Function at 0x140025eb8
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
xor r13d, r13d
lea rdx, str.WqlQuery
mov dword [rbp + 0x40], r13d
mov rcx, rbx
lea r8d, [r13 + 8]
call fcn.140014c40
mov r14, rax
test rax, rax
jne 0x140025f04
or eax, 0xffffffff
jmp 0x1400261c3
mov r8d, 9
lea rdx, str.Namespace
mov rcx, rbx
call fcn.140014c40
mov rbx, rax
mov qword [rbp - 0x30], r13
lea rax, [rbp - 0x30]
mov edi, 1
lea r9, [0x1400595b8]
mov qword [rsp + 0x20], rax
mov r8d, edi
lea rcx, [0x1400595c8]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140025f53
or esi, 0xffffffff
jmp 0x1400261b2
mov qword [rbp + 0x50], r13
lea r15, [0x140063614]
test rbx, rbx
je 0x140025f8d
mov rax, qword [rbx + 8]
test rax, rax
je 0x140025f72
mov rcx, qword [rbx + 0x18]
jmp 0x140025f75
mov rcx, r13
test rax, rax
mov r8d, ecx
mov rdx, r15
lea rcx, [rbp - 0x18]
cmovne rdx, rax
call fcn.14001d36c
jmp 0x140025fa2
lea rdx, str.rootdefault
lea rcx, [rbp - 0x20]
call fcn.1400022c8
mov edi, 2
mov rcx, qword [rax]
mov rsi, qword [rbp - 0x30]
test rcx, rcx
jne 0x140026090
mov rbx, r13
mov rax, qword [rsi]
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rdx, rbx
mov dword [rsp + 0x28], r13d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [rax + 0x18]
mov rcx, rbx
mov r12d, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
or esi, 0xffffffff
test dil, 2
je 0x14002601a
mov rdx, qword [rbp - 0x20]
and edi, 0xfffffffd
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14002601a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, 1
je 0x14002603e
mov rdx, qword [rbp - 0x18]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14002603e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r12d, r12d
js 0x1400261a3
mov rcx, qword [rbp + 0x50]
mov eax, 3
mov dword [rsp + 0x38], r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea edx, [rax + 7]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400261a3
mov r12, qword [rbp + 0x50]
mov qword [rbp + 0x58], r13
mov rax, qword [r14 + 8]
test rax, rax
je 0x1400260a7
mov rcx, qword [r14 + 0x18]
jmp 0x1400260aa
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1400261e9
jmp 0x140025fb5
mov rcx, r13
test rax, rax
mov r8d, ecx
lea rcx, [rbp - 0x10]
cmovne r15, rax
mov rdx, r15
call fcn.14001d36c
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400260cd
mov rbx, r13
jmp 0x1400260df
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1400261de
lea rcx, [0x140064828]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
je 0x1400261de
mov rax, qword [r12]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x28], rcx
mov r9d, 0x20
mov rcx, r12
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rdi
call qword [rax + 0xa0]
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdx, qword [rbp - 0x10]
mov ecx, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140026152
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r14d, r14d
jne 0x140026194
mov rcx, qword [rbp + 0x58]
lea rdx, [rbp + 0x40]
mov qword [rbp - 0x28], r13
lea r9, [rbp - 0x28]
mov dword [rbp + 0x40], r13d
lea r8d, [r14 + 1]
mov qword [rsp + 0x20], rdx
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x28]
mov esi, r13d
test eax, eax
sete sil
test rcx, rcx
je 0x140026194
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400261a3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400261b2
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400261c1
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140002198
int3
mov ecx, 0x8007000e
call fcn.140002198
int3