Function at 0x415ed0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4c11d0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x11c]
push eax
push 0x4a02ac
push 1
push esi
push 0x4a037c
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x124], esi
xor edi, edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
lea edx, [ebp - 0x110]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x4160b1
mov ecx, dword [ebp - 0x110]
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4160b1
push 0xfe
lea eax, [ebp - 0x10a]
xor edx, edx
push esi
push eax
mov word [ebp - 0x10c], dx
call fcn.0046ed60
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10c]
push str.Win32_Process.Handle__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
add esp, 0x18
push esi
lea edx, [ebp - 0x118]
push edx
push esi
push esi
push str.Win32_Process
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x120]
push edx
push esi
push str.Terminate
push eax
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push edx
push esi
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x114]
mov ecx, 3
push esi
mov word [ebp - 0x134], cx
lea ecx, [ebp - 0x134]
push ecx
push esi
mov dword [ebp - 0x12c], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push str.Reason
push eax
call edx
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x124]
push edx
mov edx, dword [ebp - 0x114]
push edx
push esi
push esi
push str.Terminate
lea edx, [ebp - 0x10c]
push edx
push eax
mov eax, dword [ecx + 0x60]
call eax
test eax, eax
js 0x4160b1
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x144]
push edx
push esi
push str.ReturnValue
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
js 0x4160b1
cmp word [ebp - 0x144], 3
jne 0x4160b1
xor ecx, ecx
cmp dword [ebp - 0x13c], esi
sete cl
mov edi, ecx
mov eax, dword [ebp - 0x124]
cmp eax, esi
je 0x4160c9
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x124], esi
mov eax, dword [ebp - 0x114]
cmp eax, esi
je 0x4160e1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x114], esi
mov eax, dword [ebp - 0x120]
cmp eax, esi
je 0x4160f9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x120], esi
mov eax, dword [ebp - 0x118]
cmp eax, esi
je 0x416111
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x118], esi
mov eax, dword [ebp - 0x110]
cmp eax, esi
je 0x416129
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x110], esi
mov eax, dword [ebp - 0x11c]
cmp eax, esi
je 0x416141
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x11c], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0046b255
mov esp, ebp
pop ebp
ret