Function at 0x466ef0
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xec
mov eax, dword [0x5398d0]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp byte [0x53980c], 0
mov eax, dword [0x4b83a4]
je 0x4670d0
xor esi, esi
cmp eax, 1
jbe 0x466f40
mov eax, dword [ebp - 0x1c]
sub eax, dword [0x5398d0]
jne 0x46714c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fbdd4
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4fbde4
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x467110
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
sub esp, 4
mov esi, eax
test eax, eax
je 0x466fb5
xor esi, esi
cmp dword [ebp - 0xa0], 2
je 0x467118
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebx]
test eax, eax
je 0x466fe3
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebx], 0
sub esp, 4
mov dword [esp], str.._rootcimv2
lea ecx, [ebp - 0xb4]
call fcn.00466ba0
mov edi, dword [ebp - 0xb4]
sub esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
mov eax, dword [ebp - 0xbc]
call eax
sub esp, 0x24
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
sub esp, 4
test esi, esi
js 0x467110
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
sub esp, 0x20
mov esi, 1
test eax, eax
js 0x4670f8
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x466f21
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
jmp 0x466f21
mov byte [0x53980c], 1
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [0x4b83a4], eax
sub esp, 4
jmp 0x466f1a
mov eax, dword [ebx]
test eax, eax
je 0x467110
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebx], 0
sub esp, 4
nop
xor esi, esi
jmp 0x4670ab
cmp dword [ebp - 0xac], 5
mov esi, pe_nt_image_headers32
ja 0x466fb5
mov esi, 0
jne 0x466fb5
mov ecx, dword [ebp - 0xa8]
xor eax, eax
test ecx, ecx
setne al
shl eax, 7
mov esi, eax
jmp 0x466fb5
call fcn.00485600
mov ebx, eax
jmp 0x4b0c0a
mov dword [esp], 0x4fcc2e
call esi
sub esp, 4
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str.IsWow64Process
call eax
sub esp, 8
mov esi, eax
test eax, eax
je 0x46a0c0
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x46a0c0
mov eax, dword [esp + 0x3c]
mov edx, str._64_
test eax, eax
je 0x46a0c0
test ebp, ebp
je 0x469f80
test edi, edi
jne 0x46a000
movzx ecx, word [esp + 0x156]
movzx eax, word [esp + 0x154]
test cx, cx
jne 0x46a030
test ax, ax
je 0x469fd0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x16d]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.__s_sp_u_s
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call fcn.0048cd90
lea esi, [esi]
nop
lea esi, [esp + 0x15d]
lea eax, [ebx + 8]
mov dword [ebx], eax
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp], esi
mov ecx, ebx
add eax, esi
mov dword [esp + 4], eax
call fcn.00469430
sub esp, 8
mov eax, dword [esp + 0x18c]
sub eax, dword [0x5398d0]
jne 0x46a36e
add esp, 0x19c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 0x18], edx
cmp dword [esp + 0x50], 2
mov ecx, 0x4fcc10
mov eax, 0x4fcc13
mov edx, dword [esp + 0x48]
cmove eax, ecx
mov dword [esp + 8], str.__s_u._u_s
mov dword [esp + 4], 0x1e
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x16d]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call fcn.0048cd90
jmp 0x469eb0
lea eax, [esp + 0x16d]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.__s_s
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call fcn.0048cd90
jmp 0x469eb0
lea eax, [esp + 0x16d]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.__s_b_u_s
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call fcn.0048cd90
jmp 0x469eb0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x16d]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.__s_sp_u._u_s
mov dword [esp + 4], 0x1e
mov dword [esp], eax
call fcn.0048cd90
jmp 0x469eb0
mov edx, 0x4fc166
jmp 0x469e4a
call fcn.00485600
xor edi, edi
mov ebp, str.w10_1909
jmp 0x469de9
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x4b0c1d
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push eax
mov dword [esp], ebx
call fcn.00489660
nop
mov dword [esp], edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysFreeString]
call edi
push edx
mov dword [esp], esi
call edi
push eax
mov dword [esp], ebx
call fcn.00489660
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4b0c50
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4b0c60
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push eax
mov dword [esp], ebx
call fcn.00489660
mov dword [esp], ebx
call fcn.004ab130
mov dword [esp], esi
call fcn.00489660
mov dword [esp], ebx
call fcn.004ab130
mov dword [esp], esi
call fcn.00489660
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x2c]
cmp eax, edx
je 0x4b0c9a
mov dword [esp], eax
call fcn.004ab140
mov dword [esp], ebx
call fcn.00489660
mov ebp, str.w10_2004
jmp 0x469de9