Function at 0x1400923f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp], rax
mov r13, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x50], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
lea r8d, [r15 + 4]
lea rdx, str.none
call fcn.1400041a0
nop
mov dword [rsp + 0x50], 1
mov r12b, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400925ef
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rbp - 0x38], r15
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1401b8260]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x1401b8270]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400925e8
mov qword [rbp - 0x40], r15
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x18]
lea ecx, [r15 + 0x18]
call fcn.140161880
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140092520
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140092954
jmp 0x140092523
mov rbx, r15
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x14009295f
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x38]
call rsi
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14009259e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14009257f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140092591
call fcn.140161b04
mov qword [rbx + 8], r15
mov edx, Ordinal_27
mov rcx, rbx
call fcn.140161b04
test esi, esi
js 0x1400925de
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140092619
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140161860
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x30], r15
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
mov ecx, Ordinal_27
call fcn.140161880
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140092666
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
mov rcx, r14
call fcn.140162af0
mov qword [rbx], rax
jmp 0x140092668
xor ebx, ebx
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x14009295f
mov r14, qword [rbx]
mov ecx, Ordinal_27
call fcn.140161880
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400926b8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 1
lea rcx, [0x1403b2538]
call fcn.140162af0
mov qword [rsi], rax
jmp 0x1400926ba
xor esi, esi
mov qword [rsp + 0x78], rsi
test rsi, rsi
je 0x140092949
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
mov r8, r14
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x40]
call r15
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x140092738
mov rcx, qword [rsi]
test rcx, rcx
je 0x140092714
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14009272a
call fcn.140161b04
mov qword [rsi + 8], 0
mov edx, Ordinal_27
mov rcx, rsi
call fcn.140161b04
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14009277f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14009275c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140092772
call fcn.140161b04
mov qword [rbx + 8], 0
mov edx, Ordinal_27
mov rcx, rbx
call fcn.140161b04
test r14d, r14d
js 0x1400925d4
xor esi, esi
mov qword [rbp - 0x28], rsi
mov dword [rbp - 8], esi
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140092904
mov r14d, dword [rsp + 0x50]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x28]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 8], 0
je 0x140092904
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x20]
xor r8d, r8d
mov rdx, r13
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x1400928ed
mov rcx, qword [rbp - 0x18]
call fcn.1401629d0
test r12b, r12b
je 0x14009285f
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140092811
mov rcx, qword [rdi + 0x18]
cmp rbx, rcx
ja 0x14009284c
mov rsi, rdi
cmp rcx, 0xf
jbe 0x14009282f
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
xor esi, esi
xor r12b, r12b
jmp 0x14009287b
mov r9, rax
mov rdx, rbx
mov rcx, rdi
call fcn.14000f980
xor r12b, r12b
jmp 0x14009287b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140092866
mov rdx, rax
mov rcx, rdi
call fcn.140003590
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.1400922c0
nop
mov r8d, 1
lea rdx, [0x1403ae5fc]
mov rcx, rax
call fcn.140003590
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or r14d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.14002c640
lea rcx, [rbp - 0x80]
call fcn.140003530
nop
lea rcx, [rbp - 0x60]
call fcn.140003530
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x1400927b0
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rdi + 0x10]
dec rcx
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140092940
mov rax, qword [rdi]
mov byte [rax + rcx], 0
jmp 0x1400925ef
mov ecx, 0x8007000e
call fcn.1401629c0
nop
mov ecx, 0x8007000e
call fcn.1401629c0
nop
mov ecx, 0x8007000e
call fcn.1401629c0
int3