Function at 0x18001a8f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180040030]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x10], rax
xor ebx, ebx
mov dword [rbp + 8], ebx
lea rdi, [0x1800413d8]
mov qword [rbp + 0x10], rdi
mov byte [rbp + 0x60], 0x46
mov al, 8
mov cl, 0x69
mov dl, 7
xor al, 0x46
mov byte [rbp + 0x61], al
xor cl, 0x46
mov byte [rbp + 0x62], cl
xor dl, 0x46
mov byte [rbp + 0x63], dl
mov byte [rbp + 0x64], bl
xorps xmm0, xmm0
movups xmmword [0x1800413d8], xmm0
mov qword [0x1800413e8], rbx
mov qword [0x1800413f0], rbx
lea rax, [rbp + 0x61]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x18001a980
lea rdx, [rbp + 0x61]
mov rcx, rdi
call fcn.1800053f0
mov dword [rbp + 8], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x18001b1a8
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x18001b1a2
mov qword [rbp + 0x40], rbx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1800349e8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1800349f8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18001b198
mov qword [rbp + 0x28], rbx
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0x30], rax
mov ecx, 0x28
mov dword [rsp + 0x50], ecx
mov word [rbp - 0x60], cx
lea edi, [rcx + 0x3f]
lea r12d, [rcx + 0x4c]
lea r13d, [rcx + 0x43]
movzx esi, cx
movzx eax, word [0x180035bae]
xor ax, cx
mov word [rsp + 0x58], ax
movzx r14d, word [str.PNPDeviceID]
xor r14w, cx
movzx ebx, word [0x180035bb2]
xor bx, cx
movzx r11d, word [0x180035bb4]
xor r11w, cx
movzx r10d, word [0x180035bb6]
xor r10w, cx
movzx r9d, word [0x180035bb8]
xor r9w, cx
movzx r8d, word [0x180035bba]
xor r8w, cx
movzx edx, word [0x180035bbc]
xor dx, cx
movzx ecx, word [0x180035bbe]
xor cx, si
movzx eax, word [0x180035bc0]
xor ax, si
mov r15d, 0x7a
xor r15w, word [rsp + 0x50]
mov word [rbp - 0x5e], r15w
mov r15d, edi
xor r15w, word [rsp + 0x50]
mov word [rbp - 0x5c], r15w
xor di, si
mov word [rbp - 0x5a], di
mov r15d, 0x7c
xor r15w, si
mov word [rbp - 0x58], r15w
mov r15d, 0x28
xor r12w, r15w
mov word [rbp - 0x56], r12w
xor r13w, r15w
mov word [rbp - 0x54], r13w
mov edi, 0x61
xor di, r15w
mov word [rbp - 0x52], di
mov edi, 0x65
xor di, r15w
mov word [rbp - 0x50], di
mov edi, 0x7e
xor di, r15w
mov word [rbp - 0x4e], di
mov edi, 0x1a
xor di, r15w
mov word [rbp - 0x4c], di
xor si, r15w
mov word [rbp - 0x4a], si
movzx edi, word [rsp + 0x58]
xor di, r15w
mov word [rbp - 0x48], di
xor r14w, r15w
mov word [rbp - 0x46], r14w
xor bx, r15w
mov word [rbp - 0x44], bx
xor r11w, r15w
mov word [rbp - 0x42], r11w
xor r10w, r15w
mov word [rbp - 0x40], r10w
xor r9w, r15w
mov word [rbp - 0x3e], r9w
xor r8w, r15w
mov word [rbp - 0x3c], r8w
xor dx, r15w
mov word [rbp - 0x3a], dx
xor cx, r15w
mov word [rbp - 0x38], cx
xor ax, r15w
mov word [rbp - 0x36], ax
xor r15d, r15d
mov word [rbp - 0x34], r15w
lea ecx, [r15 + 0x18]
call fcn.180030798
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x18001abe1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, [rbp - 0x5e]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18001b1e3
jmp 0x18001abe4
mov rbx, r15
mov qword [rbp - 0x68], rbx
test rbx, rbx
je 0x18001b1ee
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x40]
call qword [rbp + 0x30]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18001ac5f
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001ac40
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18001ac52
call fcn.180030790
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.180030790
test edi, edi
js 0x18001b187
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x18001b187
mov qword [rbp + 0x30], r15
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
movdqa xmm1, xmmword [0x180037350]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm2, xmmword [0x1800372f0]
movdqu xmmword [rsp + 0x70], xmm2
mov dl, 0x1a
movzx r8d, dl
mov r9b, 0x13
mov r10b, 4
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x61], al
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
xor r8b, cl
mov byte [rbp - 0x7f], r8b
xor r9b, cl
mov byte [rbp - 0x7e], r9b
xor r10b, cl
mov byte [rbp - 0x7d], r10b
mov byte [rbp - 0x7c], 0
mov ecx, 0x18
call fcn.180030798
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x18001adc6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r15
mov dword [rdi + 0x10], 1
lea rcx, [rsp + 0x61]
call fcn.180030440
mov qword [rdi], rax
jmp 0x18001adc9
mov rdi, r15
mov qword [rbp + 0x18], rdi
test rdi, rdi
je 0x18001b1f9
mov rsi, qword [rdi]
mov byte [rsp + 0x50], 0x58
mov al, 0xf
mov cl, 9
mov dl, 0x14
xor r8d, r8d
xor al, 0x58
mov byte [rsp + 0x51], al
xor cl, 0x58
mov byte [rsp + 0x52], cl
xor dl, 0x58
mov byte [rsp + 0x53], dl
mov byte [rsp + 0x54], r8b
lea ecx, [r8 + 0x18]
call fcn.180030798
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x18001ae3b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x51]
call fcn.180030440
mov qword [rbx], rax
jmp 0x18001ae3e
mov rbx, r15
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x18001b1d8
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x28]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18001aeae
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001ae8e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18001aea0
call fcn.180030790
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.180030790
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x18001aeed
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001aece
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18001aee0
call fcn.180030790
mov qword [rdi + 8], r15
mov edx, 0x18
mov rcx, rdi
call fcn.180030790
test esi, esi
js 0x18001b187
mov qword [rbp + 0x38], r15
mov dword [rbp + 0x60], r15d
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x18001b187
mov r14d, 0x40
mov dword [rbp - 0x70], r14d
lea ebx, [r14 - 0x30]
lea edi, [rbx + 0x15]
lea r15d, [r14 - 0x32]
lea r12d, [r14 - 0x3c]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x38]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x60], 0
je 0x18001b187
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rbp - 0x68], rax
mov word [rbp - 0x30], r14w
mov word [rsp + 0x58], bx
movzx r14d, r15w
movzx r15d, bx
movzx r13d, di
movzx eax, word [0x180035bc8]
xor ax, 0x40
mov word [rbp - 0x78], ax
movzx eax, word [0x180035bca]
xor ax, 0x40
mov word [rsp + 0x50], ax
movzx edi, word [0x180035bcc]
xor di, 0x40
movzx ebx, word [0x180035bce]
xor bx, 0x40
movzx r11d, word [str.alnum]
xor r11w, 0x40
movzx r10d, word [0x180035bd2]
xor r10w, 0x40
movzx ecx, word [0x180035bd4]
xor cx, 0x40
movzx r9d, word [0x180035bd6]
xor r9w, 0x40
movzx r8d, word [0x180035bd8]
xor r8w, 0x40
movzx edx, word [0x180035bda]
xor dx, 0x40
movzx eax, word [0x180035bdc]
xor ax, 0x40
movzx esi, r15w
xor si, word [rbp - 0x70]
mov word [rbp - 0x2e], si
xor r14w, 0x40
mov word [rbp - 0x2c], r14w
mov r14d, 0x40
xor r15w, r14w
mov word [rbp - 0x2a], r15w
xor r12w, r14w
mov word [rbp - 0x28], r12w
xor r13w, r14w
mov word [rbp - 0x26], r13w
mov r15d, 0x36
xor r15w, r14w
mov word [rbp - 0x24], r15w
mov r15d, 0x29
xor r15w, r14w
mov word [rbp - 0x22], r15w
mov r15d, 0x23
xor r15w, r14w
mov word [rbp - 0x20], r15w
mov r15d, 0x25
xor r15w, r14w
mov word [rbp - 0x1e], r15w
mov r15d, 9
xor r15w, r14w
mov word [rbp - 0x1c], r15w
mov r12d, 4
movzx esi, r12w
xor si, r14w
mov word [rbp - 0x1a], si
movzx esi, r14w
xor si, r14w
mov word [rbp - 0x18], si
movzx esi, word [rbp - 0x78]
xor si, r14w
mov word [rbp - 0x16], si
movzx esi, word [rsp + 0x50]
xor si, r14w
mov word [rbp - 0x14], si
xor di, r14w
mov word [rbp - 0x12], di
xor bx, r14w
mov word [rbp - 0x10], bx
xor r11w, r14w
mov word [rbp - 0xe], r11w
xor r10w, r14w
mov word [rbp - 0xc], r10w
xor cx, r14w
mov word [rbp - 0xa], cx
xor r9w, r14w
mov word [rbp - 8], r9w
xor r8w, r14w
mov word [rbp - 6], r8w
xor dx, r14w
mov word [rbp - 4], dx
xor ax, r14w
mov word [rbp - 2], ax
xor r15d, r15d
mov word [rbp], r15w
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, [rbp - 0x2e]
mov rcx, qword [rbp + 0x38]
call qword [rbp - 0x68]
test eax, eax
js 0x18001b164
mov rcx, qword [rbp + 0x50]
call fcn.180030320
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x18001b142
mov rdx, rax
lea rcx, [0x1800413d8]
call fcn.180004210
lea rcx, [rbp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
mov ebx, 0x10
lea edi, [rbx + 0x15]
lea r15d, [rbx - 2]
jne 0x18001af30
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea rdi, [0x1800413d8]
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, rdi
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.180030770
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180030310
nop
mov ecx, 0x8007000e
call fcn.180030310
nop
mov ecx, 0x8007000e
call fcn.180030310
int3
mov ecx, 0x8007000e
call fcn.180030310
int3