Function at 0x42cac0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x5c8
mov esi, esp
lea eax, [0x449b70]
mov dword [esi + 0x58c], eax
mov al, byte [esi + 0x140]
mov byte [esi + 0x14c], al
mov byte [esi + 0x144], 0x90
mov byte [esi + 0x145], 0x91
mov byte [esi + 0x146], 0x94
mov byte [esi + 0x147], 0x14
mov eax, 4
mov byte [esi + eax + 0x144], 0
add eax, 1
cmp eax, 5
jne 0x42cb0a
xor ecx, ecx
cmp ecx, 5
jae 0x42cb8b
movzx ebx, byte [esi + ecx + 0x144]
mov edi, ecx
add edi, 0xa4
mov eax, 0x3b81bb5b
sub eax, ecx
mov edx, 0x3b81bb5b
sub edx, ecx
or eax, edx
xor eax, 0xffffffff
mov edx, ebx
or edx, eax
and edi, ebx
sub edx, edi
mov edi, edx
and edi, 0xc9
mov eax, edx
and eax, 2
xor eax, 2
mov ebx, edx
and ebx, 0xc9
imul ebx, eax
mov eax, edx
and eax, 2
or edi, 2
imul edi, eax
add edi, ebx
xor edx, 0xcb
add edx, edi
add dl, 1
mov byte [esi + ecx + 0x144], dl
add ecx, 1
jmp 0x42cb1c
mov eax, dword [esi + 0x144]
mov ecx, dword [eax + 0x26c]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov ecx, dword [eax + 0x270]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0x260]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0x264]
sub eax, 2
sete byte [edx + 0xc]
mov eax, edx
add eax, 0x10
mov dword [esi + 0xc0], eax
mov dword [edx + 0x10], 0
mov eax, edx
add eax, 0x14
mov dword [esi + 0x354], eax
mov byte [edx + 0x14], 0
mov eax, edx
add eax, 0x28
mov dword [esi + 0x48c], eax
mov word [edx + 0x28], 0
mov eax, edx
add eax, 0x2a
mov dword [esi + 0x1c4], eax
mov byte [edx + 0x2a], 0
mov dword [esi + 0x13c], 0
sub esp, 0x14
lea eax, [esi + 0x13c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x444a28
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x444a38
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
not eax
shr eax, 0x1f
mov dword [esi + 0x588], eax
mov eax, dword [esi + 0x58c]
mov ecx, dword [esi + 0x588]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x449b78]
xor ecx, 0x2887ef5
sub eax, ecx
push eax
mov ecx, esp
mov dword [esi + 0x274], ecx
mov dword [ecx], 0x449b7c
push eax
mov dword [esi + 0x264], esp
push eax
mov ecx, esp
mov dword [esi + 0x278], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449b88]
mov dword [esi + 0x26c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x280], ecx
mov dword [ecx], 0x449b90
push eax
mov dword [esi + 0x27c], esp
push eax
mov ecx, esp
mov dword [esi + 0x29c], ecx
mov dword [ecx], 0x449b9c
push eax
mov dword [esi + 0x290], esp
push eax
mov ecx, esp
mov dword [esi + 0x288], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [str.__v_:_]
mov dword [esi + 0x284], ecx
push eax
mov ecx, esp
mov dword [esi + 0x294], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449bb0]
mov dword [esi + 0x28c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2a4], ecx
mov dword [ecx], 0x449bb8
push eax
mov dword [esi + 0x298], esp
push eax
mov ecx, esp
mov dword [esi + 0x2a8], ecx
mov dword [ecx], 0x449bc4
push eax
mov dword [esi + 0x2a0], esp
push eax
mov ecx, esp
mov dword [esi + 0x2c0], ecx
mov dword [ecx], 0x449bd0
push eax
mov dword [esi + 0x2b8], esp
push eax
mov ecx, esp
mov dword [esi + 0x2b0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449bdc]
mov dword [esi + 0x2ac], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2bc], ecx
mov dword [ecx], 0x449be4
push eax
mov dword [esi + 0x2b4], esp
push eax
mov ecx, esp
mov dword [esi + 0x2d0], ecx
mov dword [ecx], 0x449bf0
push eax
mov dword [esi + 0x2cc], esp
push eax
mov ecx, esp
mov dword [esi + 0x2c8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449bfc]
mov dword [esi + 0x2c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2d8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c04]
mov dword [esi + 0x2d4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2e0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c0c]
mov dword [esi + 0x2dc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2e8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c14]
mov dword [esi + 0x2e4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2f0], ecx
mov dword [ecx], 0x449c1c
push eax
mov dword [esi + 0x2ec], esp
push eax
mov ecx, esp
mov dword [esi + 0x2f8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c28]
mov dword [esi + 0x2f4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x300], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c30]
mov dword [esi + 0x2fc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x308], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c38]
mov dword [esi + 0x304], ecx
push eax
mov ecx, esp
mov dword [esi + 0x310], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c40]
mov dword [esi + 0x30c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x318], ecx
mov dword [ecx], 0x449c48
push eax
mov dword [esi + 0x314], esp
push eax
mov ecx, esp
mov dword [esi + 0x328], ecx
mov dword [ecx], 0x449c54
push eax
mov dword [esi + 0x320], esp
push eax
mov ecx, esp
mov dword [esi + 0x324], ecx
mov dword [ecx], 0x449c60
push eax
mov dword [esi + 0x31c], esp
push eax
mov ecx, esp
mov dword [esi + 0x330], ecx
mov dword [ecx], 0x449c6c
push eax
mov dword [esi + 0x32c], esp
push eax
mov ecx, esp
mov dword [esi + 0x340], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c78]
mov dword [esi + 0x33c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x348], ecx
mov dword [ecx], 0x449c80
push eax
mov dword [esi + 0x344], esp
push eax
mov ecx, esp
mov dword [esi + 0x364], ecx
mov dword [ecx], 0x449c8c
push eax
mov dword [esi + 0x35c], esp
push eax
mov ecx, esp
mov dword [esi + 0x36c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449c98]
mov dword [esi + 0x368], ecx
push eax
mov ecx, esp
mov dword [esi + 0x374], ecx
mov dword [ecx], 0x449ca0
push eax
mov dword [esi + 0x370], esp
push eax
mov ecx, esp
mov dword [esi + 0x384], ecx
mov dword [ecx], 0x449cac
push eax
mov dword [esi + 0x380], esp
push eax
mov ecx, esp
mov dword [esi + 0x37c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449cb8]
mov dword [esi + 0x378], ecx
push eax
mov ecx, esp
mov dword [esi + 0x398], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449cc0]
mov dword [esi + 0x394], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3a0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449cc8]
mov dword [esi + 0x39c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3ac], ecx
mov dword [ecx], 0x449cd0
push eax
mov dword [esi + 0x3a4], esp
push eax
mov ecx, esp
mov dword [esi + 0x3b4], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449cdc]
mov dword [esi + 0x3a8], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449ce4]
mov dword [esi + 0x3bc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449cec]
mov dword [esi + 0x3c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3d8], ecx
mov dword [ecx], 0x449cf4
push eax
mov dword [esi + 0x3cc], esp
push eax
mov ecx, esp
mov dword [esi + 0x3f0], ecx
mov dword [ecx], 0x449d00
push eax
mov dword [esi + 0x3e4], esp
push eax
mov ecx, esp
mov dword [esi + 0x3e0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449d0c]
mov dword [esi + 0x3dc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3ec], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449d14]
mov dword [esi + 0x3e8], ecx
push eax
mov ecx, esp
mov dword [esi + 0x404], ecx
mov dword [ecx], 0x449d1c
push eax
mov dword [esi + 0x3fc], esp
push eax
mov ecx, esp
mov dword [esi + 0x408], ecx
mov dword [ecx], 0x449d28
push eax
mov dword [esi + 0x400], esp
push eax
mov ecx, esp
mov dword [esi + 0x420], ecx
mov dword [ecx], 0x449d34
push eax
mov dword [esi + 0x418], esp
push eax
mov ecx, esp
mov dword [esi + 0x410], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449d40]
mov dword [esi + 0x40c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x41c], ecx
mov dword [ecx], 0x449d48
push eax
mov dword [esi + 0x414], esp
push eax
mov ecx, esp
mov dword [esi + 0x438], ecx
mov dword [ecx], 0x449d54
push eax
mov dword [esi + 0x430], esp
push eax
mov ecx, esp
mov dword [esi + 0x428], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449d60]
mov dword [esi + 0x424], ecx
push eax
mov ecx, esp
mov dword [esi + 0x434], ecx
mov dword [ecx], 0x449d68
push eax
mov dword [esi + 0x42c], esp
push eax
mov ecx, esp
mov dword [esi + 0x450], ecx
mov dword [ecx], 0x449d74
push eax
mov dword [esi + 0x448], esp
push eax
mov ecx, esp
mov dword [esi + 0x440], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449d80]
mov dword [esi + 0x43c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x44c], ecx
mov dword [ecx], 0x449d88
push eax
mov dword [esi + 0x444], esp
push eax
mov ecx, esp
mov dword [esi + 0x46c], ecx
mov dword [ecx], 0x449d94
push eax
mov dword [esi + 0x45c], esp
push eax
mov ecx, esp
mov dword [esi + 0x458], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449da0]
mov dword [esi + 0x454], ecx
push eax
mov ecx, esp
mov dword [esi + 0x464], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449da8]
mov dword [esi + 0x460], ecx
push eax
mov ecx, esp
mov dword [esi + 0x470], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449db0]
mov dword [esi + 0x468], ecx
push eax
mov ecx, esp
mov dword [esi + 0x478], ecx
mov dword [ecx], 0x449db8
push eax
mov dword [esi + 0x474], esp
push eax
mov ecx, esp
mov dword [esi + 0x488], ecx
mov dword [ecx], 0x449dc4
push eax
mov dword [esi + 0x484], esp
push eax
mov ecx, esp
mov dword [esi + 0x480], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449dd0]
mov dword [esi + 0x47c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4bc], ecx
mov dword [ecx], 0x449dd8
push eax
mov dword [esi + 0x4b4], esp
push eax
mov ecx, esp
mov dword [esi + 0x4c0], ecx
mov dword [ecx], 0x449de4
push eax
mov dword [esi + 0x4b8], esp
push eax
mov ecx, esp
mov dword [esi + 0x4dc], ecx
mov dword [ecx], 0x449df0
push eax
mov dword [esi + 0x4d0], esp
push eax
mov ecx, esp
mov dword [esi + 0x4c8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449dfc]
mov dword [esi + 0x4c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4d4], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e04]
mov dword [esi + 0x4cc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4e0], ecx
mov dword [ecx], 0x449e0c
push eax
mov dword [esi + 0x4d8], esp
push eax
mov ecx, esp
mov dword [esi + 0x4f4], ecx
mov dword [ecx], 0x449e18
push eax
mov dword [esi + 0x4ec], esp
push eax
mov ecx, esp
mov dword [esi + 0x4e8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e24]
mov dword [esi + 0x4e4], ecx
push eax
mov ebx, esp
mov dword [ebx], case.0x42501a.294
mov ecx, dword [0x449e2c]
mov dword [esi + 0x4fc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x504], ecx
mov dword [ecx], 0x449e34
push eax
mov dword [esi + 0x500], esp
push eax
mov ecx, esp
mov dword [esi + 0x524], ecx
mov dword [ecx], 0x449e40
push eax
mov dword [esi + 0x51c], esp
push eax
mov ecx, esp
mov dword [esi + 0x514], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e4c]
mov dword [esi + 0x510], ecx
push eax
mov ecx, esp
mov dword [esi + 0x520], ecx
mov dword [ecx], 0x449e54
push eax
mov dword [esi + 0x518], esp
push eax
mov ecx, esp
mov dword [esi + 0x53c], ecx
mov dword [ecx], 0x449e60
push eax
mov dword [esi + 0x534], esp
push eax
mov ecx, esp
mov dword [esi + 0x52c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e6c]
mov dword [esi + 0x528], ecx
push eax
mov ecx, esp
mov dword [esi + 0x538], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e74]
mov dword [esi + 0x530], ecx
push eax
mov ecx, esp
mov dword [esi + 0x544], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e7c]
mov dword [esi + 0x540], ecx
push eax
mov ecx, esp
mov dword [esi + 0x54c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449e84]
mov dword [esi + 0x548], ecx
push eax
mov edx, esp
mov dword [edx], case.0x42501a.294
mov ecx, dword [0x449e8c]
mov dword [esi + 0x550], ecx
push eax
mov ecx, esp
mov dword [esi + 0x55c], ecx
mov dword [ecx], 0x449e94
push eax
mov dword [esi + 0x558], esp
push eax
mov ecx, esp
mov dword [esi + 0x574], ecx
mov dword [ecx], 0x449ea0
push eax
mov dword [esi + 0x56c], esp
push eax
mov ecx, esp
mov dword [esi + 0x564], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449eac]
mov dword [esi + 0x560], ecx
push eax
mov ecx, esp
mov dword [esi + 0x570], ecx
mov dword [ecx], 0x449eb4
push eax
mov dword [esi + 0x568], esp
push eax
mov ecx, esp
mov dword [esi + 0x584], ecx
mov dword [ecx], 0x449ec0
push eax
mov dword [esi + 0x580], esp
push eax
mov ecx, esp
mov dword [esi + 0x57c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449ecc]
mov dword [esi + 0x578], ecx
push eax
mov edi, esp
mov dword [edi], case.0x42501a.294
mov ecx, dword [0x449ed4]
mov dword [esi + 0x250], ecx
push eax
mov ecx, esp
mov dword [esi + 0x258], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449edc]
mov dword [esi + 0x254], ecx
push eax
mov ecx, esp
mov dword [esi + 0x260], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449ee4]
mov dword [esi + 0x25c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x270], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449eec]
mov dword [esi + 0x268], ecx
push eax
mov ecx, esp
mov dword [esi + 0x338], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449ef4]
mov dword [esi + 0x334], ecx
push eax
mov ecx, esp
mov dword [esi + 0x350], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449efc]
mov dword [esi + 0x34c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x360], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f04]
mov dword [esi + 0x358], ecx
push eax
mov ecx, esp
mov dword [esi + 0x390], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f0c]
mov dword [esi + 0x38c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3b8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f14]
mov dword [esi + 0x3b0], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3d4], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f1c]
mov dword [esi + 0x3d0], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3f8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f24]
mov dword [esi + 0x3f4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x494], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f2c]
mov dword [esi + 0x490], ecx
push eax
mov ecx, esp
mov dword [esi + 0x49c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f34]
mov dword [esi + 0x498], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4a8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f3c]
mov dword [esi + 0x4a4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4b0], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f44]
mov dword [esi + 0x4ac], ecx
push eax
mov ecx, esp
mov dword [esi + 0x4f8], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f4c]
mov dword [esi + 0x4f0], ecx
push eax
mov ecx, esp
mov dword [esi + 0x50c], ecx
mov dword [ecx], case.0x42501a.294
mov ecx, dword [0x449f54]
mov dword [esi + 0x508], ecx
jmp eax