Function at 0x402ec0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414183
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x80
mov eax, dword [0x465148]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push str.Find_RepeatProcess
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x7c], 0
xor ecx, ecx
mov word [ebp - 0x5c], cx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0x46232c
push 1
push 0
push 0x4623fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x402fa8
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401d20
mov eax, dword [ebp - 0x54]
jmp 0x4031c4
mov dword [ebp - 0x8c], str.SiPleIKUDJmVPE3GsL4ia0mRXOqYQnPvGwex4WHXxw5EgXtFf52QCfImsYKJoNUNJqMS4sLclQj9eBN6Q24FpYeSv8GoBqdOxLn3EVhD7gGXqujKePU4SawToVyOOb3z1Ecrw6EJO6INhYRlNTJXxKgiiQs50rlWzoL1xEnhopExT1UurXVV6Jgkq5njS8yL2zWrMl1tK5D841tFt1jau7lCSB5PSHMGH4VYwVdUJHCIkVagEhUxPStfKcb666DimYczebFB8FnzRdaxdgdwt5DC3l9FmNl4aKBLARdTI7v7DQcFPJVfVKVzKldjcLIlM0jLuOIAcWsRfkDGEKavXWxiNfvSOw6nmEOq1O8NdRuw1DnxgDiHuKFp6PWna5tiqUVdtIu6ojGVYkT5GV5SEgGTsHiXQWl9YeOflnUpitX4Srj0qtAKNxXaGb7VecPPxkWjkCz5rl61avdVrocDuK0WxoPIknDb0b8MjmLOjEC2VBRo62Dws1lrHdHSSA0RJ3uJqtOJlTYx3k4Kg3W0GuCcOgK9moLuzsuQXSalSnn43Lbjgkvmjlz9wWUmRToyNbVsqujvh7SfdyceO21tHKXDmrTwiLPpagVvxhPxPTnWrOCBaAwTrUFpPGgLb7GjO1VCeao6KjA6rcBnXInNg3EyqomnLB7qr2I3A8IfgG4MwQNnkng09oVBw0rK2oPN7anFWbCrt7ahMuwnPMcWhbCrxKwtDbammul1Qj2wwt5VXhB0vqxL2GSmLEsdVb0Vdqnh1xSJqoRgyVtJN5Wc0a02vsWP05Nf7AzfnSfGcgnVHF82GLrBVViyYHwiB9CSXTln3qfpNfgKihbbvLk0QicnmGxJe75m8wqKod5jag5ETWKm8Eh5UyclMs9p3fo3qTT8Wk2b719INvDFOeh8x5RGnQmHVkjf7JaRsStdtXCbYe75kBD6kdQ58s1buEe7U1VYRXQ03lxn9T6rR70y3kTv5CMvY34H0Wh8kJFtw7GPDR4w4nkKJNNpat9wqOkXY3zBbjx2A4JbAW3X1iVwz3sAhUqbuO7JX6xm0Q8oRGbcMvIij0rpYtOehAKzAq6Ls6eVyybIWiiOHogWUUMxywVUYU7XNtxFsoXALAyynUg7z0sgkJhH8DVDa4jJXogXpuv9Qb8NCn1hieGprovkIi0Kv1Xqy4E2chO8axTL9hlEtuTvC6ptwWp2GtyFMVIc9NiFfUWbjWTKpHBxHkhS08wCmVliAT0B4sByUyo7vv7b7lUoWPGRKkM43BsfysEmeQKb7Iu40QhHkkvP6CzrC4GhkxPC1yoqjT5D4HvT4BtgsbDwjYaeDTOADvgC0FwEtJgB7NPSTcFRCQ80fr4v2nRHr3jEdOTMlMgsRlWHGMBIERpIXMacf5yJ7srd6vYtXKq87ElmukSa6gs218IOVBJb0PSWMLOeQzpiR4EkqxUF9yR8oMhBVxhUo2ID79YtYuabiXAquSWPLOL8ymImiwbdxCRfBHGwMY2INHSRFB4qBBS4nJiAhbuJC05Ov1HA8MBr1IphSHajX1wNe1xnjamxOiTALclJlVSwIn5D0WXzVDy9TDkv69Y5epKS2PyXcH8OU8SlQS4lfBtKEeQmsNFcT2PeD4P8WEYMQoVbfOOWkwiddKFYtPM6QzdgEvg1gAnwVEnkUOrQnzDXJpC3pXLp3fLIPltgiAAMLnslxH0DdpGmPCTSJV99q1dyDeIpD0eWb2sbL5m3qbeEAa2r9syHOC4NenNTkre5c9OccjdYgCCXv0QkujDR5yGGts84SLON2eY6nx5qHVLjAoxLQhbPX5jwUHE7f9CtaOv2PElyoPcBfSAEx909feUNRQU8OYx1br1v0jaFJz0EmgQw1I2NyNm9h939tVO1VHerhWzdMTO8hzrwXPh7ykljOlL2vX2JtaU84KoKl6TEM8TsjjMRQblbTKkzHf423qWfDGj1RV4F8xYL82IaXpHPA9Brhhap56hSjtORyJIx0ESyIQkxoTAqEQ3bSMS3gNSvhAfjjkPxxA2wzETTAg0hCGDfFK5JocUYIjJtG2XMmIg3qlOzXSIRF0YYdu0SzWvxLEgF2HelwHF9aPyeQUqNHDgCwubB3IUQupFjiHm8wsIrT5EXAizOi0eh7ztBicvVW7yWdUDWkadfW0IhqGuNMXcYTM5eW6Ec86qjaKVwmgetPAt0zyhL9U4BhuwtT8RtWrxeh7FssteHhNGpd8TU7OlY6fF1e3GXk02GlqTeXMX8dEcarmav555LEVG6cBMg6nQPTEddFpxCJ9Xhm1E2bETxGG5DhzRl4XMU9eLFLTnEdiYcXAQ4d23MqRHeaIJBYTrl1alNW0en9akKhoYkIajPvaI3JQhMy6fG7UhCmKbyiNc9csbGTz3W2uBW6Nr4sftCMwt6ztCAAiOYDzlbHhegA2cqwngYiLcX3uq2CJjxbIwfqlgULNnNbfDzwrQtCTlIDQdb1mi7obHkl6uepbBuhQpbLRpRYAFY0bt9HtXCNNQ09WsxF0B8NQkCbvcSPAJ0fwqq4r34aIwqyLooijCq7tvYQgyDBpWaguSpWSA3o5lacbmxIIwX5fpV64UDFjy1yaepGHYOG42aFBgN6mIeVWQMrOMKmlBfnbqz25ThoQnKzdPdhOcBsDVxytJiYiYDHE00aroY5DgFnVBROfylNB5LpXrTKJpabf5BMtO6vDC2ztY5XjWACt7J5jDER0rV96mh09SrE5ulyh9fFb5o136lTs71udqaFU7JmGzsHeYuIB9UCwjGwsu6pqNOGczexTbCUAfh1jgMnsQMbzuj952ckfEjwBTFcIYq8BACbDATOzWJo26XlxOqAUI61Qi8OEyBWMzSXtkTfuXG38bg1Lgfjw8c74qphptqJoz5n9RfSvfNBDnGxV7LR853IbNs9fT6k0cSBYINPGXkgNRDGtqGLNSpHTLlIWzG2qsz2isNcQ8FToroL5CqLERuRGuiXNNbzKF7gtIT9fugW7rWEu6bNtIYkHY37FbLV7qj9fjpbIh6zOyDaPgqJ6gr8WTEvomBEtALcHWv5K7UWsCKaPiYnFA5eIc2uMIcu9k700kFG4yUy36Q3NpChnNLA8PeFGyiGS6MjkEX95OxDimSSv79J9bf5B2IopWLGXRezwMfck9L2pMfO7x2oBxGPFAHtSwGpO92UyfkAfLpcadvHiM2NUKVYkiCTCy3EFQcd67b8c6ScfXyIj8TBIHBtGFqiYP6tm6InatypAfaFfKwn62oxXa542WzOgBlkoeEqdnXT12HRBOLvccin2SwoM22gAwyWTM1r3LGPeXuxHMYiOtq2IBOSsxjV2JMqDuSCSCLl6i15LM5dO0zr9WFMLOoKxOka3ikbkM1kBVksWnf6F1ADRyvdySOcVPKS9kqrm81zUwUbhzV5u3kJQYw4LuCnWfUFEVhPnr6DloQmEQRF3MCVoKI6w2mTc1TTTG2N9rnVhzGGT72DK9oudlPT5G60aw5iRjNVQRIIkNwqJKF8EcuKsamQPhrugE7U9MKQ1lL3cxUqIBkCqhRazBzbjlsKMGR81f3hCuVOJU06lULTpSpcv0vYbaNKSowEn5RYXQnLVNorYs24yI5suDX7hEz1EXvuKOqRNX2qWJf3SprAtIPBfJwixuqE26w2kgTRfhBb2Xc4epAdr0EmMvw551xnSSwWUnz0NdzfBtqe3xi5jSvyB62P8jAsVTKg0jDnn89EeTCQhmGADSp4xBWL38LJObHjDtpbfnkhCCYNJQ9vzKnSN4STnVME3c7MBq7G6dSMAHfz8vjVWor33te6LTRd4R2FhW5d0RmJ8VCd6c5hdXEHgPb21TKY8zJjF3Bbqx2rmKRk6jDhrM62S1Cd5vH9sbMmsT05emX6xnf9yCq1nqPkGTh011vs8W0MVTCwCpYI4FypIr8SoAXWSiAy3nqc7DtU2DP7hJF7uc4vMsJBvgBl2XMSyjhihqypmVYBcmpXuhBnMQufozS36ERM2cndoYRd8KsNMcjKSSvwFfRbjSWCs2AV77y04oiCdlGASafNDIB2jIE8dKXLRHrOBRcjReYh754UE7SfRbgApOS
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jge 0x402ff6
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401d20
mov eax, dword [ebp - 0x70]
jmp 0x4031c4
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x403030
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401d20
mov eax, dword [ebp - 0x64]
jmp 0x4031c4
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x30
mov edx, dword [ebp + 0xc]
push edx
push 0x421494
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x403076
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401d20
mov eax, dword [ebp - 0x4c]
jmp 0x4031c4
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x24], 0
je 0x403161
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x1c], 0
jne 0x4030ac
jmp 0x403161
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
push 1
lea ecx, [ebp - 0x18]
call fcn.00405700
push 0
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401b60
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00401910
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402140
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push eax
call fcn.00401970
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + 0x18]
call edx
mov byte [ebp - 0x3d], al
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x403150
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401e40
jmp 0x40307d
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401d20
mov eax, dword [ebp - 0x58]
jmp 0x4031c4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004098de
mov esp, ebp
pop ebp
ret 0x28