Function at 0x49ce40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
push 0
push 0
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x54c888
push 1
push 0
push 0x54c958
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x49cec4
test byte [0x652fc0], 2
je 0x49ceac
push esi
push str.Failed_to_create_IWbemLocator_object._Error_code__0x_x_n
push 2
push str.CWMIEventApp::Initialize
call fcn.004cb3a0
add esp, 0x10
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.ROOTCIMV2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
call fcn.0049c660
mov eax, dword [eax]
mov dword [ebp - 4], 0
test eax, eax
je 0x49cee9
mov edx, dword [eax]
jmp 0x49ceeb
xor edx, edx
mov eax, dword [ebp - 0x10]
lea esi, [ebp - 0x14]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00433490
test esi, esi
jns 0x49cf59
test byte [0x652fc0], 2
je 0x49cf38
push esi
push str.Could_not_connect._Error_code__0x_x_n
push 2
push str.CWMIEventApp::Initialize
call fcn.004cb3a0
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jns 0x49cfbe
test byte [0x652fc0], 2
je 0x49cf94
push esi
push str.Could_not_set_proxy_blanket._Error_code__0x_x_n
push 2
push str.CWMIEventApp::Initialize
call fcn.004cb3a0
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x54c8e8
push 4
push 0
push 0x54c978
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x49d02b
test byte [0x652fc0], 2
je 0x49d001
push esi
push str.Failed_to_create_apartment._Error_code__0x_x_n
push 2
push str.CWMIEventApp::Initialize
call fcn.004cb3a0
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret