helloworld – performs actions identical to the newer sample’s ‘Sub’ function helloworld1 – accepts command-line arguments, performs a UAC bypass helloworld2 – drops and compiles a mof filemof file   sqmAddTostream – expected to run initially by the malware, checks OS version and loads the malware with helloworld2