Function at 0x140003960
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140016040]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r14, r8
mov r12, rdx
mov rdi, rcx
mov qword [rbp - 0x40], rcx
xor r15d, r15d
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x20], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x140010cc0]
movdqu xmmword [rbp - 8], xmm1
mov byte [rbp - 0x18], r15b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140003a61
mov r8d, 0x15
lea rdx, str.CoInitializeEx_failed
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x10], r15
mov rcx, rdi
call fcn.14000ba50
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140003a37
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004341
call fcn.14000d250
mov rax, rdi
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14000d230
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x140003aac
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8d, 0x1b
lea rdx, str.CoInitializeSecurity_failed
jmp 0x1400039e5
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14000f8f8]
xor edx, edx
mov r8d, 1
lea rcx, [0x14000f908]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140003aed
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8d, 0x17
lea rdx, str.CoCreateInstance_failed
jmp 0x1400039e5
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.14000d258
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140003b41
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004353
jmp 0x140003b44
mov rbx, r15
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140004374
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x50]
call rsi
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140003bbf
mov rcx, qword [rbx]
test rcx, rcx
je 0x140003ba0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140003bb2
call fcn.14000d250
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000d250
test esi, esi
jns 0x140003be5
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8d, 0x14
lea rdx, str.ConnectServer_failed
jmp 0x1400039e5
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140003c44
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r8d, 0x18
lea rdx, str.CoSetProxyBlanket_failed
jmp 0x1400039e5
mov r15, qword [r14 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 7
jb 0x14000437f
mov qword [rsp + 0x50], r14
cmp qword [r14 + 0x18], 7
jbe 0x140003c76
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea r13, [r15 + 7]
mov esi, 7
lea rbx, [rbp - 0x80]
cmp r13, rsi
jbe 0x140003d29
mov rsi, r13
or rsi, 7
cmp rsi, rcx
jbe 0x140003ce9
mov rsi, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140003d1d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004385
mov rcx, rax
call fcn.14000d258
test rax, rax
je 0x140003d16
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003d25
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140004385
add rcx, rcx
jne 0x140003cb8
xor ebx, ebx
jmp 0x140003d25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d258
mov rbx, rax
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rsi
movsd xmm0, qword [str.SELECT]
movsd qword [rbx], xmm0
mov eax, dword [0x1400100d8]
mov dword [rbx + 8], eax
movzx eax, word [0x1400100dc]
mov word [rbx + 0xc], ax
lea rcx, [rbx + 0xe]
lea r8, [r15 + r15]
mov rdx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + r13*2], ax
lea rdx, str._FROM
lea rcx, [rbp - 0x80]
call fcn.14000a120
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rsi, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 7
jbe 0x140003dc0
mov r12, qword [r12]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x140003e0d
lea rax, [rsi + r15]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rcx, 7
cmova rbx, qword [rsp + 0x58]
lea rcx, [rbx + r15*2]
lea r8, [rsi + rsi]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r15]
mov word [rbx + rax*2], r13w
lea rax, [rsp + 0x58]
jmp 0x140003e22
mov qword [rsp + 0x20], rsi
mov r9, r12
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14000b610
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140003e95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d250
movdqa xmm0, xmmword [0x140010cb0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r13w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140003ef4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ee7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d250
movdqa xmm0, xmmword [0x140010cb0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r13w
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rsi, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova rsi, qword [rbp + 8]
mov ecx, 0x18
call fcn.14000d258
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140003f64
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140003f67
test rsi, rsi
jne 0x14000435e
jmp 0x140003f67
mov rbx, r13
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x14000438b
mov r15, qword [rbx]
mov ecx, 0x18
call fcn.14000d258
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140003fb7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x1400100e0]
call fcn.14000cf00
mov qword [rsi], rax
jmp 0x140003fba
mov rsi, r13
mov qword [rsp + 0x78], rsi
test rsi, rsi
je 0x140004396
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x58]
call r12
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x14000402c
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000400c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000401e
call fcn.14000d250
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.14000d250
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000406b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000404c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000405e
call fcn.14000d250
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14000d250
test r15d, r15d
jns 0x140004109
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov r8d, 0x10
lea rdx, str.ExecQuery_failed
mov rcx, rdi
call fcn.14000ba50
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400040f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042e5
call fcn.14000d250
movdqa xmm0, xmmword [0x140010cb0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r13w
jmp 0x1400039fc
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000426a
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp - 0x20], 0
je 0x14000426a
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000415c
mov rdx, qword [r14]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x38]
xor r8d, r8d
call qword [rax + 0x20]
test eax, eax
js 0x140004253
mov rsi, qword [rbp - 0x30]
mov ecx, 0x18
call fcn.14000d258
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400041c6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400041c9
test rsi, rsi
jne 0x140004369
jmp 0x1400041c9
mov rbx, r13
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140004348
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400041ec
mov rcx, qword [rbx]
call fcn.14000cde0
mov qword [rbx + 8], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400041f3
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000a260
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004249
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000422a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000423c
call fcn.14000d250
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14000d250
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x140004120
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 8]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x140010cc0]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400042f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400042ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d250
movdqa xmm0, xmmword [0x140010cb0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r13w
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140003a37
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
int3
call fcn.140001230
int3
call fcn.140001190
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
nop
mov ecx, 0x8007000e
call fcn.14000cdd0
int3