Function at 0x140092350
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp], rax
mov r13, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x50], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
lea r8d, [r15 + 4]
lea rdx, str.none
call fcn.140004190
nop
mov dword [rsp + 0x50], 1
mov r12b, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14009254f
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rbp - 0x38], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1401b8260]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x1401b8270]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140092548
mov qword [rbp - 0x40], r15
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x18]
lea ecx, [r15 + 0x18]
call fcn.1401617e0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140092480
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400928b4
jmp 0x140092483
mov rbx, r15
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x1400928bf
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x38]
call rsi
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400924fe
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400924df
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400924f1
call fcn.140161a64
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140161a64
test esi, esi
js 0x14009253e
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140092579
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1401617c0
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x30], r15
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
mov ecx, Ordinal_26
call fcn.1401617e0
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400925c6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
mov rcx, r14
call fcn.140162a50
mov qword [rbx], rax
jmp 0x1400925c8
xor ebx, ebx
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x1400928bf
mov r14, qword [rbx]
mov ecx, Ordinal_26
call fcn.1401617e0
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140092618
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 1
lea rcx, [0x1403b2518]
call fcn.140162a50
mov qword [rsi], rax
jmp 0x14009261a
xor esi, esi
mov qword [rsp + 0x78], rsi
test rsi, rsi
je 0x1400928a9
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r14
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x40]
call r15
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x140092698
mov rcx, qword [rsi]
test rcx, rcx
je 0x140092674
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14009268a
call fcn.140161a64
mov qword [rsi + 8], 0
mov edx, Ordinal_26
mov rcx, rsi
call fcn.140161a64
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400926df
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400926bc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400926d2
call fcn.140161a64
mov qword [rbx + 8], 0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140161a64
test r14d, r14d
js 0x140092534
xor esi, esi
mov qword [rbp - 0x28], rsi
mov dword [rbp - 8], esi
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140092864
mov r14d, dword [rsp + 0x50]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x28]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 8], 0
je 0x140092864
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, r13
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x14009284d
mov rcx, qword [rbp - 0x18]
call fcn.140162930
test r12b, r12b
je 0x1400927bf
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140092771
mov rcx, qword [rdi + 0x18]
cmp rbx, rcx
ja 0x1400927ac
mov rsi, rdi
cmp rcx, 0xf
jbe 0x14009278f
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
xor esi, esi
xor r12b, r12b
jmp 0x1400927db
mov r9, rax
mov rdx, rbx
mov rcx, rdi
call fcn.14000f970
xor r12b, r12b
jmp 0x1400927db
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400927c6
mov rdx, rax
mov rcx, rdi
call fcn.140003580
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140092220
nop
mov r8d, 1
lea rdx, [0x1403ae61c]
mov rcx, rax
call fcn.140003580
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or r14d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.14002c630
lea rcx, [rbp - 0x80]
call fcn.140003520
nop
lea rcx, [rbp - 0x60]
call fcn.140003520
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x140092710
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rdi + 0x10]
dec rcx
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400928a0
mov rax, qword [rdi]
mov byte [rax + rcx], 0
jmp 0x14009254f
mov ecx, 0x8007000e
call fcn.140162920
nop
mov ecx, 0x8007000e
call fcn.140162920
nop
mov ecx, 0x8007000e
call fcn.140162920
int3