Function at 0x404a20
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415f53
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x80
mov eax, dword [0x478010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x74], str.L4jci5SNPG6mc5RRXalNIYkPgs6hg2NHaGMxfsk04qX0RRYrAQ8OqFqTmLAhY9CDnloqWruVSKl7SfJTVy2h6qFPpUYwFq7AxHP68mmudhz7E8duB8S5Lb5zvstQM88ydnwDBgtcS0eHcGvxzrg1AycEIqvotMvGmUG0mQR6Ds7YegHreguCPS2cXfOEu468gQjSuA5Q6ymk6oWFmlGmWdbR1SnpeTNcFF6UgBdGJIksKPmN7nJquhIXCHsOJmudHLzs4JPoWNEqOy6s42gUcwdikwxlIL6BPx1Lqw2m45fAzHkn9UEHU6NiECrKtDwRXksS1frxdlgGSCejGA7xCQ6XWKcc0FJBooHIEOcuuM7IjU1aqxzWtkfSt585TNFsL0jXjUVkQ5x51jSRufHkJMTcogNdp8jbbkCb5TOI8ltqOO4rn80SPceEKp5Gp0Dz3wJJbNxX489MczO2YyFEkdUyt24VsUFxfGwP1qhTju3veYpLBRKvTcbNn98HHCp20QAv4dLXmSXgFC6WUkX7oeIPdcU6X2T8V3nB2ldaDfT3TgbS0aR1N5MJy7lwHjbV3e0NGFm5rX8dVTX2jyJyed87TfzJ0LlFMipDYNtRYRfnsIMQGEDTWO0aEo3MAWrCU7iq01kijf4zJ8YUpxp5lLbG5Pu5PCA9Du8lWgdDpPD4KHTT4hDUXEY1miQmMHTGwd7pdfUQaQmx4fUwHPF3vKd6yUmF4muKy0fpgnLmjUPVULpBKaD0M4csAnxoXWwW6wi2LHCfuaWzatM0Ycp5KhLbkH9fs29WRpLKv4N8f7P4jKtHCKFqwNjVvrdg5lxw3gWRpVcd1NVmvfTKfFP0lIFYIA3O5RSt8ATwxvaj6GULxKvfPG4DBQg8vAcCiLoI5SrH5ICMHFJRPjKpJwlWOGYNgjvFeqigbB9ap9YyW7ABt69uJRmnErfXg74l2nOa98ny07baNRXhazaSXkBfV20cILeitrey4NfjtDDI9bCrgmjYYtkDA4HDGzDyYyMEqWCJBqlRLMx2Ih8kHPxvHRi09cbsBVMM7O9TjTKTjR1jdm9urT2CwsizWN1E4WvjnAgLCcREl3AQ0RW9V6lAqzGeP0yaGciGTs86K8cvhq3y0d53gNLPTCYrsQuissssHvFt1eKuuxuEJ390VnpBBJeekRNG1JmeePDkTJ69anfJrdJTO75YkLWcR2FkBdlGkrtS0zgCqoTFVLvLcepT1eexoLCv9jNBbiqe4oOFislGGW3CJXL4JoC16VnTaC9Prkuh0wRzEXHlOf3Buri4GbfX5RXqRWKi5qsJQ20diGnu5haWTLRjffHkkmFp5j40vqRcLEk4ST2lSV4VO2cYSV7zGC2rgUw1u6025Pu9YiBrfgsVrdGbgi7NWmStwczvdbVsfIE554hDRw5nqhyK96RFJIiMCJHHenvvQds5vNw84dDPKaLprN2oChB0VopWvkk5DO5TuB5rM0RRPJ3HdyON25r1ubaBnDJQuPeTaXVoDKybsOT0FeVhhEE6XkvbzQRmpe70zSlaQxtwNcAt9oyNAUpQGgXbesDWzDsIBLPhkFpKqz997ksS4j7bzB7gQVHPhuv84wcxzCbLjElSb0RGHFqkfeu8nGt1WO1TDtu7K5AAN5Lm95zTpkjRVaFy45ajcpfhVq2uGWugEqJ5RXONV1VGuDipCrIqHK15oApuMjKWYflmqJrgX0N2s7VD81ROm3BHpGtfbsdRj3rnXaJG3UDsXeeg326Qa9P7dRmdyUMmzfE7PLw8DTrQOQPmfGFEgG3RXIqdinmL3hnovIaa5xtpt2o8Y5BeUV68GilnoKRBstKQyUuWBQiFY2BNRkHnzSlyk728w9enSaIYKXUglkFw4j8IXrtINgGtG9EgWSoHMBV5XaiqhUG96yHiGphJisuKtMFUBuki30Sgew3jlYE44B21PbcJTzHNhUMu4F2VVxKuHK7skoc9BxRrDE3OBqJGCPYLxlst5jwzHhTRTr9z0DWeFFtVxxyYQlvRREEPwqY6FbmeDREPbo35U2QSY7ARgFRayUD3HSBwdj0K1T6LGtXOLukgk5P60sQsIGsbrGF62bLdoa9zJLtiYLNu83M26SsM9GapWKgW10aY1MHHbmpuIvXQ5nryxu3zfQOXPY90aIe31jX0tyBqvkfq03kb8m9z4lxd4cU0DXtTpMpBLOTdkNR8RPtXBXDPjtpv3dUwI4XF9EJ1OSa3srNJOasyzfzJjPymyKfYQ3f31RV12CgdEJNM4akcxBm1297jKxNDBFoiHKfJr96215lH2GGETUCH5nf1cdbxGn0fPcdEKLAV3SHIegCmWrgdKG7aOnPzXjckRqAzh0EqCsWSlaKeQYrdUqTyXASupjAxbdsz0yf636Q6cjdPFIAJ7aN5mnjPbWjs2J68vliBY3Y3JoEgnkpawG2E8cMXys3fzC714uNGvuHk4KfeNVRbYWOlLsM7VOWCRYljyjI93z5hprF0H6bNU7qdcxxjRGHTOmTtvk6SspY6ae6rHPPmsz6tHL3q5qw0hK9g6iUSY14OOAgWlDCxkU7mVq58o77lWBJJ87fbfqHi4GnyYrxkUUMf0J9XMvI1sQAl3V6TfA4eGobQYBT5fyowlSyho55CgORNY6zgqp58CiWXu0erX1gHO0nft2umLl0dC8IyxKrjWFsGBRnopIKlFbqRpdG1hFIWmMF7OrBYTtXij0qfufd7xtiYKf0XUxXJe2wpOfM7PrjHsyIEOn1IrRkfbne8M7YEQYoWvR0xgUNpNdSzB9xYMkF9wDH1N1i5x1skf2YTO1gqY3NkHJcNoJd0KGhJPlDHeFPeMjgHhw3pyDCvEzo8sWzXXVhWAA4AuJJohk7ezW2zVXL6zfy0xNd1ouCTHLS6x9kEgABDLuBGrvTmgAaxE1iVr9FqGkCVg5PVCCxT53D8hc0U9CEW9lMnDplVV8977UtdIOwMPeAQymgHjywvMrnMCu4pvTaTftfgWhas3byybbQfaM8boqPLQsUhEDnj1mTDEEh4g0RbxiXyNEm8oTTR8L6FDeimtzw978gQfBPS9x4y1pgxijTmAdz4ThNQiEQm8Wksd3zd5ttjV34Wuu8tMiqmhJr742Tj4jLzghsJBGaS4WNmVz80g8xPm4UtlrJwmCQQ3hQN9g9oznO27Q2DJhCT7f5fPO2vvJWEsSLV5rr9SVTjFIKtyTBDKKbbeUdXH85jObyeWs6OoXFFT8OvAvMKI6Aq7cAGSHLYXyTwzxhxszAKPwlC3PIADMJw5TgBEUcK7CObTYbMmEUkbP0zITm9kl9pE3bPkK3zYhEj748qnQLilz22JWV2Pjnojq7AVFDkIF3AC6uJHz5HtIixKz3yof8dvzEecGPKWe0mYmImv1BKnMcyQwABqI7VBNeiwk6tIDQB1elmT5XLAMJpAUNKAlc5Wb7p5Br2yQeXG20aVvxdlfsjV3fbJGfwPymnG4uQq77Gd7lADLBIzgwnkzOHTpfxwxU8RMqdJSPG0SbS06e1VmFCGjJPm7hNcvuJSl1loU0vDJkDVvj1JEcWmqyFxtrl1zFqENAkHfzkV3JRjLAK4JX7aj8X79YC4FPwQO59r8RYThoWYpBoDJsOkDG8VObursdyOt0ER9tWLQnFIJLfUgHDzkKc5cp98nR8BroEE5mjUeQdgOiM3tk05zbPOY7e7CF3XQWKV3MP0T47judAT2wgsQanBUOJh9ldmoSwjmmTPjkmulpp284GLSeL8J85xHoGWf0pQD1yq12hqKz6HshnxFcCgdJ3GMdEB8IH1L1r1uDBDQfITd8mKsha57oNwEYtTeYDMSWT3iHtFxMog86yPMViReWVKlIC6jljyoHR8XRoWsmrbshKFq1w8ojo5DiHaBUJcYyV86PgS3YhIWlEBsG1xotx87muMSqN1z4l4enoQvvvGRwPpcqAY6w7v5qSmq9gMn9Xc0mtbMBQx1DMle2FymAfKDPUW2UNHRYjXYJz7BLatH6P5oFlA2UtlDJMl1cYsMbx2QvbStksmJRhMPMmx1OGKH8N3d0fb7AredM8FDpQOruf4Ud39cFdmeOr
push str.Find_RepeatProcess
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x8c], 0
xor ecx, ecx
mov word [ebp - 0x5c], cx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0x4759c0
push 1
push 0
push 0x4759b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x404b12
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x54]
jmp 0x404d24
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jge 0x404b56
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x70]
jmp 0x404d24
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x404b90
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x64]
jmp 0x404d24
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x30
mov edx, dword [ebp + 0xc]
push edx
push 0x44093c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x404bd6
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x4c]
jmp 0x404d24
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x24], 0
je 0x404cc1
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x1c], 0
jne 0x404c0c
jmp 0x404cc1
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
push 4
lea ecx, [ebp - 0x18]
call fcn.00406d30
push 0
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00403a30
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00403940
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00403de0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push eax
call fcn.00401520
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + 0x18]
call edx
mov byte [ebp - 0x3d], al
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x404cb0
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403bb0
jmp 0x404bdd
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x58]
jmp 0x404d24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a56e
mov esp, ebp
pop ebp
ret 0x28