Function at 0x14005fbc0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, 0x80000000
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x14005fbfa
cmp eax, 0x80010106
jne 0x14005fd84
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x14005fc3d
cmp eax, 0x80010119
jne 0x14005fd7e
mov qword [rbp + 0x7f], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [0x1401c82b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401c82c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14005fd7e
mov qword [rbp + 0x77], r15
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, SafeArrayPutElement
call fcn.1401833e0
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14005fcb7
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14005ffd2
jmp 0x14005fcba
mov rbx, r15
mov qword [rbp - 9], rbx
test rbx, rbx
je 0x14005ffdd
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x7f]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14005fd34
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005fd15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14005fd27
call fcn.140183144
mov qword [rbx + 8], r15
mov edx, SafeArrayPutElement
mov rcx, rbx
call fcn.140183144
test edi, edi
js 0x14005fd74
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14005fd96
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbp - 0x19], r15
mov rax, qword [rbp + 0x77]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, SafeArrayPutElement
call fcn.1401833e0
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14005fdda
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_ComputerSystemProduct
call fcn.140182970
mov qword [rbx], rax
jmp 0x14005fddd
mov rbx, r15
mov qword [rbp - 1], rbx
test rbx, rbx
je 0x14005ffdd
mov rsi, qword [rbx]
mov ecx, SafeArrayPutElement
call fcn.1401833e0
mov rdi, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14005fe1f
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x1401e646c]
call fcn.140182970
mov qword [rdi], rax
jmp 0x14005fe22
mov rdi, r15
mov qword [rbp + 7], rdi
test rdi, rdi
je 0x14005ffc7
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x77]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14005fe92
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005fe72
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005fe84
call fcn.140183144
mov qword [rdi + 8], r15
mov edx, SafeArrayPutElement
mov rcx, rdi
call fcn.140183144
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14005fed1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005feb2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14005fec4
call fcn.140183144
mov qword [rbx + 8], r15
mov edx, SafeArrayPutElement
mov rcx, rbx
call fcn.140183144
test esi, esi
js 0x14005fd6a
mov qword [rbp - 0x11], r15
mov dword [rbp + 0x67], r15d
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005ff91
lea rbx, [0x140223f40]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x11]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x67], 0
je 0x14005ff91
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xf]
xor r8d, r8d
lea rdx, [0x1401e6470]
call qword [rax + 0x20]
mov rax, qword [rbp + 0x17]
mov rdx, rbx
sub rdx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14005ff60
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
jne 0x14005ff00
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140182960
nop
mov ecx, 0x8007000e
call fcn.140182960
nop
mov ecx, 0x8007000e
call fcn.140182960
int3