Function at 0x1401520a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x88
xor r13d, r13d
lea rdi, [rcx + 0x20]
lea rsi, [rcx + 0x28]
mov qword [rcx + 8], r13
lea r14, [rcx + 0x30]
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
mov r15, rcx
mov qword [rdi], r13
mov r8, rdx
mov qword [rsi], r13
mov qword [r14], r13
cmp qword [rdx + 0x18], 0xf
jbe 0x1401520e5
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
lea rdx, [rsp + 0x50]
add r9, r8
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x78], r12
call fcn.140153010
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov dword [rsp + 0x38], r13d
xor r8d, r8d
mov qword [rsp + 0x30], r13
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9, [0x1403da1c0]
lea rcx, [0x1403da1d0]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x1401521c4
mov qword [rdi], r13
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1401521a3
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14015219e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140152436
call fcn.1401c7f18
mov r12, qword [rsp + 0x78]
mov rax, r15
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rbp, qword [rdi]
mov ecx, 0x18
mov rax, qword [rbp]
mov r12, qword [rax + 0x18]
call fcn.1401c7ed4
mov rdi, rax
test rax, rax
je 0x14015243d
lea rcx, str.ROOTCIMV2
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14015243d
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rdx, rax
mov dword [rsp + 0x28], r13d
mov rcx, rbp
mov qword [rsp + 0x20], r13
call r12
mov ebp, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140152272
mov rcx, qword [rdi]
test rcx, rcx
je 0x140152253
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140152265
call fcn.1401c7f18
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1401c7f18
test ebp, ebp
je 0x14015227e
mov qword [rsi], r13
jmp 0x140152161
mov rbp, qword [rsi]
mov ecx, 0x18
cmp qword [rsp + 0x68], 7
lea rsi, [rsp + 0x50]
cmova rsi, qword [rsp + 0x50]
mov rax, qword [rbp]
mov r12, qword [rax + 0xa0]
call fcn.1401c7ed4
mov rdi, rax
test rax, rax
je 0x14015243d
lea rcx, [0x1404929c0]
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call fcn.1401c8f00
mov r9d, 0x20
mov qword [rsp + 0x28], r14
mov r8, rsi
mov qword [rdi], rax
mov rdx, rax
mov qword [rsp + 0x20], r13
mov rcx, rbp
call r12
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14015232a
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015230b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14015231d
call fcn.1401c7f18
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1401c7f18
test esi, esi
je 0x140152340
mov qword [r14], r13
jmp 0x140152161
mov rcx, qword [r14]
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xd8]
mov edx, 0xffffffff
mov qword [rsp + 0xd8], r13
mov dword [rsp + 0xc0], r13d
mov rax, qword [rcx]
lea r8d, [rdx + 2]
call qword [rax + 0x20]
mov edi, eax
test eax, eax
js 0x1401523e5
cmp dword [rsp + 0xc0], r13d
jbe 0x1401523e5
mov rdx, qword [r15 + 0x10]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], rcx
cmp rdx, qword [r15 + 0x18]
je 0x1401523c1
mov qword [rdx], r13
mov rcx, r13
mov rax, qword [rsp + 0xd0]
mov qword [rdx], rax
add qword [r15 + 0x10], 8
mov qword [rsp + 0xd0], rcx
jmp 0x1401523da
lea r8, [rsp + 0xd0]
lea rcx, [r15 + 8]
call fcn.140154000
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x1401523e5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test edi, edi
je 0x140152340
mov rdx, qword [rsp + 0x68]
mov byte [r15], 1
cmp rdx, 7
jbe 0x1401521a3
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14015219e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14015219e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x8007000e
call fcn.1401c8ef0
int3