Function at 0x1400d3c70
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x78], rdx
mov r14, rcx
lea rax, [0x1402aa8a0]
mov rcx, qword [0x1402aa8a0]
cmp rcx, rax
je 0x1400d3cd9
test dword [rcx + 0x44], 0x1000000
je 0x1400d3cd9
cmp byte [rcx + 0x41], 4
jb 0x1400d3cd9
mov edx, 0x11
lea r8, [0x140236f28]
mov rcx, qword [rcx + 0x38]
call fcn.140024300
xor r13d, r13d
mov qword [rbp + 0x48], r13
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x140232950]
xor edx, edx
lea r8d, [r13 + 0x17]
lea rcx, [0x14024abf8]
call qword [sym.imp.OLE32.DLL_CoCreateInstance]
mov r12d, eax
test eax, eax
je 0x1400d3d2a
lea r9, [0x140232960]
mov r8d, eax
lea rdx, str.D:qba2workspace2936SSE_Storage_NGSAImplementation_source_serviceSystemFileTracker.cpp
mov ecx, 0x124
call fcn.140075ee0
jmp 0x1400d45d7
mov qword [rbp + 0x10], r13
mov rdi, qword [rbp + 0x48]
mov ecx, 0x18
call fcn.14013ffac
mov rbx, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x1400d3d7a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMv2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400d4621
jmp 0x1400d3d7d
mov rbx, r13
mov qword [rbp - 0x40], rbx
test rbx, rbx
je 0x1400d4642
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400d3da4
mov qword [rbp + 0x10], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
mov rax, qword [rdi]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140047660.0]
mov r12d, eax
mov r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400d3e21
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d3e02
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d3e14
call fcn.14014012c
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14013ff64
test r12d, r12d
je 0x1400d3e46
lea r9, str.ConnectServer
mov r8d, r12d
lea rdx, str.D:qba2workspace2936SSE_Storage_NGSAImplementation_source_serviceSystemFileTracker.cpp
mov ecx, pe_nt_image_headers64
call fcn.140075ee0
jmp 0x1400d45bc
mov qword [rbp + 0x20], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.OLE32.DLL_CoSetProxyBlanket]
mov r12d, eax
test eax, eax
je 0x1400d3e9f
mov ecx, 0x12d
lea r9, [0x140232a08]
mov r8d, eax
lea rdx, str.D:qba2workspace2936SSE_Storage_NGSAImplementation_source_serviceSystemFileTracker.cpp
call fcn.140075ee0
jmp 0x1400d45a1
mov rsi, qword [rbp + 0x10]
mov ecx, 0x18
call fcn.14013ffac
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400d3eec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_PageFileUsage
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400d462c
jmp 0x1400d3eef
mov rbx, r13
mov qword [rbp - 0x38], rbx
test rbx, rbx
je 0x1400d464d
mov ecx, 0x18
call fcn.14013ffac
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400d3f45
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x140232a68]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400d4637
jmp 0x1400d3f48
mov rdi, r13
mov qword [rbp - 0x30], rdi
test rdi, rdi
je 0x1400d4658
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400d3f6f
mov qword [rbp + 0x20], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
mov rax, qword [rsi]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rcx, rsi
mov rax, qword [rax + 0xa0]
call qword [case.0x140047660.0]
mov r12d, eax
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400d3fdd
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d3fbd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400d3fcf
call fcn.14014012c
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.14013ff64
nop
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400d401a
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d3ffb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400d400d
call fcn.14014012c
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14013ff64
test r12d, r12d
je 0x1400d403f
mov ecx, 0x134
lea r9, str.ExecQuery_for_Win32_PageFileUsage
mov r8d, r12d
lea rdx, str.D:qba2workspace2936SSE_Storage_NGSAImplementation_source_serviceSystemFileTracker.cpp
call fcn.140075ee0
jmp 0x1400d45a1
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r13w
mov r8, r15
inc r8
cmp word [r14 + r8*2], 0
jne 0x1400d4053
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.140007240
nop
lea rdi, [rbp + 0x50]
mov r8, qword [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rdi, r8
lea rcx, [rbp + 0x50]
cmovae rcx, r8
mov rax, qword [rbp + 0x60]
lea rsi, [rcx + rax*2]
lea rbx, [rbp + 0x50]
cmovae rbx, r8
cmp rbx, rsi
je 0x1400d40c0
sub rdi, rbx
nop dword [rax]
movzx ecx, word [rbx]
call fcn.1400fa2f4
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x1400d40a0
nop word [rax + rax]
mov qword [rbp + 0x18], r13
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x18]
mov r8d, 1
mov edx, r15d
mov rax, qword [rax + 0x20]
call qword [case.0x140047660.0]
mov r12d, eax
test eax, eax
jne 0x1400d428a
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 8]
xor r8d, r8d
lea rdx, str.Name
mov rax, qword [rax + 0x20]
call qword [case.0x140047660.0]
mov r12d, eax
test eax, eax
jne 0x1400d4512
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
mov rdx, qword [rbp]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400d4150
lea rcx, [rbp + 0x28]
call fcn.140007240
nop
lea rdi, [rbp + 0x28]
mov r11, qword [rbp + 0x28]
mov r13, qword [rbp + 0x40]
cmp r13, 8
cmovae rdi, r11
lea rax, [rbp + 0x28]
cmovae rax, r11
mov rcx, qword [rbp + 0x38]
lea rsi, [rax + rcx*2]
mov qword [rbp - 0x80], rsi
lea rbx, [rbp + 0x28]
cmovae rbx, r11
mov qword [rbp - 0x70], rbx
cmp rbx, rsi
je 0x1400d41c2
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.1400fa2f4
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x1400d41a1
mov r13, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
mov r11, qword [rbp + 0x28]
mov r10, r15
inc r10
cmp word [r14 + r10*2], 0
jne 0x1400d41c5
lea rbx, [rbp + 0x28]
cmp r13, 8
cmovae rbx, r11
cmp r10, rcx
ja 0x1400d4223
test r10, r10
jne 0x1400d41ea
xor eax, eax
jmp 0x1400d4226
sub rcx, r10
lea rdi, [rcx + 1]
lea rdi, [rbx + rdi*2]
mov rax, rbx
nop dword [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
je 0x1400d4223
movzx edx, word [r14]
nop
cmp word [rax], dx
je 0x1400d42b2
add rax, 2
sub rcx, 1
jne 0x1400d4210
mov rax, r15
cmp rax, 0xffffffffffffffff
jne 0x1400d42eb
cmp r13, 8
jb 0x1400d426b
lea rdx, [r13*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x1400d4263
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d466f
mov rcx, r11
call fcn.14013ff64
xor r13d, r13d
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400d42a4
mov qword [rbp + 0x18], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
test r12d, r12d
jne 0x1400d4550
jmp 0x1400d40c0
mov r8, r10
mov rdx, r14
test r10, r10
je 0x1400d42d7
mov r9, rax
sub r9, r14
movzx ecx, word [rdx]
cmp word [rdx + r9], cx
jne 0x1400d42e2
add rdx, 2
sub r8, 1
jne 0x1400d42c3
sub rax, rbx
sar rax, 1
jmp 0x1400d4226
add rax, 2
jmp 0x1400d4200
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov rdx, qword [rbp]
inc r15
cmp word [rdx + r15*2], r13w
jne 0x1400d4306
mov r8, r15
lea rcx, [rsp + 0x58]
call fcn.140007240
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
sub rax, rcx
lfence
lea rsi, [0x140232940]
cmp rax, 4
jb 0x1400d43ca
add qword [rsp + 0x68], 4
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdi, qword [rsp + 0x58]
lea rax, [0x140232948]
cmp rax, rdi
jbe 0x1400d4380
lea rax, [rdi + rcx*2]
cmp rsi, rax
ja 0x1400d4380
cmp rdi, rsi
ja 0x1400d4375
mov rbx, r13
jmp 0x1400d4385
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
jmp 0x1400d4385
mov ebx, 4
lea r8, [rcx*2 + 2]
lea rcx, [rdi + 8]
mov rdx, rdi
call fcn.140132e10
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140132e10
mov r8d, 8
sub r8, rbx
lea rdx, [rsi + 8]
add rdx, rbx
lea rcx, [rdi + rbx]
call fcn.140132e10
lea rax, [rsp + 0x58]
jmp 0x1400d43eb
mov ebx, 4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.14007d990
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea rax, [rbp - 0x60]
mov rbx, qword [rsp + 0x78]
cmp rbx, rax
je 0x1400d4439
mov rcx, rbx
call fcn.140007180
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1400d447a
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400d447a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d4474
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4663
call fcn.14013ff64
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400d44bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d44b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d4669
call fcn.14013ff64
mov r12d, r13d
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x1400d44ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d44fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d466f
call fcn.14013ff64
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
jmp 0x1400d452a
xor r9d, r9d
mov r8d, eax
lea rdx, str.D:qba2workspace2936SSE_Storage_NGSAImplementation_source_serviceSystemFileTracker.cpp
mov ecx, 0x140
call fcn.140075ee0
nop
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400d4550
mov qword [rbp + 0x18], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1400d4590
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d458b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d461b
call fcn.14013ff64
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r13w
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400d45bc
mov qword [rbp + 0x20], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400d45d7
mov qword [rbp + 0x10], r13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140047660.0]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400d45f1
mov qword [rbp + 0x48], r13
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x140047660.0]
mov eax, r12d
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.140140100
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e0284
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
mov ecx, 0x8007000e
call fcn.14020ab50
nop
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
int3