Function at 0x4016c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f438
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x493224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x88], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0x30], ax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x18]
push ecx
push 0x430438
push 1
push 0
push 0x430508
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x401793
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00403fd0
mov eax, dword [ebp - 0x64]
jmp 0x4019ed
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jge 0x4017e2
mov dword [ebp - 0x68], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00403fd0
mov eax, dword [ebp - 0x68]
jmp 0x4019ed
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x401823
mov dword [ebp - 0x38], str.liU92KbYEIYbdhUajyV4q5V8kDy5JEXvPHR5jAQfVb1mRUuUfE3RKk5n4nOIAhdGRm17lL9iAq7l939Eq0umz4N44MCvsLxPCagAkd2M6tIjsqO3n4bWicUeQccoEAwJsH2sngGBtxkywFexK5xDc2xdxcJuT6w2QjfgtKC4s5qqvrRpnVvYtp0GVzxTiFD9s0m5uXyJy8D1ER6jQ3U49qJPrOzyMUATVtbn7uj0TC9Rq7iV22X9DnpcYrO4MA1SeftGxMgiyrrjlQCWvqC8xKUex2Xj5KwB1wMNnFUm4J8DBnxWcavH68XUIe7gm5se3w6R6SEsGakXPiOcdfoUuO7jUcXKJyvAispn8RH1nTMl9qyzTC4eSWJGbDLxLoH9VzPfPS6zNBOJ4ScBHjFJtFleW33Kx94fFg5jR05Wb3fwzVj39y1BKKlp9bSMzjyeQwjjY8AGUgS47PwE8Lqd1xv2txenbQ8arrnWpQ1B8Q0SuLrjMpIEdz43VQaC5eC47opEuYIh89D7BeNuQcM8FnYaCycaTo7ndUvS1fO9mdnqi7z0K3uU6r0YNNre8K1MIKOc9napmLi6eO1Yx2IlBbCSwURVG5hybQrX7rjLmfeP0rVXWuHOyClj4Haco8rpiOJpgj7NprpxlhBUJli274Uc24KQJRmBU3IM6Q8oUM2hgUQh0EPjHgkMLC3PPFg78JTnnI52xwv34JMoRYyH1BWHLFXFFlBaCkKxhwqY5yLoVvLW78Hn9rSnDeXt7banKqNGjRrmvuhtUupWa3yxB507a21UVSTFJKANjbdSnanQ4A8ruvQknhAJxkk7VsGN9BrYvES7pGGc2M259dcJnxxqUdW04zWOJ9b3KWPgP4eAtyTX1OveMBzNWp0CCaHjecTR7QLhfrGL1qeSSGrl9Cko4jsbsT5p08ga8nJKn1OSfFjKfGcvs1KkRnnhnd5maNvzMP6ScYruHnjEjby3dt8oa4QS8hsxvDtzvNywQ7hsJlBzqw8WG5eehyOIiuuUDLCFVH18X47drmJrvt5gyXj05r2vFHpRlMJzXTPxf5qiKVryOIT4fPQ4kroevqWwEvdAPRjt4pmTo2kkh7Lsbd8cNQpMiwsXBBjjuLe78Wic90VTBEv5msRsCFN9CjdW5TYTuHLQsfMnRxMfksF4nPiaevte9rr5OlSYXACqrsBExNm2UNhXnejQmy6QL9RL9MGmUXdpoVl52w10YynpAbdxBxqbfBPG8Yzl99TBiuhAtMW1DgceqwuiRtG0hwfwrrcU2F7IvctldL54aIzT0eUgWKGGGpvOK2Ikurkz2dNeAGm7bmvSvFbquTUaUFxr7fwMxMYKCUTGyD9mCeeEfCYvWzBQUBGtRfbvdouBUN4CDCgiL4aHycVX0jDypJRlmfsmDpKWtq6oHjvJjeP4AyGAowP78VSLHXiFl1fu8mKDwX5GtDroGor75PHOKNONRGpHa0TM9fwg9dnaN5Hcv4Ms8uTUVqtgiqb92TEiccmOFmjE0aYg95vthY8JHOpLxQtjKFEMyxcUzFAt0caSDmGnRW6Gt0VOjnG22Hnn9LYfHmEIMaFYTiEFThvg4T8FeHhFMyLphzWjey2A2GqIK61TfrrStSohGXDpTwulSgUJsWcBRjh2IO3wvlUCB1QPN4yWadmz02c8ptuKp483LYFm6Fj4wKDasAUbTtsVsroU4lTgOjFAT280WsMiFFE7EbImlTGkMyInP3J4xqEQ6ducHj3lWD7bGs1aFSOPeVTKAlCG9NWthyEQIhp5GMzrY5VD4ynFxAW0njd7mRD37n15Vcp9fwhCG4osHO6adS3gQUGg5C6vNcL5qOLRFM5rglffAOpqIrA3AHKH4JORgmTbsimMcAjmDSRghCgen4ksRvnJFvlmyGpMSpXd4FkLyMDFCFNM91ysqoTjxklCLM9qjrWi0YTFW9X4lc3sI7cUsJV0qyyFR1KM2dg5cL4IY8ppccNKtFIzB8t1
mov dword [ebp - 0x6c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00403fd0
mov eax, dword [ebp - 0x6c]
jmp 0x4019ed
lea eax, [ebp - 0x28]
push eax
push 0
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
push 0x489c1c
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
call edx
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jge 0x401874
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00403fd0
mov eax, dword [ebp - 0x70]
jmp 0x4019ed
mov dword [ebp - 0x44], str.YqLmOLWQLNAm34m0TmJynkpVNlpUh1xx2kOHmfbhwInpPTXyKh6cMYYLyAxSdUCRYNNwTYvmFe2BaJQ5l76DjC8pTtHyYr11nTIpe9EeNBRQyre2HkG3zDTrBoTbFrYCdUXyiUtrrU1ebnTHizacouqPtyU97klcVpdPgvST6XtWWsdk0N7vLERYbUpYMYv9pewKu9RVsTdMD3CRpnE19X2EDSM1U9MxIhhQhudPo8JBDiaWEruLWuSMYQ4c79q7HU8aEdKvbV5XgDeioO6xwSOgfAQNByJ7bUJKbxLPN7Cvbh2Mqog5MzpFRtdXrsvhfshxSy84J4zliHowy781qPkmTo6gUg8yXMoqBeQ82I61NIOME1gXSJqmQPjJCHE6pc3fSg5EbDezbup4Wd0hQY956B8g15VVONoPAQJ1OmVmI9yRbpQ2jglJMv8GsQF9agGFlFyN5GmeMdhLsq64i0f15R8gJP4fIS9BuMt5SAJ3i2rr5MDBsqooJbfxP2lawC5PhifBrRl1zahQiqBh7XhpQ0nQW5dnsUXPArFcifd98SwycKpXeguIXKcpnnU0lECrUKzMqo8hybqFLDHVn9z0tm8PtyvwPtY7Fq5Ps8y2qqik5znrC1zBobaXobHDUWibpXlDixWCuynQHSc6BWbEMjQN03yvKl6KOAA4OXY5Yjik1tJtjU2PfTNI4yI2JYNeIL1uDLgE667obC6BJfq0SY3nKH97jzKJL7xKVaMSm24KtWnhGkluqu8Fu8TG3bhermIerh3AFND4duB2NIwdafYO57lI1ugp58QWzmPWjKeK6sIef0PElMNwwSAlAVtUs65y3nsFl517pOdzDrcTk43WqF5y8bBxG7Q1qP4fTl7ST4OxsO8y8mISlOCep1WPGH4FJNmUBwHOLUrtTUYcUnQcTjy8uyutor0NL98DA9Q7qpAW9CsiDEypfKbpFfQnLYkF8Cm4vlwsyStJqQGl0B6N2hCJxQfGM57qr8mLvLGLahw1DrFMozdjDWCp6zTS49BUxfbjmcR7bJ3r2T4fHxx63fXSdX2rbePzgVako4iaaXcqnGOecJ33auD00BLXDvrhWLIUjQsbEzbT1m8Bs4DrMKry06yrDXHeXuG5AKV5IE7myOQp6vAwyYk6iDFgHSwQGPjNsSvuUY0GRhqTM8yvPSlSrXkkzUrJwEa0W73MO8MY77O9CSpRqGEzLRBEJaerw7q4H0h2GAtEsphpinB5Scl78yyFDjlaB0LlzlNjhTfNJDbKWdr37pXViNdfEzUS2qQP7pqJLCe0f0SAdjQrMA3HcdcuJBDWY8StsEQEo04n89VIkNPYWTW0UcH7Ixv4g76h6uxjz0VHr9beaXnv5wLaJMpnmUIfkwInXiIISgxg6yKzn6gC8l2MqqFjPe26QBkeHBmCXsDJ44XviQ07UgPrqai9f4TIcGt6HzQztCe04N6PGaJd7oL2B9mj4XKzYGzmJnQozwOm2HVUMcv7c8chT8YmuDuSMmHhwqEeheja5dY81MUDAlKeW4lV4JIIl9sFCwJxh4BPGGwJSs5azkmg16AJIQQ0tbWYyXT7TxDSLtAL5tAFjO94MT1T9k1nWGWLoHevGjgVWGywy7Wv97jlQFv0pqqRybnmv84Iyy99c0Uc86AH9DseLwyl8EVpmQxIFvb6FygePKfx1xSkq0Patv9ctiBJ9Tf85baO0wAhrgY6NBkjmn8TsvH6XcIGJScBJBgE6xwKUuLq5Mnh73HGPk8PpTM32L6XvrtQ4DUiw0q4z0rGJuDffGJsXzsDdy8gzXPbwBDPJnFxYpL2lDlhjU2RGnkUNYdnivdqGxX8cW6QRhsFCNFb10zcTcceTg77OCoy7YFT9QSrXeuJwqJYSMVqIGFc1gUh6r0f5F48u1zBGFMfk6rsSk2y61h1WrTI9wFWFoblHhgWLEvkkQCdILv9zc38RVAf6NXSO8KARnoiiR04V25A1nFdg8rfeuEL8Co0
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x28], 0
je 0x40197d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
call edx
cmp dword [ebp - 0x40], 0
jne 0x4018b1
jmp 0x40197d
push 0
push 0
lea eax, [ebp - 0x58]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
call edx
push 0
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00403ed0
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x74], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00403f90
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00403ce0
mov dword [ebp - 0xa0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x78], esp
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00404840
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x88]
mov eax, dword [edx + 0xc]
call eax
mov byte [ebp - 0xa5], al
movzx ecx, byte [ebp - 0xa5]
test ecx, ecx
je 0x40196c
mov dword [ebp - 0x60], str.tXOsofvolANDGL6FEat3iaMQLKln3R7am3hf5hJzbUMS4y5qyOEmrrtJGtXnn5s0NvlBw2vB59tEGaYLq09vbOu40UjB3SnrETGp8XPW72yBUFYT
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00403e20
jmp 0x401882
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00403fd0
mov eax, dword [ebp - 0x7c]
jmp 0x4019ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c