Function at 0x403b50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415a93
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x90
mov eax, dword [0x4593c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x7c], str.M20Awa3in2pLXvw2GPPtjYcRkJaXYnNm2QD5HVI2gJ8gjrhFHnUAzzAuYt3zbzT6oYhKJeBdC1w3LeGeC5V5THSBwCr93dd6AL26BVhIexoWPgWy9ldqaEMrrE6eGOMkN9V6Ab0DR6SJMHpfv8XBw0zpg67k0KLsLBRbcuDfjwBaEAwyrXkYmEebzC3TDdsQJgFfdHI2oIuTeLUtb0gsmQkzTTLm3ciAsL1CIXqGTGUz4UnEuVGktc6CQJB4qxQtdmt51Kx6IvBMuwLuF2mmSyrA1YekHURWMQxSGTvnFkH5AW95ubWM5aQT0zHrDPdfuDzJCwpNDmJXflIciM1fMAteryxBGBQd8IPLT70TvWBR4HLkSS1T1H8p0Yy09oXs3DrzUsBmbrCcqOMFC3ii1Ievi52K0bOh6vsekHg5ylujunm7mt4ulcRN24AX3LPFE4Nf3hBcBaiwcOfhtStWMYLIThhEPMBlzAiygXU0gwu6csksQDvDphgWB8vOHJNGiWDBpT82t9YeXqDETC5UxBnmR76nIRhOGzrfcvP0fM17IFkzxj0DMOJ2qMfgIl2xdvbMCxcOyjdQq0IDdMV7Y7Cd1Nyil5cnNle2V77DqDEwP1fXRFs5iYXprR1hXS2xUfRbBE3MRNKbu9vmYc3J5hjhsNYYJlVXx0hUrT9LWSjKCHemwa3L09RJSsf6yTtfaUtotUamH2zejJhb0UHf05uPxOVh6OkJMUqb19wtev8smdGJqrbKgVDTeUCaObkrVvWkDihgADXilRzGlgtjeOspPPfjUUs7EJLjar84UOtwAhfmMtvnCeH4cN7eoLOcugv6IYorjxqUeR9LkL7RrYLKc4XpWkFNwjF4ED49UlY88SOG2qXbVcIBIXTg7XoMkFE5BqK7SRHRUn1xugF8CkfTHWqa9WxG1KJquLIwoPxG0fytPIH0gbEa4vqs6jLLdu6TskQJB2ObxeslFMrvVSU7IecrLWUX1rNGVaGiKlgQuRQG938SWQEDEKojHzTW6INrDDp00G0ayx1NUFWIRS7TPQ5jhKQ4D0XjwpQMC7xwbslBamV9x5acfiJyyP0nhz1POxrRQJMjBEqLyr0H6Rm3S2b8q1IEfiA40kjAWI2RQ0WFiNYnT0QcLYD8ulwmeAdsQubxbkVsDbJm7VBDAAtyXeLvbF5EtshWo0rwQTziwIMDfQtn51EhtSAgCFcqIu6VTc6uhQqANYdXrb6Wx2vHpatiLRMfdPReWIQEKGksx7hvW9OcpJKnOmerjBWoIgF9mAXpEXw1x9n9zvXmouL1OO4yH3TPy4tod6pljmEhpT4uBDFbt4zBwYxobb1iva9dQSLg7AKgu21NPt1NRtOg3nCFHQM8T1rdUUfaqsdUV326CwWR67MmxAH44HQryG0vhvJfFQQ8Bg73MSjrUIrrajudKd02QNmF6hIVgJRKbNm3HdO5mjkh6i9G4GaoDzWGLbmOCaPC3EYefM6KJgGPwld25ioIiN520vrJcfKupDplMpFTAgnhEoBJzWTVJPYBIQoHtbX3em8WfuWpLlSXIrCfau3DmCJMaahUUff0dhPe31cCmQmtWwYWbxj87GkoLHOP2MKVPHk58yClItAABNLbKviqp9DHk4l3jg0slIyaVfiOueXiVuugJINffErqObRpj9U4LhAKrNbKyqzJfT0rOfI25uoLwj1Xx4RgRaGT8w8j4L6lPozUn37RTs4lY14UAFwtcYdj0hT6sdTF1rRRARbCe1Rf1cTJ1HY658Eqzw8aq7Xx7zUoqjdM57a1F773pYLszRGnRhk2T5TUuobzzMIC0laEjjRHnrKQwj6YrbVG88Y1uBupvyi32QYzwG1Kx1dwxkOMmofwzy6evY2StGHIJmCHbt2rxMNG0GU3bFsr00ObVmsUu5OWebYoqd2f1Tzt2WBG1oGKqojDaEJoitHO6bPrDKLMEyY1xwfmtsSg84pEETh9sqv3sPS6ulDX83SldBkqUwR7jkqkF7tIrCK3hkXqWPjBwNzPc0xvtScviG2XBKaFmFpHONuERFDDAzNaaBQgeEEtR4PU8dCcx77T9FM9bomhWEPK0zIEvqKxc4oBEv4aE6V2DzArT44jLNQc1d5dcrWIFDOCCE4l7z8daMwxk1WGhRn0gE07GsxuY4UNtLBy6n5e776R3YSADKjFwREhRRJL5Y7a3WgzkBLze7L6AjIDpHX2z7CH5xJk70KwDatGm3c6kIJTCfnzEYdScc1J0o57UYi5EcyKw7mn1CTgSogRiayBW3V0kNN5CMPGTuzunSzd9wBdFy5CC2Yve4WI9AVB8abADKTiEucKzR10X0bLmIOvEyGwvlig2pE0zXibj0EC1T9YryqdHxGdYTSsopyIBmeWUlMMuzsLfANEvvlGk8yOgvnVLVbOQknogpMpylfxTHEFfIVQknKeEL1KwNwtrafbGTY13tEIDLbNsxReeqSVB5M6xEHQMds2JSq8K8rq23FYCPlf5GT5HUIzAUI9YmiApDu1BvscBCihXX9ekQ5sLGW9sMlLQ0yk7JRwNPAWQi0TnRDnRR4uOSEcRcefR2FGK0A8FiQ0dEzbtUMN6VKf5X8tsROfhSCWFwY0Pai462ECy55tNyrrYrI7RhpyWtWiEGKT2F3eQzHPDLDiirIq8PRGGH79xiOMY6Uff6mXK9XAsX90hCubnE47p7S6lgVqkEM7GIwa5ozOp8QiWn2mJrVGxktDoTB2Rw3cHPT62JryDhAHUfTdtK6avRt8odGnc7FPTMXpLlmYWSMFh12F0clBG3l7NFD5o7015Rfap9TrS1qwzMDgXjtxrWkcJmuGWvGmdsmL0StoGa4vORhdeJoO3pud2MRBRtG8vUY5A0msgqRIpSRkO55KL2K4e2V9xwjgnBTj8KBphkxbiGC710BXMdRPyFsvRpdfpUW4y98640pKMr4Ef75xf3nJXNNM99ljpi4mKXEAF1mgIv7Ib7JUhtH871RXc10hp7fyxHJ3QuPmlAVIGFRVVa4vksaTdyMBBRztHIMM25RBmA4GPuPOdxvvFKKnUBEopXdg020goU6uVIohRi6b5MTTU4j2rdSprUnt6vp4MFHlGr5PgNa2tTXBv54pmK42xcp6EIVXLvsoHtEjIKEMgBfFBXPWKO9iIjHsh4eNB9JMuOXj5Vgdgo6j5qYY6inRdLHhuEPBgLqx2Jb5s6IufxIQuFvIlkm4r70HPn7xp74yKKNt72TdV37M8tWgUjYP3TbfJUfTrrIExEE3yAGl3K9IX3pBEUvLSGYNBGg8ou5vJvTWrx6ccbuqEaCDT7v7X4bGPSXN5xmH7C1XGKcyXEEMB7Pao5RIyCCAHs4EXmoIVAPzo58wUiXRSGVNmiP86Xhyv93xfizVSguPPo9EyVAPicmatuWtfJ86tresN8Sz6LruxzxQidw1jt6ERF6yPAj3KAKyedRMctvTcwHpyvzS8QKE67uNV9YFvBD7PoFDf3M3Ja62HYn2EdwmekGjO8oAMiEyA3Y2IpLCeqgN3yqcuU7UH8xNVcRREcsse36MBHcS2gOcPT1hUPSkvAfBW5PT4Cwv8MTBjqdLDDt6hthjYpJu01kJJtLv0G8zpcO6HgfQMwYKzvarly9e22EQn8fTkdpDSHSK7c3knVeOOXtYsGbbTtoc8OTFTOjN4eHWisJ4yR8k5AOopLsXmt3IthsNxSBnagqXuzJxElHHpUCf3he1BrsX7kHFXyTJ6LQVmkLScq2MLdbhQbhHi1N9TJy2ULDrvfhV4JWSV9hL7wzn60Yhy8z6WkV41a5cHGDSa8FWMBGgjFKwFJhRVXzjyWRjUdkOJDpDI4E8TSBgdcrSeUHurYXTbrvHb7hhj7GUdnY7D5p9BufK5Bn6yTeDyE1yiPGGRF5kAb2ewkAHeCzyimYtdIaVzuFCL89jzoRogPxtlJH5NtERAeMkKFUOkOOY1u2weRNt4Yys1uoPXGzoqQCg3gVY8zR9ocBRqciSjwrqIKmUkFd0VjUIlj1KuEm1hiT1mYiMJCThPGpFrBiGXfF7nQh771PRUyON2mlfAHYzSvoOPonA5LsGmbaEWCYn
push str.Find_RepeatProcess
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x9c], str.mruTlefHFRnkfmwHG2b7qVNmHj0Ugg9rJC7nFoJBMecw1bxLzlVFBbk2vUQR9NTd7zD10kMWsoyqabaikXmX881VhmoSBDNXpi1YTddd0bvziMr6XqYR4lC78IUVsnBQejNhnvawTq9TXflaeMQ4RGchp7RpujU9WF5OUU7DQ0EKHuzAyACcve8JFDG6sA8izWxqqsSXLNkPYhIC5TvKnl9tFsW844tRResNhmAzKHvge8cGEjj8kGj8mHh6Xn2zg5Fxj9G76CAxPidiNUrCF9XUTypVKUHhTCA7MAYUkt7y6NR7MlOo9SPLEb8YYScXCueStLBY9dDAlu1YzI1wYlXebNiWbd5L1Oa9xXXStNQjMTnPMG9XQcGqgCRXOzIYjgy1CLSSrcsMBmvM
mov dword [ebp - 0x84], 0
xor ecx, ecx
mov word [ebp - 0x50], cx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x94], str.5xvcroDtOk1SIcYdx6h4sTBVKS2lM8kPk3ekWtekn8k3wk5feiswToIcSigg1EWLH1CSyXy6qDgPkeUaxc3921ytST8cjSsABVYD3d9IuI8gczHysYM5AEuXx5dlmPGR393DybI97Gd80cqyuISLzS5QIw2CKDdMBV0dwtbjYcL2t1IOKn0UmQ6lmn1JQygXrsuWImEdPjXgabVvYNhtDnwGw9CaR1OBgJAFfGsPstXXqRaipIgFqVv7hIc8QAxopJRuw18bMyQXtv8oSL004BrSOo4CDWMvKfkNlvofLMHUkAkvRtVeeaTipQwpVWDGL1pfLYa6sLueQMUPme2nUWGCo9N2gyQawD1HdTAL0xb1JSMaUmEJs1LbaL3MYTUFBBwnqj1kyuHgtOuI
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x8c], str.BdpkSoXImQQVfJvV7JLDjzIK82mQ6hR4E6DHuXIa3j1rRmpQgkRKT11zDTLcIi3FVlCJuKGDLwyg8dPtknDfsh13l0qpDv4EsmksS8EqSxIVxgy2mt03qMPgnkiEwHLLNs6a06AQNPGKrD3iX9jlwFPgVkiQTQKg8ONqvlGe0gAM1AuvnKo
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0x4526f0
push 1
push 0
push 0x4527c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x403c60
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401520
mov eax, dword [ebp - 0x54]
jmp 0x403e7c
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jge 0x403ca4
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401520
mov eax, dword [ebp - 0x70]
jmp 0x403e7c
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x403cde
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401520
mov eax, dword [ebp - 0x64]
jmp 0x403e7c
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x30
mov edx, dword [ebp + 0xc]
push edx
push 0x41bc6c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x403d24
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401520
mov eax, dword [ebp - 0x5c]
jmp 0x403e7c
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x24], 0
je 0x403e0f
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x1c], 0
jne 0x403d5a
jmp 0x403e0f
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
push 1
lea ecx, [ebp - 0x18]
call fcn.00402310
push 0
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401420
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00402e90
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00401600
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x88], esp
push eax
call fcn.00401340
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + 0x18]
call edx
mov byte [ebp - 0x3d], al
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x403dfe
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401560
jmp 0x403d2b
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401520
mov eax, dword [ebp - 0x58]
jmp 0x403e7c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a40b
mov esp, ebp
pop ebp
ret 0x28