Function at 0x100146c7
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x38
mov eax, 0x100864aa
call fcn.1006d527
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x14]
push eax
push 0x1008ae74
push 0x17
push ecx
push 0x100b8f68
mov dword [ebp - 4], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1001472e
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x100149ba
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x100149ba
and dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x14]
push str.rootcimv2
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10009083
push 2
pop ecx
lea edx, [ebp - 0x18]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push dword [eax]
mov byte [ebp - 4], cl
mov ecx, dword [esi]
push esi
call dword [ecx + 0xc]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
mov byte [ebp - 4], 1
call edi
test esi, esi
jns 0x10014786
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
jmp 0x10014998
and dword [ebp - 0x1c], 0
push str.Select
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.1000904e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.1000904e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.100139ee
test eax, eax
jns 0x100147c3
push eax
call fcn.1000167a
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call edi
push str._from
lea ecx, [ebp - 0x10]
call fcn.1000904e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.100139ee
test eax, eax
js 0x100147bd
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call edi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
call fcn.1000904e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.100139ee
test eax, eax
js 0x100147bd
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call edi
mov edi, dword [ebp - 0x18]
push 0x1008aef8
lea ecx, [ebp - 0x24]
call fcn.1000904e
mov esi, dword [ebp - 0x2c]
mov ecx, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x20
push esi
push dword [eax]
mov byte [ebp - 4], 8
push edi
call dword [ecx + 0x50]
push dword [ebp - 0x24]
mov edi, eax
mov byte [ebp - 4], 4
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x10014868
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
jmp 0x10014980
and dword [ebp - 0x40], 0
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x40]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x10]
test eax, eax
jns 0x1001489e
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
jmp 0x1001496f
push 0x10
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.1006de50
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [ebp - 0x28]
push 0
push 0
push edi
call fcn.1006d400
pop ecx
inc eax
push eax
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x100c7688
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x24], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100718a0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0xb
test edi, edi
jne 0x1001490c
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
jmp 0x10014965
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x28]
call fcn.1006d400
pop ecx
inc eax
push eax
push dword [ebp - 0x28]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
push 0
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x3c]
push edx
push 0
push edi
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10014952
cmp dword [ebp - 0x34], 0
je 0x10014952
push dword [ebp - 0x34]
mov ecx, ebx
call fcn.100138e3
jmp 0x1001495e
push 0x1008ac08
mov ecx, ebx
call fcn.10001588
push edi
call fcn.1006c617
pop ecx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 4
test eax, eax
je 0x10014980
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
test eax, eax
je 0x10014998
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
test eax, eax
je 0x100149a9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100149ba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
call fcn.1006d4f5
ret