Function at 0x14004ebc0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc38]
sub rsp, 0xd00
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rbx, rdx
xor edi, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14004ec3e
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14004ec58
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
jmp 0x14004f5d0
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140108e40]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140108e50]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14004ec38
mov qword [rbp + 0xc58], rdi
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
movabs rax, 0x2c4bda6fda75a4c
mov qword [rbp], rax
movabs rax, 0xe91fe6c3b5312f3
mov qword [rbp + 8], rax
movabs rax, 0x3d32f0b30
mov qword [rbp + 0x10], rax
movabs rcx, 0x13ca2f145bd
mov qword [rbp + 0x18], rcx
movabs rax, 0x290bde9fde85a1e
mov qword [rbp + 0x40], rax
movabs rax, 0xedcfe253b1012af
mov qword [rbp + 0x48], rax
movabs rax, 0x3d31d0b66
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rcx
xorps xmm4, xmm4
xorps xmm5, xmm5
lea rax, [rbp + 0x560]
mov ecx, 4
mov qword [rax], rdi
mov qword [rax + 8], rdi
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14004ed10
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x560], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
xorps xmm1, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x570], xmm1
movdqa xmmword [rbp + 0x580], xmm4
movdqa xmmword [rbp + 0x590], xmm5
lea rax, [rbp + 0xa60]
lea rcx, [rbp + 0x560]
mov r15d, 2
mov edx, r15d
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14004ed70
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
lea ecx, [rdx + 0x18]
call fcn.1400e73d4
mov rsi, rax
mov qword [rbp + 0xc50], rax
test rax, rax
je 0x14004ee2d
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0xa60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14004f608
jmp 0x14004ee30
mov rsi, rdi
mov qword [rbp - 0x30], rsi
test rsi, rsi
je 0x14004f619
lea rax, [rbp + 0xc58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x50]
call r14
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x14004eeaf
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004ee90
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004eea2
call fcn.1400e7658
mov qword [rsi + 8], rdi
mov edx, 0x18
mov rcx, rsi
call fcn.1400e7658
test r14d, r14d
js 0x14004eef5
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0xc58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14004eeff
mov rcx, qword [rbp + 0xc58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
jmp 0x14004f5af
mov qword [rsp + 0x60], rdi
mov rax, qword [rbp + 0xc58]
mov rcx, qword [rax]
mov r13, qword [rcx + 0xa0]
movabs rax, 0x93f4ca2404f5612
mov qword [rbp + 0x1c0], rax
movabs rax, 0x4b83dfed5a38456e
mov qword [rbp + 0x1c8], rax
movabs rax, 0xe91aa1b5fdd5637
mov qword [rbp + 0x1d0], rax
movabs rax, 0x4a0ff3ae1afde21d
mov qword [rbp + 0x1d8], rax
movabs rax, 0x16d6b2c5b6a8d337
mov qword [rbp + 0x1e0], rax
movabs rax, 0x167f54080968485c
mov qword [rbp + 0x1e8], rax
movabs rax, 0x1d2100fc462b2f97
mov qword [rbp + 0x1f0], rax
movabs rax, 0x49daa8bfbb5f8dd9
mov qword [rbp + 0x1f8], rax
xorps xmm6, xmm6
movabs rax, 0x231f18e105031341
mov qword [rbp + 0x240], rax
movabs rax, 0x22d4ffa0156a034e
mov qword [rbp + 0x248], rax
movabs rax, 0x7cf4d94e00ef6559
mov qword [rbp + 0x250], rax
movabs rax, 0x6a7b9ddb759e815c
mov qword [rbp + 0x258], rax
movabs rax, 0x799a9280e4ed9b60
mov qword [rbp + 0x260], rax
movabs rax, 0x6310376b4804293f
mov qword [rbp + 0x268], rax
movabs rax, 0x487354dc7b0b5bf9
mov qword [rbp + 0x270], rax
movabs rax, 0x49daa8bfbb5f8d9c
mov qword [rbp + 0x278], rax
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm9, xmm9
lea rax, [rbp + 0x6c0]
mov ecx, 8
nop
mov qword [rax], rdi
mov qword [rax + 8], rdi
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14004f040
movdqa xmm0, xmmword [rbp + 0x1c0]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x6c0], xmm0
movdqa xmm1, xmmword [rbp + 0x1d0]
xorps xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x6d0], xmm1
movdqa xmm0, xmmword [rbp + 0x1e0]
xorps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x6e0], xmm0
movdqa xmm1, xmmword [rbp + 0x1f0]
xorps xmm1, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x6f0], xmm1
movdqa xmmword [rbp + 0x700], xmm6
movdqa xmmword [rbp + 0x710], xmm7
movdqa xmmword [rbp + 0x720], xmm8
movdqa xmmword [rbp + 0x730], xmm9
lea rax, [rbp + 0x1c0]
lea rcx, [rbp + 0x6c0]
mov edx, 7
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14004f0e2
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea ecx, [rdx + 0x18]
call fcn.1400e73d4
mov rsi, rax
mov qword [rbp + 0xc50], rax
test rax, rax
je 0x14004f175
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x1c0]
call fcn.1400e8320
mov qword [rsi], rax
jmp 0x14004f178
mov rsi, rdi
mov qword [rbp - 0x28], rsi
test rsi, rsi
je 0x14004f624
mov r12, qword [rsi]
movabs rax, 0x6989d5713
mov qword [rbp - 0x70], rax
movabs rcx, 0x2dc81187cec
mov qword [rbp - 0x68], rcx
movabs rax, 0x698d10644
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm1, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0xa0], xmm1
movaps xmm0, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0xb0], xmm0
mov ecx, 0x18
call fcn.1400e73d4
mov r14, rax
mov qword [rbp + 0xc50], rax
test rax, rax
je 0x14004f221
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x80]
call fcn.1400e8320
mov qword [r14], rax
jmp 0x14004f224
mov r14, rdi
mov qword [rbp - 0x20], r14
test r14, r14
je 0x14004f62f
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, 0x30
mov r8, r12
mov rdx, qword [r14]
mov rcx, qword [rbp + 0xc58]
call r13
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
cmp ecx, 1
jne 0x14004f29a
mov rcx, qword [r14]
test rcx, rcx
je 0x14004f27a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], rdi
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14004f28c
call fcn.1400e7658
mov qword [r14 + 8], rdi
mov edx, 0x18
mov rcx, r14
call fcn.1400e7658
nop
mov eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14004f2d9
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004f2ba
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004f2cc
call fcn.1400e7658
mov qword [rsi + 8], rdi
mov edx, 0x18
mov rcx, rsi
call fcn.1400e7658
test r12d, r12d
js 0x14004eee8
mov qword [rsp + 0x58], rdi
mov dword [rbp + 0xc40], edi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004f592
mov rax, qword [rcx]
lea r9, [rbp + 0xc40]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0xc40], 0
je 0x14004f592
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
movabs rax, 0x482753758a118
mov qword [rbp - 0x70], rax
movabs rdx, 0x4dd9059e37f571a
mov qword [rbp - 0x68], rdx
movabs rax, 0x482313711a14b
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
xorps xmm2, xmm2
lea rax, [rbp + 0x140]
nop dword [rax]
mov qword [rax], rdi
mov qword [rax + 8], rdi
lea rax, [rax + 0x10]
sub r15, 1
jne 0x14004f370
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xd0], xmm2
movaps xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp + 0x170]
movaps xmmword [rbp + 0xf0], xmm1
movaps xmm0, xmmword [rbp + 0x180]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm1, xmmword [rbp + 0x190]
movaps xmmword [rbp + 0x110], xmm1
movaps xmm0, xmmword [rbp + 0x1a0]
movaps xmmword [rbp + 0x120], xmm0
movaps xmm1, xmmword [rbp + 0x1b0]
movaps xmmword [rbp + 0x130], xmm1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x18]
xor r8d, r8d
lea rdx, [rbp + 0xc0]
call r10
mov rdx, qword [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140053c70
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x70]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
cmova rcx, r8
mov rax, qword [rbp - 0x80]
lea r15, [rcx + rax*2]
lea rsi, [rsp + 0x70]
cmova rsi, r8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
cmp rsi, r15
jne 0x14004f471
mov byte [rbx], 0
jmp 0x14004f552
mov rax, r15
sub rax, rsi
sar rax, 1
movabs r14, 0x7fffffffffffffff
cmp rax, r14
ja 0x14004f602
cmp rax, 0xf
jbe 0x14004f510
or rax, 0xf
cmp rax, r14
jbe 0x14004f4c5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400e73d4
test rax, rax
je 0x14004f4f0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004f504
mov r14, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14004f4f7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004f613
jmp 0x14004f4aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004f504
call fcn.1400e73d4
mov rdi, rax
mov qword [rbx], rdi
mov qword [rbx + 0x18], r14
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004f51d
mov rdx, qword [rbx]
movzx ecx, byte [rsi]
mov rax, qword [rbx + 0x10]
mov byte [rdx + rax], cl
inc qword [rbx + 0x10]
mov rax, qword [rbx + 0x10]
add rsi, 2
cmp rsi, r15
jne 0x14004f510
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004f545
mov rcx, qword [rbx]
mov byte [rax + rcx], 0
mov rdx, qword [rbp - 0x78]
mov r8, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14004f5d0
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14004f588
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f588
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400e7658
jmp 0x14004f5d0
mov rcx, qword [rbp + 0xc58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rbx
lea r11, [rsp + 0xd00]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14003fbb0
nop
mov ecx, 0x8007000e
call fcn.1400e8310
nop
call fcn.140003300
nop
mov ecx, 0x8007000e
call fcn.1400e8310
int3
mov ecx, 0x8007000e
call fcn.1400e8310
nop
mov ecx, 0x8007000e
call fcn.1400e8310
int3