Function at 0x1400afbf0
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x800]
sub rsp, 0x900
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rdi, r8
mov ebx, edx
mov r13, rcx
xor esi, esi
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rdi
mov r9d, ebx
lea r8, str.SELECT__FROM_Win32_Process_Where_ProcessId___d_And_Name____s_
mov edx, 0x400
lea rcx, [rbp - 0x10]
call fcn.1400abed0
mov qword [rsp + 0x60], rsi
lea ecx, [rsi + 0x18]
call fcn.1401d0330
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r12d, [rsi + 1]
test rax, rax
je 0x1400afc96
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400b0103
jmp 0x1400afc99
mov rdi, rsi
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x1400b0119
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400afcd6
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, [0x140245f2c]
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400afcd9
mov rbx, rsi
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x1400b00f8
mov rcx, qword [r13 + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov r9d, Ordinal_50
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + SHCreateDirectory]
mov r15d, eax
mov r14d, 0xffffffff
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400afd55
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400afd35
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400afd47
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
nop
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400afd92
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400afd73
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rsi
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400afd85
call fcn.1401d0398
mov qword [rdi + 8], rsi
mov edx, Ordinal_27
mov rcx, rdi
call fcn.1401d0398
test r15d, r15d
jns 0x1400afd9e
xor eax, eax
jmp 0x1400b00ce
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x48], esi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b00c6
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov r8d, r12d
mov edx, r14d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rsp + 0x48], 0
je 0x1400b00c1
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x28]
xor r8d, r8d
lea rdx, str.__PATH
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x50], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400afe33
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Win32_Process
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400afe36
mov rbx, rsi
mov qword [rbp - 0x58], rbx
test rbx, rbx
je 0x1400b010e
mov rcx, qword [r13 + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + Ordinal_50]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400afea3
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400afe84
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400afe96
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
mov qword [rsp + 0x70], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400afed8
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Terminate
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400afedb
mov rbx, rsi
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1400b010e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x98]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400aff44
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400aff25
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400aff37
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
mov qword [rsp + 0x58], rsi
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
xor edx, edx
call qword [rax + 0x78]
mov eax, reloc.WS2_32.dll_socket
mov word [rbp - 0x80], ax
mov dword [rbp - 0x78], esi
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.Reason
call qword [rax + Ordinal_41]
mov qword [rsp + 0x68], rsi
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400affb9
mov qword [rax + 8], rsi
mov dword [rax + 0x10], r12d
lea rcx, str.Terminate
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400affbc
mov rbx, rsi
mov qword [rbp - 0x48], rbx
test rbx, rbx
je 0x1400b010e
mov rcx, qword [r13 + 0x40]
mov r10, qword [rcx]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rbx]
mov rdx, qword [rbp - 0x20]
call qword [r10 + 0xc0]
mov edi, eax
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x1400b003d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b001e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400b0030
call fcn.1401d0398
mov qword [rbx + 8], rsi
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
test edi, edi
js 0x1400b0081
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.ReturnValue
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x38], 0
cmove esi, r12d
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, esi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1401d0310
mov rbx, qword [rsp + 0x958]
add rsp, 0x900
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
int3
mov ecx, 0x8007000e
call fcn.1401d13b0
int3