Function at 0x140049fb0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14004a02c
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov r12d, 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14004a0b2
lea rdx, str.Failed_to_initialize_security._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14004a018
mov qword [rbp + 0x7f], r15
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f5b08]
xor edx, edx
mov r8d, 1
lea rcx, [0x1400f5b18]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14004a0ea
lea rdx, str.Failed_to_create_IWbemLocator_object._Error_code__0x
jmp 0x14004a070
mov qword [rbp + 0x77], r15
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
mov ecx, Ordinal_27
call fcn.1400e2004
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14004a135
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ROOTDEFAULT
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004a70b
jmp 0x14004a138
mov rbx, r15
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14004a742
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x7f]
call r14
mov r14d, eax
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x14004a1af
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004a190
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004a1a2
call fcn.1400e2280
mov qword [rbx + 8], r15
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1400e2280
test r14d, r14d
jns 0x14004a208
lea rdx, str.Could_not_connect_to_WMI._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14004a018
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14004a294
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14004a018
mov qword [rbp - 0x41], r15
mov rax, qword [rbp + 0x77]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x30]
mov ecx, Ordinal_27
call fcn.1400e2004
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14004a2df
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.SystemRestore
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004a716
jmp 0x14004a2e2
mov rbx, r15
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14004a742
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x77]
call rdi
mov ebx, eax
lea rcx, [rbp + 0x6f]
call fcn.14003e960
test ebx, ebx
jns 0x14004a327
lea rdx, str.Failed_to_get_SystemRestore_class._Error_code__0x
jmp 0x14004a23e
mov qword [rbp - 0x39], r15
mov rax, qword [rbp - 0x41]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x98]
mov ecx, Ordinal_27
call fcn.1400e2004
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14004a375
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.CreateRestorePoint
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004a721
jmp 0x14004a378
mov rbx, r15
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14004a742
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x41]
call rdi
mov ebx, eax
lea rcx, [rbp + 0x6f]
call fcn.14003e960
test ebx, ebx
jns 0x14004a3f6
lea rdx, str.Failed_to_get_CreateRestorePoint_method._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14004a275
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
lea r8, [rbp - 0x49]
xor edx, edx
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
jns 0x14004a467
lea rdx, str.Failed_to_spawn_instance._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14004a275
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov word [rbp - 0x21], ax
cmp qword [rsi + 0x18], 7
jbe 0x14004a484
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x19], rax
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, [0x140169c58]
call qword [rax + Ordinal_41]
mov ebx, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x14004a51f
lea rdx, str.Failed_to_set_Description_property._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14007b170
lea rdx, [0x14003e940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14007b350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14004a275
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rbp - 9], r12w
mov dword [rbp - 1], r15d
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.RestorePointType
call qword [rax + Ordinal_41]
mov ebx, eax
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x14004a56b
lea rdx, str.Failed_to_set_RestorePointType_property._Error_code__0x
jmp 0x14004a4c5
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rbp + 0xf], r12w
mov dword [rbp + 0x17], 0x64
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0xf]
xor r8d, r8d
lea rdx, str.EventType
call qword [rax + Ordinal_41]
mov ebx, eax
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x14004a5ba
lea rdx, str.Failed_to_set_EventType_property._Error_code__0x
jmp 0x14004a4c5
mov qword [rbp - 0x31], r15
mov rax, qword [rbp + 0x77]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xc0]
mov r14, qword [rbp - 0x49]
mov ecx, Ordinal_27
call fcn.1400e2004
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14004a60c
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.CreateRestorePoint
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004a72c
jmp 0x14004a60f
mov rbx, r15
mov qword [rbp - 0x29], rbx
test rbx, rbx
je 0x14004a742
mov rdi, qword [rbx]
mov ecx, Ordinal_27
call fcn.1400e2004
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14004a65b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.SystemRestore
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004a737
jmp 0x14004a65e
mov rbx, r15
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14004a700
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x77]
call rsi
mov ebx, eax
lea rcx, [rbp + 0x6f]
call fcn.14003e960
nop
lea rcx, [rbp - 0x29]
call fcn.14003e960
test ebx, ebx
jns 0x14004a6b7
lea rdx, str.Failed_to_execute_CreateRestorePoint_method._Error_code__0x
jmp 0x14004a4c5
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x14004a01a
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
nop
mov ecx, 0x8007000e
call fcn.1400e3110
int3