Function at 0x14002f23c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
xor r13d, r13d
mov r14, rcx
lea rcx, [rbp + 0xf]
mov dword [rbp + 0x6f], r13d
mov edi, r13d
mov qword [rbp - 0x49], r13
mov qword [rbp + 0x7f], r13
mov r12, rdx
mov qword [rbp + 0x77], r13
mov qword [rbp - 0x59], r13
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x39]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
xor r8d, r8d
lea rdx, [0x14009d600]
mov rcx, r14
call fcn.140004d8c
xor ecx, ecx
mov dword [r12], r13d
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x40], r13
lea esi, [r13 + 1]
mov dword [rsp + 0x38], r13d
test eax, eax
mov qword [rsp + 0x30], r13
mov r15d, r13d
cmove r15d, esi
mov dword [rsp + 0x28], 3
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
je 0x14002f307
cmp eax, 0x80010119
jne 0x14002f5a5
lea rax, [rbp - 0x49]
mov r8d, esi
lea r9, [0x1400a9528]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1400a94c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002f5a5
lea rdx, str.ROOTCIMV2
lea rcx, [rbp - 0x51]
call fcn.1400220fc
mov rcx, qword [rax]
test rcx, rcx
je 0x14002f34e
mov rdx, qword [rcx]
jmp 0x14002f351
mov rdx, r13
mov rcx, qword [rbp - 0x49]
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rax, qword [rcx]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [rax + 0x18]
lea rcx, [rbp - 0x51]
mov ebx, eax
call fcn.140024498
test ebx, ebx
jne 0x14002f5a5
mov rcx, qword [rbp + 0x7f]
lea eax, [rbx + 3]
mov dword [rsp + 0x38], r13d
lea edx, [rbx + 0xa]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x14002f5a5
lea ecx, [rbx + 0x18]
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x14002f3e9
lea rcx, str.Select__from_Win32_VideoController
mov qword [rax + 8], r13
mov dword [rax + 0x10], esi
call fcn.140039270
mov qword [rbx], rax
jmp 0x14002f3ec
mov rbx, r13
mov qword [rbp - 0x51], rbx
test rbx, rbx
je 0x14002f63f
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.140037e24
mov rbx, rax
test rax, rax
je 0x14002f42a
lea rcx, [0x1400a1d74]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call fcn.140039270
mov qword [rbx], rax
jmp 0x14002f42d
mov rbx, r13
mov qword [rbp - 0x41], rbx
test rbx, rbx
je 0x14002f64a
mov rcx, qword [rbp + 0x7f]
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x28], rdx
mov r9d, gethostbyname
mov rdx, qword [rbx]
mov r8, rsi
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0xa0]
lea rcx, [rbp - 0x41]
mov ebx, eax
call fcn.140024498
lea rcx, [rbp - 0x51]
call fcn.140024498
test ebx, ebx
jne 0x14002f5a5
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14002f59e
mov edi, 0x10624dd3
mov rax, qword [rcx]
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x59]
or edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
jne 0x14002f59a
cmp dword [rbp + 0x6f], r13d
je 0x14002f58b
mov rcx, qword [rbp - 0x59]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x28], r13
lea rdx, str.AdapterRAM
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x14002f50b
cmp word [rbp - 0x21], 2
jb 0x14002f50b
mov eax, edi
imul dword [rbp - 0x19]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [r12], edx
mov rcx, qword [rbp - 0x59]
lea r9, [rbp - 0x39]
mov qword [rsp + 0x28], r13
lea rdx, str.Name
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
jne 0x14002f564
cmp word [rbp - 0x39], 2
jb 0x14002f564
mov rcx, qword [rbp - 0x31]
call fcn.140039150
mov rbx, rax
cmp byte [rax], r13b
jne 0x14002f54e
mov rax, r13
jmp 0x14002f556
mov rcx, rbx
call fcn.140045e50
mov r8, rax
mov rdx, rbx
mov rcx, r14
call fcn.140004d8c
lea rcx, [0x1400a4aa0]
call fcn.140045e50
mov r9, rax
lea rdx, [0x1400a4aa0]
xor r8d, r8d
mov rcx, r14
call fcn.14000501c
cmp rax, 0xffffffffffffffff
je 0x14002f59a
mov rcx, qword [rbp + 0x77]
test rcx, rcx
jne 0x14002f48f
jmp 0x14002f59e
mov rcx, qword [rbp + 0x77]
mov edi, 1
jmp 0x14002f5a9
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x7f]
test rdx, rdx
je 0x14002f5bf
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rbp - 0x49]
test rdx, rdx
je 0x14002f5d5
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14002f5e0
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14002f5ef
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
test r15d, r15d
je 0x14002f5fa
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x39]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rsp + 0x110]
mov eax, edi
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140038fa0
int3
mov ecx, 0x8007000e
call fcn.140038fa0
int3