Function at 0x1800933f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rdi, r9
mov r13, r8
lea rdx, str.SELECT
lea rcx, [rbp - 0x41]
call fcn.180094040
nop
mov r9, r13
cmp qword [r13 + 0x18], 7
jbe 0x18009343b
mov r9, qword [r13]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [r9 + rsi*2], 0
jne 0x180093442
mov r14, qword [rbp - 0x31]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
sub rax, r14
xor r15d, r15d
cmp rsi, rax
ja 0x180093497
lea rax, [rsi + r14]
mov qword [rbp - 0x31], rax
lea rbx, [rbp - 0x41]
cmp rcx, 7
cmova rbx, qword [rbp - 0x41]
lea rcx, [rbx + r14*2]
lea r8, [rsi + rsi]
mov rdx, r9
call fcn.18011f220
lea rax, [r14 + rsi]
mov word [rbx + rax*2], r15w
lea rax, [rbp - 0x41]
jmp 0x1800934ad
mov qword [rsp + 0x20], rsi
movzx r8d, byte [rbp + 0x67]
mov rdx, rsi
lea rcx, [rbp - 0x41]
call fcn.180007b20
lea rdx, str._FROM
mov rcx, rax
call fcn.180095e60
mov rcx, qword [rbp + 0x67]
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x1800934cd
mov rdx, qword [rcx]
mov rcx, rax
call fcn.180095e60
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
mov dword [rbp - 0x21], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x180093651
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [0x180161b78]
mov r12d, 1
mov r8d, r12d
xor edx, edx
lea rcx, [0x180161b88]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18009364a
mov rax, qword [rbp - 0x49]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.1800e667c
mov rbx, rax
mov qword [rbp - 0x61], rax
test rax, rax
je 0x180093581
mov qword [rax + 8], r15
mov dword [rax + 0x10], r12d
mov rsi, qword [rbp + 0x7f]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180093584
test rsi, rsi
jne 0x180093be1
jmp 0x180093584
mov rbx, r15
mov qword [rbp - 0x61], rbx
test rbx, rbx
je 0x180093c1e
lea rax, [rbp - 0x51]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x49]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1800935ff
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800935e0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800935f2
call fcn.1800e66b8
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1800e66b8
test esi, esi
js 0x180093640
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x18009369a
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x180093870
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, 0x1000
mov rax, rcx
jb 0x180093690
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093c18
call fcn.1800e66b8
jmp 0x180093870
mov rax, qword [rbp - 0x51]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
lea rsi, [rbp - 0x41]
cmp qword [rbp - 0x29], 7
cmova rsi, qword [rbp - 0x41]
mov ecx, 0x18
call fcn.1800e667c
mov rbx, rax
mov qword [rbp - 0x61], rax
test rax, rax
je 0x1800936f4
mov qword [rax + 8], 0
mov dword [rax + 0x10], r12d
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1800936f6
test rsi, rsi
jne 0x180093bec
jmp 0x1800936f6
xor ebx, ebx
mov qword [rbp - 0x61], rbx
test rbx, rbx
je 0x180093c1e
mov r14, qword [rbx]
mov ecx, 0x18
call fcn.1800e667c
mov rsi, rax
mov qword [rbp + 0xf], rax
test rax, rax
je 0x180093743
mov qword [rax + 8], 0
mov dword [rax + 0x10], r12d
lea rcx, [0x180137860]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x180093bf7
jmp 0x180093745
xor esi, esi
mov qword [rbp + 0xf], rsi
test rsi, rsi
je 0x180093bd6
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x30
mov r8, r14
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x51]
call r15
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x1800937c2
mov rcx, qword [rsi]
test rcx, rcx
je 0x18009379e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1800937b4
call fcn.1800e66b8
mov qword [rsi + 8], 0
mov edx, 0x18
mov rcx, rsi
call fcn.1800e66b8
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180093809
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800937e6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800937fc
call fcn.1800e66b8
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.1800e66b8
test r14d, r14d
jns 0x1800938ae
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x18009386d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180093868
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093c18
call fcn.1800e66b8
xor r15d, r15d
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r15w
mov rcx, qword [rbp + 0x67]
call fcn.1800117a0
nop
mov rcx, r13
call fcn.1800117a0
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180093b08
xor r14d, r14d
nop
mov rax, qword [rcx]
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x11]
mov r8d, r12d
mov edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rbp - 0x21], 0
je 0x180093b08
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
mov rdx, r13
cmp qword [r13 + 0x18], 7
jbe 0x1800938fa
mov rdx, qword [r13]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 9]
xor r8d, r8d
call qword [rax + 0x20]
lea rdx, [0x1802c6668]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
je 0x180093abf
lea rdx, [0x1802c6680]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
je 0x180093abf
lea rdx, [0x1802c6698]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
jne 0x180093965
movsx rax, word [rbp - 1]
jmp 0x180093ac3
lea rdx, [0x1802c66b0]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
jne 0x180093984
mov eax, dword [rbp - 1]
jmp 0x180093ac3
lea rdx, [0x1802c66c8]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
jne 0x1800939a4
movzx eax, word [rbp - 1]
jmp 0x180093ac3
lea rdx, [0x1802c66e0]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
jne 0x1800939c4
mov rax, qword [rbp - 1]
jmp 0x180093ac3
lea rdx, [0x1802c66f8]
lea rcx, [0x1802c6650]
call fcn.1800e887c
test eax, eax
jne 0x1800939e4
mov rax, qword [rbp - 1]
jmp 0x180093ac3
mov rsi, qword [rbp - 1]
mov ecx, 0x18
call fcn.1800e667c
mov rbx, rax
mov qword [rbp + 0xf], rax
test rax, rax
je 0x180093a22
mov qword [rax + 8], r14
mov dword [rax + 0x10], r12d
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180093a25
test rsi, rsi
jne 0x180093c02
jmp 0x180093a25
mov rbx, r14
mov qword [rbp + 0x17], rbx
test rbx, rbx
je 0x180093c1e
mov rcx, qword [rbx]
test rcx, rcx
je 0x180093a56
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
test rax, rax
je 0x180093c0d
jmp 0x180093a59
mov rax, r14
mov qword [rbp - 0x61], rax
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x180093a71
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x180093a7e
lea r8, [rbp - 0x61]
mov rcx, rdi
call fcn.180015110
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180093ae7
mov rcx, qword [rbx]
test rcx, rcx
je 0x180093a9e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180093ab0
call fcn.1800e66b8
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.1800e66b8
jmp 0x180093ae7
movsxd rax, dword [rbp - 1]
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
mov qword [rbp - 0x61], rax
je 0x180093adb
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x180093ae7
lea r8, [rbp - 0x61]
mov rcx, rdi
call fcn.180015110
lea rcx, [rbp - 9]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
jne 0x1800938c0
mov r9, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, r9
sub rcx, rdx
sar rcx, 3
test rcx, rcx
jne 0x180093b6d
cmp rcx, 1
jbe 0x180093b2e
lea rax, [rdx + 8]
mov qword [rdi + 8], rax
jmp 0x180093b6d
mov rax, qword [rdi + 0x10]
sub rax, rdx
sar rax, 3
cmp rax, 1
jae 0x180093b50
lea r8, [rbp - 0x59]
mov rdx, r12
mov rcx, rdi
call fcn.180093f20
jmp 0x180093b6d
sub r12, rcx
lea r8, [r12*8]
lea rbx, [r9 + r8]
xor edx, edx
mov rcx, r9
call fcn.18011f8c0
mov qword [rdi + 8], rbx
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x18009386d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180093868
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180093c18
jmp 0x180093868
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
nop
call fcn.1800ec8e4
nop
mov ecx, 0x8007000e
call fcn.1800e74d0
int3