Function at 0x140096470
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r15, rdx
xor r12d, r12d
mov r14d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, 0x80000000
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x1400964d1
cmp eax, 0x80010106
jne 0x140096512
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x14009651c
cmp eax, 0x80010119
je 0x14009651c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 0xfffffffe
jmp 0x140096828
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7f90]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400d8060]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14009650c
mov qword [rbp - 0x78], r12
lea rcx, [0x1400ee138]
call fcn.1400299a0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140096571
mov ecx, 0x8007000e
call fcn.140009900
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x18]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x1400965f6
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140096612
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400965f6
mov qword [rbp - 0x78], r12
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r14d, 0xfffffffe
jmp 0x140096816
mov qword [rsp + 0x68], r12
mov rsi, qword [rbp - 0x78]
mov rcx, qword [str.SELECT__FROM_Win32_NetworkAdapter_WHERE__MACAddress_IS_NOT_NULL__AND__NOT__PNPDeviceID_LIKE_ROOT____AND__NOT__PNPDeviceID_LIKE_USB___]
test rcx, rcx
je 0x140096644
call fcn.1400299a0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14009664c
mov ecx, 0x8007000e
call fcn.140009900
int3
mov rbx, r12
mov qword [rsp + 0x60], rbx
lea rcx, [0x1400ee144]
call fcn.1400299a0
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x14009666f
mov ecx, 0x8007000e
call fcn.140009900
nop
mov rax, qword [rsi]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
mov r9d, gethostbyname
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0xa0]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x1400966de
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400966c2
mov qword [rbp - 0x78], r12
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r14d, 0xfffffffd
jmp 0x140096816
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400967eb
nop dword [rax]
mov qword [rsp + 0x60], r12
mov dword [rbp - 0x70], r12d
test r15, r15
je 0x140096708
cmp r14d, 1
jge 0x1400967eb
mov rax, qword [rcx]
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rbp - 0x70], 0
je 0x1400967e6
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, qword [str.PNPDeviceID]
call qword [rax + 0x20]
mov edx, 0x80
lea rax, [rbp - 0x60]
lea rcx, [rbp - 0x60]
mov r8, qword [rsp + 0x78]
sub r8, rcx
lea rcx, [rdx + 0x7fffff7e]
test rcx, rcx
je 0x140096796
movzx ecx, word [r8 + rax]
test cx, cx
je 0x140096796
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x140096773
lea rcx, [rax - 2]
test rdx, rdx
cmovne rcx, rax
mov word [rcx], r12w
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r15, r15
je 0x1400967c8
mov r8d, r14d
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.140096140
test eax, eax
je 0x1400967cb
inc r14d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400966f0
jmp 0x1400967eb
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140096804
mov qword [rbp - 0x78], r12
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140096825
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, r14d
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret