Function at 0x1400e094c
Capabilities:
Connect to wmi namespace via wbemlocator
Terminate process

Disassembly:
jmp 0x14011f730
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1409d3c80]
xor rax, rbp
mov qword [rbp + 0x260], rax
lea rcx, [0x1409f313a]
call fcn.1400e5ded
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14011f78b
mov eax, 1
jmp 0x14011fb51
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14011f7e2
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov eax, 1
jmp 0x14011fb51
mov qword [rbp + 0x28], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea r9, [0x1402c6110]
mov r8d, 1
xor edx, edx
lea rcx, [0x1402c6248]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14011f829
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov eax, 1
jmp 0x14011fb51
mov qword [rbp + 0x48], 0
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x228], rax
lea rdx, str.ROOTCIMV2
lea rcx, [rbp + 0x1d8]
call fcn.1400e54d8
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x238], rax
mov rcx, qword [rbp + 0x238]
call fcn.1400e5d39
mov qword [rbp + 0x240], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x240]
mov rcx, qword [rbp + 0x28]
call qword [rbp + 0x228]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x1d8]
call fcn.1400e4f88
nop
cmp dword [rbp + 4], 0
jge 0x14011f8f7
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov eax, 1
jmp 0x14011fb51
mov qword [rbp + 0x68], 0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rax, qword [rax + 0xa0]
mov qword [rbp + 0x228], rax
lea rdx, str.SELECT_UUID_FROM_Win32_ComputerSystemProduct
lea rcx, [rbp + 0x1f8]
call fcn.1400e36e2
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x238], rax
mov rcx, qword [rbp + 0x238]
call fcn.1400e5d39
mov qword [rbp + 0x240], rax
lea rdx, [0x1402bff10]
lea rcx, [rbp + 0x218]
call fcn.1400e36e2
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x250], rax
mov rcx, qword [rbp + 0x250]
call fcn.1400e5d39
mov qword [rbp + 0x258], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x30
mov r8, qword [rbp + 0x240]
mov rdx, qword [rbp + 0x258]
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x228]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x218]
call fcn.1400e4f88
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400e4f88
nop
cmp dword [rbp + 4], 0
jge 0x14011fa0c
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x10]
nop
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov eax, 1
jmp 0x14011fb51
mov qword [rbp + 0x88], 0
mov dword [rbp + 0xa4], 0
cmp qword [rbp + 0x68], 0
je 0x14011fb1b
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x228], rax
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x88]
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x228]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xa4], 0
jne 0x14011fa7a
jmp 0x14011fb1b
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xe8]
xor r8d, r8d
lea rdx, str.UUID
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x228]
mov dword [rbp + 0xc4], eax
mov rdx, qword [str.0F747472_545A_8F44_4C66_0CCC47ECFDED]
mov rcx, qword [rbp + 0xf0]
call fcn.1400e2dcd
test eax, eax
je 0x14011faf3
lea rcx, [rbp + 0xe8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
nop
jmp 0x14011fa21
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x10]
nop
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x10]
nop
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400e4d5d
mov rax, rdi
mov rcx, qword [rbp + 0x260]
xor rcx, rbp
call fcn.1400e2d2d
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret