Function at 0x404a00
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415f60
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x84
mov eax, dword [0x479010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push str.Find_RepeatProcess
mov eax, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x44]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x88], 0
xor ecx, ecx
mov word [ebp - 0x6c], cx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0x476240
push 1
push 0
push 0x476230
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x404aeb
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x54]
jmp 0x404d0e
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jge 0x404b2f
mov dword [ebp - 0x70], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x70]
jmp 0x404d0e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x404b69
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x64]
jmp 0x404d0e
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x30
mov edx, dword [ebp + 0xc]
push edx
push 0x449f2c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x404baf
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x5c]
jmp 0x404d0e
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x24], 0
je 0x404cab
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x1c], 0
jne 0x404be5
jmp 0x404cab
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ecx + 0x10]
call eax
push 4
lea ecx, [ebp - 0x18]
call fcn.00402a60
push 0
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004039e0
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
lea edx, [ebp + 0x18]
push edx
call fcn.004038f0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x90], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00403d90
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
push eax
call fcn.00401520
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + 0x18]
call edx
mov byte [ebp - 0x3d], al
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x404c90
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x84], str.FA1dno0jkEfL2aqh2Tfie2qzFI9AObmSgH4vNquwcdwIMQadexKSKc0aL7leAabqUnIg4wME3sKVoQe6ONu4qpEXXrT2kvy3peFUNRjF8J2NXLPYw5NqJ1jvhxihIB07SUoLQn0aFQJXjng0qINri0rSzDfx9604R1aV9FjfH3ttOCKo13noR6XLDvMLyN7ni2YlL5dEe2aDAHCrai9moIoq7jbcCLQFvsCLXBcF5XV8h2ay9FzjSYHGyGXpzfMBcJCO6Xfb1reVh9FaBlMYzIoXqHXjmDuVtfjVGCSDFyIoK8wtkczJeIc8EfoBQf2KFe0MOsIHspRbLVXjwFcFQjxBONXKjly8sQJgFGFfR0PCuDnFyomfABqlqRjhYicBIiSJgXhEpQIVycXrdac58HUDe4UpsPLf2o7qUW29mtdDXwIjpoos0em6CbgtGASTaIA5SGCdIw4k7vkQch79CdnDDgQRY9UjWw24hH4H5R3GMWkpMF5xlaQxVyd375XXrMCi9YCNFAWubDWau8wDm3UmOsRzcSXfMb7hnWOYo0xyRjfaOWaXMfX2hCn5K0yjh5J7Mur7JxDOME1eo5eDCCHNTkIS5iOzf5VGPKOazpVXpbKIitRX24HV68g92Mi4u9BCGjvvgPFj0gQ557ePwgh6cFvnoGup6DYidvW6mqXrdJl4oUCvi1Hor5xXir3AvHVW9WvxmAoWiLbiE38fWipP7yRbBmHmFYflwz9FNRQmhfr7RdGIntszurkiXwp84LzCABxwePG8UYmvuIc8Jbw1S4evORb1GRsrTEUlcaAJMxjewqm3trYJBVcYjaeP3HmSfBeygBFwbnOHuNQygyNwXxiPo0R9ahAuII0O3WqQaJv3qQba2cBnlwX8MNA9A8ogVcx1eOHz3P6QUpjfuVCHzDae6WTTLTRMMoJTW9CX8xAnSJxNtVbBScdsvNkgrEb2DbHtyauqHSLavUuCkjBGj4miQ13Uyz1IQ8As2KXU8EFlLC5glmIQEaHgcLuSDdCF8Klpwq92EYCmhNhqcj4OS9UttKnyTmcQAuEGjtHVsycYgy3NVm087oaDz5Dz8XWiLM1wNQOlyrfkDeof2EBaxW71dkw0Ne96w1CWycbyTcROUkiCkiK6zAWt1uwa0v3sbtuOgTYvkOsdhzMU2j5YHLpqv5oIunVBptoPM1WCwKEB5oJqXUWp4dPp6UJNd5vUjzUayX3akxIw7A3JsgImMmEpKe5zqqhMpAkhUeSQ6UBvldPcorDAdVk7ix8rGqoxMvOBYWnLrI1bJ1a072NquDHEGwEoe7lzUwL8VRAYe3PRhMuhIotWkKvAacaBjA2h1GLvthr4xjz7YqF85I0UT6oXdTIsa3LX5Pu6M6L0MiqCQUUDP3UNT8QfAl6x6JeVSHNXALggA5clWiRLmeSLBQklktEBo1tnWMES8lyIR4kpiHxuPWHGHQ6FIFpElgXwAqbl9r8MM1UaXllJbIi8uhm49KGnNcCO3C6nTMSpP4RvFNqHyGMh32CIQWhyJILYFpaynQ7tzUH9JIu29R4VAqYoVz0IqC9LrERE32nWHuWVNnF5TL7VT1HPB6O9fW7iWBgojGikxH8PIfgygQjrCh4PLpi1X5mkXuwPxTie61lJJ6ONPE6Ykscl3YzqRESksBQt0AGp5nhpzTiPsGWtwA2sKMokCy1kCeycYnyNUhcwrXUgavugIqlpUj1zoWr2QE0fEGQqJHTCWNhmcEm3lwIyfxkUNe8MHcEjdGkvmaQabfi4YHkVLcBqc1N0U8pA0c2qorT0JeoheX1HoX1QTrqPQmVdw7hhXisDqBcVqErJkiMiuEiBlXKL0cFThBtTiRzJPKkohY8hR3gUr5PfR1kJ5Ftdhmp8wmsE7kLGkeUVoC2oHu80RsIpTBIRFYtRCxh324GmCsBG9jNehEwu1q8FePcAlUdL5I55E4PaeQqscdtEEXfQdroCSn230ql8TONkgHD0cFW9lg2CQnsDEj1xIdMP4AE0CkhOrK82DecAacDIoqbRNc6WztoxLla6ijf32f1CDTxA1BAklcj0oypvjmcE4qWRrrjX8ADildKRYTjsouo4u6q4X3MhHohinzycQWKRarwDgUXLHntcW5zwXlftgjsLBdBzXMlWsRWxww54dSMPLLQwvQ61RG6Wf6qjAHnakePpRwQbDVGbJwQdjybxvQWSndImh07lDm9pPYux13KqJ44xXC3cK6cSsapDIlO27dxayPERFpKMHvXdOkWCLzsxibBaCMGzjSmPIXs6kPDuFlYG64Q0ikQGV9CTPMQ4zBF7A6ts0MAMJvscOoq1ChUrQC1Pecon8Kfc1QJt1m0V6gKJQ11REfEbNLu2Lfo80RxMrKIR4irc0i75TMIht1TkrU0uS7IDlteCcTlFi9k5ib7JUat5dBmYFjhFBrhmihfiG1pOFs53nqhyNmKgMarfgEq73YLqTHc8pB8RSABWCKd3VS14MT0H9OJCjx4oL92jjYGaAnUghMShtQG46E5Yi5rPi1Fj4UcmI1u6A3YeqgUP9gH8UTUHK6L7JuQMzey1gh95HdKRW5ELf1poOKYyFVQzccyTDarhTVruSR5VBh8IDUzhFXVbg2Na5tpfaHDsUPpL7pOXW26MOBvqFVCgOeFwCOLXEIm6WqgmuBJimE1BOFRLnH8vHKt5RRGGrf3jN8c4zx7CSFgrcCUE9QySLozwKAjt4SrINNdlf8dWFcxl1pC9JF4Ijg7oliRX7Ub25KQzHlEKtub0bSGNMkoDfqFenDtNs3Mbe8FQysDjJd6mlKma0MbgHOSHeNTd2qISzeVSVDMegzqof2OAW9MKmjSNAC7pSwpAnqzOAUcl7ut7Hdea0ChOuCfJtxiE6gdwCjgkOdpLLtMuC8EKlBqDWp02eENdQVrHeznEwnsSWG4yX1b01DGTaaApwIflrdpSP3Yta7KjKYfmMuMhRleR9jYTm7nlbbjB1IP3M2eY
mov dword [ebp - 0x8c], str.KeJPOABaYdvlRjh2rRHdG4Lg6cyh7Hys77jFfMNV82SGCVzdFGekmGJkvmfNkAkSdjdMtvD1JEKsbrD7Yoxpzt9gvVgi78wKiLuo21Q6wvNTXNK4tjJ3BsJvsy53pR9TNJQUnGBKWSPTTA7Su9D0FNzpsDl6DT3BvOFX2UrBhUN5sWMNFSEh5J9eovNaMT1zqWUowgg9vxLLAzJxTRP25xlgUenDj8H1NmeeohqRsv0XMMPflLSEYBqHrK7EdrFxcESHcEBdCrPq3rOwpz9J8n2H8Qd40emfpINgw8WylKNyPLf6LoazTgsHunflfcuG8glueV9nKW4LCldtW1v5M9TzETnJKu2y4mtqqUzOBp05MARcYodCiNqResIh9TfWRlo3NsDUbtGDrJMTrjJvvtGJe5Pvp5IQUPwq6XOV3JlqSlasVHY3hgt2ep7mJ0JsxwJBKGILej7RKjPS5weub5HfgAShDYcb9adw3G56jWXSTRgswQ82CFtEVpk8QEEC8CA8WTPenWNOtxzCUOKPIAYckdxgoXhASNPif2Xf1cquQev2UCwYoezw3UwryeU5PInQuDGRn9v9I7uzeAiyiOMX0XrvvuppUDcgFTFUXmoTRd6qHWiDkATwWxvis9BtqXXAwoUvHY9KAKAeOl8pgGryuC0TOFlMNP0O05m6v11MmNPmVpYL5DG6kBmrwBA1StI39YqCiPlzadAjP4U1CyyC3njk8EjXW2mg7M0yQiHUE3zCKdMiRhu79fPkRLwuDDTedVyVRFX18CxYfHdwXhrd0Yazz3evYm5zTw2qUJgotmh5kkzuaNQ4SPOrJQs2qfqJKnTfsG0Rg0xInR0OSLHsXsyIuGfaLgdYv09cRbNCIn9M80qUFMtGh0rsCiE4gltq1QgDF1ipHomqKxaYSS4C2EvVvqjA4q5mDNY4nuVo4mWlIPWMU5E2tHWCf3ePa4kuW8c0Y9lNp5LGjuTCuTE2s7QAouobkc0pJFpVgTvlvqrrLE0mhBEtwB8gnMhFjtLr4yNx3JKDV2IhR28jfIUnhW40mKs7oaeofiaIcJOh1qwATS4eAch1j2l6l4EXl4QuSHWAx2ROPWQsD6ukLehOeM4Q1eIruA1rOUfpYSpKhJVFp5Xjwn5rFdFtSzFpDHWoboKHmzmwVN5H3RVhQxrJgq49deEt8XNVkVRaCv1xcXJL5yqPdb1CzMUcCpSGgOjJkYuit287gsUWJxFlHNspI7sEk2Rc32ONg10mUbV4LaB5s18KNlDBYMvktHHY3BOV9HX6hNMGu9ev1bArlcoHOnK3dDkWJmjkR0MHsQkquRYC7WHVNh976IemT3GqzS4l1gnhOxumWO8aq5USo1R8aUhm9cR6VvHtVshNdmwaiu2iy2w73k8VPiAQGi15amHlD2zbR12ebo9w73CzmF3BlwbfwEmQzkjHNUXayyVvq3WOB9bmE1m6otnBOxchq3EtTCGpqeuE313uw7VFXQmh9jQD4BUSX33pjSGLVP98IWr6kzjW7mmty6p40jWBedAcm9UP7H2mjhFBfAFp6roHYO7oPaAci8mQBAkqTjXFqGUvDJR4kGeYQjC2xMvVKvkYJkTd019Pf8jhfobbqf1XHjb75VL0TTBYT2sknvmO2BkkvK1IBQOKqWHWrqOwREqSM1KkfN5M1eT1GRVlwOxS7DG4D9wCv0atz6qe7fq8rcjGJBDpo23l8albF45ksWkdYIXwJv7qCKeBsDX0UX2C9ArfAgaE7mzgeTN99AwsPfJ0mvSSmF6A3ksorOKzCVIv5cft2O4SkgfY1j4Ku2bWJE15chwKzyPgowftQB2kmGwRYOQqtBkpEGSWiOE52hexwKe5aUkY7eMigVeKs6XycYusxuEKWlFah45LdViqOOhdYft8X5dShTYhENrbQh1oshog1HqTc262yFzeyaAQyCFNSQOfxTMISj6ep3jouYeADr6SM30SsbY6Xhsi3m9QlazkTFJAtnzec8h7fxKkbowWcmY7IaUEIUy7R3BQquTGpD1awuxwFV0OmSOV96weQHbamxVi8bSdLcNvfQqHFjgUJfnt9k3TAMXXgiUGVS6s0nML3HS0tL8YO4eUzFF2EbHOlJVgn2Qd9mqkxRv6h3PMCdPaF2mHQMoebK1tsYkYr972Bqw5hHMkRc0CLvu5aR7GDNFYpr5zxCo6C0lUy8cxBccwAKMBgEjc1cX8n1n3acA62SU877wGxFVgjoHBW4ShvKiB9rsxocPvv7EMOWwo2eIft0vaaGi6aHgp8JAiJW0BMowBsmdy4H40Y7ee1RxnWLLSp45B3HIuM82OFwRqg8w6cdBzIC5oK6XHENcPBEr6zt8h140AVKFeMHdNEFU3iihQeyhs3XicjemnV6sWW0389eohqAGoI7bhdKCltwuiMVvtwMrjNAVC35pT0iyVhkR4H0aeVzctSqKznxDYIXMfbHcuMAmUqlF1NwAfknPeVGTKHXscBXyYLXErXq5WAb5nQ2R3cqh0kzL31q7UN4NB7ueFF8TYR3ynDdH5cUXJnssNsuPdYCTLKBOHSxkiVoCphEBD9NQ1e8kHMVSfg1WThjRFsW5raPKSlWNOXEmX0Q0KrJwd6wPisjmdc3cnxdvkJDjAMPtkDioit53qppc3e3KBJ3UmGxpkMbUINkFn0EC0AmKgqRs6CD3GDyNVT42wBhVDURm4Y4pQJtR87LC2FAYm0wnSoKNPIFgo7QKo2aN55Cv2gKxBH3Mg58eLcBs6yG3FHbp3TcXj9XMHPk5qv44qmS5HGTfueTGf5xeqTBimqG5K96wHtEr33UWGaW2aMnPgeP8YKHVSuHems4nXJ6ClPkCw3IaM9Co9Mc3hvPNl6BBgRJs6XQiFI8EQSXxG9ByI4VUTEeB38F7Mp3PhxB9r8lm8p3yIuJK4XyIA48L8CW9PYnP3sbU8SROEr58kKSIC6Mr50GwxJ7DTmz3fmHmjcDSy0SGwsmqaDy3g71Q4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403b60
jmp 0x404bb6
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401820
mov eax, dword [ebp - 0x58]
jmp 0x404d0e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a57e
mov esp, ebp
pop ebp
ret 0x28