Function at 0x403af0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4159c3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x84
mov eax, dword [0x4473c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x74], str.gV5lh7fG7h02jBWdyn10wMoU3wFkNWC3IPyYNLyQLSQNgu8H0IFhsnogMtmz44lJiEpxk7Ac4OjPqtPWOXa3la7WJmcWWRYkP3RGiLlWQP8gsdd2iR8NrHgMWL27BH9gxmrbgJG4QRLKBfPh1Pn14XsohsrgQOUhUwLLNpxhAWpvF1MkUSVbBhj7qhF50mOlO9KcBzG5rjTe3Px2gH1Pxon6WhHM0jOKputfsqWJBgN8HV3yDz5wpq9daAd6mBl1cqcIax1h5ipWcpIhWsKLQS5ahxyg92iV0sqpERAvK2GU
mov byte [ebp - 4], 1
push str.Find_RepeatProcess
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0
xor ecx, ecx
mov word [ebp - 0x6c], cx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
je 0x403ba1
mov dword [ebp - 0x90], str.Yg81fGAgUt5yW4tS4UGcEj5ORtN7xcUFlUBa22PRMSWfXDAXQesO6I3N12nwWScVf9lIOh800iYcjDGbyI6X15UKLu10BkuHQbpc8tLiOlddNtJRUm7wR5PBEV1tYfokV9hpQlcsz5HP4JtVcWsGpX5iiPECpxdIM4Rqag4cGUrpz7hLgbyUMGdNp58U0fWglOAzBehercEcighxQ2z9oXGznq2OvbC2s2Gw2aeKvb0yE1DGPapjJKtn5CFCfhsNjw9wq2Xtq7eeLBNNuxMvN1PWjpJhcWWNH7AEHDKkpR95oJFloNc4DTOoNzgXz897x2vh85xQjyA4G6VzcgETcXI6Y0lVWHSFOcTmOWtPArmecg3yLXFwkh7MVR3ulwHeHglqPe3qn2kGQPdfSiOiWc8BIWG95DEDfwP4cbzoStNl4VS7gWbrT3fmS5lN56tEoafWutbslAjIdslnxGm54faP1lD3pAITrjPWMwRzewbbTy6b66KWk1AmheBGE094dL5tibl9SLjXNsF2DJuzHmIREKsU4pwSQmhFm2P8vjOFdAzrj6rhmWhR5jKev5DdWLrBtl45dx8d6Ao5CEhhA9wsldlt1MOSDwcIwxQky1bG326Ct3GJyUddpdzPw23aVnMSQdm4CysKD2AsC55IGB7TIEfB1zPDwAsmTYSGb0shXnSCa9LO0RmOENuPAiupQGzxuqeA6YfU0eFELRNKViNy19Nex7tYhVoYcDL3EqaUTLCv2F5oCYPy7uV5oWgeamYlffsfCtWa2byvvIkIVzufFR1oQKssV1abqERJuIPLIjsu6arCbmPE4wGYmbyprWiNoOOk4v0vCQMMCw1DBDMdJ8aaSMN4bisE31HI9XjnIlXatHm3DsWo8rIsQyNMyOUXRqN9evhG2LpBa84DL2NpCjUz2kWmG84DOMhi5S2YAfX805QXVbHSSRWngW0tuFujnrbjLalYrUQE0FBeGfSXQDFXjo7NEGQjAjsKirE9hi2ofjayQyXj4r89zBBi9GeEuySjmK4DPY2L7ISR9F2P3mi11789hk5MjKpHb78d0gvbIShnBjispXop2sDCNqmLeGi4u9gO8HK4IVxQoheAClffx7JtQnm2LJ5RWT9Oc77Yc0ASR7Sd01UI7GXvSuaPz4L75TIPPuUwy98Su2MTKYKqT3YDN5BgruVqi6fRi1yozo7TWYFpQWjzG8LgGuaxxeBnJqrzgjc337fW6kGQ9RdvqcEwEFCXGup25e92FzQtXNCNWpshmrq4RRNizPOPDC03fL3JRB2YO7dFo0KPaj4kiRM2DysYpcf7ppJa5Idk72Xv831dM3JCiBtdcOa0TYIomnk2MR3grYH5HzpB34vzP7QlDUzgNQFzqNikQFrwvIiQsNOGSbVI1k9DveQbhVNOJXJkEIcjukq5uhbw8WBKKBw3bm4I6ualdNAohemg9yP5I6GRPRP2yfHaYruw0dzWjuLTP3tJ6kHOqUGG1xjvYiJEiIa20K6j8MYFfiUewMOpQal9jocmRrThyM2q1TuzljmKOGjbFvPD2ruTSM74qYEIjF1FJxdo9Eux8Du6Orp8PuI8wW8l9SGLbWJy4FCRawoNSJPoNqk6LeMgfdqAHeaYeLYzoSmfdQUVMLE9KWyORYkucTv7KDwfHV3ha6W3BszY8zmB4aJX1uVqWSnU0floeWomzAIuq7gIIEqAD0vm5nzkDaSDDCtXvJqeCPMkkwkdJbwUtOxwJoTXXDlfi1Vxkzw49nTQyhwLDWzrEoqOtrkBd4wVOjYJybXQPXyPuJxn8166OOVpuxRXRTURSInc06p6VcarkBmn3adsgmK9t4aWj6xfsIiIfecaNbmDy0gwMVbVesErgV9gNOG2dVp7Nr30yy06qntdaSHjyvnqrxJS8d33UserLxWSq5BLH5F5mdEn6hB1rsyhBkJiE6uKhLQRxBncLnU4RM8XOS3RxnVua7l6Nf98CHCJN8glzoNmw4qU
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0x440468
push 1
push 0
push 0x440538
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x403bf0
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401540
mov eax, dword [ebp - 0x54]
jmp 0x403e02
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jge 0x403c34
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401540
mov eax, dword [ebp - 0x70]
jmp 0x403e02
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x403c6e
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401540
mov eax, dword [ebp - 0x64]
jmp 0x403e02
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x30
mov edx, dword [ebp + 0xc]
push edx
push 0x417f54
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x403cb4
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401540
mov eax, dword [ebp - 0x5c]
jmp 0x403e02
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x24], 0
je 0x403d9f
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x1c], 0
jne 0x403cea
jmp 0x403d9f
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
push 1
lea ecx, [ebp - 0x18]
call fcn.00402330
push 0
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401440
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00402eb0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00401620
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
push eax
call fcn.00401360
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + 0x18]
call edx
mov byte [ebp - 0x3d], al
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x403d8e
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401580
jmp 0x403cbb
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401540
mov eax, dword [ebp - 0x58]
jmp 0x403e02
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a33b
mov esp, ebp
pop ebp
ret 0x28