Function at 0x42dc10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x3f0
mov esi, esp
lea eax, [0x44563c]
mov dword [esi + 0x3d4], eax
mov al, byte [esi + 0x150]
mov byte [esi + 0x154], al
mov byte [esi + 0x4c], 0x1d
mov byte [esi + 0x4d], 0x1e
mov byte [esi + 0x4e], 0x11
mov byte [esi + 0x4f], 0x9f
xor ecx, ecx
cmp ecx, 4
jae 0x42dcb7
movzx edi, byte [esi + ecx + 0x4c]
mov eax, 0x4d7a4d4a
sub eax, ecx
and eax, 0x7b21da80
mov ebx, 0xcd7a4d4a
sub ebx, ecx
and ebx, 0x84de257f
mov edx, edi
xor edx, 0x7b21da80
or ebx, eax
mov eax, ebx
xor eax, 0x84de257f
xor edi, 0x84de257f
and eax, edi
xor ebx, 0x7b21da80
and edx, ebx
or edx, eax
mov ebx, edx
and ebx, 1
xor ebx, 1
mov eax, 0xa8
sub eax, edx
mov edi, 0xa8
sub edi, edx
or edi, eax
or edi, 1
sub ebx, edi
mov byte [esi + ecx + 0x4c], bl
add ecx, 1
jmp 0x42dc4b
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax + 0x26c]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov ecx, dword [eax + 0x270]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0x260]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0x264]
sub eax, 2
sete byte [edx + 0xc]
mov ebx, edx
add ebx, 0x10
mov dword [edx + 0x10], 0
mov eax, edx
add eax, 0x14
mov dword [esi + 0x2fc], eax
mov byte [edx + 0x14], 0
mov eax, edx
add eax, 0x28
mov dword [esi + 0x50], eax
mov word [edx + 0x28], 0
mov eax, edx
add eax, 0x2a
mov dword [esi + 0x3cc], eax
mov byte [edx + 0x2a], 0
mov dword [esi + 0x14c], 0
sub esp, 0x14
lea eax, [esi + 0x14c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4405ec
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4405fc
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
not eax
shr eax, 0x1f
mov dword [esi + 0x3d0], eax
mov eax, dword [esi + 0x3d4]
mov ecx, dword [esi + 0x3d0]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x445644]
xor ecx, 0xdf230dd0
sub eax, ecx
push eax
mov ecx, esp
mov dword [esi + 0x208], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445648]
mov dword [esi + 0x204], ecx
push eax
mov ecx, esp
mov dword [esi + 0x218], ecx
mov dword [ecx], 0x445650
push eax
mov dword [esi + 0x210], esp
push eax
mov ecx, esp
mov dword [esi + 0x220], ecx
mov dword [ecx], 0x44565c
push eax
mov dword [esi + 0x21c], esp
push eax
mov ecx, esp
mov dword [esi + 0x234], ecx
mov dword [ecx], 0x445668
push eax
mov dword [esi + 0x22c], esp
push eax
mov ecx, esp
mov dword [esi + 0x238], ecx
mov dword [ecx], 0x445674
push eax
mov dword [esi + 0x230], esp
push eax
mov ecx, esp
mov dword [esi + 0x250], ecx
mov dword [ecx], 0x445680
push eax
mov dword [esi + 0x244], esp
push eax
mov ecx, esp
mov dword [esi + 0x240], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x44568c]
mov dword [esi + 0x23c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x24c], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445694]
mov dword [esi + 0x248], ecx
push eax
mov ecx, esp
mov dword [esi + 0x258], ecx
mov dword [ecx], 0x44569c
push eax
mov dword [esi + 0x254], esp
push eax
mov ecx, esp
mov dword [esi + 0x268], ecx
mov dword [ecx], 0x4456a8
push eax
mov dword [esi + 0x264], esp
push eax
mov ecx, esp
mov dword [esi + 0x260], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4456b4]
mov dword [esi + 0x25c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x274], ecx
mov dword [ecx], 0x4456bc
push eax
mov dword [esi + 0x26c], esp
push eax
mov ecx, esp
mov dword [esi + 0x278], ecx
mov dword [ecx], 0x4456c8
push eax
mov dword [esi + 0x270], esp
push eax
mov ecx, esp
mov dword [esi + 0x288], ecx
mov dword [ecx], 0x4456d4
push eax
mov dword [esi + 0x280], esp
push eax
mov ecx, esp
mov dword [esi + 0x284], ecx
mov dword [ecx], 0x4456e0
push eax
mov dword [esi + 0x27c], esp
push eax
mov ecx, esp
mov dword [esi + 0x290], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4456ec]
mov dword [esi + 0x28c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2a0], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4456f4]
mov dword [esi + 0x29c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2a8], ecx
mov dword [ecx], 0x4456fc
push eax
mov dword [esi + 0x2a4], esp
push eax
mov ecx, esp
mov dword [esi + 0x2c0], ecx
mov dword [ecx], 0x445708
push eax
mov dword [esi + 0x2b0], esp
push eax
mov ecx, esp
mov dword [esi + 0x2b4], ecx
mov dword [ecx], 0x445714
push eax
mov dword [esi + 0x2ac], esp
push eax
mov ecx, esp
mov dword [esi + 0x2c8], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445720]
mov dword [esi + 0x2c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2d0], ecx
mov dword [ecx], 0x445728
push eax
mov dword [esi + 0x2cc], esp
push eax
mov ecx, esp
mov dword [esi + 0x2dc], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445734]
mov dword [esi + 0x2d4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2e8], ecx
mov dword [ecx], 0x44573c
push eax
mov dword [esi + 0x2e0], esp
push eax
mov ecx, esp
mov dword [esi + 0x2f8], ecx
mov dword [ecx], 0x445748
push eax
mov dword [esi + 0x2f4], esp
push eax
mov ecx, esp
mov dword [esi + 0x2f0], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445754]
mov dword [esi + 0x2ec], ecx
push eax
mov ecx, esp
mov dword [esi + 0x30c], ecx
mov dword [ecx], 0x44575c
push eax
mov dword [esi + 0x308], esp
push eax
mov ecx, esp
mov dword [esi + 0x314], ecx
mov dword [ecx], 0x445768
push eax
mov dword [esi + 0x310], esp
push eax
mov ecx, esp
mov dword [esi + 0x328], ecx
mov dword [ecx], 0x445774
push eax
mov dword [esi + 0x320], esp
push eax
mov ecx, esp
mov dword [esi + 0x31c], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445780]
mov dword [esi + 0x318], ecx
push eax
mov ecx, esp
mov dword [esi + 0x32c], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445788]
mov dword [esi + 0x324], ecx
push eax
mov ecx, esp
mov dword [esi + 0x334], ecx
mov dword [ecx], 0x445790
push eax
mov dword [esi + 0x330], esp
push eax
mov ecx, esp
mov dword [esi + 0x348], ecx
mov dword [ecx], 0x44579c
push eax
mov dword [esi + 0x344], esp
push eax
mov ecx, esp
mov dword [esi + 0x340], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457a8]
mov dword [esi + 0x33c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x350], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457b0]
mov dword [esi + 0x34c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x358], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457b8]
mov dword [esi + 0x354], ecx
push eax
mov ecx, esp
mov dword [esi + 0x360], ecx
mov dword [ecx], 0x4457c0
push eax
mov dword [esi + 0x35c], esp
push eax
mov ecx, esp
mov dword [esi + 0x368], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457cc]
mov dword [esi + 0x364], ecx
push eax
mov ecx, esp
mov dword [esi + 0x378], ecx
mov dword [ecx], 0x4457d4
push eax
mov dword [esi + 0x374], esp
push eax
mov ecx, esp
mov dword [esi + 0x380], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457e0]
mov dword [esi + 0x37c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x388], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x4457e8]
mov dword [esi + 0x384], ecx
push eax
mov ecx, esp
mov dword [esi + 0x390], ecx
mov dword [ecx], 0x4457f0
push eax
mov dword [esi + 0x38c], esp
push eax
mov ecx, esp
mov dword [esi + 0x3a0], ecx
mov dword [ecx], 0x4457fc
push eax
mov dword [esi + 0x39c], esp
push eax
mov ecx, esp
mov dword [esi + 0x398], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445808]
mov dword [esi + 0x394], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3a8], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445810]
mov dword [esi + 0x3a4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3b0], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445818]
mov dword [esi + 0x3ac], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3b8], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445820]
mov dword [esi + 0x3b4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c0], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445828]
mov dword [esi + 0x3bc], ecx
push eax
mov edx, esp
mov dword [edx], 0x444d50
mov ecx, dword [0x445830]
mov dword [esi + 0x3c4], ecx
push eax
mov ecx, esp
mov dword [esi + 0x200], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445838]
mov dword [esi + 0x1fc], ecx
push eax
mov ecx, esp
mov dword [esi + 0x214], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445840]
mov dword [esi + 0x20c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x228], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445848]
mov dword [esi + 0x224], ecx
push eax
mov ecx, esp
mov dword [esi + 0x298], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445850]
mov dword [esi + 0x294], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2bc], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445858]
mov dword [esi + 0x2b8], ecx
push eax
mov ecx, esp
mov dword [esi + 0x2e4], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445860]
mov dword [esi + 0x2d8], ecx
push eax
mov ecx, esp
mov dword [esi + 0x304], ecx
mov dword [ecx], 0x444d50
mov ecx, dword [0x445868]
mov dword [esi + 0x300], ecx
push eax
mov ecx, esp
mov dword [ecx], 0x444d50
mov edi, dword [0x445870]
jmp eax