Function at 0x4f30f6
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, edx
mov dword [esp + 4], ecx
lea ebx, [esp + 0x24]
and dword [ebx], 0
push ebx
push 0x570e24
push 1
push 0
push 0x570e40
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4f3136
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x4f315c
xor eax, eax
xor esi, esi
jmp 0x4f313f
mov ecx, eax
call fcn.004f23cd
mov esi, edx
lea ebx, [esp + 8]
mov ecx, ebx
mov edx, eax
push esi
call fcn.004f42e4
pop eax
mov al, byte [ebx]
cmp al, 0x11
jne 0x4f31ac
mov esi, dword [esp + 0xc]
lea ebx, [esp + 0x24]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.004f275e
and dword [esp + 0x24], 0
mov ecx, dword [esi]
sub esp, 0x24
mov dword [esp + 0x20], ebx
movaps xmm0, xmmword [0x50cfd0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x54], eax
mov dword [esp + 4], eax
and dword [esp + 0x1c], 0
mov dword [esp], esi
and dword [esp + 0x18], 0
call dword [ecx + 0xc]
test eax, eax
mov dword [esp + 0x1c], esi
js 0x4f31dc
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4f31eb
mov bl, 1
jmp 0x4f31f7
mov cl, byte [esp + 0xb]
mov edi, dword [esp + 4]
mov byte [edi + 3], cl
movzx ecx, word [esp + 9]
mov word [edi + 1], cx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov byte [edi], al
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
jmp 0x4f335b
mov ecx, eax
call fcn.004f23cd
mov edi, eax
mov dword [esp + 0x20], edx
jmp 0x4f31f5
xor edi, edi
mov dword [esp + 0x20], 0
xor ebx, ebx
xor esi, esi
inc esi
mov ecx, esi
xor edx, edx
call fcn.00467340
mov ecx, esi
xor edx, edx
call fcn.00467340
mov ecx, esi
xor edx, edx
call fcn.00467340
mov ecx, esi
xor edx, edx
call fcn.00467340
mov ecx, esi
mov esi, dword [esp + 0x30]
mov edx, esi
call fcn.00467340
test bl, bl
je 0x4f3254
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
mov ecx, esi
call fcn.004f2399
jmp 0x4f3297
lea ebx, [esp + 8]
mov ecx, ebx
mov edx, edi
push dword [esp + 0x20]
call fcn.004f42e4
pop eax
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
xor ecx, ecx
call fcn.004f2399
mov ecx, esi
call fcn.004f2399
mov al, byte [ebx]
cmp al, 0x11
jne 0x4f3326
mov edi, dword [esp + 0xc]
sub esp, 0x20
movaps xmm0, xmmword [0x50cfe0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
and dword [esp + 0x1c], 0
and dword [esp + 0x18], 0
mov dword [esp + 0x14], 3
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
lea esi, [esp + 0x24]
mov ecx, esi
mov edx, eax
call fcn.004f23b0
xor eax, eax
cmp dword [esi], eax
je 0x4f3316
mov edx, dword [esp + 0x28]
lea esi, [esp + 8]
mov ecx, esi
push dword [esp + 0x2c]
call fcn.004f42e4
pop eax
mov al, byte [esi]
cmp al, 0x11
mov ecx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
je 0x4f331e
movsd xmm0, qword [esp + 9]
movsd xmm1, qword [esp + 0x10]
movsd qword [ecx + 8], xmm1
movsd qword [ecx + 1], xmm0
mov byte [ecx], al
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x4f3355
mov ecx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov dword [ecx + 4], edi
mov byte [ecx], 0x11
jmp 0x4f3355
mov cl, byte [esp + 0xb]
mov edi, dword [esp + 4]
mov byte [edi + 3], cl
movzx ecx, word [esp + 9]
mov word [edi + 1], cx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov byte [edi], al
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret