Function at 0x1400ac700
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x800]
sub rsp, 0x900
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rdi, rdx
mov ebx, ecx
xor esi, esi
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rdi
mov r9d, ebx
lea r8, str.SELECT__FROM_Win32_Process_Where_ProcessId___d_And_Name____s_
mov edx, 0x400
lea rcx, [rbp - 0x10]
call fcn.1400abed0
mov qword [rsp + 0x60], rsi
lea ecx, [rsi + 0x18]
call fcn.1401d0330
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r12d, [rsi + 1]
test rax, rax
je 0x1400ac7a5
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400acc1c
jmp 0x1400ac7a8
mov rdi, rsi
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x1400acc32
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400ac7e5
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, [0x140245f2c]
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400ac7e8
mov rbx, rsi
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x1400acc11
mov rcx, qword [0x140268460]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov r9d, Ordinal_50
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + SHCreateDirectory]
mov r15d, eax
mov r14d, 0xffffffff
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400ac867
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ac847
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400ac859
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
nop
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400ac8a4
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400ac885
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rsi
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400ac897
call fcn.1401d0398
mov qword [rdi + 8], rsi
mov edx, Ordinal_27
mov rcx, rdi
call fcn.1401d0398
test r15d, r15d
jns 0x1400ac8b0
xor eax, eax
jmp 0x1400acbe6
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x48], esi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400acbde
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov r8d, r12d
mov edx, r14d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rsp + 0x48], 0
je 0x1400acbd9
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x28]
xor r8d, r8d
lea rdx, str.__PATH
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x50], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400ac945
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Win32_Process
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400ac948
mov rbx, rsi
mov qword [rbp - 0x58], rbx
test rbx, rbx
je 0x1400acc27
mov rcx, qword [0x140268460]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + Ordinal_50]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400ac9b8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ac999
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400ac9ab
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
mov qword [rsp + 0x70], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400ac9ed
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Terminate
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400ac9f0
mov rbx, rsi
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1400acc27
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x98]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400aca59
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400aca3a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400aca4c
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
mov qword [rsp + 0x58], rsi
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
xor edx, edx
call qword [rax + 0x78]
mov eax, reloc.WS2_32.dll_socket
mov word [rbp - 0x80], ax
mov dword [rbp - 0x78], esi
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.Reason
call qword [rax + Ordinal_41]
mov qword [rsp + 0x68], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400acace
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Terminate
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400acad1
mov rbx, rsi
mov qword [rbp - 0x48], rbx
test rbx, rbx
je 0x1400acc27
mov rcx, qword [0x140268460]
mov r10, qword [rcx]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rbx]
mov rdx, qword [rbp - 0x20]
call qword [r10 + 0xc0]
mov edi, eax
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x1400acb55
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400acb36
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400acb48
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
test edi, edi
js 0x1400acb99
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.ReturnValue
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x38], 0
cmove esi, r12d
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, esi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1401d0310
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
int3
mov ecx, 0x8007000e
call fcn.1401d13b0
int3