Function at 0x140001000
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140001038
mov edx, eax
lea rcx, str.Failed_to_initialize_COM_library._Error_code__0x_x_n
call fcn.140001540
mov eax, 1
add rsp, 0xd0
pop rbp
ret
mov qword [rsp + 0xc0], rdi
xor r9d, r9d
mov qword [rsp + 0xb0], r15
mov edi, 0xffffffff
xor r15d, r15d
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov edx, edi
mov dword [rsp + 0x38], r15d
xor ecx, ecx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x140001089
lea rcx, str.Failed_to_initialize_security._Error_code__0x_x_n
jmp 0x1400010bd
lea rax, [rbp - 0x29]
mov qword [rbp - 0x29], r15
lea r9, [0x14001b5e8]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14001b5f8]
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400010d4
lea rcx, str.Failed_to_create_IWbemLocator_object._Error_code__0x_x_n
mov edx, eax
call fcn.140001540
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x140001230
mov qword [rsp + 0xe0], rbx
mov ecx, 0x18
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xb8], r14
mov qword [rbp + 0x7f], r15
call fcn.140001788
mov rbx, rax
test rax, rax
je 0x140001517
lea rcx, str.ROOTCIMV2
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001517
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x38], r15
mov rax, qword [rcx]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [rax + 0x18]
mov esi, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001198
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001179
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000118b
call fcn.1400017c4
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400017c4
test esi, esi
jns 0x1400011ac
mov edx, esi
lea rcx, str.Could_not_connect._Error_code__0x_x_n
call fcn.140001540
jmp 0x140001203
lea rcx, str.Connected_to_ROOTCIMV2_WMI_namespace_n
call fcn.140001540
mov rcx, qword [rbp + 0x7f]
xor r9d, r9d
mov dword [rsp + 0x38], r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov edx, 0xa
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140001249
mov edx, eax
lea rcx, str.Could_not_set_proxy_blanket._Error_code__0x_x_n
call fcn.140001540
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov r14, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xb0]
add rsp, 0xd0
pop rbp
ret
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.Create
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rbp - 0x19], r15
mov r14, rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
mov rdx, rsi
call qword [r10 + 0x30]
mov rcx, qword [rbp - 0x19]
lea r9, [rbp - 0x11]
mov qword [rbp - 0x11], r15
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], r15
mov r10, qword [rcx]
call qword [r10 + 0x98]
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 0x21]
mov qword [rbp - 0x21], r15
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x78]
mov eax, 8
mov ecx, 0x18
mov word [rbp - 1], ax
call fcn.140001788
mov rbx, rax
test rax, rax
je 0x140001517
lea rcx, str.notepad.exe_c:_rto_boom.txt
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001517
mov qword [rbp + 7], rax
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140001347
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001328
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000133a
call fcn.1400017c4
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400017c4
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
xor r8d, r8d
mov dword [rsp + 0x20], r15d
lea rdx, str.CommandLine
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, qword [rbp + 7]
lea rcx, str.The_command_is:__s_n
call fcn.1400015a0
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp - 0x21]
mov rdx, rsi
mov qword [rbp - 9], r15
mov r10, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [r10 + 0xc0]
test eax, eax
jns 0x140001406
mov edx, eax
lea rcx, str.Could_not_execute_method._Error_code__0x_x_n
call fcn.140001540
lea rcx, [rbp - 1]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400011f9
mov ecx, 0x18
call fcn.140001788
mov rbx, rax
test rax, rax
je 0x140001517
lea rcx, str.ReturnValue
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001517
mov rcx, qword [rbp - 9]
lea r9, [rbp + 0x17]
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x140001498
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001479
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000148b
call fcn.1400017c4
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400017c4
mov rdx, qword [rbp + 0x1f]
lea rcx, str.Return_value:__s_n
call fcn.1400015a0
lea rcx, [rbp - 1]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x17]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140001218
mov ecx, 0x8007000e
call fcn.140001600
int3