Function at 0x47a800
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x108], ebx
cmp dword [ebx + 8], 0
jne 0x47a83a
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0047a200
lea eax, [ebx + 0xc]
push eax
push 0x62495c
push 1
push 0
push 0x624a2c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47abd6
push 0xc
call fcn.00479f06
mov esi, eax
add esp, 4
test esi, esi
je 0x47abf2
push str.ROOTCIMV2SecurityMicrosoftVolumeEncryption
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x47abf2
mov ecx, dword [ebx + 0xc]
lea edx, [ebx + 0x10]
push edx
push 0
push 0
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push dword [esi]
push ecx
call dword [eax + 0xc]
mov dword [ebp - 0x110], eax
lea ecx, [esi + 8]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
jne 0x47a8fa
mov ecx, dword [esi]
test ecx, ecx
je 0x47a8d8
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47a8ef
push eax
call fcn.0058bb5f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0058bb51
add esp, 8
cmp dword [ebp - 0x110], 0
jl 0x47abd6
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebx + 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x47abd6
xor eax, eax
push edi
mov word [ebp - 6], ax
call fcn.004fd840
add esp, 4
test eax, eax
lea eax, [ebp - 0x104]
je 0x47a95f
push 0x5ef904
push edi
push str.DriveLetter
push str.SELECT__FROM_Win32_EncryptableVolume_Where__s_s_s
push 0x7f
push eax
call fcn.0047ac10
add esp, 0x18
jmp 0x47a9e7
push 0x5ef920
push edi
push 0x5ef924
push str.SELECT__FROM_Win32_EncryptableVolume_Where__s_s_s
push 0x7f
push eax
call fcn.0047ac10
lea ecx, [ebp - 0x104]
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47a983
sub ecx, edx
lea ebx, [ebp - 0x104]
sar ecx, 1
lea eax, [ebp - 6]
lea edi, [ebp - 0x104]
lea ebx, [ebx + ecx*2]
cmp ebx, eax
jae 0x47a9e1
movzx eax, word [edi]
test ax, ax
je 0x47a9e1
add edi, 2
cmp eax, 0x5c
jne 0x47a9da
mov eax, ebx
lea esi, [edi + 2]
sub eax, edi
add eax, 2
push eax
push edi
push esi
call fcn.005c9380
mov eax, 0x5c
add esp, 0xc
mov word [edi], ax
add ebx, 2
mov edi, esi
lea eax, [ebp - 6]
cmp ebx, eax
jb 0x47a9a8
mov ebx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
mov dword [ebx + 0x14], 0
lea edi, [ebx + 0x14]
push eax
lea ecx, [ebp - 0x110]
call fcn.0047a140
mov eax, dword [eax]
test eax, eax
je 0x47aa0d
mov esi, dword [eax]
jmp 0x47aa0f
xor esi, esi
push 0x5ef938
lea ecx, [ebp - 0x108]
call fcn.0047a140
mov eax, dword [eax]
test eax, eax
je 0x47aa29
mov edx, dword [eax]
jmp 0x47aa2b
xor edx, edx
mov eax, dword [ebx + 0x10]
push edi
push 0
push 0x30
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x50]
mov esi, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
test esi, esi
je 0x47aa99
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x47aa8f
test esi, esi
je 0x47aa8f
mov eax, dword [esi]
test eax, eax
je 0x47aa6d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47aa84
push eax
call fcn.0058bb5f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0058bb51
add esp, 8
mov dword [ebp - 0x108], 0
mov esi, dword [ebp - 0x110]
test esi, esi
je 0x47aae7
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x47aae7
test esi, esi
je 0x47aae7
mov eax, dword [esi]
test eax, eax
je 0x47aac5
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47aadc
push eax
call fcn.0058bb5f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0058bb51
add esp, 8
cmp dword [ebp - 0x10c], 0
jl 0x47abd6
mov ecx, dword [edi]
test ecx, ecx
je 0x47abd6
lea esi, [ebx + 0x20]
lea edi, [ebx + 0x18]
mov dword [esi], 0
mov eax, dword [ecx]
push esi
push edi
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [esi], 0
je 0x47abd6
push str.__RELPATH
lea ecx, [ebp - 0x10c]
call fcn.0047a140
mov eax, dword [eax]
test eax, eax
je 0x47ab39
mov esi, dword [eax]
jmp 0x47ab3b
xor esi, esi
mov ecx, dword [edi]
lea eax, [ebx + 0x28]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0
push esi
push ecx
call dword [edx + 0x10]
mov esi, dword [ebp - 0x10c]
mov edi, eax
test esi, esi
je 0x47ab9e
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x47ab9e
test esi, esi
je 0x47ab9e
mov eax, dword [esi]
test eax, eax
je 0x47ab7c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47ab93
push eax
call fcn.0058bb5f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0058bb51
add esp, 8
test edi, edi
js 0x47abd6
mov ecx, dword [ebx + 0x10]
lea eax, [ebx + 0x1c]
push 0
push eax
push 0
mov edx, dword [ecx]
push 0
push str.Win32_EncryptableVolume
push ecx
call dword [edx + 0x18]
test eax, eax
js 0x47abd6
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
call fcn.0047a200
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.0058d160
int3