytes  [ 50, 6A, 01, FF, 75, 10, E8, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpCommandW + 1EB                                                   3D9B1FFE 27 Bytes  [ FF, 83, 65, 00, 73, 00, 73, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileW + 7                                                     3D9B2546 29 Bytes  [ 01, 00, 54, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileW + 25                                                    3D9B2564 11 Bytes  [ 64, 00, 6F, 00, 65, 00, 73, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileW + 7                                                     3D9B2570 23 Bytes  [ 6F, 00, 74, 00, 20, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileW + 1F                                                    3D9B2588 81 Bytes  [ 64, 00, 20, 00, 74, 00, 68, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileEx + 4D                                                   3D9B25DA 95 Bytes  [ 69, 00, 66, 00, 69, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpGetFileEx + AD                                                   3D9B263A 81 Bytes  [ 74, 00, 72, 00, 61, 00, 6E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileEx + 4D                                                   3D9B268C 89 Bytes  [ 54, 00, 68, 00, 65, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileEx + A7                                                   3D9B26E6 25 Bytes  [ 72, 00, 65, 00, 71, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileEx + C1                                                   3D9B2700 17 Bytes  [ 65, 00, 20, 00, 73, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileEx + D3                                                   3D9B2712 1 Byte  [ 73 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FtpPutFileEx + D5                                                   3D9B2714 7 Bytes  [ 69, 00, 64, 00, 65, 00, 20 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherCreateLocatorA + D                                            3D9B65E6 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherFindFirstFileA + D                                            3D9B65F8 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherOpenFileA + D                                                 3D9B660A 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetAttributeA + D                                             3D9B661C 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetLocatorTypeA + D                                           3D9B662E 26 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetLocatorTypeA + 29                                          3D9B664A 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetLocatorTypeA + 5A                                          3D9B667B 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetLocatorTypeA + 77                                          3D9B6698 77 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GopherGetLocatorTypeA + C5                                          3D9B66E6 29 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteWpadCacheForNetworks + 88                                     3D9B68E2 14 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteWpadCacheForNetworks + 97                                     3D9B68F1 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteWpadCacheForNetworks + 9A                                     3D9B68F4 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteWpadCacheForNetworks + 9C                                     3D9B68F6 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteWpadCacheForNetworks + 9E                                     3D9B68F8 1 Byte  [ 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacySetZonePreferenceW + B                                       3D9BA098 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacySetZonePreferenceW + 16                                      3D9BA0A3 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacySetZonePreferenceW + 1F                                      3D9BA0AC 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacySetZonePreferenceW + 25                                      3D9BA0B2 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!PrivacySetZonePreferenceW + 2C                                      3D9BA0B9 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpCheckDavCompliance + 22                                         3D9BA3AB 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpCheckDavCompliance + 31                                         3D9BA3BA 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpCheckDavCompliance + 3A                                         3D9BA3C3 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpCheckDavCompliance + 45                                         3D9BA3CE 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpCheckDavCompliance + 4E                                         3D9BA3D7 65 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestExA + 54                                             3D9BA7CA 143 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestExW + 8B                                             3D9BA85A 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestExW + 93                                             3D9BA862 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpSendRequestExW + AA                                             3D9BA879 49 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestA + 2D                                                3D9BA8AB 36 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestW + 20                                                3D9BA8D0 40 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestW + 4B                                                3D9BA8FB 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestW + 7F                                                3D9BA92F 141 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestW + 10E                                               3D9BA9BE 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!HttpEndRequestW + 133                                               3D9BA9E3 4 Bytes  [ 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetPerSiteCookieDecisionA + 65                              3D9BAF36 72 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetPerSiteCookieDecisionW + 44                              3D9BAF7F 7 Bytes  [ 00, 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetPerSiteCookieDecisionW + 4C                              3D9BAF87 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetPerSiteCookieDecisionW + 62                              3D9BAF9D 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetPerSiteCookieDecisionA + 1F                              3D9BAFC1 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetPerSiteCookieDecisionA + 32                              3D9BAFD4 87 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetPerSiteCookieDecisionW + 53                              3D9BB02C 22 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetPerSiteCookieDecisionW + 6A                              3D9BB043 25 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionA + 15                             3D9BB05D 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionA + 1B                             3D9BB063 51 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionA + 4F                             3D9BB097 86 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionW + 52                             3D9BB0EE 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionW + 62                             3D9BB0FE 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionW + 6B                             3D9BB107 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetEnumPerSiteCookieDecisionW + 8F                             3D9BB12B 107 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetClearAllPerSiteCookieDecisions + 67                         3D9BB197 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetClearAllPerSiteCookieDecisions + 7D                         3D9BB1AD 17 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetClearAllPerSiteCookieDecisions + 8F                         3D9BB1BF 64 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetClearAllPerSiteCookieDecisions + D0                         3D9BB200 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetClearAllPerSiteCookieDecisions + 105                        3D9BB235 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieA + 1C                                             3D9BBE70 11 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieA + 7                                              3D9BBE7C 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieA + 9                                              3D9BBE7E 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieA + 26                                             3D9BBE9B 27 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieW + 7                                              3D9BBEB7 1 Byte  [ 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieW + 9                                              3D9BBEB9 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetGetCookieW + 1E                                             3D9BBECE 152 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieW + 94                                             3D9BBF67 50 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSetCookieW + C7                                             3D9BBF9A 60 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeToSystemTime + 38                                       3D9BBFD7 48 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeToSystemTimeW + 2C                                      3D9BC008 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeToSystemTimeW + 39                                      3D9BC015 173 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTimeW + 33                                    3D9BC0C3 9 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTimeW + 3D                                    3D9BC0CD 107 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTimeW + AA                                    3D9BC13A 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTimeW + B1                                    3D9BC141 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetTimeFromSystemTimeW + BF                                    3D9BC14F 15 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UrlZonesDetach + 82                                                 3D9BF990 59 Bytes  [ 64, 00, 69, 00, 76, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UrlZonesDetach + BE                                                 3D9BF9CC 19 Bytes  [ 69, 00, 6E, 00, 67, 00, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UrlZonesDetach + D2                                                 3D9BF9E0 121 Bytes  [ 6F, 00, 63, 00, 63, 00, 75, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UrlZonesDetach + 14C                                                3D9BFA5A 53 Bytes  [ 20, 00, 74, 00, 68, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UrlZonesDetach + 182                                                3D9BFA90 13 Bytes  [ 76, 00, 69, 00, 64, 00, 65, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteIE3Cache + 7                                                  3D9C3811 33 Bytes  [ 43, 9E, 04, 00, 45, 9E, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheContainerA + 1E                                       3D9C3833 123 Bytes  [ 00, 40, 4F, 9E, 04, C0, 4F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheContainerW + 56                                       3D9C38AF 45 Bytes  [ 00, B8, 3B, A0, 04, 58, 3D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntryW + F                                            3D9C38DD 105 Bytes  [ 00, 00, 00, B8, 4C, A0, 04, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheEntryW + 79                                           3D9C3947 34 Bytes  [ 00, 04, 00, 00, 00, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheGroup + 1F                                            3D9C396B 20 Bytes  [ 00, 0D, 00, 00, 00, 0E, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheGroup + 34                                            3D9C3980 25 Bytes  [ 12, 00, 00, 00, 13, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!DeleteUrlCacheGroup + 4E                                            3D9C399A 49 Bytes  [ 00, 00, 19, 00, 00, 00, 1A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheGroup + 2D                                         3D9C39CC 22 Bytes  [ 25, 00, 00, 00, 26, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheGroup + 45                                         3D9C39E4 43 Bytes  [ 2B, 00, 00, 00, 2C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindFirstUrlCacheGroup + 71                                         3D9C3A10 15 Bytes  [ 36, 00, 00, 00, 37, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerW + B                                      3D9C3A20 3 Bytes  [ 3A, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerW + F                                      3D9C3A24 13 Bytes  [ 3B, 00, 00, 00, 3C, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerW + 1E                                     3D9C3A33 60 Bytes  [ 00, 3F, 00, 00, 00, 40, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerW + 5B                                     3D9C3A70 7 Bytes  [ 4E, 00, 00, 00, 4F, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheContainerW + 63                                     3D9C3A78 25 Bytes  [ 50, 00, 00, 00, 51, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheGroup + 9                                           3D9C3AA0 6 Bytes  [ 5A, 00, 00, 00, 5B, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheGroup + 10                                          3D9C3AA7 14 Bytes  [ 00, 5C, 00, 00, 00, 5D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheGroup + 20                                          3D9C3AB7 12 Bytes  [ 00, 60, 00, 00, 00, 61, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheGroup + 2D                                          3D9C3AC4 7 Bytes  [ 63, 00, 00, 00, 64, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheGroup + 35                                          3D9C3ACC 30 Bytes  [ 65, 00, 00, 00, 66, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExW + 3A                                       3D9C3B2A 72 Bytes  [ 00, 00, 7D, 00, 00, 00, 7E, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExW + 84                                       3D9C3B74 15 Bytes  [ 8F, 00, 00, 00, 90, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExW + 94                                       3D9C3B84 27 Bytes  [ 93, 00, 00, 00, 94, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryExW + B0                                       3D9C3BA0 23 Bytes  [ 9A, 00, 00, 00, 9B, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceA + 13                                             3D9C3BB8 21 Bytes  [ A0, 00, 00, 00, A1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceA + 2A                                             3D9C3BCF 24 Bytes  [ 00, A6, 00, 00, 00, A7, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceA + 43                                             3D9C3BE8 15 Bytes  [ AC, 00, 00, 00, AD, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceW + B                                              3D9C3BF8 3 Bytes  [ B0, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceW + F                                              3D9C3BFC 3 Bytes  [ B1, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceW + 13                                             3D9C3C00 39 Bytes  [ B2, 00, 00, 00, B3, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceW + 3B                                             3D9C3C28 21 Bytes  [ BC, 00, 00, 00, BD, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FreeUrlCacheSpaceW + 52                                             3D9C3C3F 39 Bytes  [ 00, C2, 00, 00, 00, C3, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoA + 16                                         3D9C3C82 17 Bytes  [ 00, 00, D3, 00, 00, 00, D4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoA + 28                                         3D9C3C94 35 Bytes  [ D7, 00, 00, 00, D8, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoA + 4C                                         3D9C3CB8 14 Bytes  [ E0, 00, 00, 00, E1, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoW + B                                          3D9C3CC8 21 Bytes  [ E4, 00, 00, 00, E5, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoW + 22                                         3D9C3CDF 12 Bytes  [ 00, EA, 00, 00, 00, EB, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoW + 2F                                         3D9C3CEC 22 Bytes  [ ED, 00, 00, 00, EE, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoW + 47                                         3D9C3D04 49 Bytes  [ F3, 00, 00, 00, F4, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheConfigInfoW + 79                                         3D9C3D36 13 Bytes  [ 00, 00, 00, 01, 00, 00, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeA + 9                                      3D9C3D44 14 Bytes  [ 03, 01, 00, 00, 04, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeA + 19                                     3D9C3D54 19 Bytes  [ 07, 01, 00, 00, 08, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeA + 2D                                     3D9C3D68 38 Bytes  [ 0C, 01, 00, 00, 0D, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeA + 55                                     3D9C3D90 22 Bytes  [ 16, 01, 00, 00, 17, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeA + 6C                                     3D9C3DA7 15 Bytes  [ 00, 1C, 01, 00, 00, 1D, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeW + B                                      3D9C3DB7 75 Bytes  [ 00, 20, 01, 00, 00, 21, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeW + 57                                     3D9C3E03 32 Bytes  [ 00, 33, 01, 00, 00, 34, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeW + 78                                     3D9C3E24 78 Bytes  [ 3B, 01, 00, 00, 3C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeW + C7                                     3D9C3E73 8 Bytes  [ 00, 4F, 01, 00, 00, 50, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!GetUrlCacheGroupAttributeW + D0                                     3D9C3E7C 38 Bytes  [ 51, 01, 00, 00, 52, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!IsUrlCacheEntryExpiredA + 23                                        3D9C3EA4 174 Bytes  [ 5B, 01, 00, 00, 5C, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileA + 9                                      3D9C3F53 24 Bytes  [ 00, 87, 01, 00, 00, 88, 01, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileA + 22                                     3D9C3F6C 14 Bytes  [ 8D, 01, 00, 00, 8E, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileA + 32                                     3D9C3F7C 63 Bytes  [ 91, 01, 00, 00, 92, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RetrieveUrlCacheEntryFileA + 72                                     3D9C3FBC 19 Bytes  [ A1, 01, 00, 00, A2, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RunOnceUrlCache + F                                                 3D9C3FD0 6 Bytes  [ A6, 01, 00, 00, A7, 01 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RunOnceUrlCache + 17                                                3D9C3FD8 75 Bytes  [ A8, 01, 00, 00, A9, 01, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoW + 41                                         3D9C4024 35 Bytes  [ 48, 0C, 1F, 00, 18, 0E, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoW + 65                                         3D9C4048 4 Bytes  [ E0, 1B, 1F, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroup                                               3D9C404D 50 Bytes  [ 1D, 1F, 00, 40, 1F, 1F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroup + 34                                          3D9C4081 54 Bytes  [ 00, 00, 00, 98, 32, 1F, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheEntryGroup + 6B                                          3D9C40B8 150 Bytes  [ C8, 47, 1F, 00, 70, 49, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeA + 9                                      3D9C414F 21 Bytes  [ 00, 20, 63, 1C, 00, 70, F7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeA + 1F                                     3D9C4165 24 Bytes  [ FE, 1D, 00, 90, FF, 1D, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeA + 39                                     3D9C417F 44 Bytes  [ 00, 48, 08, 1E, 00, 28, A5, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeW + A                                      3D9C41AC 51 Bytes  [ E0, B3, 1F, 00, 68, B5, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeW + 3E                                     3D9C41E0 27 Bytes  [ B0, C6, 1F, 00, 60, C8, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheGroupAttributeW + 5A                                     3D9C41FC 63 Bytes  [ A8, D0, 1F, 00, 30, D2, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheHeaderData + 12                                          3D9C423C 23 Bytes  JMP 28C44260 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheHeaderData + 2A                                          3D9C4254 37 Bytes  [ D8, F1, 1F, 00, 88, F3, 1F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!RegisterUrlCacheNotification + 20                                   3D9C427A 74 Bytes  [ 1F, 00, 00, 00, 00, 00, 38, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UpdateUrlCacheContentPath + 1D                                      3D9C42C5 38 Bytes  [ 19, 20, 00, 90, 1A, 20, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UpdateUrlCacheContentPath + 44                                      3D9C42EC 75 Bytes  [ 10, 27, 20, 00, A8, 28, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UpdateUrlCacheContentPath + 90                                      3D9C4338 22 Bytes  [ 58, 43, 20, 00, E0, 44, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UpdateUrlCacheContentPath + A8                                      3D9C4350 3 Bytes  [ 50, 4B, 20 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!UpdateUrlCacheContentPath + AC                                      3D9C4354 11 Bytes  CALL C59C63A5 
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!FindNextUrlCacheEntryW + 46                                         3D9C43F4 15 Bytes  [ 00, 8B, 20, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoA + B                                          3D9C4404 55 Bytes  [ 60, 90, 20, 00, 08, 92, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoA + 43                                         3D9C443C 51 Bytes  [ A0, A4, 20, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoA + 77                                         3D9C4470 55 Bytes  [ 28, B7, 20, 00, B8, B8, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoA + AF                                         3D9C44A8 8 Bytes  [ 60, CB, 20, 00, E8, CC, 20, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!SetUrlCacheConfigInfoA + B8                                         3D9C44B1 13 Bytes  [ CE, 20, 00, 38, D0, 20, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowSecurityInfo + B                                                3D9C9277 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowSecurityInfo + 1A                                               3D9C9286 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowSecurityInfo + 28                                               3D9C9294 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowSecurityInfo + 34                                               3D9C92A0 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowSecurityInfo + 42                                               3D9C92AE 78 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowCertificate + E                                                 3D9C9425 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowClientAuthCerts + E                                             3D9C9438 18 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ParseX509EncodedCertificateForListBoxEntry + E                      3D9C944B 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowX509EncodedCertificate + 18                                     3D9C9468 28 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowX509EncodedCertificate + 35                                     3D9C9485 8 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowX509EncodedCertificate + 40                                     3D9C9490 4 Bytes  [ 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowX509EncodedCertificate + 47                                     3D9C9497 10 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!ShowX509EncodedCertificate + 53                                     3D9C94A3 3 Bytes  [ 00, 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringA + B                                          3D9C9814 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringA + 2F                                         3D9C9838 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringA + 37                                         3D9C9840 55 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringA + 70                                         3D9C9879 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringA + 86                                         3D9C988F 2 Bytes  [ 00, 00 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringW + B                                          3D9C9972 34 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringW + 2F                                         3D9C9996 6 Bytes  [ 00, 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringW + 37                                         3D9C999E 35 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringW + 5D                                         3D9C99C4 21 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetAlgIdToStringW + 74                                         3D9C99DB 20 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringA + 16                              3D9C9AEB 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringA + 25                              3D9C9AFA 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringA + 2D                              3D9C9B02 79 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringA + 7E                              3D9C9B53 87 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringA + D6                              3D9C9BAB 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringW + B                               3D9C9BBB 13 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringW + 19                              3D9C9BC9 12 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringW + 28                              3D9C9BD8 5 Bytes  [ 00, 00, 00, 00, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringW + 30                              3D9C9BE0 82 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetSecurityProtocolToStringW + 84                              3D9C9C34 90 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetErrorDlg + B                                                3D9CA3B4 107 Bytes  [ 74, 00, 6F, 00, 20, 00, 69, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetErrorDlg + 77                                               3D9CA420 5 Bytes  [ 72, 00, 65, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetErrorDlg + 7D                                               3D9CA426 9 Bytes  [ 64, 00, 20, 00, 66, 00, 72, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetErrorDlg + 87                                               3D9CA430 21 Bytes  [ 6D, 00, 2E, 00, 0D, 00, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetErrorDlg + 9D                                               3D9CA446 7 Bytes  [ 69, 00, 63, 00, 61, 00, 74 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + 5C                                    3D9CA8F8 17 Bytes  [ 66, 00, 6F, 00, 72, 00, 6D, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + 6E                                    3D9CA90A 5 Bytes  [ 20, 00, 77, 00, 61 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + 74                                    3D9CA910 17 Bytes  [ 73, 00, 20, 00, 6E, 00, 6F, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + 86                                    3D9CA922 27 Bytes  [ 69, 00, 6E, 00, 74, 00, 65, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] WININET.dll!InternetConfirmZoneCrossing + A2                                    3D9CA93E 5 Bytes  [ 70, 00, 6C, 00, 65 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + FFFFCF75                                             76BF10ED 14 Bytes  [ 02, 00, 00, 16, 02, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + FFFFCF84                                             76BF10FC 7 Bytes  [ 19, 02, 00, 00, 1A, 02, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + FFFFCF8C                                             76BF1104 14 Bytes  [ 1B, 02, 00, 00, 1C, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + FFFFCF9C                                             76BF1114 15 Bytes  [ 1F, 02, 00, 00, 20, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + FFFFCFAC                                             76BF1124 6 Bytes  [ 23, 02, 00, 00, 24, 02 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameA + A                                          76BF1488 26 Bytes  [ FC, 02, 00, 00, FD, 02, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameA + 26                                         76BF14A4 47 Bytes  [ 03, 03, 00, 00, 04, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameA + 56                                         76BF14D4 30 Bytes  [ 0F, 03, 00, 00, 10, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameA + 76                                         76BF14F4 19 Bytes  [ 17, 03, 00, 00, 18, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameA + 8A                                         76BF1508 35 Bytes  [ 1C, 03, 00, 00, 1D, 03, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumDeviceDrivers + 4E                                                76BF168F 24 Bytes  [ 00, 7E, 03, 00, 00, 7F, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumDeviceDrivers + 67                                                76BF16A8 19 Bytes  [ 84, 03, 00, 00, 85, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumDeviceDrivers + 7B                                                76BF16BC 23 Bytes  [ 89, 03, 00, 00, 8A, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumDeviceDrivers + 93                                                76BF16D4 26 Bytes  [ 8F, 03, 00, 00, 90, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumDeviceDrivers + AE                                                76BF16EF 7 Bytes  [ 00, 96, 03, 00, 00, 97, 03 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExW + 15                                             76BF178C 26 Bytes  [ BD, 03, 00, 00, BE, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExW + 30                                             76BF17A7 48 Bytes  [ 00, C4, 03, 00, 00, C5, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExW + 61                                             76BF17D8 10 Bytes  [ D0, 03, 00, 00, D1, 03, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExW + 6C                                             76BF17E3 7 Bytes  [ 00, D3, 03, 00, 00, D4, 03 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExW + 75                                             76BF17EC 39 Bytes  [ D5, 03, 00, 00, D6, 03, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverFileNameA + B                                          76BF1CF8 106 Bytes  [ 18, 05, 00, 00, 19, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverFileNameA + 76                                         76BF1D63 63 Bytes  [ 00, 33, 05, 00, 00, 34, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverFileNameW + 3B                                         76BF1DA3 27 Bytes  [ 00, 43, 05, 00, 00, 44, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverFileNameW + 57                                         76BF1DBF 63 Bytes  [ 00, 4A, 05, 00, 00, 4B, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameW + 3B                                         76BF1DFF 27 Bytes  [ 00, 5A, 05, 00, 00, 5B, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetDeviceDriverBaseNameW + 57                                         76BF1E1B 15 Bytes  [ 00, 61, 05, 00, 00, 62, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetMappedFileNameW + B                                                76BF1E2B 23 Bytes  [ 00, 65, 05, 00, 00, 66, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetMappedFileNameW + 23                                               76BF1E43 111 Bytes  [ 00, 6B, 05, 00, 00, 6C, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetMappedFileNameW + 93                                               76BF1EB3 99 Bytes  [ 00, 87, 05, 00, 00, 88, 05, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetMappedFileNameA + 5F                                               76BF1F17 7 Bytes  [ 00, A0, 05, 00, 00, A1, 05 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcessModules + 4                                                76BF1F20 50 Bytes  [ A2, 05, 00, 00, A3, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcessModules + 38                                               76BF1F54 31 Bytes  [ AF, 05, 00, 00, B0, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcessModules + 58                                               76BF1F74 30 Bytes  [ B7, 05, 00, 00, B8, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcessModules + 78                                               76BF1F94 42 Bytes  [ BF, 05, 00, 00, C0, 05, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcessModules + A4                                               76BF1FC0 47 Bytes  [ CA, 05, 00, 00, CB, 05, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleFileNameExA + 63                                             76BF20D8 99 Bytes  [ 10, 0A, 00, 00, 11, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleBaseNameW + 5F                                               76BF213C 230 Bytes  [ 29, 0A, 00, 00, 2A, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleInformation + 61                                             76BF2223 44 Bytes  [ 00, 63, 0A, 00, 00, 64, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetModuleInformation + 8E                                             76BF2250 56 Bytes  [ 6E, 0A, 00, 00, 6F, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EmptyWorkingSet + 28                                                  76BF2289 33 Bytes  [ 0A, 00, 00, 7D, 0A, 00, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EmptyWorkingSet + 4A                                                  76BF22AB 27 Bytes  [ 00, 85, 0A, 00, 00, 86, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EmptyWorkingSet + 66                                                  76BF22C7 11 Bytes  [ 00, 8C, 0A, 00, 00, 8D, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!QueryWorkingSet + 7                                                   76BF22D3 47 Bytes  [ 00, 8F, 0A, 00, 00, 90, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!QueryWorkingSet + 37                                                  76BF2303 55 Bytes  [ 00, 9B, 0A, 00, 00, 9C, 0A, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!QueryWorkingSet + 70                                                  76BF233C 3 Bytes  [ A9, 0A, 00 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!QueryWorkingSet + 74                                                  76BF2340 63 Bytes  [ AA, 0A, 00, 00, AB, 0A, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!QueryWorkingSet + B4                                                  76BF2380 2 Bytes  [ BA, 0A ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcesses + E                                                     76BF3AA8 2 Bytes  [ 84, 10 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcesses + 11                                                    76BF3AAB 31 Bytes  [ 00, 85, 10, 00, 00, 86, 10, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcesses + 32                                                    76BF3ACC 31 Bytes  [ 8D, 10, 00, 00, 8E, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcesses + 52                                                    76BF3AEC 31 Bytes  [ 95, 10, 00, 00, 96, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumProcesses + 72                                                    76BF3B0C 19 Bytes  [ 9D, 10, 00, 00, 9E, 10, 00, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessMemoryInfo + 9                                              76BF3BEE 73 Bytes  [ 00, 00, D6, 10, 00, 00, D7, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessMemoryInfo + 53                                             76BF3C38 14 Bytes  CALL 5FBF3C4D 
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessMemoryInfo + 63                                             76BF3C48 25 Bytes  [ EC, 10, 00, 00, ED, 10, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessMemoryInfo + 7D                                             76BF3C62 54 Bytes  [ 00, 00, F3, 10, 00, 00, F4, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessMemoryInfo + B4                                             76BF3C99 1 Byte  [ 11 ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!InitializeProcessForWsWatch + 7                                       76BF3CE0 19 Bytes  [ 12, 11, 00, 00, 13, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!InitializeProcessForWsWatch + 1B                                      76BF3CF4 6 Bytes  [ 17, 11, 00, 00, 18, 11 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!InitializeProcessForWsWatch + 23                                      76BF3CFC 27 Bytes  [ 19, 11, 00, 00, 1A, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!InitializeProcessForWsWatch + 3F                                      76BF3D18 11 Bytes  [ 20, 11, 00, 00, 21, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetWsChanges + 7                                                      76BF3D24 67 Bytes  [ 23, 11, 00, 00, 24, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessImageFileNameW + 11                                         76BF3D68 34 Bytes  [ 34, 11, 00, 00, 35, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessImageFileNameW + 34                                         76BF3D8B 84 Bytes  [ 00, 3D, 11, 00, 00, 3E, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessImageFileNameW + 89                                         76BF3DE0 131 Bytes  [ 52, 11, 00, 00, 53, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetProcessImageFileNameA + 7F                                         76BF3E64 14 Bytes  [ 73, 11, 00, 00, 74, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetPerformanceInfo + B                                                76BF3E74 30 Bytes  [ 77, 11, 00, 00, 78, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetPerformanceInfo + 2A                                               76BF3E93 28 Bytes  [ 00, 7F, 11, 00, 00, 80, 11, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetPerformanceInfo + 47                                               76BF3EB0 50 Bytes  [ 86, 11, 00, 00, 87, 11, 00, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetPerformanceInfo + 7B                                               76BF3EE4 2 Bytes  [ 93, 11 ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!GetPerformanceInfo + 7E                                               76BF3EE7 51 Bytes  [ 00, 94, 11, 00, 00, 95, 11, ... ]
.text     ...                                                                                                                        
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesW + 53                                                   76BF405C 28 Bytes  [ 10, DC, 86, 03, B8, DD, 86, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesW + 70                                                   76BF4079 517 Bytes  [ 00, 00, 00, C8, E7, 86, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + 107                                                  76BF427F 16 Bytes  [ 03, 18, EA, 85, 03, 20, EB, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + 118                                                  76BF4290 20 Bytes  [ 90, EE, 85, 03, 08, F0, 85, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + 12D                                                  76BF42A5 87 Bytes  [ 00, 00, 00, 80, F6, 85, 03, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + 187                                                  76BF42FF 60 Bytes  [ 00, 18, 16, 86, 03, 68, 17, ... ]
.text     C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe[248] PSAPI.DLL!EnumPageFilesA + 1C4                                                  76BF433C 207 Bytes  [ F0, 2A, 86, 03, 98, 2C, 86, ... ]
.text     ...                                                                                                                        

---- Devices - GMER 1.0.12 ----

Device    \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_FILE_SYSTEM_CONTROL                                              [B1221701] tfsnifs.sys
Device    \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_FILE_SYSTEM_CONTROL                                               [B1221701] tfsnifs.sys
Device    \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_FILE_SYSTEM_CONTROL                                                   [B1221701] tfsnifs.sys
Device    \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_FILE_SYSTEM_CONTROL                                                [B1221701] tfsnifs.sys
Device    \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_FILE_SYSTEM_CONTROL                                               [B1221701] tfsnifs.sys
---- Processes - GMER 1.0.12 ----

Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [272]             0x10000000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [272]             0x00810000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [544]             0x10000000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [544]             0x00810000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [996]             0x028E0000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1100]            0x10000000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1100]            0x00810000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1212]            0x10000000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1212]            0x00810000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UACdsewwcojsn.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1404]            0x10000000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\SYSTEM32\SVCHOST.EXE [1404]            0x00810000                                                                                                                                           
Library   \\?\globalroot\systemroot\system32\UAChfqjuovakl.dll (*** hidden *** ) @ C:\WINDOWS\explorer.exe [2476]                    0x10000000                                                                                                                                           

---- Files - GMER 1.0.12 ----

ADS       C:\david\f_system:test                                                                                                     
ADS       C:\Documents and Settings\Admin\Favorites\Links\Suggested Sites.url:favicon                                                
ADS       C:\Documents and Settings\All Users\Application Data\TEMP:C085630F                                                         
ADS       C:\Documents and Settings\D Frazier\Favorites\Links\Suggested Sites.url:favicon                                            
ADS       C:\Documents and Settings\David Frazier\Desktop\Speakeasy - Speed Test.url:favicon                                         
ADS       C:\Documents and Settings\David Frazier\Favorites\Business\Compare prices on new, used, and out of print b....url:favicon  
ADS       C:\Documents and Settings\David Frazier\Favorites\Business\eBay\eBay - The World's Online Marketplace.url:favicon          
ADS       C:\Documents and Settings\David Frazier\Favorites\Business\PayPal - My Account.url:favicon                                 
ADS       C:\Documents and Settings\David Frazier\Favorites\Business\PayPal - Welcome.url:favicon                                    
ADS       C:\Documents and Settings\David Frazier\Favorites\Business\SBC Yahoo! Calendar - naturalstatephoto.url:favicon             
ADS       C:\Documents and Settings\David Frazier\Favorites\Family Tree DNA - we do genetic tests for your ....url:favicon           
ADS       ...                                                                                                                        

---- EOF - GMER 1.0.12 ----
