Function at 0x14003dda0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14, r8
xor r15d, r15d
mov sil, r15b
mov dil, r15b
mov qword [rbp + 0x48], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r15
lea edx, [r15 + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14003de2a
lea r9d, [r15 + 0x25]
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_CoInitializeEx__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
lea rcx, [rbp + 0x30]
call fcn.140010fa4
jmp 0x14003e169
mov edi, 1
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
mov ecx, 0x80000000
add eax, ecx
test ecx, eax
jne 0x14003deab
cmp ebx, 0x80010119
je 0x14003deab
lea r9d, [rdi + 0x3c]
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_CoInitializeSecurity__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
jmp 0x14003de1c
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [0x14008f5c8]
mov r8d, edi
xor edx, edx
lea rcx, [0x14008f5b8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14003df0f
mov r9d, 0x4a
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_CoCreateInstance__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
jmp 0x14003de1c
lea rdx, str.ROOTCIMV2
lea rcx, [rbp + 0x30]
call fcn.14003dcb8
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x14003df2d
mov rdx, qword [rcx]
jmp 0x14003df30
mov rdx, r15
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
lea r8, [rbp + 0x48]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rax + 0x18]
call qword [case.0x14002da31.0]
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.14003dd3c
test ebx, ebx
jns 0x14003dfaf
mov r9d, 0x5b
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_ConnectServer__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
jmp 0x14003de1c
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14003e01f
mov r9d, 0x6c
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_CoSetProxyBlanket__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
jmp 0x14003de1c
lea rdx, str.SELECT__FROM_Win32_UserProfile
lea rcx, [rbp - 8]
call fcn.14003dcb8
mov rbx, rax
lea rdx, [0x14009ae90]
lea rcx, [rbp + 0x30]
call fcn.14003dcb8
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003e050
mov r8, qword [rcx]
jmp 0x14003e053
mov r8, r15
mov rax, qword [rax]
test rax, rax
je 0x14003e060
mov rdx, qword [rax]
jmp 0x14003e063
mov rdx, r15
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov rax, qword [rax + 0xa0]
call qword [case.0x14002da31.0]
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.14003dd3c
nop
lea rcx, [rbp - 8]
call fcn.14003dd3c
test ebx, ebx
jns 0x14003e0e0
mov r9d, 0x7a
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__Failed_to_call_ExecQuery__Result:
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
mov rcx, rax
mov edx, ebx
call fcn.14000d8d0
nop
jmp 0x14003de1c
mov qword [rbp - 0x10], r15
mov dword [rbp + 0x38], r15d
jmp 0x14003e125
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x10]
mov r8d, edi
or edx, 0xffffffff
mov rax, qword [rax + 0x20]
call qword [case.0x14002da31.0]
cmp dword [rbp + 0x38], r15d
je 0x14003e130
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14003e125
mov rdx, r14
call fcn.14003e1b8
test al, al
je 0x14003e166
mov rcx, qword [rbp - 0x20]
test rcx, rcx
jne 0x14003e0ea
jmp 0x14003e166
mov r9d, 0x87
lea r8, str.c:jenkinsworkspaceClientClientWindows_release_64client_srcinstallwindowsNoMSIInstallerPureCleanZoomEnumUserByWMI.cpp
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140010d78
nop
lea rdx, str._RunWMIQuery__pEnumerator__Next_WBEM_INFINITE_uReturn_is_0
lea rcx, [0x1400b21c0]
call fcn.14000f6a8
nop
lea rcx, [rbp + 0x30]
call fcn.140010fa4
mov sil, dil
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14003e17f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14002da31.0]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14003e195
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14002da31.0]
test dil, dil
je 0x14003e1a0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, sil
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret