Function at 0x518a6b
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
lea edi, [ebp - 0x48]
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
test esi, esi
je 0x518ab4
cmp byte [esi], bl
jne 0x518ab9
mov esi, str.rootcimv2
cmp dword [ebp + 0xc], ebx
je 0x518ca4
lea eax, [ebp - 0x28]
push eax
push 0x5d7600
push 1
push ebx
push 0x5d7610
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x518c9d
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004923af
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
pop ecx
pop ecx
push edx
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push eax
call dword [ecx + 0xc]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.004917e1
pop ecx
test esi, esi
js 0x518c8b
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
js 0x518c82
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.004923af
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
pop ecx
pop ecx
push edx
mov ecx, dword [eax]
push ebx
push 0x30
push dword [ebp - 0x18]
push 0x59bfd8
push eax
call dword [ecx + 0x50]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.004917e1
pop ecx
jmp 0x518c60
test esi, esi
js 0x518c78
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 8]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
mov esi, eax
test esi, esi
js 0x518c6d
cmp dword [ebp - 0x2c], ebx
je 0x518c6d
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push ebx
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0x518c57
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElemsize]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov esi, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push dword [ebp + 0x10]
call fcn.004650ad
mov edi, dword [ebp - 0x30]
add esp, 0x10
jmp 0x518c52
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
push ebx
push dword [eax + edi*4]
push ecx
call dword [edx + 0x10]
mov esi, eax
test esi, esi
js 0x518c51
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax + edi*4]
call fcn.00491c91
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x34]
call fcn.00518202
lea eax, [ebp - 0x20]
push eax
call fcn.004917e1
add esp, 0x18
inc edi
cmp edi, dword [ebp - 0x24]
jl 0x518c01
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x518b6b
jmp 0x518c82
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp esi, 1
cmove esi, eax
test ecx, ecx
je 0x518c82
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
test esi, esi
setns al
jmp 0x518c9f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push str.Pointer_is_NULL_n
push 0xa2
push str.C:_actions_runner_workclientclientworkflowwindowswmi.c
call fcn.00453f4f
int3