Function at 0x140064350
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x1400d2070]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov edx, 8
lea rcx, [rsp + 0x168]
call fcn.140001d80
lea rcx, [rsp + 0x168]
call fcn.140034080
nop
lea rcx, [rsp + 0x168]
call fcn.140002280
mov qword [rsp + 0x20], rax
lea r9, [0x14009f4d8]
mov r8d, 1
xor edx, edx
lea rcx, [0x14009f4c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140064402
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
lea r8, [0x1400b113c]
lea rdx, str.IWbemLocator::CoCreateInstance
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
mov eax, dword [0x1400d72e0]
and eax, 1
test eax, eax
jne 0x140064453
mov eax, dword [0x1400d72e0]
or eax, 1
mov dword [0x1400d72e0], eax
lea rdx, str..ROOTSecurityCenter
lea rcx, [0x1400d72a0]
call fcn.140002040
nop
lea rdx, str..ROOTSecurityCenter2
lea rcx, [0x1400d72c0]
call fcn.140002040
nop
lea rcx, [0x14009c1c0]
call fcn.140069d3c
nop
lea rax, [0x1400d72a0]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140002280
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call fcn.140062450
mov qword [rsp + 0xe8], rax
jmp 0x140064499
mov rax, qword [rsp + 0x60]
add rax, 0x20
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe8]
cmp qword [rsp + 0x60], rax
je 0x140064e7e
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
mov edx, 8
lea rcx, [rsp + 0x160]
call fcn.140001d80
lea rcx, [rsp + 0x160]
call fcn.140034080
nop
mov edx, 8
lea rcx, [rsp + 0x180]
call fcn.140001d80
mov rcx, qword [rsp + 0x90]
call fcn.140003970
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140058fd0
nop
lea rcx, [rsp + 0x168]
call fcn.140002170
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x160]
call fcn.140002280
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x180]
call fcn.140002170
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0xf8]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140064617
mov rcx, qword [rsp + 0x90]
call fcn.140003970
mov dword [rsp + 0x20], 0x8004100e
mov r9d, dword [rsp + 0x50]
mov r8, rax
lea rdx, str.IWbemLocator::ConnectServer_to
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
lea rcx, [rsp + 0x160]
call fcn.140002170
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400646bb
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
lea r8, [0x1400b1194]
lea rdx, str.CoSetProxyBlanket::IWbemServices
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
mov rax, qword [rsp + 0x1f0]
add rax, 0x90
mov qword [rsp + 0x98], rax
mov edx, 8
lea rcx, [rsp + 0x1a8]
call fcn.140001d80
lea rdx, [rsp + 0x1a8]
mov rcx, qword [rsp + 0x98]
call fcn.14001ec10
mov edx, 8
lea rcx, [rsp + 0x1b0]
call fcn.140001d80
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x98]
call fcn.14001ebe0
jmp 0x14006472e
lea rcx, [rsp + 0x1a8]
call fcn.14001e760
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1a8]
call fcn.140001ea0
movzx eax, al
test eax, eax
je 0x140064e5e
lea rcx, [rsp + 0x1a8]
call fcn.14001e780
mov qword [rsp + 0x68], rax
mov edx, 8
lea rcx, [rsp + 0x178]
call fcn.140001d80
mov rax, qword [rsp + 0x68]
mov rcx, rax
call fcn.140003970
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.140058fd0
nop
mov edx, 8
lea rcx, [rsp + 0x188]
call fcn.140001d80
lea rcx, [rsp + 0x188]
call fcn.140034080
nop
lea rcx, [rsp + 0x160]
call fcn.140002170
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rax, qword [rax + 0x90]
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x188]
call fcn.140002280
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x178]
call fcn.140002170
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400648b4
lea rcx, [rsp + 0x178]
call fcn.140002170
mov dword [rsp + 0x20], 0x80041002
mov r9d, dword [rsp + 0x50]
mov r8, rax
lea rdx, str.IWbemServices::CreateInstanceEnum
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x188]
call fcn.140031c70
nop
lea rcx, [rsp + 0x178]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
mov dword [rsp + 0x50], 0
cmp dword [rsp + 0x50], 0
jne 0x140064e3e
mov dword [rsp + 0x198], 0
mov edx, 8
lea rcx, [rsp + 0x170]
call fcn.140001d80
lea rcx, [rsp + 0x170]
call fcn.140034080
nop
lea rcx, [rsp + 0x188]
call fcn.140002170
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x170]
call fcn.140002280
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x118]
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0xa0]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400649f2
lea rcx, [rsp + 0x178]
call fcn.140002170
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
mov r8, rax
lea rdx, str.IWbemServices::Enumerator__Next
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x170]
call fcn.140031c70
nop
lea rcx, [rsp + 0x188]
call fcn.140031c70
nop
lea rcx, [rsp + 0x178]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
cmp dword [rsp + 0x198], 0
jne 0x140064a0e
lea rcx, [rsp + 0x170]
call fcn.140031c70
jmp 0x1400648bc
mov edx, 8
lea rcx, [rsp + 0x190]
call fcn.140001d80
lea rcx, [rsp + 0x190]
call fcn.140034510
nop
lea rcx, [rsp + 0x170]
call fcn.140002170
lea r8, [rsp + 0x190]
lea rdx, [0x1400b8108]
mov rcx, rax
call fcn.140064ff0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140064af0
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
lea r8, str.displayName
lea rdx, [0x1400bd4d0]
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x190]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x170]
call fcn.140031c70
nop
lea rcx, [rsp + 0x188]
call fcn.140031c70
nop
lea rcx, [rsp + 0x178]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
lea rcx, [rsp + 0x190]
call fcn.140002170
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0x20
call fcn.140003970
mov rcx, qword [rsp + 0xa8]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140064b34
add rax, 2
test dx, dx
jne 0x140064b1e
xor eax, eax
jmp 0x140064b39
sbb eax, eax
or eax, 1
test eax, eax
je 0x140064b5d
lea rcx, [rsp + 0x190]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x170]
call fcn.140031c70
jmp 0x1400648bc
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 0x48]
inc eax
mov rcx, qword [rsp + 0x1f0]
mov dword [rcx + 0x48], eax
mov edx, 8
lea rcx, [rsp + 0x1a0]
call fcn.140001d80
lea rcx, [rsp + 0x1a0]
call fcn.140034510
nop
lea rcx, [rsp + 0x170]
call fcn.140002170
lea r8, [rsp + 0x1a0]
lea rdx, [0x1400bd500]
mov rcx, rax
call fcn.140064ff0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140064c65
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
lea r8, str.instanceGuid
lea rdx, str.WmiStringFromInstance
mov rcx, qword [rsp + 0x1f0]
call fcn.140064f40
nop
lea rcx, [rsp + 0x1a0]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x190]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x170]
call fcn.140031c70
nop
lea rcx, [rsp + 0x188]
call fcn.140031c70
nop
lea rcx, [rsp + 0x178]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax + 0x78]
test eax, eax
jne 0x140064e10
lea rcx, [rsp + 0x1a0]
call fcn.140002170
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x68]
lea r8, str..instanceGuid_
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.140006540
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc8], rax
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x120]
call fcn.140006610
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
lea r8, [0x1400b12c4]
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x1b8]
call fcn.140006610
nop
lea rcx, [rsp + 0x120]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x140]
call fcn.140003bf0
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x160]
call fcn.14005f350
mov byte [rsp + 0x55], al
movzx eax, byte [rsp + 0x55]
test eax, eax
jne 0x140064dc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x1b8]
call fcn.140003970
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x20], ecx
mov r9, rax
lea r8, str.IWbemServices::DeleteInstance__s__failed:_0x_x
mov edx, 0x4f
lea rcx, [0x1400bd5d0]
call fcn.140048c20
cmp dword [rsp + 0x58], 0x80041002
je 0x140064dbf
mov rax, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x1f0]
call fcn.14005de00
jmp 0x140064e02
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 0x4c]
inc eax
mov rcx, qword [rsp + 0x1f0]
mov dword [rcx + 0x4c], eax
lea rcx, [rsp + 0x1b8]
call fcn.140003970
mov r9, rax
lea r8, str.IWbemServices::DeleteInstance__s__success
mov edx, 0x56
lea rcx, [0x1400bd6d0]
call fcn.140048c20
nop
lea rcx, [rsp + 0x1b8]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x1a0]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x190]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x170]
call fcn.140031c70
jmp 0x1400648bc
lea rcx, [rsp + 0x188]
call fcn.140031c70
nop
lea rcx, [rsp + 0x178]
call fcn.140058fb0
jmp 0x140064721
lea rcx, [rsp + 0x180]
call fcn.140058fb0
nop
lea rcx, [rsp + 0x160]
call fcn.140031c70
jmp 0x14006448b
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax + 0x78]
test eax, eax
je 0x140064eca
mov rax, qword [rsp + 0x1f0]
cmp dword [rax + 0x48], 0
jle 0x140064ea3
mov byte [rsp + 0x54], 1
jmp 0x140064ea8
mov byte [rsp + 0x54], 0
movzx edx, byte [rsp + 0x54]
mov rcx, qword [rsp + 0x1f0]
call fcn.14005da90
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
jmp 0x140064f1f
mov rax, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f0]
mov ecx, dword [rcx + 0x4c]
cmp dword [rax + 0x48], ecx
jle 0x140064eec
mov dword [rsp + 0x5c], 1
jmp 0x140064ef4
mov dword [rsp + 0x5c], 0
mov rax, qword [rsp + 0x1f0]
movzx ecx, byte [rsp + 0x5c]
mov byte [rax + 0x50], cl
mov rcx, qword [rsp + 0x1f0]
call fcn.14005dc70
nop
lea rcx, [rsp + 0x168]
call fcn.140031c70
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140069a00
add rsp, 0x1e8
ret