Function at 0x18000e5a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xe0
mov rbx, r9
mov rsi, r8
mov r15, rcx
xor r14b, r14b
mov byte [rbp + 0x7f], r14b
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
xor r12d, r12d
mov qword [rbp + 0x67], r12
mov rdi, qword [rbp + 0x77]
test r8, r8
je 0x18000e662
test rbx, rbx
je 0x18000e662
mov qword [rbp - 0x11], rbx
mov rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], r12w
jne 0x18000e605
mov dword [rbp - 9], eax
mov qword [rbp - 0x31], rsi
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r8 + rax*2], r12w
jne 0x18000e620
mov dword [rbp - 0x29], eax
mov qword [rbp - 0x21], rdi
test rdi, rdi
je 0x18000e64f
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], r12w
jne 0x18000e640
mov dword [rbp - 0x19], eax
jmp 0x18000e653
mov dword [rbp - 0x19], r12d
mov dword [rbp - 5], 2
lea rax, [rbp - 0x31]
mov qword [rbp + 0x67], rax
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x18000ecab
mov qword [rbp - 0x59], r12
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea r9, [0x180060208]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18004d010]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000ec96
mov qword [rbp + 0x5f], r12
mov rdx, r15
lea rcx, str._ls_rootcimv2
call fcn.180001620
mov r15, rax
mov r9, rbx
mov r8, rsi
mov rdx, rax
lea rcx, str._ls__username:__ls___password_:__ls_
call fcn.180001620
mov qword [rbp - 0x69], rax
test rdi, rdi
je 0x18000e801
cmp word [rdi], 0x2e
jne 0x18000e6ef
cmp word [rdi + 2], 0
je 0x18000e801
mov r8, rsi
mov rdx, rdi
lea rcx, [0x18005e1a0]
call fcn.180001620
mov r14, rax
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x71], rax
test rbx, rbx
jne 0x18000e71d
mov rbx, r12
mov qword [rbp - 0x79], rbx
mov r13, r12
jmp 0x18000e739
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x79], rax
mov r13, rax
test rax, rax
je 0x18000ece0
test r14, r14
jne 0x18000e759
mov rdi, r12
mov qword [rbp - 0x61], r12
test r15, r15
jne 0x18000e777
xor r9d, r9d
mov esi, r9d
mov qword [rbp - 0x51], r9
mov edx, r9d
jmp 0x18000e796
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x61], rax
mov r12, rax
test rax, rax
je 0x18000ecd5
jmp 0x18000e745
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rbp - 0x51], rax
mov rdx, rax
test rax, rax
je 0x18000ed01
xor r9d, r9d
mov rcx, qword [rbp - 0x71]
mov rax, qword [rcx]
lea r8, [rbp + 0x5f]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r9
mov r9, r13
mov r8, r12
call qword [rax + 0x18]
mov r12d, eax
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14, r14
je 0x18000e894
mov edx, 2
mov rcx, r14
call fcn.180010c10
jmp 0x18000e894
mov r13, qword [rbp - 0x59]
test rbx, rbx
jne 0x18000eb0f
mov rbx, r12
mov qword [rbp - 0x71], rbx
test rsi, rsi
jne 0x18000eb30
xor edi, edi
mov qword [rbp - 0x51], rdi
xor r14d, r14d
test r15, r15
jne 0x18000eb51
xor esi, esi
mov qword [rbp - 0x79], rsi
xor edx, edx
mov rax, qword [r13]
lea rcx, [rbp + 0x5f]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8, r14
mov rcx, r13
call qword [rax + 0x18]
mov r12d, eax
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r9b, 1
lea rdx, str.connected
test r12d, r12d
js 0x18000ec45
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov r14, qword [rbp - 0x69]
mov qword [rsp + 0x20], r14
movzx r8d, r9b
call fcn.180002a10
mov dword [rsp + 0x38], 0x20
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
mov edx, 0xffffffff
lea r9, [r12 - 1]
mov r8d, edx
mov rcx, qword [rbp + 0x5f]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x18000ec27
mov qword [rbp - 0x69], r12
mov rbx, qword [rbp + 0x5f]
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x18000ed0c
mov rax, qword [rbx]
mov qword [rsp + 0x28], r12
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x30]
mov ebx, eax
shr ebx, 0x1f
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor bl, 1
je 0x18000ebc7
mov qword [rbp - 0x79], r12
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x79]
xor r8d, r8d
lea rdx, str.Create
call qword [rax + 0x98]
test eax, eax
js 0x18000ebb4
mov qword [rbp + 0x67], r12
mov rcx, qword [rbp - 0x79]
mov rax, qword [rcx]
lea r8, [rbp + 0x67]
xor edx, edx
call qword [rax + 0x78]
test eax, eax
js 0x18000eba1
lea rcx, str.C:windows_system32_notepad.exe
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x18000ed17
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 1]
call fcn.18000cfc0
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbx, qword [rbp + 0x67]
lea rcx, str.CommandLine
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x18000ed22
mov rax, qword [rbx]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x28]
mov ebx, eax
shr ebx, 0x1f
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor bl, 1
je 0x18000eb93
mov qword [rbp - 0x61], r12
mov rbx, qword [rbp + 0x5f]
lea rcx, str.Create
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x18000ed2d
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x51], rax
test rax, rax
je 0x18000ecca
mov r10, qword [rbx]
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x61]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call qword [r10 + 0xc0]
mov ebx, eax
shr ebx, 0x1f
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor bl, 1
je 0x18000eb80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x49]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, str.ReturnValue
call qword [rax + 0x20]
test eax, eax
js 0x18000eb72
cmp word [rbp - 0x49], 3
jne 0x18000eb72
cmp dword [rbp - 0x41], 0
sete bl
mov byte [rbp + 0x7f], bl
jmp 0x18000eb74
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x71], rax
mov r12, rax
test rax, rax
je 0x18000ece0
jmp 0x18000e815
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x51], rax
mov r14, rax
test rax, rax
je 0x18000eceb
jmp 0x18000e827
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rbp - 0x79], rax
mov rdx, rax
test rax, rax
je 0x18000ecf6
jmp 0x18000e838
xor bl, bl
lea rcx, [rbp - 0x49]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x18000eb82
xor bl, bl
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x18000eb95
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x18000eb95
xor bl, bl
lea rcx, [rbp - 1]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x18000eba3
xor bl, bl
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x18000ebb6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x18000ebb6
xor bl, bl
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x18000ebc9
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x18000ebc9
xor bl, bl
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x18000ebd8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test bl, bl
je 0x18000ec27
lea r8, str.C:windows_system32_notepad.exe
mov rdx, qword [rbp + 0x57]
lea rcx, str._ls_____ls
call fcn.180001620
mov rbx, rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], rax
mov r9b, 1
movzx r8d, r9b
lea rdx, str.executeRemoteProcess
call fcn.180002a10
test rbx, rbx
je 0x18000ec5d
mov edx, 2
mov rcx, rbx
call fcn.180010c10
jmp 0x18000ec5d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], r12
mov r9b, 1
xor r8d, r8d
lea rdx, str.executeRemoteProcess
call fcn.180002a10
jmp 0x18000ec5d
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.180002a10
mov r14, qword [rbp - 0x69]
test r15, r15
je 0x18000ec6f
mov edx, 2
mov rcx, r15
call fcn.180010c10
test r14, r14
je 0x18000ec82
mov edx, 2
mov rcx, r14
call fcn.180010c10
nop
mov rcx, qword [rbp + 0x5f]
test rcx, rcx
je 0x18000ec91
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
movzx r14d, byte [rbp + 0x7f]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x18000eca5
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, r14b
mov rbx, qword [rsp + 0x138]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
nop
mov ecx, 0x8007000e
call fcn.180001510
int3