Function at 0x140008c10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
mov dword [rbp - 0x65], r12d
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::WMIData::IsPKSupported
xor edx, edx
call fcn.14009cf00
mov ebx, r12d
mov qword [rbp - 0x39], rbx
call fcn.140014190
cmp byte [rax + 0x64], r12b
je 0x140008cc1
lea ecx, [r12 + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140008cba
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::WMIData::IsPKSupported
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140008cbd
mov rbx, r12
mov qword [rbp - 0x39], rbx
xor r14b, r14b
mov byte [rbp - 0x69], r14b
mov dword [rbp + 0x1f], r12d
mov qword [rbp - 1], r12
mov qword [rbp - 9], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 0x19], r12
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [0x140104360]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140104390]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov edi, eax
test eax, eax
jns 0x140008d2e
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_create_IWbemLocator_object.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 5
call fcn.14009cf00
jmp 0x140009436
call fcn.140014190
mov rcx, rax
lea r9, str.Started_reading_from_ROOTCIMV2
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 2
call fcn.14009cf00
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140008d96
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000948c
jmp 0x140008d99
mov rbx, r12
mov qword [rbp - 0x31], rbx
test rbx, rbx
je 0x1400094ad
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
lea rdx, [rbp - 9]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140008e1e
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008dff
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140008e11
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test edi, edi
jns 0x140008e4b
call fcn.140014190
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_connect_to_ROOTcimv2.__hr:0x_08X_
mov rcx, rax
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 5
call fcn.14009cf00
jmp 0x1400093c4
mov rcx, qword [rbp - 9]
test rcx, rcx
jne 0x140008e67
call fcn.140014190
mov qword [rsp + 0x20], r12
lea r9, str.IWbemServices____0x_08X
jmp 0x140008e32
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x140008ea9
call fcn.140014190
mov dword [rsp + 0x20], ebx
lea r9, str.Could_not_set_proxy_blanket.__hr:0x_08X_
jmp 0x140008e32
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140008ef1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_ComputerSystem
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140009497
jmp 0x140008ef4
mov rbx, r12
mov qword [rbp - 0x29], rbx
test rbx, rbx
je 0x1400094ad
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140008f49
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1400094a2
jmp 0x140008f4c
mov rdi, r12
mov qword [rbp - 0x21], rdi
test rdi, rdi
je 0x1400094b8
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140008fc9
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008fa9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008fbb
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009008
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008fe9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140008ffb
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
jns 0x140009021
call fcn.140014190
mov dword [rsp + 0x20], esi
lea r9, str.Query_for_system_information_failed.__hr:0x_08X_
jmp 0x140008e32
mov rcx, qword [rbp - 0x11]
test rcx, rcx
jne 0x140009040
call fcn.140014190
mov qword [rsp + 0x20], r12
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008e32
mov rax, qword [rcx]
lea rdx, [rbp + 0x1f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x19]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x1f], 0
je 0x140009390
cmp qword [rbp - 0x19], 0
je 0x140009390
test eax, eax
js 0x140009390
lea rcx, [rbp + 7]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
call fcn.140008ac0
mov rcx, rax
test rax, rax
je 0x140009481
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x49], rdi
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, str.OEMStringArray
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
test eax, eax
js 0x14000933b
mov rax, qword [rbp + 0xf]
mov ecx, dword [rax + 0x18]
mov dword [rbp - 0x61], ecx
mov dword [rbp - 0x51], r12d
test ecx, ecx
je 0x1400092ed
mov rcx, r12
mov qword [rbp - 0x59], rcx
mov rax, qword [rax + 0x10]
mov r15, qword [rcx + rax]
mov qword [rbp - 0x41], r12
lea r13, [rdi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x14000912e
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov rcx, rax
test rax, rax
jne 0x140009152
call fcn.140008ac0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140014436.0]
mov rcx, rax
test rax, rax
je 0x1400094ce
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x41], rbx
or dword [rbp - 0x65], 1
test r15, r15
jne 0x140009175
mov esi, r12d
jmp 0x14000918b
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140009180
movsxd r12, dword [rdi - 0x10]
lea r14d, [rsi + r12]
test r14d, r14d
js 0x1400094c3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400091be
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.140009970
mov rbx, qword [rbp - 0x41]
add r12, r12
je 0x1400091e8
test rbx, rbx
jne 0x1400091da
call fcn.1400b95a0
mov dword [rax], SafeArrayCopy
call fcn.1400b1700
jmp 0x1400091e8
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1400a5110
lea rcx, [r12 + rbx]
movsxd r8, esi
add r8, r8
je 0x14000921f
test rcx, rcx
je 0x14000920f
test r15, r15
je 0x140009208
mov rdx, r15
call fcn.1400a5110
jmp 0x14000921f
xor edx, edx
call fcn.1400a57c0
call fcn.1400b95a0
mov dword [rax], SafeArrayCopy
call fcn.1400b1700
cmp r14d, dword [rbx - 0xc]
jg 0x1400094c3
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r12d, r12d
mov word [rbx + rax*2], r12w
lea rdi, [rbx - 0x18]
cmp rdi, r13
je 0x14000929c
cmp dword [r13 + 0x10], r12d
jl 0x14000928c
mov rax, qword [r13]
cmp qword [rdi], rax
jne 0x14000928c
mov rcx, rdi
call fcn.140006b80
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r13 + 0x10], ecx
sub ecx, 1
jg 0x140009282
mov r8, qword [r13]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
mov rdx, r13
mov rcx, r8
call qword [case.0x140014436.0]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x14000929c
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.14000d9e0
and dword [rbp - 0x65], 0xfffffffe
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x1400092c2
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov edx, dword [rbp - 0x51]
inc edx
mov dword [rbp - 0x51], edx
mov rcx, qword [rbp - 0x59]
add rcx, 8
mov qword [rbp - 0x59], rcx
mov rdi, qword [rbp - 0x49]
cmp edx, dword [rbp - 0x61]
jae 0x1400092e8
mov rax, qword [rbp + 0xf]
jmp 0x140009100
movzx r14d, byte [rbp - 0x69]
mov eax, dword [rdi - 0x10]
test eax, eax
je 0x14000933b
js 0x14000933b
lea rdx, str.PROGKEY:1
mov rcx, rdi
call fcn.1400a40d0
test rax, rax
je 0x14000933b
sub rax, rdi
sar rax, 1
test eax, eax
js 0x14000933b
call fcn.140014190
mov rcx, rax
lea r9, str.Do_not_see_programmable_key_tag.
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 2
call fcn.14009cf00
mov r14b, 1
mov byte [rbp - 0x69], r14b
lea rcx, [rbp + 7]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14000935f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp - 0x19], r12
lea rdx, [rdi - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009382
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400093de
jmp 0x140009040
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x1f]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400093de
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp - 0x11], r12
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400093f8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp - 9], r12
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140009412
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp - 1], r12
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::WMIData::IsPKSupported
mov edx, 1
call fcn.14009cf00
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x140009450
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
movzx eax, r14b
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x80070057
call fcn.140006b40
int3
mov ecx, 0x80004005
call fcn.140006b40
int3