Function at 0x140022b98
Capabilities:
Connect to wmi namespace via wbemlocator
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rsi, qword [rcx + 8]
xor r15d, r15d
mov rbx, qword [rcx]
mov edi, r15d
mov dword [rbp + 0x60], r15d
mov r14, rcx
jmp 0x140022bd1
mov rcx, rbx
call fcn.14002217c
add rbx, 0x68
cmp rbx, rsi
jne 0x140022bc5
mov rax, qword [r14]
lea rcx, [rsp + 0x68]
mov qword [r14 + 8], rax
mov qword [rsp + 0x58], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], r15
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x40], r15
mov esi, 3
mov dword [rsp + 0x38], r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], esi
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
je 0x140022c52
cmp eax, 0x80010119
jne 0x140022fd1
lea rax, [rsp + 0x58]
mov r13d, 1
mov r8d, r13d
mov qword [rsp + 0x20], rax
lea r9, [0x1400a9528]
xor edx, edx
lea rcx, [0x1400a94c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140022fd1
lea rdx, str.ROOTCIMV2
lea rcx, [rsp + 0x50]
call fcn.1400220fc
mov rcx, qword [rax]
test rcx, rcx
je 0x140022ca1
mov rdx, qword [rcx]
jmp 0x140022ca4
mov rdx, r15
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x78]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rax, qword [rcx]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [rax + 0x18]
lea rcx, [rsp + 0x50]
mov ebx, eax
call fcn.140024498
test ebx, ebx
jne 0x140022fd1
mov rcx, qword [rbp + 0x78]
lea edx, [rbx + 0xa]
mov dword [rsp + 0x38], r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x140022fd1
lea ecx, [rbx + 0x18]
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x140022d3c
lea rcx, str.Select__from_Win32_Process
mov qword [rax + 8], r15
mov dword [rax + 0x10], r13d
call fcn.140039270
mov qword [rbx], rax
jmp 0x140022d3f
mov rbx, r15
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x14002307b
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x140022d7b
lea rcx, [0x1400a1d74]
mov qword [rax + 8], r15
mov dword [rax + 0x10], r13d
call fcn.140039270
mov qword [rbx], rax
jmp 0x140022d7e
mov rbx, r15
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x140023086
mov rcx, qword [rbp + 0x78]
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x28], rdx
mov r9d, gethostbyname
mov rdx, qword [rbx]
mov r8, rsi
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rsp + 0x60]
mov ebx, eax
call fcn.140024498
lea rcx, [rsp + 0x50]
call fcn.140024498
test ebx, ebx
jne 0x140022fd1
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x140022fcc
lea edi, [rbx + 0xf]
lea rdx, [rbp + 0x60]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x68], r15
lea r9, [rbp + 0x70]
mov byte [rbp - 0x78], r15b
mov r8d, r13d
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], r15b
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x38], r15b
mov dword [rbp - 0x80], r15d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
or edx, 0xffffffff
call qword [rax + 0x20]
test eax, eax
jne 0x140022fbf
cmp dword [rbp + 0x60], r15d
je 0x140022fa7
mov rcx, qword [rbp + 0x70]
lea r9, [rbp - 0x10]
mov qword [rsp + 0x28], r15
lea rdx, [0x1400a1d78]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
mov eax, dword [rbp - 0x80]
jne 0x140022e69
cmp word [rbp - 0x10], 2
cmovae eax, dword [rbp - 8]
mov dword [rbp - 0x80], eax
cmp eax, 4
jbe 0x140022fa7
mov rcx, qword [rbp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], r15
lea rdx, str.CommandLine
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x140022eda
cmp word [rsp + 0x68], 2
jb 0x140022eda
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022eda
cmp word [rcx], r15w
je 0x140022eda
call fcn.140039150
mov rbx, rax
cmp byte [rax], r15b
jne 0x140022ec3
mov rax, r15
jmp 0x140022ecb
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.140004d8c
mov rcx, qword [rbp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], r15
lea rdx, str.ExecutablePath
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x140022f42
cmp word [rsp + 0x68], 2
jb 0x140022f42
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022f42
cmp word [rcx], r15w
je 0x140022f42
call fcn.140039150
mov rbx, rax
cmp byte [rax], r15b
jne 0x140022f2b
mov rax, r15
jmp 0x140022f33
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x78]
mov rdx, rbx
call fcn.140004d8c
cmp qword [rbp - 0x68], r15
jbe 0x140022f9b
cmp qword [rbp - 0x60], 0x10
lea rcx, [rbp - 0x78]
cmovae rcx, qword [rbp - 0x78]
call fcn.14001fcc0
test eax, eax
je 0x140022f9b
cmp qword [rbp - 0x60], 0x10
lea rcx, [rbp - 0x78]
cmovae rcx, qword [rbp - 0x78]
call fcn.140012a80
mov rbx, rax
test rax, rax
je 0x140022f9b
cmp byte [rax], r15b
jne 0x140022f84
mov rax, r15
jmp 0x140022f8c
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x58]
mov rdx, rbx
call fcn.140004d8c
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140024744
lea rcx, [rbp - 0x80]
call fcn.14002217c
mov rcx, qword [rbp + 0x68]
test rcx, rcx
jne 0x140022de1
jmp 0x140022fcc
lea rcx, [rbp - 0x80]
call fcn.14002217c
mov rcx, qword [rbp + 0x68]
mov edi, r13d
jmp 0x140022fd5
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140022feb
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140023002
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14002300d
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x14002301c
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
lea rcx, str.zccm__GetProcessInfo_done__n
test edi, edi
jne 0x14002302e
lea rcx, str.zccm__GetProcessInfo_failed__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, edi
lea rdx, str.ZCCM_GetProcessInfo:_result_d__r_n
mov ecx, 4
call fcn.1400191e0
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
add rsp, 0x120
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140038fa0
int3
mov ecx, 0x8007000e
call fcn.140038fa0
int3