Function at 0x401644
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
push ebx
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40164b
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00402000
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
push dword [esp + 4]
call fcn.00402bae
cmp dword [0x4111d8], 0
je 0x40168e
cmp dword [0x4111dc], 0
je 0x40168e
mov eax, 1
jmp 0x401690
xor eax, eax
and eax, eax
je 0x401699
jmp 0x4017ee
push 6
push 0
call sub.ole32.dll_CoInitializeEx
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, 0x80010106
jne 0x4016cb
push 4
push 0
call sub.ole32.dll_CoInitializeEx
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x4016d8
jmp 0x401a44
push 0
push 0
push 0
push 2
push 2
push 0
push 0
push 0xffffffff
push 0
call sub.ole32.dll_CoInitializeSecurity
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x401729
mov ebx, dword [esp + 0xc]
cmp ebx, 0x80010119
je 0x401729
mov eax, 1
jmp 0x40172b
xor eax, eax
and eax, eax
je 0x401734
jmp 0x401a44
lea eax, [0x4111d8]
push eax
mov ebp, 0x4109a8
push ebp
push 1
push 0
mov ebp, 0x410998
push ebp
call sub.ole32.dll_CoCreateInstance
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x401767
jmp 0x401a44
lea eax, [0x4111dc]
push eax
push 0
push 0
push 0
mov eax, str.MS_409
push eax
push 0
push 0
mov eax, 0x4100b0
push eax
mov eax, dword [0x4111d8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x4017af
jmp 0x401a1a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x4111dc]
call sub.ole32.dll_CoSetProxyBlanket
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x4017ee
jmp 0x401a1a
lea eax, [esp + 0x3c]
push eax
push 0
push 0x30
mov eax, dword [esp + 0xc]
push eax
mov eax, 0x410264
push eax
mov eax, dword [0x4111dc]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jge 0x401824
jmp 0x4019f6
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x44]
push eax
push 1
push 0xffffffff
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x401859
jmp 0x4019f6
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x18]
call sub.OLEAUT32.dll_SafeArrayLock
lea eax, [esp + 0x18]
push eax
push 1
push dword [esp + 0x18]
call sub.OLEAUT32.dll_SafeArrayGetLBound
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
jmp 0x4018a7
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 8]
jl 0x4019f1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x18]
call sub.OLEAUT32.dll_SafeArrayPutElement
cmp dword [esp + 0x20], 0
je 0x4019e7
mov edx, dword [0x4117fc]
push edx
push edx
push dword [esp + 0x28]
call fcn.0040bd60
lea eax, [esp + 0x28]
push eax
call fcn.0040be70
mov edx, dword [0x4117fc]
push edx
push edx
push 1
push dword [esp + 0x30]
call fcn.00402580
add dword [0x4117fc], 2
mov edx, 0x4100c6
pop ecx
mov dword [0x4117fc], ecx
add ecx, dword [0x4109e8]
call fcn.00402050
je 0x401929
jmp 0x4019e7
push 0
push 0
lea eax, [esp + 0x34]
push eax
push 0
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
mov dword [esp + 0xc], eax
lea ebp, [esp + 0x2c]
movsx ebx, word [ebp]
push ebx
mov ebx, 8
cmp ebx, dword [esp]
jne 0x401983
mov edx, dword [0x4117fc]
push edx
push edx
lea ebp, [esp + 0x38]
push dword [ebp + 8]
call fcn.0040bd60
lea eax, [esp + 0x30]
push eax
call fcn.0040be70
jmp 0x4019be
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4019b0
mov edx, dword [0x4117fc]
push edx
push edx
lea ebp, [esp + 0x38]
mov eax, dword [ebp + 8]
cdq
push edx
push eax
call fcn.004025f0
lea eax, [esp + 0x30]
push eax
call fcn.0040be70
jmp 0x4019be
mov edx, 0x410028
lea ecx, [esp + 0x2c]
call fcn.00402008
pop eax
mov edx, dword [esp + 0x28]
push dword [0x4117fc]
push edx
call fcn.0040bef0
push dword [esp + 0x28]
push dword [esp + 0xc]
call fcn.00402c30
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.0040be70
inc dword [esp + 8]
jno 0x4018a7
jmp 0x40182e
cmp dword [esp + 0x40], 0
je 0x401a07
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [eax]
call dword [eax + 8]
cmp dword [esp + 0x3c], 0
je 0x401a18
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
jmp 0x401a44
cmp dword [0x4111dc], 0
je 0x401a2e
mov eax, dword [0x4111dc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
cmp dword [0x4111d8], 0
je 0x401a42
mov eax, dword [0x4111d8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
xor eax, eax
push dword [esp + 0x28]
call fcn.0040bf50
push dword [esp + 0x24]
call fcn.0040bf50
push dword [esp]
call fcn.0040bf50
add esp, 0x44
pop ebx
pop ebp
ret 8