Function at 0x1400e56b8
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
xor r12d, r12d
lea rax, [rbp - 0x39]
lea r9, [0x1400e5e68]
lea rcx, [0x1400e5e88]
lea r8d, [r12 + 1]
xor edx, edx
mov r15d, r12d
mov qword [rbp - 0x39], r12
mov qword [rbp + 0x6f], r12
mov qword [rbp - 0x31], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x140148ea8]
lea r14, [0x140148ea8]
lea edi, [r12 + 5]
cmp r10, r14
je 0x1400e575c
test byte [r10 + 0x1c], 0x20
je 0x1400e575c
movzx edx, byte [r10 + 0x19]
test ebx, ebx
lea eax, [rdi - 3]
cmovns eax, edi
cmp edx, eax
jl 0x1400e575c
mov rax, qword [rbp - 0x39]
mov rcx, qword [r10 + 0x10]
lea edx, [rdi + 5]
lea r8, [0x140009600]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14001783c
mov r10, qword [0x140148ea8]
test ebx, ebx
js 0x1400e5dc1
lea rcx, [0x1400e5e98]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test rax, rax
jne 0x1400e57b7
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400e5df2
test byte [r10 + 0x1c], 0x20
je 0x1400e5dc1
cmp byte [r10 + 0x19], 4
jb 0x1400e5dc1
mov rcx, qword [r10 + 0x10]
lea edx, [rax + 0xb]
lea r8, [0x140009600]
call fcn.14000fcb0
jmp 0x1400e5dba
mov rbx, qword [rbp - 0x39]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140015690]
lea rax, [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call rdi
mov ebx, eax
mov rcx, qword [0x140148ea8]
mov edi, 5
cmp rcx, r14
je 0x1400e583e
test byte [rcx + 0x1c], 0x20
je 0x1400e583e
movzx edx, byte [rcx + 0x19]
test ebx, ebx
lea eax, [rdi - 3]
cmovns eax, edi
cmp edx, eax
jl 0x1400e583e
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 7]
lea r8, [0x140009600]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14001783c
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x1400e5db5
mov rcx, qword [rbp + 0x6f]
mov eax, 3
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
or r9, 0xffffffffffffffff
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
mov r10, qword [0x140148ea8]
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
cmp r10, r14
je 0x1400e58c8
test byte [r10 + 0x1c], 0x20
je 0x1400e58c8
movzx ecx, byte [r10 + 0x19]
test ebx, ebx
lea eax, [rdx - 0xb]
cmovns eax, edi
cmp ecx, eax
jl 0x1400e58c8
mov rax, qword [rbp + 0x6f]
mov rcx, qword [r10 + 0x10]
lea r8, [0x140009600]
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.14001783c
mov r10, qword [0x140148ea8]
test ebx, ebx
js 0x1400e5dc1
lea rcx, [0x1400e5eb0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [0x1400e5ec0]
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x1400e598b
test rax, rax
je 0x1400e598b
mov rbx, qword [rbp + 0x6f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa0]
mov rcx, rdi
call qword [fcn.140015690]
lea rax, [rbp - 0x31]
mov r9d, 0x30
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], r12
call rdi
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e59c4
test byte [rcx + 0x1c], 0x20
je 0x1400e59c4
movzx edx, byte [rcx + 0x19]
mov eax, 2
test ebx, ebx
lea r8d, [rax + 3]
cmovns eax, r8d
cmp edx, eax
jl 0x1400e59c4
mov rax, qword [rbp - 0x31]
mov rcx, qword [rcx + 0x10]
mov r9d, ebx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call fcn.1400e557c
jmp 0x1400e59c4
mov ebx, 0x8007000e
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e59c4
test byte [rcx + 0x1c], 0x20
je 0x1400e59c4
cmp byte [rcx + 0x19], 4
jb 0x1400e59c4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009600]
mov edx, reloc.Cabinet.dll_FCIDestroy
call fcn.14000fcb0
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x1400e5db5
lea r14, [0x140009600]
test r15d, r15d
jne 0x1400e5db5
mov rbx, qword [rbp - 0x31]
mov qword [rbp - 0x29], r12
mov dword [rbp + 0x67], r12d
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140015690]
lea rax, [rbp + 0x67]
lea r9, [rbp - 0x29]
lea r8d, [r15 + 1]
or edx, 0xffffffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call rdi
cmp dword [rbp + 0x67], r12d
je 0x1400e5d97
test eax, eax
js 0x1400e5d97
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x29]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rbp + 0xf]
lea rdx, [0x1400e5f08]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call rdi
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
lea esi, [r15 + 2]
cmp rcx, rax
je 0x1400e5abd
test byte [rcx + 0x1c], 0x20
je 0x1400e5abd
movzx edx, byte [rcx + 0x19]
test ebx, ebx
lea r8d, [r15 + 5]
mov eax, esi
cmovns eax, r8d
cmp edx, eax
jl 0x1400e5abd
movzx eax, word [rbp + 0xf]
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0xe]
mov r9d, ebx
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.140011e38
test ebx, ebx
js 0x1400e5d66
mov eax, reloc.Cabinet.dll_FCIFlushCabinet
cmp ax, word [rbp + 0xf]
jne 0x1400e5d66
mov rdi, qword [rbp + 0x17]
mov qword [rbp + 0x7f], r12
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [fcn.140015690]
lea r8, [rbp + 0x7f]
lea rdx, [0x1400e5e78]
mov rcx, rdi
call rbx
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e5b48
test byte [rcx + 0x1c], 0x20
je 0x1400e5b48
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e5b48
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xc]
mov r9d, ebx
mov r8, r14
mov qword [rsp + 0x20], rax
call fcn.14001783c
test ebx, ebx
js 0x1400e5d48
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x7f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rbp - 9]
lea rdx, [0x1400e5f30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call rdi
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e5bd7
test byte [rcx + 0x1c], 0x20
je 0x1400e5bd7
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e5bd7
movzx eax, word [rbp - 9]
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xd]
mov r9d, ebx
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.140011e38
test ebx, ebx
js 0x1400e5d3e
mov eax, reloc.Cabinet.dll_FCIFlushCabinet
cmp ax, word [rbp - 9]
jne 0x1400e5d3e
mov rdi, qword [rbp - 1]
mov qword [rbp + 0x77], r12
mov rax, qword [rdi]
mov rbx, qword [rax]
mov rcx, rbx
call qword [fcn.140015690]
lea r8, [rbp + 0x77]
lea rdx, [0x1400e5e78]
mov rcx, rdi
call rbx
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e5c62
test byte [rcx + 0x1c], 0x20
je 0x1400e5c62
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e5c62
mov rax, qword [rbp + 0x77]
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xe]
mov r9d, ebx
mov r8, r14
mov qword [rsp + 0x20], rax
call fcn.14001783c
test ebx, ebx
js 0x1400e5d20
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x77]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.140015690]
lea r9, [rbp - 0x21]
lea rdx, [0x1400e5f58]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call rdi
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x1400e5cfb
test byte [rcx + 0x1c], 0x20
je 0x1400e5cfb
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, esi
mov r8d, 5
cmovns eax, r8d
cmp edx, eax
jl 0x1400e5cfb
movzx r8d, word [rbp - 0x21]
mov eax, dword [rbp - 0x19]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov edx, reloc.Cabinet.dll_FDICreate
mov r8, r14
mov r9d, ebx
call fcn.140011ae0
test ebx, ebx
js 0x1400e5d16
mov eax, 3
cmp ax, word [rbp - 0x21]
jne 0x1400e5d16
cmp dword [rbp - 0x19], esi
mov eax, 1
cmove r15d, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp + 0x77]
test rbx, rbx
je 0x1400e5d3e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1400e5d66
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x1400e59e5
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
jmp 0x1400e59e5
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x1400e5db5
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
mov edi, 5
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp r10, rax
je 0x1400e5df2
test byte [r10 + 0x1c], 2
je 0x1400e5df2
cmp byte [r10 + 0x19], dil
jb 0x1400e5df2
mov rcx, qword [r10 + 0x10]
lea r8, [0x140009600]
mov edx, reloc.OLEAUT32.dll_SafeArrayUnlock
mov r9d, r15d
call fcn.14000fd64
mov rbx, qword [rbp - 0x31]
test rbx, rbx
je 0x1400e5e10
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
mov rbx, qword [rbp + 0x6f]
test rbx, rbx
je 0x1400e5e2e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x1400e5e4c
mov rcx, qword [rbx]
mov rdi, qword [rcx + 0x10]
mov rcx, rdi
call qword [fcn.140015690]
mov rcx, rbx
call rdi
mov eax, r15d
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret