Function at 0x43c6ca
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov esi, dword [ebp + 8]
mov eax, dword [0x45303c]
mov dword [esp + 0x10], 0x69df6b8f
mov dword [esp + 0x14], 0x6dfb6ff7
mov dword [esp + 0x18], 0x51f953f8
mov dword [esp + 0x1c], 0x559257c3
mov dword [esp + 0x20], 0x59f55bc2
mov dword [esp + 0x24], 0x5df55fc2
mov dword [esp + 0x28], 0x414243b7
mov word [esp + 0x2c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x97
xor dl, byte [esp + ecx + 0x10]
add dl, 0xd
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, 0x1e
jne case.default.0x43c6a3
lea ecx, [esp + 0x64]
lea edx, [esp + 0x94]
lea edi, [esp + 0x10]
push ecx
push 8
push edx
push 0xd
push edi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x45068c]
jmp dword [0x4506a8]
mov word [esp + 0x94], 0x43
mov word [esp + 0x96], 0x3a
jmp dword [0x4506a8]
mov dword [esp + 0x98], 0x5c
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x449ce0
push 1
push 0
push 0x449cf0
call dword [sym.imp.ole32.dll_CoCreateInstance]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x98], 0x5c
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x449ce0
push 1
push 0
push 0x449cf0
call dword [sym.imp.ole32.dll_CoCreateInstance]
jmp dword [0x4506ac]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4506b4]
mov dword [esp + 0x10], 0xc30dc172
mov dword [esp + 0x14], 0xc772c50b
mov dword [esp + 0x18], 0xcb09c974
mov dword [esp + 0x1c], 0xcf03cd05
mov dword [esp + 0x20], 0xb360b106
mov dword [esp + 0x24], 0xb5b4
mov byte [esp + 0x28], 0
mov eax, 0x4f
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi]
lea edx, [ecx + ecx]
not edx
add edx, ecx
lea ebx, [edx + edx]
not ebx
add ebx, edx
lea edx, [eax - 0x7f876b00]
or edx, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov esi, edx
and esi, 0xdf
and ebx, 0x20
or ebx, esi
and ecx, eax
xor ebx, ecx
not edx
and edx, ecx
xor ebx, 0xdf
or edx, ebx
add dl, 0x90
mov byte [edi], dl
inc edi
dec eax
cmp eax, 0x36
jne case.default.0x43c81a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
mov esi, dword [ebp + 8]
jmp dword [eax*4 + 0x4506bc]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x6c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4506c4]
mov dword [esp + 0x7c], edi
jmp dword [0x4506d0]
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x5c]
lea edi, [esp + 0x60]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x5c], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x4506e4]
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0x8f2b89df
mov dword [esp + 0x14], 0x833b8d3a
mov dword [esp + 0x18], 0x873a8121
mov dword [esp + 0x1c], 0x9b2f85d6
mov dword [esp + 0x20], 0x9f389925
mov dword [esp + 0x24], 0x93249d39
mov word [esp + 0x28], 0x9190
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov ecx, 0x1788aba2
mov edx, 0x5d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x1788ab92]
mov ebx, edi
not ebx
mov eax, ecx
and eax, ebx
or ebx, edx
add edi, ebx
inc edi
or edi, eax
add edi, 0x8a54a5d5
mov eax, edi
and eax, 1
xor edi, 1
lea eax, [edi + eax*2]
mov byte [esp + ecx - 0x1788ab92], al
inc ecx
dec edx
cmp ecx, 0x1788abc1
jne 0x43c900
mov edx, dword [esp + 4]
mov eax, dword [edx]
push 0
push 0
lea edi, [esp + 0x88]
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [eax + 0x10]
test eax, eax
setns al
cmp word [esp + 0x80], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x4506ec]
push dword [esp + 0x88]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, dword [esp + 0x88]
mov dword [esp], eax
lea ecx, [edx + eax*2]
mov dword [esp + 4], ecx
movzx ecx, word [edx]
test cx, cx
mov dword [esp + 8], edx
je 0x43c9d9
xor edi, edi
mov eax, edx
jmp 0x43c9b1
add edi, edx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
je 0x43c9db
cmp eax, dword [esp + 4]
jae 0x43c9db
movzx ebx, cx
cmp ebx, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp ebx, 0x80
jb 0x43c9a3
mov edx, ecx
jmp 0x43c9a3
xor edi, edi
lea eax, [edi + 1]
mov dword [esp + 0x58], eax
push eax
call fcn.0040c710
add esp, 4
mov ebx, eax
mov dword [esp + 0x48], eax
test edi, edi
mov ecx, dword [esp + 8]
jle 0x43cacd
mov ebx, dword [esp + 0x48]
cmp dword [esp], 0
jle 0x43cacd
mov ebx, dword [esp + 0x48]
lea eax, [ebx + edi]
mov dword [esp + 0x74], eax
add dword [esp + 0x58], ebx
add ecx, 2
movzx edx, word [ecx - 2]
test dx, dx
je 0x43cacd
cmp dx, 0x7f
ja 0x43ca3b
mov byte [ebx], dl
mov dword [esp], 1
jmp 0x43cab5
mov dword [esp + 8], ecx
mov ecx, ebx
not ecx
add ecx, dword [esp + 0x58]
movzx eax, dx
cmp ecx, 2
jb 0x43ca76
cmp eax, 0x7ff
ja 0x43ca76
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [ebx], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 1], dl
mov dword [esp], 2
mov ecx, dword [esp + 8]
jmp 0x43cab5
mov dword [esp], 0
cmp ecx, 3
mov ecx, dword [esp + 8]
jb 0x43cab5
mov ecx, eax
shr ecx, 0xc
or cl, 0xe0
mov byte [ebx], cl
shr eax, 6
mov ecx, eax
xor cl, 0xc0
or al, 0x3f
and al, cl
mov ecx, dword [esp + 8]
add al, 0x80
mov byte [ebx + 1], al
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 2], dl
mov dword [esp], 3
add ebx, dword [esp]
cmp ebx, dword [esp + 0x74]
jae 0x43cacd
mov eax, ecx
add ecx, 2
cmp eax, dword [esp + 4]
jb 0x43ca1d
mov byte [ebx], 0
xor ecx, ecx
mov edx, dword [case.0x43c81a.17]
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
xor eax, eax
cmp ecx, 4
setb al
jmp dword [eax*4 + 0x450704]
mov eax, ecx
and eax, 0xfffffffb
mov dword [esp + 4], edi
mov edi, ecx
and ecx, 4
mov ebx, edi
or ebx, 4
imul ebx, ecx
xor ecx, 4
imul ecx, eax
add ebx, dword [esp + 0x48]
mov eax, dword [ecx + ebx]
mov ecx, edi
mov edi, dword [esp + 4]
mov dword [esp + ecx*4 + 0x64], eax
mov eax, edi
xor eax, 4
and edi, 0xfffffffb
add edi, edi
sub edi, eax
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x45070c]
inc ecx
jmp case.0x43c81a.15
lea edi, [esp + 0x80]
jmp dword [0x450724]
push dword [esp + 0x48]
call fcn.0040c720
add esp, 4
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp case.0x43c81a.9
xor ecx, ecx
test edi, edi
setne cl
mov eax, edi
jmp dword [ecx*4 + 0x45073c]
xor ecx, ecx
cmp dword [esp + edi*4 + 0x64], 0
sete cl
mov eax, edi
jmp dword [ecx*4 + 0x450754]
lea eax, [edi - 1]
imul eax, dword [esp + eax*4 + 0x64], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + edi*4 + 0x64], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push esi
push eax
call fcn.004352d0
add esp, 0x10
nop
nop
nop
nop
nop
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne case.default.0x43cbe4
xor edx, edx
cmp ebx, 0
setne dl
xor ecx, ecx
jmp dword [edx*4 + 0x45075c]
mov byte [eax + ecx - 1], 0x30
dec ecx
xor edx, edx
cmp ebx, ecx
setne dl
jmp dword [edx*4 + 0x45075c]
add esi, 8
inc edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x450734]
mov dword [esp + 0x78], edi
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4506dc]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x4c]
call edi
push dword [esp + 0x78]
call edi
mov edi, dword [esp + 0x7c]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], 0
push 0xd2e7977e
push dword [0x453034]
call fcn.004457f0
add esp, 8
lea ecx, [esp + 0x10]
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
lea ecx, [esp + 0xb0]
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x45072c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], eax
xor edi, edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x450734]
mov dword [esp + 0x10], 0x73a371af
mov dword [esp + 0x14], 0x7f7e7da8
mov byte [esp + 0x18], 0
mov eax, 0x2d586594
mov ecx, 0x52a79a6b
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x2d586584]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, 0xbdd0b95b
and edx, 0xffffffa4
or edx, edi
mov edi, eax
and edi, 0x2d50211b
mov ebx, ecx
and ebx, 0x42270224
or ebx, edi
not ebx
mov edi, edx
and edi, ebx
add ebx, edx
add edi, edi
sub ebx, edi
add bl, 0x1c
mov byte [esp + eax - 0x2d586584], bl
inc eax
dec ecx
cmp eax, 0x2d58659d
jne 0x43cce0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], 0xf3bff1a3
mov dword [esp + 0x14], 0xffb3fda8
mov dword [esp + 0x18], 0xfba6f9bb
mov dword [esp + 0x1c], 0xc7acc5a4
mov dword [esp + 0x20], 0xc38cc1a0
mov dword [esp + 0x24], 0xcf99cd9e
mov dword [esp + 0x28], 0xcbaac99d
mov dword [esp + 0x2c], 0xd77fd58b
mov dword [esp + 0x30], 0xd3a1d166
mov dword [esp + 0x34], 0xdf79ddae
mov dword [esp + 0x38], 0xdb93d99a
mov dword [esp + 0x3c], 0x27752573
mov word [esp + 0x40], 0x2120
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor eax, eax
movzx ecx, byte [esp + eax + 0x10]
mov edx, eax
xor edx, 0x46b41e2b
mov edi, eax
or edi, 0x14
and edi, edx
add edi, edi
mov edx, eax
xor edx, 0xb94be1d4
mov ebx, edi
and ebx, edx
xor edx, edi
lea edx, [edx + ebx*2]
lea ebx, [ecx + ecx]
not ebx
add ebx, ecx
mov edi, ecx
not edi
or edi, ebx
and edi, edx
lea ebx, [edx + edx]
not ebx
add ebx, edx
not edx
or edx, ebx
and edx, ecx
or edx, edi
mov ecx, edx
not ecx
and ecx, 0x25
and edx, 0xda
sub edx, ecx
inc dl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x37
jne 0x43cdb0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push 0
push 0x30
push edi
push dword [esp + 0x5c]
push eax
call dword [ecx + 0x50]
jmp dword [0x4506d4]
mov dword [esp + 0x10], 0x73a371af
mov dword [esp + 0x14], 0x7f7e7da8
mov byte [esp + 0x18], 0
mov eax, 0x2d586594
mov ecx, 0x52a79a6b
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x2d586584]
lea edi, [edx + edx]
not edi
add edi, edx
and edi, 0xbdd0b95b
and edx, 0xffffffa4
or edx, edi
mov edi, eax
and edi, 0x2d50211b
mov ebx, ecx
and ebx, 0x42270224
or ebx, edi
not ebx
mov edi, edx
and edi, ebx
add ebx, edx
add edi, edi
sub ebx, edi
add bl, 0x1c
mov byte [esp + eax - 0x2d586584], bl
inc eax
dec ecx
cmp eax, 0x2d58659d
jne 0x43ce60
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], 0xf3bff1a3
mov dword [esp + 0x14], 0xffb3fda8
mov dword [esp + 0x18], 0xfba6f9bb
mov dword [esp + 0x1c], 0xc7acc5a4
mov dword [esp + 0x20], 0xc38cc1a0
mov dword [esp + 0x24], 0xcf99cd9e
mov dword [esp + 0x28], 0xcbaac99d
mov dword [esp + 0x2c], 0xd77fd58b
mov dword [esp + 0x30], 0xd3a1d166
mov dword [esp + 0x34], 0xdf79ddae
mov dword [esp + 0x38], 0xdb93d99a
mov dword [esp + 0x3c], 0x27752573
mov word [esp + 0x40], 0x2120
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
xor eax, eax
movzx ecx, byte [esp + eax + 0x10]
mov edx, eax
xor edx, 0x46b41e2b
mov ebx, eax
or ebx, 0x14
and ebx, edx
add ebx, ebx
mov edx, eax
xor edx, 0xb94be1d4
mov edi, ebx
and edi, edx
xor edx, ebx
lea edx, [edx + edi*2]
lea edi, [ecx + ecx]
not edi
add edi, ecx
mov ebx, ecx
not ebx
or ebx, edi
and ebx, edx
lea edi, [edx + edx]
not edi
add edi, edx
not edx
or edx, edi
and edx, ecx
or edx, ebx
mov ecx, edx
not ecx
and ecx, 0x25
and edx, 0xda
sub edx, ecx
inc dl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x37
jne 0x43cf30
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
lea edi, [esp + 0x54]
push edi
push 0
push 0x30
push eax
push dword [esp + 0x5c]
push ecx
call dword [edx + 0x50]
jmp case.0x43c81a.6
int3
xor eax, eax
jmp 0x43d246
push 0x400
call fcn.004402e0
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x282b2a25
mov word [ebp - 0x14], 0
mov eax, 0x48
mov edx, 0x37
nop
nop
nop
nop
nop
mov ebx, eax
and ebx, 0x45
mov ecx, edx
and ecx, 0x3a
or ecx, ebx
xor cl, byte [ebp + edx - 0x4f]
xor cl, 0x45
add cl, 0xed
mov byte [ebp + edx - 0x4f], cl
dec eax
inc edx
cmp edx, 0x3d
jne 0x43d030
mov eax, dword [ebp - 0x18]
mov edx, dword [0x453040]
test edx, edx
je 0x43d082
xor ebx, ebx
mov ecx, dword [0x453044]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x43d1f3
inc ebx
cmp edx, ebx
jne 0x43d070
mov ebx, dword [ebp - 0x10]
not eax
shr eax, 0x1f
mov dword [ebp - 0x1c], 0
jmp dword [eax*4 + 0x45077c]
push ebx
call fcn.00440350
add esp, 4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0x282b2a25
mov word [ebp - 0x14], 0
mov ecx, 0x48
mov edx, 0x37
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x45
mov ebx, edx
and ebx, 0x3a
or ebx, esi
xor bl, byte [ebp + edx - 0x4f]
xor bl, 0x45
add bl, 0xed
mov byte [ebp + edx - 0x4f], bl
dec ecx
inc edx
cmp edx, 0x3d
jne 0x43d0c0
mov ecx, dword [0x453040]
test ecx, ecx
je 0x43d241
mov edx, dword [ebp - 0x18]
xor esi, esi
mov edi, dword [0x453044]
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43d227
inc esi
cmp ecx, esi
jne 0x43d100
jmp 0x43d241
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1c], 0
cmp ecx, dword [ebx]
setb al
xor ecx, ecx
jmp dword [eax*4 + 0x450794]
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
mov ebx, dword [ebp - 0x10]
je 0x43d085
lea eax, [ebp - 0x2c]
push 0x2f
push 0x400
push ebx
push eax
push dword [ebp - 0x20]
push 5
push dword [0x453048]
push edx
call fcn.00443090
add esp, 0x20
jmp 0x43d085
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je 0x43d241
push eax
push 1
push dword [0x453048]
push ecx
call fcn.00443090
add esp, 0x10
mov eax, dword [ebp - 0x1c]
and al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebx], 0xb0
mov byte [ebx], 1
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x10043cf], bh
add byte [eax], al
add dl, cl
mov byte [ebx], 0
mov dword [ebx], case.0x43c6a3.7
add bh, al
inc ebx
add byte [eax - 0x34], bl
inc ebx
add byte [esi - 0x39], bl
inc ebx
add byte [edi - 0x34], al
int3
inc ebx
add byte [ecx], ah
enter 0x43, 0x3d
int3
int3