Function at 0x1400acc40
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov r15, rdx
mov r12d, ecx
xor r13d, r13d
mov r14d, r13d
mov esi, r13d
cmp dword [0x140268318], r13d
jne 0x1400ace50
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x1400accae
mov dword [0x140268318], r13d
jmp 0x1400acfbd
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1400accfb
cmp eax, 0x80010119
je 0x1400accfb
mov dword [0x140268318], r13d
jmp 0x1400acfbd
lea rax, [0x140268468]
mov qword [rsp + 0x20], rax
lea r9, [0x140245cf0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140245d00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400acd31
mov dword [0x140268318], r13d
jmp 0x1400acfbd
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400acd6e
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, str.rootCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400ad146
jmp 0x1400acd71
mov rbx, r13
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x1400ad15c
mov rcx, qword [0x140268468]
mov rax, qword [rcx]
lea rdx, [0x140268460]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + Ordinal_26]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400acdf5
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400acdd6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400acde8
call fcn.1401d0398
mov qword [rbx + 8], r13
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
mov rcx, qword [0x140268460]
test edi, edi
jns 0x1400ace0c
mov dword [0x140268318], r13d
jmp 0x1400acfc4
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400ace46
mov dword [0x140268318], r13d
jmp 0x1400acfbd
mov dword [0x140268318], 1
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov r9, r15
lea r8, str.SELECT__FROM_Win32_Process_WHERE_Name___s
mov edx, 0x800
lea rcx, [rbp - 0x30]
call fcn.1400773d0
mov qword [rsp + 0x68], r13
mov ecx, Ordinal_27
call fcn.1401d0330
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400aceb8
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400ad151
jmp 0x1400acebb
mov rdi, r13
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x1400ad15c
mov ecx, Ordinal_27
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400acefb
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, [0x140245f2c]
call fcn.1401d13c0
mov qword [rbx], rax
jmp 0x1400acefe
mov rbx, r13
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1400ad13b
mov rcx, qword [0x140268460]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, Ordinal_50
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + SHCreateDirectory]
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1400acf79
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400acf59
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400acf6b
call fcn.1401d0398
mov qword [rbx + 8], r13
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1401d0398
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400acfb8
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400acf99
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400acfab
call fcn.1401d0398
mov qword [rdi + 8], r13
mov edx, Ordinal_27
mov rcx, rdi
call fcn.1401d0398
test r15d, r15d
jns 0x1400acfe8
mov rcx, qword [0x140268460]
test rcx, rcx
je 0x1400acfcf
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x140268468]
test rcx, rcx
je 0x1400acfe1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor eax, eax
jmp 0x1400ad10b
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x50], r13d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ad102
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rsp + 0x50], 0
je 0x1400ad0fd
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
xor r8d, r8d
lea rdx, [0x140245f30]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x48]
xor r8d, r8d
lea rdx, str.SessionId
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.ProcessId
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp - 0x40], r12d
je 0x1400ad0a8
mov rdx, qword [rbp - 0x70]
mov ecx, dword [rsp + 0x78]
call fcn.1400ac700
jmp 0x1400ad0c3
inc esi
cmp esi, 1
jbe 0x1400ad0be
mov rdx, qword [rbp - 0x70]
mov ecx, dword [rsp + 0x78]
call fcn.1400ac700
jmp 0x1400ad0c3
mov r14d, dword [rsp + 0x78]
lea rcx, [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400ad000
jmp 0x1400ad102
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, r14d
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.1401d0310
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
nop
mov ecx, 0x8007000e
call fcn.1401d13b0
int3