Function at 0x437d20
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x128]
push eax
push 0x458bac
push 1
push ebx
push 0x458c7c
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x124], ebx
mov byte [ebp - 0x10d], bl
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x437f18
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.ROOTCIMV2
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
js 0x437f18
mov ecx, dword [ebp - 0x114]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x437f18
push 0xfe
lea eax, [ebp - 0x10a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x10c], dx
call fcn.00446e60
mov ecx, dword [ebp + 8]
push ecx
push str.Win32_Process.Handle__u_
mov ecx, 0x80
lea ebx, [ebp - 0x10c]
call fcn.00404b50
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
add esp, 0x14
push 0
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
push str.Win32_Process
push eax
call edx
test eax, eax
js 0x437f16
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x11c]
push edx
push 0
push str.Terminate
push eax
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
js 0x437f16
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
lea edx, [ebp - 0x118]
push edx
push 0
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
js 0x437f16
mov eax, dword [ebp - 0x118]
mov ecx, 3
push 0
mov word [ebp - 0x13c], cx
lea ecx, [ebp - 0x13c]
push ecx
push 0
mov dword [ebp - 0x134], 0
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push str.Reason
push eax
call edx
test eax, eax
js 0x437f16
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x124]
push edx
mov edx, dword [ebp - 0x118]
push edx
push 0
push 0
push str.Terminate
mov edx, ebx
push edx
push eax
mov eax, dword [ecx + 0x60]
call eax
test eax, eax
js 0x437f16
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
push 0
push 0
lea edx, [ebp - 0x14c]
push edx
push 0
push str.ReturnValue
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
js 0x437f16
cmp word [ebp - 0x14c], 3
jne 0x437f16
cmp dword [ebp - 0x144], 0
sete byte [ebp - 0x10d]
xor ebx, ebx
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0x437f30
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x124], ebx
mov eax, dword [ebp - 0x118]
cmp eax, ebx
je 0x437f48
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x118], ebx
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x437f60
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x11c], ebx
mov eax, dword [ebp - 0x120]
cmp eax, ebx
je 0x437f78
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x120], ebx
mov eax, dword [ebp - 0x114]
cmp eax, ebx
je 0x437f90
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x114], ebx
mov eax, dword [ebp - 0x128]
cmp eax, ebx
je 0x437fa2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x10d]
xor ecx, ebp
pop ebx
call fcn.0043e417
mov esp, ebp
pop ebp
ret