Function at 0x14003ef10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140160200]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rdi, r9
mov rsi, r8
mov r15, rdx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], r8
lea rdx, str.SELECT
lea rcx, [rbp]
call fcn.14003df60
nop
mov r13, r15
cmp qword [r15 + 0x18], 8
jb 0x14003ef69
mov r13, qword [r15]
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x14003ef76
mov r9, qword [rsi]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp word [r9 + r14*2], 0
jne 0x14003ef80
mov r12, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
sub rax, r12
cmp r14, rax
ja 0x14003efd3
lea rax, [r14 + r12]
mov qword [rbp + 0x10], rax
lea rbx, [rbp]
cmp rcx, 8
cmovae rbx, qword [rbp]
lea rcx, [rbx + r12*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.1400dd6b0
lea rax, [r12 + r14]
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rbx, [rbp]
jmp 0x14003efe7
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rbp]
call fcn.140040200
mov rbx, rax
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x14003f02e
lea r12, [rcx + 6]
mov qword [rbx + 0x10], r12
mov r14, rbx
cmp rdx, 8
jb 0x14003f00f
mov r14, qword [rbx]
lea rcx, [r14 + rcx*2]
mov r8d, recv
lea rdx, str._FROM
call fcn.1400dd6b0
xor eax, eax
mov word [r14 + r12*2], ax
jmp 0x14003f04e
mov qword [rsp + 0x20], 6
lea r9, str._FROM
mov edx, 6
mov rcx, rbx
call fcn.140040200
mov rbx, rax
mov rdx, r13
mov rcx, rbx
call fcn.14003ff90
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
mov dword [rbp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14003f1a5
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14003f0cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14003f0ca
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9de
call fcn.1400db19c
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14003f11f
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14003f11a
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f9fa
mov rcx, r8
call fcn.1400db19c
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14003f16e
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14003f169
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f9a1
mov rcx, r8
call fcn.1400db19c
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1400daef0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14003f1e2
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14003f08f
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140132450]
mov r13d, 1
mov r8d, r13d
xor edx, edx
lea rcx, [0x140132460]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14003f219
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14003f08f
mov ecx, Ordinal_27
call fcn.1400daf10
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14003f25f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], r13d
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14003f9a7
jmp 0x14003f262
mov rbx, r12
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14003f9e4
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + Ordinal_26]
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14003f2e1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003f2c2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003f2d4
call fcn.1400db19c
mov qword [rbx + 8], r12
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1400db19c
test r14d, r14d
jns 0x14003f2fb
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14003f08f
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14003f339
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14003f2e6
lea rbx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rbx, qword [rbp]
mov ecx, Ordinal_27
call fcn.1400daf10
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003f38f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rax
mov qword [r14 + 8], r12
mov dword [r14 + 0x10], r13d
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
jne 0x14003f392
test rbx, rbx
jne 0x14003f9b2
jmp 0x14003f392
mov r14, r12
mov qword [rbp - 0x68], r14
test r14, r14
je 0x14003f9e4
mov ecx, Ordinal_27
call fcn.1400daf10
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003f3e5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], r13d
lea rcx, [0x140146480]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14003f9bd
jmp 0x14003f3e8
mov rbx, r12
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x14003f9ef
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, Ordinal_50
mov r8, qword [r14]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14003f463
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003f441
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov qword [rbx], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003f455
call fcn.1400db19c
xor eax, eax
mov qword [rbx + 8], rax
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1400db19c
nop
mov eax, 0xffffffff
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x14003f4a9
mov rcx, qword [r14]
test rcx, rcx
je 0x14003f488
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov qword [r14], rbx
jmp 0x14003f48a
xor ebx, ebx
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14003f49c
call fcn.1400db19c
mov qword [r14 + 8], rbx
mov edx, Ordinal_27
mov rcx, r14
call fcn.1400db19c
test r12d, r12d
jns 0x14003f5c1
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14003f50d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9de
call fcn.1400db19c
xor ebx, ebx
mov word [rbp], bx
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rbx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14003f55e
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x14003f559
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f9fa
mov rcx, r8
call fcn.1400db19c
mov word [r15], bx
mov qword [r15 + 0x18], 7
mov qword [r15 + 0x10], rbx
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14003f5ad
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14003f5a8
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f9a1
mov rcx, r8
call fcn.1400db19c
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
jmp 0x14003f17e
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14003f8d8
xor r12d, r12d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x30]
mov r8d, r13d
mov edx, 0xffffffff
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x20], 0
je 0x14003f8d8
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14003f612
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
lea rdx, [0x140175840]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
je 0x14003f88d
lea rdx, [0x1401754d8]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
je 0x14003f88d
lea rdx, [0x1401757d0]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
jne 0x14003f6a5
movsx rax, word [rbp - 0x20]
mov qword [rsp + 0x60], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f69b
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rsp + 0x60]
jmp 0x14003f8af
lea rdx, [0x140175828]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
jne 0x14003f6e5
mov eax, dword [rbp - 0x20]
mov qword [rsp + 0x68], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f6db
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rsp + 0x68]
jmp 0x14003f8af
lea rdx, [0x140175870]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
jne 0x14003f726
movzx eax, word [rbp - 0x20]
mov qword [rsp + 0x70], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f71c
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rsp + 0x70]
jmp 0x14003f8af
lea rdx, [0x140175858]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
jne 0x14003f767
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x78], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f75d
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rsp + 0x78]
jmp 0x14003f8af
lea rdx, [0x140175810]
lea rcx, [0x140175888]
call fcn.1400dd320
test eax, eax
jne 0x14003f7a6
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x80], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f79d
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rbp - 0x80]
jmp 0x14003f8af
mov r14, qword [rbp - 0x20]
mov ecx, Ordinal_27
call fcn.1400daf10
mov rbx, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14003f7f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], r13d
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14003f7f3
test r14, r14
jne 0x14003f9c8
jmp 0x14003f7f3
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x14003f9e4
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003f824
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
test rax, rax
je 0x14003f9d3
jmp 0x14003f827
mov rax, r12
mov qword [rbp - 0x78], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f83f
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f84c
lea r8, [rbp - 0x78]
mov rcx, rdi
call fcn.1400403c0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14003f8b7
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003f86c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003f87e
call fcn.1400db19c
mov qword [rbx + 8], r12
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1400db19c
jmp 0x14003f8b7
movsxd rax, dword [rbp - 0x20]
mov qword [rsp + 0x58], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14003f8aa
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14003f8b7
lea r8, [rsp + 0x58]
mov rcx, rdi
call fcn.1400403c0
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x14003f5e0
mov r14, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, r14
sub rcx, rdx
cmp rcx, 8
jae 0x14003f938
sar rcx, 3
cmp rcx, 1
jbe 0x14003f8fb
lea rax, [rdx + 8]
jmp 0x14003f934
jae 0x14003f938
mov rax, qword [rdi + 0x10]
sub rax, rdx
sar rax, 3
cmp rax, 1
jae 0x14003f918
mov rcx, rdi
call fcn.1400400a0
jmp 0x14003f938
sub r13, rcx
lea rbx, [r13*8]
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.1400ddd60
lea rax, [rbx + r14]
mov qword [rdi + 8], rax
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14003f50d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f9de
jmp 0x14003f508
call fcn.1400eeeb4
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
call fcn.1400eeeb4
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
mov ecx, 0x8007000e
call fcn.1400dc0d0
nop
call fcn.1400eeeb4
int3