Function at 0x40c6f0
Capabilities:
Connect to wmi namespace via wbemlocator
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434a94
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x44c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x24], eax
xor ecx, ecx
xorps xmm0, xmm0
push ecx
movq qword [eax], xmm0
push ecx
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], ecx
mov dword [eax + 8], ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
mov ecx, esi
shr ecx, 0x1f
xor cl, 1
mov byte [0x44e584], cl
test esi, esi
jns 0x40c7e6
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
cmp esi, 0x80010106
je 0x40c7b4
mov dword [0x44cba0], 2
call dword [eax + 0x1c]
push str.CoInitializeEx_failed:
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
push esi
mov dword [eax + 0x244], 1
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
jmp 0x40cd6e
mov dword [0x44cba0], 1
call dword [eax + 0x1c]
push str.CoInitializeEx_has_returned_RPC_E_CHANGED_MODE
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push 0
call dword [eax + 0x3c]
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
call dword [eax + 0x1c]
push str.Initializing...
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x44e790
push 0x436480
push 1
push 0
push 0x4364b0
call ebx
mov esi, eax
test esi, esi
jns 0x40c88c
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
mov dword [0x44cba0], 2
call dword [edx + 0x1c]
push str._Failed
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push str.Failed_to_create_IWbemLocator_object
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0x43ccbc
jmp 0x40c77d
push 0xc
call fcn.004173ce
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x40c8d9
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push str..ROOTCIMV2
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x40cd8a
jmp 0x40c8db
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x40cd94
push 0x44e794
push 0
push 0
push 0
push 0
mov dword [ebp - 4], 1
mov eax, dword [0x44e790]
push 0
push 0
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, eax
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x40c95d
mov ecx, dword [esi]
test ecx, ecx
je 0x40c93b
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40c952
push eax
call fcn.00417697
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041739d
add esp, 8
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
mov dword [ebp - 0x18], 0
push str._WMI_
test edi, edi
jns 0x40c9ae
mov dword [0x44cba0], 2
call dword [eax + 0x1c]
push str._Failed
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push str.Cannot_tonnect_to_rootcimv2
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0x43ccbc
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push edi
jmp 0x40c785
call dword [eax + 0x1c]
push str.Connected_to_ROOTCIMV2_WMI_namespace
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x44e794]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x40ca35
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
mov dword [0x44cba0], 2
call dword [edx + 0x1c]
push str._Failed
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push str.Cannot_set_proxy_blanket
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0x43ccbc
jmp 0x40c77d
push 0x44e798
push 0x436490
push 1
push 0
push 0x4364c0
call ebx
mov esi, eax
test esi, esi
jns 0x40ca8f
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
mov dword [0x44cba0], 2
call dword [edx + 0x1c]
push str._Failed
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push str.Cannot_not_create_refresher
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0x43ccbc
jmp 0x40c77d
mov eax, dword [0x44e798]
push 0x44e79c
push 0x4364a0
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
jns 0x40cae8
mov edx, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
mov dword [0x44cba0], 2
call dword [edx + 0x1c]
push str._Failed
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push str.Could_not_query_configureRefresher
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0x43ccbc
jmp 0x40c77d
mov ecx, str.Win32_PageFileUsage
call fcn.0040c5c0
mov ecx, str.Win32_PerfFormattedData_PerfDisk_LogicalDisk
mov dword [0x44e7a0], eax
call fcn.0040c5c0
mov dword [0x44e7a4], eax
mov eax, dword [0x44e798]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, dword [0x44e560]
xor edi, edi
mov ebx, dword [0x44e564]
cmp esi, ebx
je 0x40cb3d
mov ecx, esi
call fcn.0040c290
add esi, 0x24
cmp esi, ebx
jne 0x40cb25
mov eax, dword [0x44e560]
mov dword [0x44e564], eax
push str.Name
lea ecx, [ebp - 0x5c]
call fcn.00404ac0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 2
push eax
mov ecx, 0x44e560
call fcn.0040d150
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c290
mov esi, dword [0x44e7a4]
xor eax, eax
mov dword [ebp - 0x14], eax
test esi, esi
je 0x40cc09
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
push esi
call dword [eax + 0x14]
cmp eax, 0x8004103c
jne 0x40cbee
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40cc09
mov ecx, 4
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0041768e
mov ebx, dword [ebp - 0x14]
add esp, 4
mov edi, eax
mov ecx, edi
lea edx, [ebx*4]
test edx, edx
je 0x40cbe0
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x40cbd2
mov ebx, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push edi
push ebx
push 0
push esi
call dword [eax + 0x14]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40cc09
push 0x44e560
mov edx, eax
mov ecx, edi
call fcn.0040cda0
mov eax, dword [ebp - 0x14]
add esp, 4
xor esi, esi
test eax, eax
je 0x40cc2c
nop
mov ecx, dword [edi + esi*4]
test ecx, ecx
je 0x40cc27
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + esi*4], 0
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, eax
jb 0x40cc10
mov ecx, dword [0x44e560]
xor esi, esi
mov eax, dword [ecx + 0x1c]
sub eax, dword [ecx + 0x18]
sar eax, 4
test eax, eax
je 0x40cd20
xor ebx, ebx
mov eax, dword [ecx + 0x18]
mov edi, dword [eax + ebx + 8]
test edi, edi
je 0x40cd0b
movzx eax, word [edi]
test ax, ax
je 0x40cd0b
cmp word [edi + 2], 0x3a
jne 0x40cd0b
mov ecx, dword [0x44e570]
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], al
cmp ecx, dword [0x44e574]
je 0x40cc92
mov eax, dword [ebp - 0x28]
mov dword [ecx], esi
mov dword [ecx + 4], eax
add dword [0x44e570], 8
jmp 0x40cc9c
lea eax, [ebp - 0x2c]
push eax
push ecx
call fcn.0040d460
mov ax, word [0x43e87c]
xorps xmm0, xmm0
mov word [ebp - 0x18], ax
movzx eax, byte [0x43e87e]
mov byte [ebp - 0x16], al
movzx eax, byte [edi]
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x20]
push 0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x20], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
shrd ecx, eax, 0x14
mov eax, dword [0x44e57c]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ecx
cmp eax, dword [0x44e580]
je 0x40ccfb
mov dword [eax], esi
mov dword [eax + 4], ecx
add dword [0x44e57c], 8
jmp 0x40cd05
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.0040d2e0
mov ecx, dword [0x44e560]
mov eax, dword [ecx + 0x1c]
inc esi
sub eax, dword [ecx + 0x18]
add ebx, 0x10
sar eax, 4
cmp esi, eax
jb 0x40cc47
mov eax, dword [vtable.CDebugPrint.0]
mov ecx, 0x44c958
push str._WMI_
call dword [eax + 0x1c]
push str.Initialized_successfully
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
push 0xd
mov esi, eax
call fcn.00405920
push 0xa
call fcn.00405920
push 0
mov ecx, esi
call fcn.00405650
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x40bd10
mov dword [eax + 8], 0x40c350
mov dword [eax + 4], 0x40bd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041713e
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00416e20
push 0x8007000e
call fcn.00416e20
int3