Function at 0x42c3b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x3b8
mov esi, esp
mov eax, dword [ebp + 8]
lea ecx, [0x44419c]
mov dword [esi + 0x38c], ecx
mov cl, byte [esi + 0x90]
mov byte [esi + 0x94], cl
mov word [esi + 0x50], 0xd17c
mov word [esi + 0x52], 0x5143
xor ecx, ecx
cmp ecx, 2
jae 0x42c42b
movzx edx, word [esi + ecx*2 + 0x50]
mov edi, 0x5537c263
sub edi, ecx
mov ebx, 0x5537c263
sub ebx, ecx
and ebx, edi
or ebx, edx
mov edi, 0xc263
sub edi, ecx
and edi, edx
sub edi, ebx
mov edx, edi
and edx, 1
or edi, 1
add edi, 0x131e
add edx, edi
mov word [esi + ecx*2 + 0x50], dx
add ecx, 1
jmp 0x42c3ea
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx + 0x26c]
mov dword [eax], edx
mov edx, dword [ecx + 0x270]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x260]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0x264]
sub ecx, 2
sete byte [eax + 0xc]
mov edi, eax
add edi, 0x10
mov dword [eax + 0x10], 0
mov ecx, eax
add ecx, 0x14
mov dword [esi + 0x274], ecx
mov byte [eax + 0x14], 0
mov ecx, eax
add ecx, 0x28
mov dword [esi + 0x2d8], ecx
mov word [eax + 0x28], 0
mov ecx, eax
add ecx, 0x2a
mov dword [esi + 0x108], ecx
mov byte [eax + 0x2a], 0
mov dword [esi + 0x8c], 0
sub esp, 0x14
lea eax, [esi + 0x8c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x43f5e8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x43f5f8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
not eax
shr eax, 0x1f
mov dword [esi + 0x388], eax
mov eax, dword [esi + 0x38c]
mov ecx, dword [esi + 0x388]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x4441a4]
xor ecx, 0xfcef48e1
sub eax, ecx
push eax
mov ecx, esp
mov dword [esi + 0x220], ecx
mov dword [ecx], 0x4441a8
push eax
mov dword [esi + 0x21c], esp
push eax
mov ecx, esp
mov dword [esi + 0x228], ecx
mov dword [ecx], 0x4441b4
push eax
mov dword [esi + 0x224], esp
push eax
mov ecx, esp
mov dword [esi + 0x230], ecx
mov dword [ecx], 0x4441c0
push eax
mov dword [esi + 0x22c], esp
push eax
mov ecx, esp
mov dword [esi + 0x238], ecx
mov dword [ecx], 0x4441cc
push eax
mov dword [esi + 0x234], esp
push eax
mov ecx, esp
mov dword [esi + 0x244], ecx
mov dword [ecx], 0x4441d8
push eax
mov dword [esi + 0x23c], esp
push eax
mov ecx, esp
mov dword [esi + 0x248], ecx
mov dword [ecx], 0x4441e4
push eax
mov dword [esi + 0x240], esp
push eax
mov ecx, esp
mov dword [esi + 0x260], ecx
mov dword [ecx], 0x4441f0
push eax
mov dword [esi + 0x25c], esp
push eax
mov ecx, esp
mov dword [esi + 0x258], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x4441fc]
mov dword [esi + 0x254], ecx
push eax
mov ecx, esp
mov dword [esi + 0x268], ecx
mov dword [ecx], 0x444204
push eax
mov dword [esi + 0x264], esp
push eax
mov ecx, esp
mov dword [esi + 0x27c], ecx
mov dword [ecx], 0x444210
push eax
mov dword [esi + 0x278], esp
push eax
mov ecx, esp
mov dword [esi + 0x284], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x44421c]
mov dword [esi + 0x280], ecx
push eax
mov ecx, esp
mov dword [esi + 0x28c], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444224]
mov dword [esi + 0x288], ecx
push eax
mov ecx, esp
mov dword [esi + 0x298], ecx
mov dword [ecx], 0x44422c
push eax
mov dword [esi + 0x290], esp
push eax
mov ecx, esp
mov dword [esi + 0x29c], ecx
mov dword [ecx], 0x444238
push eax
mov dword [esi + 0x294], esp
push eax
mov ecx, esp
mov dword [esi + 0x2b4], ecx
mov dword [ecx], 0x444244
push eax
mov dword [esi + 0x2a8], esp
push eax
mov ecx, esp
mov dword [esi + 0x2a4], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444250]
mov dword [esi + 0x2a0], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2b0], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444258]
mov dword [esi + 0x2ac], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2bc], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444260]
mov dword [esi + 0x2b8], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2c8], ecx
mov dword [ecx], 0x444268
push eax
mov dword [esi + 0x2c0], esp
push eax
mov ecx, esp
mov dword [esi + 0x2cc], ecx
mov dword [ecx], 0x444274
push eax
mov dword [esi + 0x2c4], esp
push eax
mov ecx, esp
mov dword [esi + 0x304], ecx
mov dword [ecx], 0x444280
push eax
mov dword [esi + 0x2fc], esp
push eax
mov ecx, esp
mov dword [esi + 0x2f4], ecx
mov dword [ecx], 0x44428c
push eax
mov dword [esi + 0x2f0], esp
push eax
mov ecx, esp
mov dword [esi + 0x300], ecx
mov dword [ecx], 0x444298
push eax
mov dword [esi + 0x2f8], esp
push eax
mov ecx, esp
mov dword [esi + 0x318], ecx
mov dword [ecx], 0x4442a4
push eax
mov dword [esi + 0x310], esp
push eax
mov ecx, esp
mov dword [esi + 0x30c], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x4442b0]
mov dword [esi + 0x308], ecx
push eax
mov ecx, esp
mov dword [esi + 0x31c], ecx
mov dword [ecx], 0x4442b8
push eax
mov dword [esi + 0x314], esp
push eax
mov ecx, esp
mov dword [esi + 0x104], ecx
mov dword [ecx], 0x4442c4
push eax
mov dword [esi + 0x328], esp
push eax
mov ecx, esp
mov dword [esi + 0x324], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x4442d0]
mov dword [esi + 0x320], ecx
push eax
mov ecx, esp
mov dword [esi + 0x33c], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x4442d8]
mov dword [esi + 0x338], ecx
push eax
mov ecx, esp
mov dword [esi + 0x344], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x4442e0]
mov dword [esi + 0x340], ecx
push eax
mov ecx, esp
mov dword [esi + 0x34c], ecx
mov dword [ecx], 0x4442e8
push eax
mov dword [esi + 0x348], esp
push eax
mov ecx, esp
mov dword [esi + 0x36c], ecx
mov dword [ecx], 0x4442f4
push eax
mov dword [esi + 0x364], esp
push eax
mov ecx, esp
mov dword [esi + 0x360], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444300]
mov dword [esi + 0x358], ecx
push eax
mov ecx, esp
mov dword [esi + 0x368], ecx
mov dword [ecx], 0x444308
push eax
mov dword [esi + 0x35c], esp
push eax
mov ecx, esp
mov dword [esi + 0x37c], ecx
mov dword [ecx], 0x444314
push eax
mov dword [esi + 0x378], esp
push eax
mov ecx, esp
mov dword [esi + 0x374], ecx
mov dword [ecx], 0x443a80
mov ecx, dword [0x444320]
mov dword [esi + 0x370], ecx
push eax
mov ecx, esp
mov dword [ecx], 0x443a80
mov edx, dword [0x444328]
push eax
mov ebx, esp
mov dword [esi + 0x250], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444330]
mov dword [esi + 0x24c], ebx
push eax
mov ebx, esp
mov dword [esi + 0x270], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444338]
mov dword [esi + 0x26c], ebx
push eax
mov ebx, esp
mov dword [esi + 0x2d4], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444340]
mov dword [esi + 0x2d0], ebx
push eax
mov ebx, esp
mov dword [esi + 0x2e4], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444348]
mov dword [esi + 0x2e0], ebx
push eax
mov ebx, esp
mov dword [esi + 0x2ec], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444350]
mov dword [esi + 0x2e8], ebx
push eax
mov ebx, esp
mov dword [esi + 0x330], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444358]
mov dword [esi + 0x32c], ebx
push eax
mov ebx, esp
mov dword [esi + 0x354], ebx
mov dword [ebx], 0x443a80
mov ebx, dword [0x444360]
jmp eax