Function at 0x401990
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403ab9
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x38]
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 1
mov eax, 0x30
mov dword [ebp - 0x30], eax
mov ecx, 0x63
xor cx, word [ebp - 0x30]
mov word [ebp - 0x70], ax
mov eax, 0x75
mov word [ebp - 0x6e], cx
mov ecx, eax
xor cx, word [ebp - 0x30]
mov word [ebp - 0x6c], cx
mov ecx, 0x7c
xor cx, word [ebp - 0x30]
lea edx, [eax - 2]
lea esi, [eax - 0x11]
mov word [ebp - 0x6a], cx
mov ecx, 0x30
lea edi, [eax - 0x65]
xor ax, cx
xor dx, cx
mov word [ebp - 0x68], ax
xor si, cx
xor eax, eax
mov word [ebp - 0x66], dx
mov word [ebp - 0x60], ax
xor di, cx
lea eax, [ebp - 0x6e]
mov word [ebp - 0x64], si
push eax
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x62], di
call fcn.00401860
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 7
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, 0x61
push dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x70], ax
mov eax, 0x41
mov esi, eax
xor si, word [ebp - 0x5c]
mov word [ebp - 0x6e], si
mov esi, 0x61
lea ecx, [eax - 0x1a]
xor cx, si
lea edx, [eax - 0xe]
lea edi, [eax - 0x13]
mov word [ebp - 0x6c], cx
xor ax, si
mov ecx, 0x2c
xor cx, si
mov word [ebp - 0x64], ax
xor eax, eax
mov word [ebp - 0x66], cx
xor dx, si
mov word [ebp - 0x62], ax
xor di, si
mov word [ebp - 0x6a], dx
cmp dword [ebp + 0x34], 7
lea ecx, [ebp - 0x6e]
lea eax, [ebp + 0x20]
mov word [ebp - 0x68], di
cmova eax, dword [ebp + 0x20]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004025d0
mov ecx, eax
call fcn.004025d0
mov ecx, eax
call fcn.004025d0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x401c4e
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x401c48
lea eax, [ebp - 0x38]
push eax
push 0x404194
push 1
push 0
push 0x4041a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401c48
push 0xc
call fcn.00402b18
mov edi, eax
add esp, 4
mov dword [ebp - 0x50], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x401b99
push dword [ebp - 0x54]
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x401b9b
cmp dword [ebp - 0x54], eax
jne 0x402191
jmp 0x401b9b
xor edi, edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x50], edi
test edi, edi
je 0x402191
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x38]
push edx
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push dword [edi]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x50], eax
or ecx, 0xffffffff
mov byte [ebp - 4], 2
lock xadd dword [edi + 8], ecx
dec ecx
jne 0x401c13
mov ecx, dword [edi]
test ecx, ecx
je 0x401bee
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401c05
push eax
call fcn.00402b13
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.00402b48
mov eax, dword [ebp - 0x50]
add esp, 8
test eax, eax
js 0x401c3f
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x34]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x401d24
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x401c88
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401c7e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d1e
push ecx
push edx
call fcn.00402b48
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 7
jbe 0x401cd2
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401cc8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401d1e
push ecx
push edx
call fcn.00402b48
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x402174
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40216a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40216a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
push 0xc
cmova eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
call fcn.00402b18
mov edi, eax
add esp, 4
mov dword [ebp - 0x50], edi
mov byte [ebp - 4], 5
test edi, edi
je 0x401d7f
push dword [ebp - 0x54]
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x401d81
cmp dword [ebp - 0x54], eax
jne 0x40219b
jmp 0x401d81
xor edi, edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x50], edi
test edi, edi
je 0x4021a5
mov byte [ebp - 4], 6
mov eax, 0x1a
mov word [ebp - 0x68], ax
mov esi, 0x1a
mov eax, 0x4d
push 0xc
lea ecx, [eax - 2]
lea edx, [eax + 9]
xor cx, si
xor ax, si
mov word [ebp - 0x64], cx
mov word [ebp - 0x66], ax
xor dx, si
xor eax, eax
mov word [ebp - 0x62], dx
mov word [ebp - 0x60], ax
call fcn.00402b18
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x401e15
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 1
lea eax, [ebp - 0x66]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edx, dword [ebp - 0x54]
mov dword [edx], eax
test eax, eax
je 0x4021af
jmp 0x401e1a
xor edx, edx
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 6
mov dword [ebp - 0x5c], edx
test edx, edx
je 0x4021b9
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x34]
push esi
push 0
push 0x30
push dword [edi]
mov ecx, dword [eax]
push dword [edx]
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x50], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x54]
lock xadd dword [eax + 8], ecx
dec ecx
mov esi, dword [ebp - 0x58]
jne 0x401e91
mov ecx, dword [eax]
test ecx, ecx
je 0x401e6c
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x401e86
push ecx
call fcn.00402b13
mov eax, dword [ebp - 0x54]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
call fcn.00402b48
add esp, 8
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x401ed5
mov eax, dword [edi]
test eax, eax
je 0x401eb3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x401eca
push eax
call fcn.00402b13
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.00402b48
add esp, 8
cmp dword [ebp - 0x50], 0
jl 0x401c36
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4020fa
mov edi, dword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x3c]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x14], 0
je 0x4020fa
mov eax, dword [ebp - 0x3c]
lea esi, [ebp - 0x4c]
cmp dword [ebp + 0x34], 7
lea edx, [ebp + 0x20]
push 0
cmova edx, dword [ebp + 0x20]
mov ecx, dword [eax]
push 0
push esi
push 0
push edx
push eax
call dword [ecx + 0x10]
push 0x406120
push 0x4060f8
call edi
mov esi, dword [ebp - 0x58]
add esp, 8
test eax, eax
je 0x401fbf
push 0x406108
push 0x4060f8
call edi
add esp, 8
test eax, eax
je 0x401fbf
push 0x406160
push 0x4060f8
call edi
add esp, 8
test eax, eax
jne 0x401f6d
movsx ecx, word [ebp - 0x44]
jmp 0x401fc2
push 0x406114
push 0x4060f8
call edi
add esp, 8
test eax, eax
je 0x401fbf
push 0x406138
push 0x4060f8
call edi
add esp, 8
test eax, eax
jne 0x401f99
movzx ecx, word [ebp - 0x44]
jmp 0x401fc2
push 0x40612c
push 0x4060f8
call edi
add esp, 8
test eax, eax
je 0x401fbf
push 0x4060ec
push 0x4060f8
call edi
add esp, 8
test eax, eax
jne 0x401fe9
mov ecx, dword [ebp - 0x44]
mov eax, dword [esi + 4]
mov dword [ebp - 0x50], ecx
cmp eax, dword [esi + 8]
je 0x401fd8
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x4020dc
lea ecx, [ebp - 0x50]
push ecx
push eax
mov ecx, esi
call fcn.004027c0
jmp 0x4020dc
mov eax, dword [ebp - 0x44]
push 0xc
mov dword [ebp - 0x54], eax
call fcn.00402b18
mov edi, eax
add esp, 4
mov dword [ebp - 0x5c], edi
mov byte [ebp - 4], 9
test edi, edi
je 0x40203c
push dword [ebp - 0x54]
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x40203e
cmp dword [ebp - 0x54], eax
jne 0x402191
jmp 0x40203e
xor edi, edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x54], edi
test edi, edi
je 0x402191
mov byte [ebp - 4], 0xa
mov eax, dword [edi]
test eax, eax
je 0x402071
push eax
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
test eax, eax
je 0x402191
jmp 0x402073
xor eax, eax
mov ecx, dword [esi + 4]
mov dword [ebp - 0x50], eax
cmp ecx, dword [esi + 8]
je 0x402086
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x402092
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esi
call fcn.004027c0
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4020d6
mov eax, dword [edi]
test eax, eax
je 0x4020b4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4020cb
push eax
call fcn.00402b13
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.00402b48
add esp, 8
mov edi, dword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x401ef0
mov eax, dword [esi + 4]
mov ecx, eax
mov edx, dword [esi]
sub ecx, edx
sar ecx, 2
mov dword [ebp - 0x58], eax
test ecx, ecx
jne 0x402150
cmp ecx, 1
jbe 0x402117
lea eax, [edx + 4]
jmp 0x40214d
mov eax, dword [esi + 8]
sub eax, edx
sar eax, 2
cmp eax, 1
jae 0x402130
sub esp, 8
mov ecx, esi
call fcn.004026a0
jmp 0x402150
mov edi, 1
sub edi, ecx
shl edi, 2
push edi
push 0
push dword [ebp - 0x58]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x58]
add esp, 0xc
add eax, edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
jmp 0x401c42
push ecx
push edx
call fcn.00402b48
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402b05
mov esp, ebp
pop ebp
ret 0x38
push 0x8007000e
call fcn.00402930
push 0x8007000e
call fcn.00402930
push 0x8007000e
call fcn.00402930
push 0x8007000e
call fcn.00402930
push 0x8007000e
call fcn.00402930
int3