Function at 0x1400e80b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
xor r13d, r13d
lea rax, [rbp + 0x7f]
lea r9, [0x14012a0a8]
mov qword [rbp + 0x7f], r13
xor edx, edx
mov qword [rbp + 0x6f], r13
lea rcx, [0x14012a098]
mov qword [rbp + 0x77], r13
lea r8d, [r13 + 1]
mov qword [rsp + 0x20], rax
mov r12d, r13d
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x14014dd40]
lea rax, [0x14014dd40]
lea edi, [r13 + 5]
mov r15b, 0x20
cmp r10, rax
je 0x1400e8157
test byte [r10 + 0x1c], r15b
je 0x1400e8157
movzx edx, byte [r10 + 0x19]
lea eax, [rdi - 3]
test ebx, ebx
cmovns eax, edi
cmp edx, eax
jl 0x1400e8157
mov rax, qword [rbp + 0x7f]
lea edx, [rdi + 5]
mov rcx, qword [r10 + 0x10]
lea r8, [0x14012a0b8]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b2e4
mov r10, qword [0x14014dd40]
test ebx, ebx
js 0x1400e881d
lea rcx, str.ROOTWMI
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test rax, rax
jne 0x1400e81bf
mov r10, qword [0x14014dd40]
lea r14, [0x14014dd40]
cmp r10, r14
je 0x1400e884e
test byte [r10 + 0x1c], r15b
je 0x1400e8824
cmp byte [r10 + 0x19], 4
jb 0x1400e8824
mov rcx, qword [r10 + 0x10]
lea edx, [rax + 0xb]
lea r8, [0x14012a0b8]
call fcn.140003614
mov r10, qword [0x14014dd40]
jmp 0x1400e8824
mov rdi, qword [rbp + 0x6f]
mov r14, qword [rbp + 0x7f]
test rdi, rdi
je 0x1400e81e5
mov qword [rbp + 0x6f], r13
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov rax, qword [r14]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rax, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov rdx, rsi
mov qword [rsp + 0x30], r13
mov rcx, r14
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call rbx
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea r14, [0x14014dd40]
mov edi, 5
cmp rcx, r14
je 0x1400e826f
test byte [rcx + 0x1c], r15b
je 0x1400e826f
movzx edx, byte [rcx + 0x19]
lea eax, [rdi - 3]
test ebx, ebx
cmovns eax, edi
cmp edx, eax
jl 0x1400e826f
mov rax, qword [rbp + 0x6f]
lea edx, [rdi + 7]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012a0b8]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b2e4
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x1400e88d2
mov rcx, qword [rbp + 0x6f]
mov eax, 3
mov dword [rsp + 0x38], r13d
or r9, 0xffffffffffffffff
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], eax
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
mov r10, qword [0x14014dd40]
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
cmp r10, r14
je 0x1400e82f8
test byte [r10 + 0x1c], r15b
je 0x1400e82f8
movzx ecx, byte [r10 + 0x19]
lea eax, [rdx - 0xb]
test ebx, ebx
cmovns eax, edi
cmp ecx, eax
jl 0x1400e82f8
mov rax, qword [rbp + 0x6f]
lea r8, [0x14012a0b8]
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b2e4
mov r10, qword [0x14014dd40]
test ebx, ebx
js 0x1400e8824
lea rcx, [0x140129fb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_MSNdis_PMCapabilities
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x1400e83e0
test rax, rax
je 0x1400e83e0
mov rdi, qword [rbp + 0x77]
mov r15, qword [rbp + 0x6f]
test rdi, rdi
je 0x1400e8358
mov qword [rbp + 0x77], r13
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov rax, qword [r15]
mov rbx, qword [rax + 0xa0]
mov rcx, rbx
call qword [fcn.140009050]
lea rax, [rbp + 0x77]
mov r9d, 0x30
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rdx, r14
mov qword [rsp + 0x20], r13
mov rcx, r15
call rbx
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
mov r15b, 0x20
cmp rcx, rax
je 0x1400e8419
test byte [rcx + 0x1c], r15b
je 0x1400e8419
movzx edx, byte [rcx + 0x19]
mov eax, 2
test ebx, ebx
lea r8d, [rax + 3]
cmovns eax, r8d
cmp edx, eax
jl 0x1400e8419
mov rax, qword [rbp + 0x77]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call fcn.1400e7f6c
jmp 0x1400e8419
mov ebx, 0x8007000e
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e8419
test byte [rcx + 0x1c], r15b
je 0x1400e8419
cmp byte [rcx + 0x19], 4
jb 0x1400e8419
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012a0b8]
mov edx, reloc.Cabinet.dll_FCIDestroy
call fcn.140003614
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x1400e88cb
lea r14, [0x14012a0b8]
test r12d, r12d
jne 0x1400e88cb
mov rbx, qword [rbp + 0x77]
mov qword [rbp - 0x49], r13
mov dword [rbp + 0x67], r13d
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140009050]
lea rax, [rbp + 0x67]
or edx, 0xffffffff
lea r9, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r8d, [r12 + 1]
mov rcx, rbx
call rdi
cmp dword [rbp + 0x67], r13d
je 0x1400e87ef
test eax, eax
js 0x1400e87ef
lea rcx, [rbp - 1]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x49]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140009050]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, str.PMCapabilitiesParam
mov rcx, rbx
call rdi
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
lea esi, [r12 + 2]
cmp rcx, rax
je 0x1400e8515
test byte [rcx + 0x1c], r15b
je 0x1400e8515
movzx edx, byte [rcx + 0x19]
lea r8d, [r12 + 5]
test ebx, ebx
mov eax, esi
cmovns eax, r8d
cmp edx, eax
jl 0x1400e8515
movzx eax, word [rbp - 1]
lea edx, [rsi + 0xe]
mov rcx, qword [rcx + 0x10]
mov r9d, ebx
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.14000574c
test ebx, ebx
js 0x1400e87be
mov eax, reloc.Cabinet.dll_FCIFlushCabinet
cmp ax, word [rbp - 1]
jne 0x1400e87be
mov rdi, qword [rbp + 7]
mov qword [rbp - 0x41], r13
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [fcn.140009050]
lea r8, [rbp - 0x41]
mov rcx, rdi
lea rdx, [0x14012a088]
call rbx
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e85a0
test byte [rcx + 0x1c], r15b
je 0x1400e85a0
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e85a0
mov rax, qword [rbp - 0x41]
lea edx, [r8 + 0xc]
mov rcx, qword [rcx + 0x10]
mov r8, r14
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b2e4
test ebx, ebx
js 0x1400e87a0
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x41]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140009050]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, str.WakeOnMagicPacket
mov rcx, rbx
call rdi
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e862f
test byte [rcx + 0x1c], r15b
je 0x1400e862f
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e862f
movzx eax, word [rbp - 0x19]
lea edx, [r8 + 0xd]
mov rcx, qword [rcx + 0x10]
mov r8, r14
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.14000574c
test ebx, ebx
js 0x1400e8796
mov eax, reloc.Cabinet.dll_FCIFlushCabinet
cmp ax, word [rbp - 0x19]
jne 0x1400e8796
mov rdi, qword [rbp - 0x11]
mov qword [rbp - 0x39], r13
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [fcn.140009050]
lea r8, [rbp - 0x39]
mov rcx, rdi
lea rdx, [0x14012a088]
call rbx
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e86ba
test byte [rcx + 0x1c], r15b
je 0x1400e86ba
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e86ba
mov rax, qword [rbp - 0x39]
lea edx, [r8 + 0xe]
mov rcx, qword [rcx + 0x10]
mov r8, r14
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000b2e4
test ebx, ebx
js 0x1400e8778
lea rcx, [rbp - 0x31]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x39]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140009050]
lea r9, [rbp - 0x31]
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, str.NdisPMCapabilityState
mov rcx, rbx
call rdi
mov ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e8753
test byte [rcx + 0x1c], r15b
je 0x1400e8753
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e8753
movzx r8d, word [rbp - 0x31]
mov edx, reloc.Cabinet.dll_FDICreate
mov eax, dword [rbp - 0x29]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8, r14
call fcn.1400053f0
test ebx, ebx
js 0x1400e876e
mov eax, 3
cmp ax, word [rbp - 0x31]
jne 0x1400e876e
cmp dword [rbp - 0x29], esi
mov eax, 1
cmove r12d, eax
lea rcx, [rbp - 0x31]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x1400e8796
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp - 0x41]
test rbx, rbx
je 0x1400e87be
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
lea rcx, [rbp - 1]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x1400e843a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
jmp 0x1400e843a
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x1400e88cb
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
mov r10, qword [0x14014dd40]
mov edi, 5
lea r14, [0x14014dd40]
cmp r10, r14
je 0x1400e884e
test byte [r10 + 0x1c], 2
je 0x1400e884e
cmp byte [r10 + 0x19], dil
jb 0x1400e884e
mov rcx, qword [r10 + 0x10]
lea r8, [0x14012a0b8]
mov edx, reloc.OLEAUT32.dll_SafeArrayUnlock
mov r9d, r12d
call fcn.1400036d4
mov rdi, qword [rbp + 0x77]
test rdi, rdi
je 0x1400e8870
mov qword [rbp + 0x77], r13
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov rdi, qword [rbp + 0x6f]
test rdi, rdi
je 0x1400e8892
mov qword [rbp + 0x6f], r13
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov rdi, qword [rbp + 0x7f]
test rdi, rdi
je 0x1400e88b4
mov qword [rbp + 0x7f], r13
mov rdx, qword [rdi]
mov rbx, qword [rdx + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, rdi
call rbx
mov eax, r12d
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r14, [0x14014dd40]
mov r10, qword [0x14014dd40]
mov edi, 5
jmp 0x1400e8824