Function at 0x42a000
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x390
mov esi, dword [ebp + 8]
mov dword [esp + 0x364], 0x4409bc
mov al, byte [esp + 0x160]
mov byte [esp + 0x164], al
mov byte [esp + 0x30], 0x5e
mov byte [esp + 0x31], 0x5f
mov byte [esp + 0x32], 0x5e
mov byte [esp + 0x33], 0xde
call fcn.00414120
call fcn.00414120
movzx eax, byte [esp + 0x30]
xor eax, 0x2e
add al, 0x90
mov byte [esp + 0x30], al
movzx eax, byte [esp + 0x31]
xor eax, 0x2f
add al, 0x90
mov byte [esp + 0x31], al
movzx eax, byte [esp + 0x32]
xor eax, 0x30
add al, 0x90
mov byte [esp + 0x32], al
movzx eax, byte [esp + 0x33]
xor eax, 0x31
add al, 0x90
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x26c]
mov dword [esi], ecx
mov ecx, dword [eax + 0x270]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0x260]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x264]
sub eax, 2
sete byte [esi + 0xc]
mov ebx, esi
add ebx, 0x10
mov dword [esi + 0x10], 0
mov eax, esi
add eax, 0x14
mov dword [esp + 0x1c8], eax
mov byte [esi + 0x14], 0
mov eax, esi
add eax, 0x28
mov dword [esp + 0x214], eax
mov word [esi + 0x28], 0
mov eax, esi
add eax, 0x2a
mov dword [esp + 0x220], eax
mov byte [esi + 0x2a], 0
mov dword [esp + 0x15c], 0
lea eax, [esp + 0x15c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x43b5e8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x43b5f8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x360], eax
mov eax, dword [esp + 0x364]
mov ecx, dword [esp + 0x360]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x4409c4]
mov edx, ecx
and edx, 0x1a4b2dea
add edx, edx
sub edx, ecx
lea ecx, [edx + eax - 0x1a4b2dea]
mov dword [esp + 0x35c], 0x440210
mov eax, dword [0x4409c8]
mov dword [esp + 0x358], 0x4409d0
mov dword [esp + 0x350], 0x4409dc
mov dword [esp + 0x348], 0x4409e8
mov dword [esp + 0x340], 0x4409f4
mov dword [esp + 0x338], 0x440a00
mov dword [esp + 0x330], 0x440a0c
mov dword [esp + 0x328], 0x440a18
mov dword [esp + 0x320], 0x440210
mov edx, dword [0x440a24]
mov dword [esp + 0x200], edx
mov dword [esp + 0x31c], 0x440a2c
mov dword [esp + 0x314], 0x440a38
mov dword [esp + 0x30c], 0x440a44
mov dword [esp + 0x304], 0x440a50
mov dword [esp + 0x2fc], 0x440210
mov edx, dword [0x440a5c]
mov dword [esp + 0x208], edx
mov dword [esp + 0x2f8], 0x440210
mov edx, dword [0x440a64]
mov dword [esp + 0x20c], edx
mov dword [esp + 0x2f4], 0x440a6c
mov dword [esp + 0x2ec], 0x440210
mov edx, dword [0x440a78]
mov dword [esp + 0x210], edx
mov dword [esp + 0x2e8], 0x440a80
mov dword [esp + 0x2e0], 0x440210
mov edx, dword [0x440a8c]
mov dword [esp + 0x218], edx
mov dword [esp + 0x2dc], 0x440a94
mov dword [esp + 0x2d4], 0x440aa0
mov dword [esp + 0x2cc], 0x440aac
mov dword [esp + 0x2c4], 0x440210
mov edx, dword [0x440ab8]
mov dword [esp + 0x228], edx
mov dword [esp + 0x2c0], 0x440210
mov edx, dword [0x440ac0]
mov dword [esp + 0x22c], edx
mov dword [esp + 0x2bc], 0x440210
mov edx, dword [0x440ac8]
mov dword [esp + 0x230], edx
mov dword [esp + 0x2b8], 0x440ad0
mov dword [esp + 0x2b0], 0x440adc
mov dword [esp + 0x2a8], 0x440210
mov edx, dword [0x440ae8]
mov dword [esp + 0x238], edx
mov dword [esp + 0x2a4], 0x440210
mov edx, dword [0x440af0]
mov dword [esp + 0x23c], edx
mov dword [esp + 0x2a0], 0x440210
mov edx, dword [0x440af8]
mov dword [esp + 0x244], edx
mov dword [esp + 0x29c], 0x440b00
mov dword [esp + 0x294], 0x440b0c
mov dword [esp + 0x28c], 0x440210
mov edx, dword [0x440b18]
mov dword [esp + 0x24c], edx
mov dword [esp + 0x288], 0x440210
mov esi, dword [0x440b20]
mov dword [esp + 0x284], 0x440210
mov edx, dword [0x440b28]
mov dword [esp + 0x280], 0x440b30
mov dword [esp + 0x278], 0x440b3c
mov dword [esp + 0x270], 0x440210
mov edi, dword [0x440b48]
mov dword [esp + 0x1fc], edi
mov dword [esp + 0x26c], 0x440210
mov edi, dword [0x440b50]
mov dword [esp + 0x204], edi
mov dword [esp + 0x268], 0x440210
mov edi, dword [0x440b58]
mov dword [esp + 0x224], edi
mov dword [esp + 0x264], 0x440210
mov edi, dword [0x440b60]
mov dword [esp + 0x234], edi
mov dword [esp + 0x260], 0x440210
mov edi, dword [0x440b68]
mov dword [esp + 0x248], edi
mov dword [esp + 0x25c], 0x440210
mov edi, dword [0x440b70]
jmp ecx