Function at 0x140095194
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
xor r15d, r15d
lea rax, [rbp + 0x7f]
lea r9, [0x1400baaa8]
mov qword [rbp + 0x7f], r15
xor edx, edx
mov qword [rbp + 0x6f], r15
lea rcx, [0x1400baa98]
mov qword [rbp + 0x77], r15
lea r8d, [r15 + 1]
mov qword [rsp + 0x20], rax
mov r14d, r15d
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
mov r10, qword [0x1400d0018]
lea rax, [0x1400d0018]
lea edi, [r15 + 5]
lea r13d, [r15 + 2]
lea rsi, [0x1400baab8]
cmp r10, rax
je 0x140095244
test byte [r10 + 0x1c], 0x20
je 0x140095244
movzx edx, byte [r10 + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x140095244
mov rax, qword [rbp + 0x7f]
lea edx, [rdi + 5]
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.14000adac
mov r10, qword [0x1400d0018]
test ebx, ebx
js 0x1400958b8
lea rcx, [0x1400ba998]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400952af
mov r10, qword [0x1400d0018]
lea rbx, [0x1400d0018]
cmp r10, rbx
je 0x1400958e8
test byte [r10 + 0x1c], 0x20
je 0x1400958bf
cmp byte [r10 + 0x19], 4
jb 0x1400958bf
mov rcx, qword [r10 + 0x10]
lea edx, [rax + 0xb]
mov r8, rsi
call fcn.1400034f0
mov r10, qword [0x1400d0018]
jmp 0x1400958bf
mov rcx, qword [rbp + 0x6f]
mov rdi, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400952c9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
mov rax, qword [rdi]
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rdx, rbx
mov rax, qword [rax + 0x18]
mov rcx, rdi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [case.0x1400688bc.0]
mov edi, eax
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp rcx, rax
je 0x14009534d
test byte [rcx + 0x1c], 0x20
je 0x14009534d
movzx edx, byte [rcx + 0x19]
test edi, edi
mov eax, r13d
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jb 0x14009534d
mov rax, qword [rbp + 0x6f]
lea edx, [r8 + 7]
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.14000adac
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
test edi, edi
js 0x1400958ac
mov rcx, qword [rbp + 0x6f]
mov eax, 3
mov dword [rsp + 0x38], r15d
or r9, 0xffffffffffffffff
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], eax
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
nop dword [rax + rax]
mov ebx, eax
mov r10, qword [0x1400d0018]
lea rdi, [0x1400d0018]
mov edx, SafeArrayGetDim
cmp r10, rdi
lea edi, [rdx - 8]
je 0x1400953e9
test byte [r10 + 0x1c], 0x20
je 0x1400953e9
movzx ecx, byte [r10 + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp ecx, eax
jb 0x1400953e9
mov rax, qword [rbp + 0x6f]
mov r9d, ebx
mov rcx, qword [r10 + 0x10]
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.14000adac
mov r10, qword [0x1400d0018]
test ebx, ebx
js 0x1400958b8
lea rcx, [0x1400ba9b0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
lea rcx, str.SELECT__FROM_MSNdis_PMCapabilities
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rdi, rax
test rsi, rsi
je 0x1400954c9
test rax, rax
je 0x1400954c9
mov rcx, qword [rbp + 0x77]
mov rbx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140095449
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
mov rax, qword [rbx]
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
mov r9d, 0x30
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp rcx, rax
je 0x140095502
test byte [rcx + 0x1c], 0x20
je 0x140095502
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jb 0x140095502
mov rax, qword [rbp + 0x77]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call fcn.140095044
jmp 0x140095502
mov ebx, 0x8007000e
mov rcx, qword [0x1400d0018]
lea rax, [0x1400d0018]
cmp rcx, rax
je 0x140095502
test byte [rcx + 0x1c], 0x20
je 0x140095502
cmp byte [rcx + 0x19], 4
jb 0x140095502
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400baab8]
mov edx, SafeArrayGetDim
call fcn.1400034f0
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
test ebx, ebx
js 0x1400958ac
lea rsi, [0x1400d0018]
test r14d, r14d
jne 0x1400958ac
mov rcx, qword [rbp + 0x77]
lea rdx, [rbp + 0x67]
mov qword [rbp - 0x29], r15
lea r9, [rbp - 0x29]
mov dword [rbp + 0x67], r15d
lea r8d, [r14 + 1]
mov qword [rsp + 0x20], rdx
or edx, 0xffffffff
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400688bc.0]
cmp dword [rbp + 0x67], r15d
je 0x140095896
test eax, eax
js 0x140095896
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
lea r9, [rbp + 0xf]
mov qword [rsp + 0x28], r15
lea rdx, str.PMCapabilitiesParam
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
lea edi, [r14 + 5]
cmp rcx, rsi
je 0x1400955f6
test byte [rcx + 0x1c], 0x20
je 0x1400955f6
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x1400955f6
movzx eax, word [rbp + 0xf]
lea edx, [rdi + 0xb]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400baab8]
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.1400054e0
test ebx, ebx
js 0x140095867
mov eax, SafeArrayGetDim
cmp ax, word [rbp + 0xf]
jne 0x140095867
mov rcx, qword [rbp + 0x17]
lea r8, [rbp - 0x31]
mov qword [rbp - 0x31], r15
lea rdx, [0x1400baa88]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
cmp rcx, rsi
je 0x140095671
test byte [rcx + 0x1c], 0x20
je 0x140095671
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x140095671
mov rax, qword [rbp - 0x31]
lea r8, [0x1400baab8]
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayUnlock
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000adac
test ebx, ebx
js 0x140095851
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x31]
lea r9, [rbp - 9]
mov qword [rsp + 0x28], r15
lea rdx, str.WakeOnMagicPacket
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
cmp rcx, rsi
je 0x1400956f6
test byte [rcx + 0x1c], 0x20
je 0x1400956f6
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x1400956f6
movzx eax, word [rbp - 9]
lea r8, [0x1400baab8]
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayAccessData
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.1400054e0
test ebx, ebx
js 0x140095841
mov eax, SafeArrayGetDim
cmp ax, word [rbp - 9]
jne 0x140095841
mov rcx, qword [rbp - 1]
lea r8, [rbp - 0x39]
mov qword [rbp - 0x39], r15
lea rdx, [0x1400baa88]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
cmp rcx, rsi
je 0x140095771
test byte [rcx + 0x1c], 0x20
je 0x140095771
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x140095771
mov rax, qword [rbp - 0x39]
lea r8, [0x1400baab8]
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayAccessData
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14000adac
test ebx, ebx
js 0x14009582b
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x28], r15
lea rdx, str.NdisPMCapabilityState
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400688bc.0]
mov ebx, eax
mov rcx, qword [0x1400d0018]
cmp rcx, rsi
je 0x1400957ff
test byte [rcx + 0x1c], 0x20
je 0x1400957ff
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, r13d
cmovns eax, edi
cmp edx, eax
jb 0x1400957ff
movzx r8d, word [rbp - 0x21]
mov edx, SafeArrayAccessData
mov eax, dword [rbp - 0x19]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x1400baab8]
call fcn.14000512c
test ebx, ebx
js 0x14009581b
mov eax, 3
cmp ax, word [rbp - 0x21]
jne 0x14009581b
cmp dword [rbp - 0x19], r13d
mov eax, 1
cmove r14d, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140095841
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140095867
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14009552f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
jmp 0x14009552f
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400958ac
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
mov r10, qword [0x1400d0018]
mov edi, 5
lea rbx, [0x1400d0018]
cmp r10, rbx
je 0x1400958e8
test byte [r10 + 0x1c], r13b
je 0x1400958e8
cmp byte [r10 + 0x19], dil
jb 0x1400958e8
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400baab8]
mov edx, reloc.OLEAUT32.dll_SafeArrayUnlock
mov r9d, r14d
call fcn.1400035c4
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140095902
mov qword [rbp + 0x77], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x14009591c
mov qword [rbp + 0x6f], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400688bc.0]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140095936
mov qword [rbp + 0x7f], r15
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x1400688bc.0]
mov eax, r14d
add rsp, 0xb0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret