Function at 0x1800093f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rsi, rcx
lea rcx, str._WMI__Initialising_COM
mov r12, r8
mov r14, rdx
call fcn.180009320
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor r13d, r13d
mov edi, eax
test eax, eax
jne 0x180009bd9
lea rcx, str._WMI__COM_initialised
call fcn.180009320
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x50], r13
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edi, eax
test eax, eax
jns 0x1800094a5
lea rcx, str._WMI__Failed_to_initialize_security:__x
mov edx, eax
call fcn.180009320
jmp 0x180009b6c
lea rcx, str._WMI__Security_initialised
call fcn.180009320
lea rcx, [rsp + 0x78]
call fcn.18000a3c0
xor edx, edx
lea r9, [0x18001fe18]
lea r8d, [rdx + 0x17]
lea rcx, [0x1800202d0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
jns 0x1800094f3
lea rcx, [0x18001fe28]
mov edx, eax
call fcn.180009320
jmp 0x180009b6c
lea rcx, str._WMI__WbemLocator_created.
call fcn.180009320
mov ecx, SafeArrayPutElement
call fcn.18000c120
mov rbx, rax
test rax, rax
je 0x180009d08
mov rcx, rsi
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x18000953a
test rsi, rsi
jne 0x180009cb3
mov rcx, qword [rsp + 0x78]
lea rdx, [rbp - 0x80]
xor r9d, r9d
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rbx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
call qword [rax + SafeArrayPutElement]
test eax, eax
mov edi, eax
sets r15b
lock dec dword [rbx + 0x10]
jne 0x1800095a7
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000958d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000959f
call fcn.18000c1c8
mov qword [rbx + 8], r13
mov rcx, rbx
call fcn.18000c1c8
test r15b, r15b
je 0x1800095c3
lea rcx, str._WMI__Failed_to_create_WbemServices_at__S:__x
mov r8d, edi
mov rdx, rsi
call fcn.180009320
jmp 0x180009b6c
lea rcx, str._WMI__WbemServices_created.
call fcn.180009320
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
lea rdx, [0x18001fec0]
mov r9d, 0x20
mov r8, r14
mov qword [rsp + 0x20], r13
call qword [rax + 0xa0]
mov edi, eax
test eax, eax
jns 0x180009618
lea rcx, str._WMI__Failed_to_create_Enumerator_for_query__S:__x
mov r8d, eax
mov rdx, r14
call fcn.180009320
jmp 0x180009b6c
lea rcx, str._WMI__Enumerated_created.
call fcn.180009320
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x74]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x50]
mov edx, 0x1388
mov r8d, 1
call qword [rax + 0x20]
mov edi, eax
test eax, eax
jns 0x180009665
lea rcx, str._WMI__Failed_to_get_the_first_query_element:__x
mov r8d, eax
mov rdx, r14
call fcn.180009320
jmp 0x180009b6c
mov r8, qword [rsp + 0x50]
lea rcx, str._WMI__First_result_read._hr_x_p_p
mov edx, eax
call fcn.180009320
cmp edi, 1
jne 0x18000968e
lea rcx, str._WMI__No_results_found_
call fcn.180009320
jmp 0x180009b6c
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], r13
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x38]
mov edi, eax
mov edx, eax
test eax, eax
jns 0x1800096c9
lea rcx, str._WMI__Failed_to_get_field_names:__x
call fcn.180009320
jmp 0x180009b6c
mov r8, qword [rsp + 0x58]
lea rcx, str._WMI__Field_Names_extracted._hr_x_p_p
call fcn.180009320
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov edi, eax
test eax, eax
jns 0x1800096fe
lea rcx, str._WMI__Failed_to_get_array_dimension:__x
mov edx, eax
call fcn.180009320
jmp 0x180009b6c
lea rcx, str._WMI__Field_name_array_locked.
call fcn.180009320
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElemsize]
lea rcx, str._WMI__Array_dimensions:__u
mov edx, eax
call fcn.180009320
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x64]
mov edx, 1
call qword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov edi, eax
test eax, eax
js 0x180009bc9
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x838]
mov edx, 1
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov edi, eax
test eax, eax
js 0x180009bc9
mov r8d, dword [rbp + 0x838]
mov edx, dword [rsp + 0x64]
lea rcx, str._WMI__Bounds:__u_to__u
call fcn.180009320
mov ebx, dword [rbp + 0x838]
lea rcx, str._WMI__Query_results_in__u_fields
sub ebx, dword [rsp + 0x64]
sub ebx, 9
mov edx, ebx
call fcn.180009320
movsxd r13, ebx
lea rbx, [r13*8]
mov rcx, rbx
call fcn.18000b060
mov rcx, qword [0x18002c578]
mov rsi, rax
mov qword [rsp + 0x70], rax
call qword [rcx + 0xd8]
mov r8, rbx
xor edx, edx
mov rcx, rsi
mov r12, rax
call fcn.18000b370
xor r15d, r15d
xor r14d, r14d
test r13, r13
jle 0x1800098ac
nop dword [rax]
mov rcx, qword [rsp + 0x58]
lea eax, [r15 + 9]
lea rdx, [rbp - 0x78]
mov dword [rbp - 0x78], eax
movsxd rax, r15d
lea r8, [rsi + rax*8]
call qword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov rax, qword [rsi + r14*8]
mov ecx, SafeArrayPutElement
mov rsi, qword [rax + 8]
call fcn.18000c120
mov rbx, rax
test rax, rax
je 0x180009cc9
mov rcx, rsi
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180009844
test rsi, rsi
jne 0x180009cbe
cmp qword [rbx + 8], 0
jne 0x180009857
mov rcx, rax
call fcn.18001a5a0
mov qword [rbx + 8], rax
mov rax, qword [0x18002c578]
mov r8, qword [rbx + 8]
mov edx, 0x14e7c
mov rcx, r12
call qword [rax + 0x50]
cmp qword [rbx + 8], 0
jne 0x180009880
mov rcx, qword [rbx]
call fcn.18001a5a0
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
lea rcx, str._WMI__Added_header_field:__s
call fcn.180009320
mov rcx, rbx
call fcn.18000aa00
mov rsi, qword [rsp + 0x70]
inc r14
inc r15d
cmp r14, r13
jl 0x1800097e0
lea rcx, str._WMI__added_all_field_headers
call fcn.180009320
mov rax, qword [0x18002c578]
mov r8, r12
mov r12, qword [rbp + 0x830]
mov edx, 0x40004e7e
mov rcx, r12
call qword [rax + 0x20]
lea rcx, str._WMI__processing_values...
call fcn.180009320
test edi, edi
js 0x180009b50
mov rax, qword [0x18002c578]
call qword [rax + 0xd8]
xor r14d, r14d
mov r15, rax
test r13, r13
jle 0x180009af2
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x400
call fcn.18000b370
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi + r14*8]
mov ecx, SafeArrayPutElement
mov rdi, qword [rax + 8]
call fcn.18000c120
mov rbx, rax
test rax, rax
je 0x180009cfd
mov rcx, rdi
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180009966
test rdi, rdi
jne 0x180009cd4
cmp qword [rbx + 8], 0
jne 0x180009979
mov rcx, rax
call fcn.18001a5a0
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
lea rcx, str._WMI__Extracting_value_for__s
call fcn.180009320
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx]
lea r9, [rbp - 0x38]
xor r8d, r8d
call qword [rax + 0x20]
test eax, eax
js 0x1800099eb
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x180009cdf
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
mov r8d, 0x400
call fcn.180009d20
lea rcx, [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [0x18002c578]
lea r8, [rbp - 0x20]
mov edx, 0x14e7d
mov rcx, r15
call qword [rax + 0x50]
mov rax, qword [rsi + r14*8]
mov ecx, SafeArrayPutElement
mov rsi, qword [rax + 8]
call fcn.18000c120
mov rdi, rax
test rax, rax
je 0x180009cf2
mov rcx, rsi
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x180009a48
test rsi, rsi
jne 0x180009ce7
cmp qword [rdi + 8], 0
jne 0x180009a5b
mov rcx, rax
call fcn.18001a5a0
mov qword [rdi + 8], rax
mov rdx, qword [rdi + 8]
lea r8, [rbp - 0x20]
lea rcx, str._WMI__Added_value_for__s:__s
call fcn.180009320
lock dec dword [rdi + 0x10]
jne 0x180009aa8
mov rcx, qword [rdi]
test rcx, rcx
je 0x180009a8a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180009aa0
call fcn.18000c1c8
mov qword [rdi + 8], 0
mov rcx, rdi
call fcn.18000c1c8
lock dec dword [rbx + 0x10]
jne 0x180009ae1
mov rcx, qword [rbx]
test rcx, rcx
je 0x180009ac3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180009ad9
call fcn.18000c1c8
mov qword [rbx + 8], 0
mov rcx, rbx
call fcn.18000c1c8
mov rsi, qword [rsp + 0x70]
inc r14
cmp r14, r13
jl 0x180009904
mov rax, qword [0x18002c578]
mov r8, r15
mov edx, 0x40004e7f
mov rcx, r12
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x74]
mov qword [rsp + 0x50], 0
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x50]
mov edx, 0x1388
mov r8d, 1
call qword [rax + 0x20]
mov edi, eax
cmp eax, 1
je 0x180009b5e
mov rsi, qword [rsp + 0x70]
jmp 0x1800098e0
lea rcx, str._WMI__Loop_exited_via__x
mov edx, edi
call fcn.180009320
xor r13d, r13d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180009b7c
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180009b8c
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180009b9b
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180009bab
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
js 0x180009bed
lea rcx, str._WMI__Things_appeared_to_go_well_
mov edi, r13d
call fcn.180009320
jmp 0x180009c96
lea rcx, str._WMI__Failed_to_get_array_dimensions:__x
mov edx, edi
call fcn.180009320
jmp 0x180009b61
lea rcx, str._WMI__Failed_to_initialize_COM
call fcn.180009320
test edi, edi
jns 0x180009c96
lea rcx, [rbp + 0x3e0]
xor edx, edx
mov r8d, 0x400
call fcn.18000b370
lea rbx, vtable._com_error.0
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x70], rbx
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x68], edi
call fcn.18000a900
mov edx, 0x400
lea r9, str._s__0x_x_
lea rcx, [rbp + 0x3e0]
lea r8d, [rdx - 1]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.18000af9c
lea rdx, [rbp + 0x3e0]
lea rcx, str._WMI__returning_error_____s
call fcn.180009320
mov rax, qword [0x18002c578]
lea r8, [rbp + 0x3e0]
mov edx, 0x14e80
mov rcx, r12
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x60]
mov edi, r13d
mov qword [rbp - 0x70], rbx
test rcx, rcx
je 0x180009c87
mov rax, qword [rcx]
call qword [rax + SafeArrayGetElemsize]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180009c96
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rbx, qword [rsp + 0x920]
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, eax
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3
mov ecx, 0x8007000e
call fcn.18001a590
int3