Function at 0x14002e53c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
xor r12d, r12d
mov rdi, rcx
lea rcx, [rbp + 0x60]
mov dword [rbp + 0xe8], r12d
mov esi, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r12
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [r12 + 0xf]
mov qword [rbp + 0x20], r12
xor r8d, r8d
mov qword [rbp + 0x28], rax
lea rdx, [0x14009d610]
mov qword [rbp - 0x58], rax
mov rcx, rdi
mov qword [rbp + 8], rax
mov byte [rbp + 0x10], r12b
mov qword [rbp - 0x60], r12
mov byte [rbp - 0x70], r12b
mov qword [rbp], r12
mov byte [rbp - 0x10], r12b
call fcn.140004d8c
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x40], r12
lea r13d, [r12 + 1]
mov dword [rsp + 0x38], r12d
lea r14d, [r12 + 3]
test eax, eax
mov qword [rsp + 0x30], r12
mov r15d, r12d
mov dword [rsp + 0x28], r14d
cmove r15d, r13d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
je 0x14002e630
cmp eax, 0x80010119
jne 0x14002eaaf
lea rax, [rsp + 0x60]
mov r8d, r13d
lea r9, [0x1400a9538]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1400a94d8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002eaaf
lea rdx, str.ROOTCIMV2
lea rcx, [rsp + 0x58]
call fcn.1400220fc
mov rcx, qword [rax]
test rcx, rcx
je 0x14002e679
mov rdx, qword [rcx]
jmp 0x14002e67c
mov rdx, r12
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov rax, qword [rcx]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [rax + 0x18]
lea rcx, [rsp + 0x58]
mov ebx, eax
call fcn.140024498
test ebx, ebx
jne 0x14002eaaf
mov rcx, qword [rsp + 0x50]
lea edx, [rbx + 0xa]
mov dword [rsp + 0x38], r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x14002eaaf
lea ecx, [rbx + 0x18]
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x14002e718
lea rcx, str.Select__from_Win32_OperatingSystem
mov qword [rax + 8], r12
mov dword [rax + 0x10], r13d
call fcn.140039270
mov qword [rbx], rax
jmp 0x14002e71b
mov rbx, r12
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x14002ebc1
mov r14, qword [rbx]
mov ecx, 0x18
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x14002e757
lea rcx, [0x1400a1d84]
mov qword [rax + 8], r12
mov dword [rax + 0x10], r13d
call fcn.140039270
mov qword [rbx], rax
jmp 0x14002e75a
mov rbx, r12
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x14002ebcc
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x28], rdx
mov r9d, gethostbyname
mov rdx, qword [rbx]
mov r8, r14
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rsp + 0x68]
mov ebx, eax
call fcn.140024498
lea rcx, [rsp + 0x58]
call fcn.140024498
test ebx, ebx
jne 0x14002eaaf
or r14, 0xffffffffffffffff
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x14002eaa5
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xf8]
mov edx, r14d
mov r8d, r13d
call qword [rax + 0x20]
test eax, eax
jne 0x14002ea9e
cmp dword [rbp + 0xe8], r12d
je 0x14002e7b5
mov rcx, qword [rbp + 0xf8]
lea r9, [rbp + 0x60]
mov qword [rsp + 0x28], r12
lea rdx, str.CSDVersion
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x14002e852
cmp word [rbp + 0x60], 2
jb 0x14002e852
mov rcx, qword [rbp + 0x68]
call fcn.140039150
mov rbx, rax
cmp byte [rax], r12b
jne 0x14002e83b
mov rax, r12
jmp 0x14002e843
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp + 0x10]
mov rdx, rbx
call fcn.140004d8c
mov rcx, qword [rbp + 0xf8]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x28], r12
lea rdx, str.Caption
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x14002e8af
cmp word [rbp + 0x48], 2
jb 0x14002e8af
mov rcx, qword [rbp + 0x50]
call fcn.140039150
mov rbx, rax
cmp byte [rax], r12b
jne 0x14002e898
mov rax, r12
jmp 0x14002e8a0
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x70]
mov rdx, rbx
call fcn.140004d8c
mov rcx, qword [rbp + 0xf8]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x28], r12
lea rdx, str.Version
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x14002e90c
cmp word [rbp + 0x30], 2
jb 0x14002e90c
mov rcx, qword [rbp + 0x38]
call fcn.140039150
mov rbx, rax
cmp byte [rax], r12b
jne 0x14002e8f5
mov rax, r12
jmp 0x14002e8fd
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x10]
mov rdx, rbx
call fcn.140004d8c
lea rdx, [0x14009d610]
lea rcx, [rbp - 0x70]
call fcn.140004f04
test eax, eax
je 0x14002e7b5
lea rbx, [0x14009e768]
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x78]
call fcn.14000145c
mov r9, r14
lea rdx, [rbp - 0x10]
xor r8d, r8d
mov rcx, rax
call fcn.140004a10
mov r14d, reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x20], r12
mov rdx, rax
mov qword [rbp - 0x18], r14
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x30], r12b
call fcn.140004354
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.140004b2c
mov rdx, rax
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x40], r12
mov byte [rbp - 0x50], r12b
call fcn.140004354
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x10]
xor r8d, r8d
lea rcx, [rbp - 0x50]
call fcn.140004a10
mov rdx, rax
mov qword [rbp - 0x78], r14
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x80], r12
mov byte [rsp + 0x70], r12b
call fcn.140004354
lea rax, [rsp + 0x70]
cmp rdi, rax
je 0x14002ea11
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14002e9ea
mov rcx, qword [rdi]
inc rdx
mov r8, r13
call fcn.140004554
mov qword [rdi + 0x18], r14
cmp qword [rdi + 0x18], 0x10
mov qword [rdi + 0x10], r12
jb 0x14002e9fe
mov rax, qword [rdi]
jmp 0x14002ea01
mov rax, rdi
lea rdx, [rsp + 0x70]
mov byte [rax], r12b
mov rcx, rdi
call fcn.140004354
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14002ea2b
mov rcx, qword [rsp + 0x70]
inc rdx
mov r8, r13
call fcn.140004554
mov rdx, qword [rbp - 0x38]
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x80], r12
mov byte [rsp + 0x70], r12b
cmp rdx, 0x10
jb 0x14002ea51
mov rcx, qword [rbp - 0x50]
inc rdx
mov r8, r13
call fcn.140004554
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x40], r12
mov byte [rbp - 0x50], r12b
cmp rdx, 0x10
jb 0x14002ea76
mov rcx, qword [rbp - 0x30]
inc rdx
mov r8, r13
call fcn.140004554
mov rdx, qword [rbp + 0x90]
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x20], r12
mov byte [rbp - 0x30], r12b
cmp rdx, 0x10
jb 0x14002ea9e
mov rcx, qword [rbp + 0x78]
inc rdx
mov r8, r13
call fcn.140004554
mov rcx, qword [rbp + 0xf0]
cmp qword [rdi + 0x10], r12
cmovne esi, r13d
jmp 0x14002eab6
mov rcx, qword [rbp + 0xf0]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14002ead0
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0xf0]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x14002eaea
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x14002eaf5
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14002eb07
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
test r15d, r15d
je 0x14002eb12
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14002eb2b
mov rcx, qword [rbp - 0x10]
inc rdx
mov r8, r13
call fcn.140004554
mov rdx, qword [rbp - 0x58]
mov ebx, reloc.WSOCK32.dll_ntohs
mov qword [rbp + 8], rbx
mov qword [rbp], r12
mov byte [rbp - 0x10], r12b
cmp rdx, 0x10
jb 0x14002eb55
mov rcx, qword [rbp - 0x70]
inc rdx
mov r8, r13
call fcn.140004554
mov rdx, qword [rbp + 0x28]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], r12
mov byte [rbp - 0x70], r12b
cmp rdx, 0x10
jb 0x14002eb7a
mov rcx, qword [rbp + 0x10]
inc rdx
mov r8, r13
call fcn.140004554
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x20], r12
mov byte [rbp + 0x10], r12b
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rsp + 0x1e0]
mov eax, esi
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140038fa0
int3
mov ecx, 0x8007000e
call fcn.140038fa0
int3