Function at 0x406f40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42381e
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x42d4d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x13c], ebx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, section..data
mov dword [ebp - 0x134], edi
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x120]
push eax
push 0x427810
mov esi, 1
push esi
push ebx
mov dword [ebp - 4], ebx
push 0x4278e0
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x120], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40720e
cmp dword [ebp - 0x120], ebx
je 0x40720e
push str.:ppNkmJ_
mov dword [ebp - 0x124], ebx
call fcn.00401570
add esp, 4
lea ecx, [ebp - 0x130]
push ecx
mov edi, eax
call fcn.00406090
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x130]
cmp eax, ebx
je 0x407008
mov eax, dword [eax]
jmp 0x40700a
xor eax, eax
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx]
lea esi, [ebp - 0x124]
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov eax, dword [edx + 0xc]
push ecx
call eax
test eax, eax
jne 0x4071ef
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0x4071ef
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x4071e1
push str.XHsHDW_XF:mbxOwJ0F:_hyo__m___CizQmkbxoFemb
mov dword [ebp - 0x12c], ebx
call fcn.00401570
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
mov edi, eax
call fcn.00406090
mov edi, eax
push 0x427b50
mov byte [ebp - 4], 2
call fcn.00401320
add esp, 4
push eax
lea ebx, [ebp - 0x128]
call fcn.00407650
mov byte [ebp - 4], 3
mov ecx, dword [edi]
xor esi, esi
cmp ecx, esi
je 0x4070a5
mov ecx, dword [ecx]
jmp 0x4070a7
xor ecx, ecx
mov eax, dword [eax]
cmp eax, esi
je 0x4070b1
mov edx, dword [eax]
jmp 0x4070b3
xor edx, edx
mov eax, dword [ebp - 0x124]
mov edi, dword [eax]
lea ebx, [ebp - 0x12c]
push ebx
push esi
push 0x30
push ecx
push edx
mov edx, dword [edi + 0x50]
push eax
call edx
test eax, eax
lea edi, [ebp - 0x128]
sete bl
call fcn.00406040
lea edi, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.00406040
test bl, bl
je 0x4071e1
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
push edx
lea edx, [ebp - 0x11c]
push edx
push 1
mov dword [ebp - 0x128], esi
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x128], esi
je 0x4071d3
mov ecx, dword [ebp - 0x11c]
mov edi, dword [ecx]
push esi
push esi
lea edx, [ebp - 0x150]
push edx
push esi
push str.XF:mbxOwJ0F:
call fcn.00401570
mov ecx, dword [edi + 0x10]
add esp, 4
push eax
mov eax, dword [ebp - 0x11c]
push eax
call ecx
cmp eax, esi
jne 0x4071b8
cmp word [ebp - 0x150], 8
jne 0x4071b8
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x114]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x118], edx
cmp eax, esi
jne 0x40722c
mov dword [ebp - 0x118], esi
mov byte [ebp - 4], 4
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x134]
call fcn.00407370
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
cmp eax, ecx
je 0x4071b8
push eax
call fcn.004157cc
add esp, 4
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea edi, [ebp - 0x130]
call fcn.00406040
mov edi, dword [ebp - 0x134]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041528c
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + 1]
lea edi, [ebp - 0x114]
mov ecx, ebx
lea esi, [ebp - 0x118]
call fcn.00402df0
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x118]
add ebx, ebx
push ebx
push eax
push ebx
push ecx
call fcn.004154c3
add esp, 0x10
cmp eax, 0x50
ja case.0x40726f.1
movzx edx, byte [eax + 0x4072a4]
jmp dword [edx*4 + 0x407294]
push 0x8007000e
call fcn.00403bc0
push 0x80070057
call fcn.00403bc0
push 0x80004005
call fcn.00403bc0
xchg byte [ecx + 0x40], dh
add byte [esi + 114], dh
inc eax
add byte [eax - 0x75ffbf8e], al
jb 0x4072e3
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3