Function at 0x1401624d0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1403fad18]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbp, r8
mov rax, rdx
mov rbx, rcx
mov r8d, 0x32
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x140162737
lea r8, [rsp + 0x70]
lea rdx, str.SELECT__FROM_Win32_NetworkAdapterConfiguration_WHERE_SettingID____s_
lea rcx, [rsp + 0xe0]
call fcn.140160940
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea ecx, [r12 + 0x18]
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140162582
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140162585
mov ecx, 0x8007000e
call fcn.140166010
int3
mov rdi, r12
mov qword [rsp + 0x60], rdi
test rdi, rdi
jne 0x14016259a
mov ecx, 0x8007000e
call fcn.140166010
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call sub.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1401625cd
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1402e90e4]
call fcn.140165d70
mov qword [rsi], rax
jmp 0x1401625d0
mov rsi, r12
mov qword [rsp + 0x58], rsi
test rsi, rsi
jne 0x1401625e5
mov ecx, 0x8007000e
call fcn.140166010
nop
mov rax, qword [rbx]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rdi]
mov rdx, qword [rsi]
mov rcx, rbx
call qword [rax + RegisterTypeLib]
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
dec ecx
jne 0x14016263f
mov rcx, qword [rsi]
test rcx, rcx
je 0x140162628
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140162636
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
or eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
dec eax
jne 0x14016266f
mov rcx, qword [rdi]
test rcx, rcx
je 0x140162659
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140162667
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
test ebx, ebx
js 0x140162727
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140162714
mov dword [rsp + 0x30], r12d
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x38]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
mov ebx, eax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayCreateVectorEx
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov edx, eax
lea rcx, str.netIfWinFindAdapterClassById:_IEnumWbemClassObject::Next____hr0x_x_pclsObj_p_uReturn_u_42_u_n
call fcn.140160a20
test ebx, ebx
js 0x140162707
cmp dword [rsp + 0x30], 0
je 0x140162702
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140162702
mov qword [rbp], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rdx, qword [rbp]
lea rcx, str.netIfWinFindAdapterClassById:_S_OK_and__p_n
call fcn.140160a20
xor eax, eax
jmp 0x14016277f
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x14016276b
lea rcx, str.ExecQuery_returned_no_enumerator_n
call fcn.140160a20
mov ebx, 0x80004005
jmp 0x14016276b
mov edx, ebx
lea rcx, str.ExecQuery_failed__0x_x__n
call fcn.140160a20
jmp 0x14016276b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140162745
mov ecx, eax
jmp 0x14016274e
movzx ecx, ax
or ecx, 0x80070000
mov ebx, 0x80004005
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov r8d, ecx
mov edx, eax
lea rcx, str.StringFromGUID2_failed_winEr_u__hr0x_x_n
call fcn.140160a20
mov r8, qword [rbp]
mov edx, ebx
lea rcx, str.netIfWinFindAdapterClassById:_0x_x_and__p_n
call fcn.140160a20
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14015fe00
add rsp, 0x2f0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret