Function at 0x140035ab0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x478]
sub rsp, 0x570
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov qword [r11 - 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rsi
mov esi, ebx
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov r12d, ebx
mov qword [r11 - 0x30], r13
mov r13, rcx
mov qword [r11 - 0x38], r14
lea rcx, [rbp - 0x30]
mov qword [r11 - 0x40], r15
movzx r14d, r8w
mov r15d, ebx
mov byte [rsp + 0x70], r9b
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rbx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
cmp qword [r13], rbx
jne 0x140035c17
lea rcx, str.rootwmi
mov qword [rsp + 0x78], rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x78]
xor edx, edx
lea r9, [0x14013c7e0]
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 1]
lea rcx, [0x14013c7f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jne 0x140035bf6
mov rcx, qword [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov rax, qword [rcx]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
jne 0x140035bf6
mov rcx, qword [r13]
lea edx, [rbx + 0xa]
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 4
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140035c0f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test ebx, ebx
jne 0x140035fb1
mov r15, qword [rbp - 0x50]
movzx ecx, byte [r15 + 0xe]
movzx edx, byte [r15 + 0xd]
movzx r8d, byte [r15 + 0xc]
movzx r9d, byte [r15 + 0xb]
movzx eax, byte [r15 + 0xf]
movzx r10d, byte [r15 + 0xa]
movzx r11d, byte [r15 + 9]
movzx ebx, byte [r15 + 8]
movzx edi, word [r15 + 6]
movzx esi, word [r15 + 4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rbp + 0x210]
mov dword [rsp + 0x58], edx
mov edx, 0x104
mov dword [rsp + 0x50], r8d
lea r8, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [rsp + 0x48], r9d
mov r9d, dword [r15]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1400192b0
lea rcx, str.EventTrace
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.__CLASS
mov rdi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.Guid
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.EventVersion
mov r12, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r11, qword [r13]
xor r9d, r9d
mov r15, rax
mov r8d, 0x20001
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, qword [r11]
mov r10, qword [rcx + 0x60]
mov rcx, r11
call r10
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
test ebx, ebx
jne 0x140035fb3
mov dword [rsp + 0x78], 1
nop word [rax + rax]
mov rcx, qword [rbp - 0x70]
lea rdx, [rsp + 0x78]
mov qword [rbp - 0x60], rdi
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rdx
mov r8d, 1
mov edx, 0x1388
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x140035f5a
cmp dword [rsp + 0x78], 1
jne 0x140035f9c
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x140035f5a
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [r13]
xor r9d, r9d
mov rbx, rax
mov qword [rbp - 0x78], rdi
lea rax, [rbp - 0x78]
mov r8d, 0x20001
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + 0x60]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [rsp + 0x74], 1
nop dword [rax]
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x80], rdi
test rcx, rcx
je 0x140035e15
mov rax, qword [rcx]
lea rdx, [rsp + 0x74]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x80]
mov edx, 0x1388
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
jne 0x140035f3c
cmp dword [rsp + 0x74], 1
jne 0x140035f47
mov rcx, qword [rbp - 0x80]
jmp 0x140035e25
mov rcx, qword [rbp - 0x60]
mov qword [rbp - 0x80], rcx
mov dword [rsp + 0x74], 1
mov rax, qword [rcx]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [rax + 0x20]
lea rcx, [rbp - 0x30]
mov ebx, eax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jne 0x140035f3c
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140035e66
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x68], rdi
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x68]
lea r9, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140035f3c
mov r8, qword [rbp - 0x10]
lea rcx, [rbp]
mov r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.1400e8844
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, [0x1401260fc]
lea rcx, [rbp]
call fcn.1400e3cd4
test rax, rax
jne 0x140035ee1
lea r8, [rbp]
lea rdx, [0x140126100]
lea rcx, [rbp]
call fcn.1400358d0
lea rdx, [rbp]
lea rcx, [rbp + 0x210]
call fcn.1400e89f4
test eax, eax
jne 0x140035f3c
mov rcx, qword [rbp - 0x68]
lea r9, [rbp - 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140035f6d
mov r9w, 2
lea rdx, [rbp - 0x48]
xor r8d, r8d
lea rcx, [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
movzx ebx, word [rbp - 0x40]
lea rcx, [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp r14w, bx
je 0x140035f67
cmp dword [rsp + 0x74], 1
je 0x140035dd0
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140035f5a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x78], rdi
cmp dword [rsp + 0x78], 1
je 0x140035d20
jmp 0x140035f9c
movzx r9d, r14w
jmp 0x140035f73
mov r9d, 0xffffffff
movzx eax, word [rbp + 0x4a0]
mov rcx, r13
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x80]
mov word [rsp + 0x28], ax
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x20], al
call fcn.140036970
mov qword [rbp - 0x58], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140035fb3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x70], rdi
jmp 0x140035fb3
xor edi, edi
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x70]
mov r15, qword [rsp + 0x538]
mov r14, qword [rsp + 0x540]
mov r13, qword [rsp + 0x548]
mov r12, qword [rsp + 0x550]
mov rsi, qword [rsp + 0x560]
mov rbx, qword [rsp + 0x568]
test rcx, rcx
je 0x140036025
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x70], rdi
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140036038
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbp - 0x78], rdi
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x558]
test rcx, rcx
je 0x14003604f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x570
pop rbp
ret