Function at 0x42f690
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x448
mov esi, esp
mov eax, dword [ebp + 8]
lea ecx, [0x44999c]
mov dword [esi + 0x41c], ecx
mov cl, byte [esi + 0x160]
mov byte [esi + 0x16c], cl
mov byte [esi + 0x164], 0x8c
mov byte [esi + 0x165], 0x8b
mov byte [esi + 0x166], 0x88
mov byte [esi + 0x167], 8
mov ecx, 4
mov byte [esi + ecx + 0x164], 0
add ecx, 1
cmp ecx, 5
jne 0x42f6dd
xor ecx, ecx
cmp ecx, 5
jae 0x42f746
movzx edx, byte [esi + ecx + 0x164]
mov ebx, ecx
add ebx, 0xd905d23
mov edi, 0xf26fa2dc
sub edi, ecx
and edi, 0xe15f547f
and ebx, 0x1ea0ab80
or edi, ebx
xor edi, edx
xor edi, 0x1ea0ab80
mov edx, 0xbc2e2e4f
sub edx, edi
mov edi, edx
shl edi, 1
and edi, 2
mov ebx, edx
and ebx, edi
or edx, edi
xor edx, 1
add edx, ebx
mov byte [esi + ecx + 0x164], dl
add ecx, 1
jmp 0x42f6ef
mov ecx, dword [esi + 0x164]
mov edx, dword [ecx + 0x26c]
mov dword [eax], edx
mov edx, dword [ecx + 0x270]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x260]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0x264]
sub ecx, 2
sete byte [eax + 0xc]
mov ecx, eax
add ecx, 0x10
mov dword [esi + 0x7c], ecx
mov dword [eax + 0x10], 0
mov ecx, eax
add ecx, 0x14
mov dword [esi + 0x2ec], ecx
mov byte [eax + 0x14], 0
mov ecx, eax
add ecx, 0x28
mov dword [esi + 0x358], ecx
mov word [eax + 0x28], 0
mov ecx, eax
add ecx, 0x2a
mov dword [esi + 0x1fc], ecx
mov byte [eax + 0x2a], 0
mov dword [esi + 0x15c], 0
sub esp, 0x14
lea eax, [esi + 0x15c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4445d8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4445e8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
not eax
shr eax, 0x1f
mov dword [esi + 0x418], eax
mov eax, dword [esi + 0x41c]
mov ecx, dword [esi + 0x418]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x4499a4]
xor ecx, 0x2503878
sub eax, ecx
push eax
mov ecx, esp
mov dword [esi + 0x284], ecx
mov dword [ecx], 0x4499a8
push eax
mov dword [esi + 0x27c], esp
push eax
mov ecx, esp
mov dword [esi + 0x288], ecx
mov dword [ecx], 0x4499b4
push eax
mov dword [esi + 0x280], esp
push eax
mov ecx, esp
mov dword [esi + 0x298], ecx
mov dword [ecx], 0x4499c0
push eax
mov dword [esi + 0x290], esp
push eax
mov ecx, esp
mov dword [esi + 0x294], ecx
mov dword [ecx], 0x4499cc
push eax
mov dword [esi + 0x28c], esp
push eax
mov ecx, esp
mov dword [esi + 0x2a0], ecx
mov dword [ecx], 0x4499d8
push eax
mov dword [esi + 0x29c], esp
push eax
mov ecx, esp
mov dword [esi + 0x2a8], ecx
mov dword [ecx], 0x4499e4
push eax
mov dword [esi + 0x2a4], esp
push eax
mov ecx, esp
mov dword [esi + 0x2b0], ecx
mov dword [ecx], 0x4499f0
push eax
mov dword [esi + 0x2ac], esp
push eax
mov ecx, esp
mov dword [esi + 0x2c0], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x4499fc]
mov dword [esi + 0x2bc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2c8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a04]
mov dword [esi + 0x2c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2d0], ecx
mov dword [ecx], 0x449a0c
push eax
mov dword [esi + 0x2cc], esp
push eax
mov ecx, esp
mov dword [esi + 0x2e4], ecx
mov dword [ecx], 0x449a18
push eax
mov dword [esi + 0x2dc], esp
push eax
mov ecx, esp
mov dword [esi + 0x2d8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a24]
mov dword [esi + 0x2d4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2e8], ecx
mov dword [ecx], 0x449a2c
push eax
mov dword [esi + 0x2e0], esp
push eax
mov ecx, esp
mov dword [esi + 0x2fc], ecx
mov dword [ecx], 0x449a38
push eax
mov dword [esi + 0x2f8], esp
push eax
mov ecx, esp
mov dword [esi + 0x304], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a44]
mov dword [esi + 0x300], ecx
push eax
mov ecx, esp
mov dword [esi + 0x30c], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a4c]
mov dword [esi + 0x308], ecx
push eax
mov ecx, esp
mov dword [esi + 0x314], ecx
mov dword [ecx], 0x449140
mov ecx, dword [str.Q__rK]
mov dword [esi + 0x310], ecx
push eax
mov ecx, esp
mov dword [esi + 0x31c], ecx
mov dword [ecx], 0x449a5c
push eax
mov dword [esi + 0x318], esp
push eax
mov ecx, esp
mov dword [esi + 0x324], ecx
mov dword [ecx], 0x449a68
push eax
mov dword [esi + 0x320], esp
push eax
mov ecx, esp
mov dword [esi + 0x334], ecx
mov dword [ecx], 0x449a74
push eax
mov dword [esi + 0x330], esp
push eax
mov ecx, esp
mov dword [esi + 0x32c], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a80]
mov dword [esi + 0x328], ecx
push eax
mov ecx, esp
mov dword [esi + 0x33c], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a88]
mov dword [esi + 0x338], ecx
push eax
mov ecx, esp
mov dword [esi + 0x344], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449a90]
mov dword [esi + 0x340], ecx
push eax
mov ecx, esp
mov dword [esi + 0x350], ecx
mov dword [ecx], 0x449a98
push eax
mov dword [esi + 0x348], esp
push eax
mov ecx, esp
mov dword [esi + 0x354], ecx
mov dword [ecx], 0x449aa4
push eax
mov dword [esi + 0x34c], esp
push eax
mov ecx, esp
mov dword [esi + 0x388], ecx
mov dword [ecx], 0x449ab0
push eax
mov dword [esi + 0x37c], esp
push eax
mov ecx, esp
mov dword [esi + 0x378], ecx
mov dword [ecx], 0x449abc
push eax
mov dword [esi + 0x370], esp
push eax
mov ecx, esp
mov dword [esi + 0x380], ecx
mov dword [ecx], 0x449ac8
push eax
mov dword [esi + 0x374], esp
push eax
mov ecx, esp
mov dword [esi + 0x3a0], ecx
mov dword [ecx], 0x449ad4
push eax
mov dword [esi + 0x398], esp
push eax
mov ecx, esp
mov dword [esi + 0x390], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449ae0]
mov dword [esi + 0x38c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x39c], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449ae8]
mov dword [esi + 0x394], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3a8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449af0]
mov dword [esi + 0x3a4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3b0], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449af8]
mov dword [esi + 0x3ac], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c0], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b00]
mov dword [esi + 0x3bc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b08]
mov dword [esi + 0x3c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3d0], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b10]
mov dword [esi + 0x3cc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3d8], ecx
mov dword [ecx], 0x449b18
push eax
mov dword [esi + 0x3d4], esp
push eax
mov ecx, esp
mov dword [esi + 0x3e8], ecx
mov dword [ecx], 0x449b24
push eax
mov dword [esi + 0x3e4], esp
push eax
mov ecx, esp
mov dword [esi + 0x3e0], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b30]
mov dword [esi + 0x3dc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3f4], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b38]
mov dword [esi + 0x3ec], ecx
push eax
mov ecx, esp
mov dword [esi + 0x400], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b40]
mov dword [esi + 0x3fc], ecx
push eax
mov edx, esp
mov dword [edx], 0x449140
mov ecx, dword [0x449b48]
mov dword [esi + 0x404], ecx
push eax
mov edi, esp
mov dword [edi], 0x449b50
push eax
mov dword [esi + 0x40c], esp
push eax
mov ecx, esp
mov dword [esi + 0x414], ecx
mov dword [ecx], 0x449b5c
push eax
mov dword [esi + 0x410], esp
push eax
mov ebx, esp
mov dword [ebx], 0x449140
mov ecx, dword [0x449b68]
mov dword [esi + 0x278], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2b8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b70]
mov dword [esi + 0x2b4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2f4], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b78]
mov dword [esi + 0x2f0], ecx
push eax
mov ecx, esp
mov dword [esi + 0x364], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b80]
mov dword [esi + 0x360], ecx
push eax
mov ecx, esp
mov dword [esi + 0x36c], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b88]
mov dword [esi + 0x368], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3b8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b90]
mov dword [esi + 0x3b4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3f8], ecx
mov dword [ecx], 0x449140
mov ecx, dword [0x449b98]
mov dword [esi + 0x3f0], ecx
jmp eax