Function at 0x42a5d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x5b0
mov esi, esp
mov eax, dword [ebp + 8]
lea ecx, [0x447e84]
mov dword [esi + 0x594], ecx
mov cl, byte [esi + 0x158]
mov byte [esi + 0x164], cl
mov byte [esi + 0x15c], pe_nt_image_headers32
mov byte [esi + 0x15d], 0x79
mov byte [esi + 0x15e], 0x7c
mov byte [esi + 0x15f], 0xfc
mov ecx, 4
mov byte [esi + ecx + 0x15c], 0
add ecx, 1
cmp ecx, 5
jne 0x42a61d
xor ecx, ecx
cmp ecx, 5
jae 0x42a661
movzx edi, byte [esi + ecx + 0x15c]
mov edx, ecx
add edx, 0xea
and edx, edi
mov ebx, ecx
add ebx, 0xea
or ebx, edi
xor edx, ebx
add dl, 0x6e
mov byte [esi + ecx + 0x15c], dl
add ecx, 1
jmp 0x42a62f
mov ecx, dword [esi + 0x15c]
mov edx, dword [ecx + 0x26c]
mov dword [eax], edx
mov edx, dword [ecx + 0x270]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x260]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0x264]
sub ecx, 2
sete byte [eax + 0xc]
mov ecx, eax
add ecx, 0x10
mov dword [esi + 0x90], ecx
mov dword [eax + 0x10], 0
mov ecx, eax
add ecx, 0x14
mov dword [esi + 0x404], ecx
mov byte [eax + 0x14], 0
mov ecx, eax
add ecx, 0x28
mov dword [esi + 0x488], ecx
mov word [eax + 0x28], 0
mov ecx, eax
add ecx, 0x2a
mov dword [esi + 0x514], ecx
mov byte [eax + 0x2a], 0
mov dword [esi + 0x88], 0
sub esp, 0x14
lea eax, [esi + 0x88]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4425f0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x442600
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
not eax
shr eax, 0x1f
mov dword [esi + 0x590], eax
mov eax, dword [esi + 0x594]
mov ecx, dword [esi + 0x590]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x447e8c]
xor ecx, 0xa8db2367
sub eax, ecx
mov dword [esi + 0x2ac], eax
push eax
mov eax, esp
mov dword [esi + 0x2b4], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447e90]
mov dword [esi + 0x2b0], eax
push eax
mov eax, esp
mov dword [esi + 0x2bc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447e98]
mov dword [esi + 0x2b8], eax
push eax
mov eax, esp
mov dword [esi + 0x2c4], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447ea0]
mov dword [esi + 0x2c0], eax
push eax
mov eax, esp
mov dword [esi + 0x2cc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447ea8]
mov dword [esi + 0x2c8], eax
push eax
mov eax, esp
mov dword [esi + 0x2d4], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447eb0]
mov dword [esi + 0x2d0], eax
push eax
mov eax, esp
mov dword [esi + 0x2e0], eax
mov dword [eax], 0x447eb8
push eax
mov dword [esi + 0x2d8], esp
push eax
mov eax, esp
mov dword [esi + 0x2e4], eax
mov dword [eax], 0x447ec4
push eax
mov dword [esi + 0x2dc], esp
push eax
mov eax, esp
mov dword [esi + 0x2f4], eax
mov dword [eax], 0x447ed0
push eax
mov dword [esi + 0x2ec], esp
push eax
mov eax, esp
mov dword [esi + 0x2f0], eax
mov dword [eax], 0x447edc
push eax
mov dword [esi + 0x2e8], esp
push eax
mov eax, esp
mov dword [esi + 0x30c], eax
mov dword [eax], 0x447ee8
push eax
mov dword [esi + 0x308], esp
push eax
mov eax, esp
mov dword [esi + 0x318], eax
mov dword [eax], 0x447ef4
push eax
mov dword [esi + 0x310], esp
push eax
mov eax, esp
mov dword [esi + 0x31c], eax
mov dword [eax], 0x447f00
push eax
mov dword [esi + 0x314], esp
push eax
mov eax, esp
mov dword [esi + 0x344], eax
mov dword [eax], 0x447f0c
push eax
mov dword [esi + 0x338], esp
push eax
mov eax, esp
mov dword [esi + 0x33c], eax
mov dword [eax], 0x447f18
push eax
mov dword [esi + 0x330], esp
push eax
mov eax, esp
mov dword [esi + 0x340], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447f24]
mov dword [esi + 0x334], eax
push eax
mov eax, esp
mov dword [esi + 0x34c], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447f2c]
mov dword [esi + 0x348], eax
push eax
mov eax, esp
mov dword [esi + 0x354], eax
mov dword [eax], 0x447f34
push eax
mov dword [esi + 0x350], esp
push eax
mov eax, esp
mov dword [esi + 0x364], eax
mov dword [eax], 0x447f40
push eax
mov dword [esi + 0x360], esp
push eax
mov eax, esp
mov dword [esi + 0x35c], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447f4c]
mov dword [esi + 0x358], eax
push eax
mov eax, esp
mov dword [esi + 0x36c], eax
mov dword [eax], 0x4473e0
mov eax, dword [str.X_1__b]
mov dword [esi + 0x368], eax
push eax
mov eax, esp
mov dword [esi + 0x374], eax
mov dword [eax], 0x447f5c
push eax
mov dword [esi + 0x370], esp
push eax
mov eax, esp
mov dword [esi + 0x38c], eax
mov dword [eax], 0x447f68
push eax
mov dword [esi + 0x384], esp
push eax
mov eax, esp
mov dword [esi + 0x37c], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447f74]
mov dword [esi + 0x378], eax
push eax
mov eax, esp
mov dword [esi + 0x388], eax
mov dword [eax], 0x447f7c
push eax
mov dword [esi + 0x380], esp
push eax
mov eax, esp
mov dword [esi + 0x3a4], eax
mov dword [eax], 0x447f88
push eax
mov dword [esi + 0x39c], esp
push eax
mov eax, esp
mov dword [esi + 0x394], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447f94]
mov dword [esi + 0x390], eax
push eax
mov eax, esp
mov dword [esi + 0x3a0], eax
mov dword [eax], 0x447f9c
push eax
mov dword [esi + 0x398], esp
push eax
mov eax, esp
mov dword [esi + 0x3b4], eax
mov dword [eax], 0x447fa8
push eax
mov dword [esi + 0x3b0], esp
push eax
mov eax, esp
mov dword [esi + 0x3ac], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447fb4]
mov dword [esi + 0x3a8], eax
push eax
mov eax, esp
mov dword [esi + 0x3bc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447fbc]
mov dword [esi + 0x3b8], eax
push eax
mov eax, esp
mov dword [esi + 0x3c4], eax
mov dword [eax], 0x447fc4
push eax
mov dword [esi + 0x3c0], esp
push eax
mov eax, esp
mov dword [esi + 0x3d4], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447fd0]
mov dword [esi + 0x3d0], eax
push eax
mov eax, esp
mov dword [esi + 0x3dc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447fd8]
mov dword [esi + 0x3d8], eax
push eax
mov eax, esp
mov dword [esi + 0x3f4], eax
mov dword [eax], 0x447fe0
push eax
mov dword [esi + 0x3ec], esp
push eax
mov eax, esp
mov dword [esi + 0x3fc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447fec]
mov dword [esi + 0x3f8], eax
push eax
mov eax, esp
mov dword [esi + 0x408], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x447ff4]
mov dword [esi + 0x400], eax
push eax
mov eax, esp
mov dword [esi + 0x410], eax
mov dword [eax], 0x447ffc
push eax
mov dword [esi + 0x40c], esp
push eax
mov eax, esp
mov dword [esi + 0x424], eax
mov dword [eax], 0x448008
push eax
mov dword [esi + 0x41c], esp
push eax
mov eax, esp
mov dword [esi + 0x418], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x448014]
mov dword [esi + 0x414], eax
push eax
mov eax, esp
mov dword [esi + 0x430], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x44801c]
mov dword [esi + 0x428], eax
push eax
mov eax, esp
mov dword [esi + 0x438], eax
mov dword [eax], 0x448024
push eax
mov dword [esi + 0x434], esp
push eax
mov eax, esp
mov dword [esi + 0x450], eax
mov dword [eax], 0x448030
push eax
mov dword [esi + 0x444], esp
push eax
mov eax, esp
mov dword [esi + 0x448], eax
mov dword [eax], 0x44803c
push eax
mov dword [esi + 0x43c], esp
push eax
mov eax, esp
mov dword [esi + 0x44c], eax
mov dword [eax], 0x448048
push eax
mov dword [esi + 0x440], esp
push eax
mov eax, esp
mov dword [esi + 0x464], eax
mov dword [eax], 0x448054
push eax
mov dword [esi + 0x45c], esp
push eax
mov eax, esp
mov dword [esi + 0x458], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x448060]
mov dword [esi + 0x454], eax
push eax
mov eax, esp
mov dword [esi + 0x468], eax
mov dword [eax], 0x448068
push eax
mov dword [esi + 0x460], esp
push eax
mov eax, esp
mov dword [esi + 0x47c], eax
mov dword [eax], 0x448074
push eax
mov dword [esi + 0x474], esp
push eax
mov eax, esp
mov dword [esi + 0x478], eax
mov dword [eax], 0x448080
push eax
mov dword [esi + 0x470], esp
push eax
mov eax, esp
mov dword [esi + 0x4a4], eax
mov dword [eax], 0x44808c
push eax
mov dword [esi + 0x49c], esp
push eax
mov eax, esp
mov dword [esi + 0x4b0], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x448098]
mov dword [esi + 0x4ac], eax
push eax
mov eax, esp
mov dword [esi + 0x4b8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4480a0]
mov dword [esi + 0x4b4], eax
push eax
mov eax, esp
mov dword [esi + 0x4c0], eax
mov dword [eax], 0x4480a8
push eax
mov dword [esi + 0x4bc], esp
push eax
mov eax, esp
mov dword [esi + 0x4d0], eax
mov dword [eax], 0x4480b4
push eax
mov dword [esi + 0x4cc], esp
push eax
mov eax, esp
mov dword [esi + 0x4c8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4480c0]
mov dword [esi + 0x4c4], eax
push eax
mov eax, esp
mov dword [esi + 0x4d8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4480c8]
mov dword [esi + 0x4d4], eax
push eax
mov eax, esp
mov dword [esi + 0x4e8], eax
mov dword [eax], 0x4473e0
mov eax, dword [str.:zo]
mov dword [esi + 0x4e4], eax
push eax
mov eax, esp
mov dword [esi + 0x4f0], eax
mov dword [eax], 0x4480d8
push eax
mov dword [esi + 0x4ec], esp
push eax
mov eax, esp
mov dword [esi + 0x508], eax
mov dword [eax], 0x4480e4
push eax
mov dword [esi + 0x500], esp
push eax
mov eax, esp
mov dword [esi + 0x4f8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4480f0]
mov dword [esi + 0x4f4], eax
push eax
mov eax, esp
mov dword [esi + 0x504], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4480f8]
mov dword [esi + 0x4fc], eax
push eax
mov eax, esp
mov dword [esi + 0x510], eax
mov dword [eax], 0x448100
push eax
mov dword [esi + 0x50c], esp
push eax
mov ecx, esp
mov dword [esi + 0x534], ecx
mov dword [ecx], 0x44810c
push eax
mov dword [esi + 0x52c], esp
push eax
mov ecx, esp
mov dword [esi + 0x524], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [0x448118]
mov dword [esi + 0x51c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x530], ecx
mov dword [ecx], 0x448120
push eax
mov dword [esi + 0x528], esp
push eax
mov ecx, esp
mov dword [esi + 0x544], ecx
mov dword [ecx], 0x44812c
push eax
mov dword [esi + 0x540], esp
push eax
mov ecx, esp
mov dword [esi + 0x53c], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [str.H_ft]
mov dword [esi + 0x538], ecx
push eax
mov ecx, esp
mov dword [esi + 0x54c], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [0x448140]
mov dword [esi + 0x548], ecx
push eax
mov ecx, esp
mov dword [esi + 0x554], ecx
mov dword [ecx], 0x448148
push eax
mov dword [esi + 0x550], esp
push eax
mov ecx, esp
mov dword [esi + 0x568], ecx
mov dword [ecx], 0x448154
push eax
mov dword [esi + 0x560], esp
push eax
mov ecx, esp
mov dword [esi + 0x55c], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [0x448160]
mov dword [esi + 0x558], ecx
push eax
mov ecx, esp
mov dword [esi + 0x56c], ecx
mov dword [ecx], 0x448168
push eax
mov dword [esi + 0x564], esp
push eax
mov ecx, esp
mov dword [esi + 0x580], ecx
mov dword [ecx], 0x448174
push eax
mov dword [esi + 0x574], esp
push eax
mov ecx, esp
mov dword [esi + 0x578], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [0x448180]
mov dword [esi + 0x570], ecx
push eax
mov edx, esp
mov dword [edx], 0x4473e0
mov ecx, dword [0x448188]
mov dword [esi + 0x57c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x58c], ecx
mov dword [ecx], 0x4473e0
mov ecx, dword [0x448190]
mov dword [esi + 0x588], ecx
push eax
mov ebx, esp
mov dword [ebx], 0x4473e0
mov eax, dword [0x448198]
mov dword [esi + 0x2a0], eax
push eax
mov eax, esp
mov dword [esi + 0x2a8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481a0]
mov dword [esi + 0x2a4], eax
push eax
mov eax, esp
mov dword [esi + 0x2fc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481a8]
mov dword [esi + 0x2f8], eax
push eax
mov eax, esp
mov dword [esi + 0x304], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481b0]
mov dword [esi + 0x300], eax
push eax
mov eax, esp
mov dword [esi + 0x324], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481b8]
mov dword [esi + 0x320], eax
push eax
mov eax, esp
mov dword [esi + 0x32c], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481c0]
mov dword [esi + 0x328], eax
push eax
mov eax, esp
mov dword [esi + 0x3cc], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481c8]
mov dword [esi + 0x3c8], eax
push eax
mov eax, esp
mov dword [esi + 0x3e4], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481d0]
mov dword [esi + 0x3e0], eax
push eax
mov eax, esp
mov dword [esi + 0x3f0], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481d8]
mov dword [esi + 0x3e8], eax
push eax
mov eax, esp
mov dword [esi + 0x42c], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481e0]
mov dword [esi + 0x420], eax
push eax
mov eax, esp
mov dword [esi + 0x484], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481e8]
mov dword [esi + 0x480], eax
push eax
mov eax, esp
mov dword [esi + 0x490], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481f0]
mov dword [esi + 0x48c], eax
push eax
mov eax, esp
mov dword [esi + 0x498], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x4481f8]
mov dword [esi + 0x494], eax
push eax
mov eax, esp
mov dword [esi + 0x4a8], eax
mov dword [eax], 0x4473e0
mov eax, dword [0x448200]
mov dword [esi + 0x4a0], eax
push eax
mov edi, esp
mov dword [edi], 0x4473e0
mov eax, dword [0x448208]
mov dword [esi + 0x4dc], eax
push eax
mov ecx, esp
mov dword [ecx], 0x4473e0
mov eax, dword [0x448210]
mov dword [esi + 0x518], eax
jmp dword [esi + 0x2ac]