Function at 0x14007d2a0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x110
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x50], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14007d2ea
xor eax, eax
jmp 0x14007d84a
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14007d329
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x14007d84a
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x140325610]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140325600]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14007d363
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x14007d84a
mov qword [rsp + 0x58], r14
mov ecx, 0x18
call fcn.140255070
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14007d3a5
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x14033fbf0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14007d874
jmp 0x14007d3a8
mov rbx, r14
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x14007d87f
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14007d429
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007d40a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14007d41c
call fcn.1402550ac
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.1402550ac
test edi, edi
jns 0x14007d445
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x14007d84a
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14007d49b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x14007d84a
mov qword [rsp + 0x80], r14
mov ecx, 0x18
call fcn.140255070
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14007d4d6
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_process_where_name_csrss.exe_
call fcn.1402563b0
mov qword [rdi], rax
jmp 0x14007d4d9
mov rdi, r14
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x14007d889
mov ecx, 0x18
call fcn.140255070
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14007d51a
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x14033fbec]
call fcn.1402563b0
mov qword [rbx], rax
jmp 0x14007d51d
mov rbx, r14
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14007d894
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov ebx, eax
lea rcx, [rsp + 0x78]
call fcn.14007b560
nop
lea rcx, [rsp + 0x70]
call fcn.14007b560
test ebx, ebx
jns 0x14007d595
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x14007d84a
mov qword [rsp + 0x88], r14
mov ebx, r14d
mov dword [rsp + 0x50], r14d
movabs rdi, 0xcccccccccccccccd
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14007d80c
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x88]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x50], 0
je 0x14007d80c
mov qword [rsp + 0x68], r14
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.ReadOperationCount
call qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edx, eax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VarUI8FromDisp]
lea r9, [rsp + 0xfd]
mov r8, qword [rsp + 0x68]
nop word [rax + rax]
dec r9
mov rax, rdi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x14007d650
mov qword [rsp + 0xa8], r14
mov r8, r14
mov qword [rsp + 0xb8], r14
mov edx, 0xf
mov qword [rsp + 0xc0], rdx
mov byte [rsp + 0xa8], r8b
lea rax, [rsp + 0xfd]
cmp r9, rax
je 0x14007d6da
lea r8, [rsp + 0xfd]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0xa8]
call fcn.140012e90
mov rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
or esi, 3
cmp r8, 4
lea rcx, [r8 - 4]
ja 0x14007d6ea
mov rcx, r14
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], 0xf
mov byte [rsp + 0xc8], 0
cmp r8, rcx
jb 0x14007d89f
mov rax, r8
sub rax, rcx
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0xa8]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0xa8]
lea rdx, [rax + rcx]
lea rcx, [rsp + 0xc8]
call fcn.140012e90
or esi, 4
mov r8d, 0xa
lea rcx, [rsp + 0xc8]
call fcn.14006c7a0
cdqe
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x14007d7af
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d7a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d8a4
call fcn.1402550ac
mov rax, qword [rsp + 0x68]
add ebx, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rsp + 0xc0]
cmp rdx, 0x10
jb 0x14007d5b0
inc rdx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d8aa
call fcn.1402550ac
jmp 0x14007d5b0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x14007d84a
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
mov ecx, 0x8007000e
call fcn.140256280
nop
mov ecx, 0x8007000e
call fcn.140256280
mov ecx, 0x8007000e
call fcn.140256280
nop
mov ecx, 0x8007000e
call fcn.140256280
nop
call fcn.140013190
call fcn.140260990
nop
call fcn.140260990
int3