Function at 0x1400062c0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140011020]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r12b, r12b
mov qword [rbp + 0x70], 0xf
xor r13d, r13d
mov qword [rbp + 0x68], r13
mov byte [rbp + 0x58], r12b
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r13
mov byte [rbp + 0x78], r12b
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r13
mov byte [rbp + 0x98], r12b
mov qword [rbp + 0xd0], 0xf
mov qword [rbp + 0xc8], r13
mov byte [rbp + 0xb8], r12b
mov rdi, qword [0x140011818]
mov rbx, rdi
mov rax, qword [0x140011820]
cmp rdi, rax
je 0x1400063fb
cmp dword [rbx], 0x8086
jne 0x14000638e
add rbx, 0x88
cmp rbx, rax
jne 0x140006378
jmp 0x1400063fb
cmp rbx, rax
je 0x1400063fb
mov eax, dword [rbx]
mov dword [rbp + 0x50], eax
lea rdx, [rbx + 8]
lea rax, [rbp + 0x58]
cmp rax, rdx
je 0x1400063b5
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x58]
call fcn.140007440
lea rdx, [rbx + 0x28]
lea rax, [rbp + 0x78]
cmp rax, rdx
je 0x1400063d2
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x78]
call fcn.140007440
lea rdx, [rbx + 0x48]
lea rax, [rbp + 0x98]
cmp rax, rdx
je 0x1400063f5
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x98]
call fcn.140007440
lea rdx, [rbx + 0x68]
jmp 0x140006461
mov eax, dword [rdi]
mov dword [rbp + 0x50], eax
lea rdx, [rdi + 8]
lea rax, [rbp + 0x58]
cmp rax, rdx
je 0x14000641d
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x58]
call fcn.140007440
lea rdx, [rdi + 0x28]
lea rax, [rbp + 0x78]
cmp rax, rdx
je 0x14000643a
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x78]
call fcn.140007440
lea rdx, [rdi + 0x48]
lea rax, [rbp + 0x98]
cmp rax, rdx
je 0x14000645d
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x98]
call fcn.140007440
lea rdx, [rdi + 0x68]
lea rax, [rbp + 0xb8]
cmp rax, rdx
je 0x140006480
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0xb8]
call fcn.140007440
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r13
mov byte [rbp - 0x38], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x38]
call fcn.140007440
nop
lea rcx, [rbp + 0x28]
call fcn.140001340
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x1400064c3
xor r12b, r12b
jmp 0x140006c65
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140006513
cmp eax, 0x80010119
jne 0x140006c31
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x14000d3f8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14000d3e8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140006c31
mov ecx, 0x18
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140006589
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14000658c
mov ecx, 0x8007000e
call fcn.14000abf0
int3
mov rbx, r13
mov qword [rsp + 0x70], rbx
test rbx, rbx
jne 0x1400065a1
mov ecx, 0x8007000e
call fcn.14000abf0
nop
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
lock dec dword [rbx + 0x10]
jne 0x140006606
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400065ea
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400065fd
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rbx + 8], r13
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
test edi, edi
js 0x140006c31
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140006c31
mov dword [rbp - 0x40], r13d
mov qword [rbp + 0xf8], 7
mov qword [rbp + 0xf0], r13
mov word [rbp + 0xe0], r13w
mov ecx, 0x18
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000669f
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_VideoController
call fcn.14000ad20
mov qword [rbx], rax
jmp 0x1400066a2
mov rbx, r13
mov qword [rbp - 0x80], rbx
test rbx, rbx
jne 0x1400066b6
mov ecx, 0x8007000e
call fcn.14000abf0
nop
mov ecx, 0x18
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400066f3
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x14000d8dc]
call fcn.14000ad20
mov qword [rdi], rax
jmp 0x1400066f6
mov rdi, r13
mov qword [rsp + 0x58], rdi
test rdi, rdi
jne 0x14000670b
mov ecx, 0x8007000e
call fcn.14000abf0
nop
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov esi, eax
lock dec dword [rdi + 0x10]
jne 0x140006768
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000674b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000675e
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rdi + 8], r13
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
nop
lock dec dword [rbx + 0x10]
jne 0x14000679b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000677f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006792
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rbx + 8], r13
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
test esi, esi
jns 0x1400067a4
jmp 0x140006c31
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140006c2f
mov qword [rbp - 0x70], r13
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x70]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rbp - 0x40], 0
je 0x140006c2b
mov qword [rbp], 0xf
mov qword [rbp - 8], r13
mov byte [rbp - 0x18], 0
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r13
mov byte [rbp + 8], 0
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
xor r8d, r8d
lea rdx, [0x14000d8e0]
call qword [rax + 0x20]
test eax, eax
js 0x1400068f7
mov rdi, qword [rbp - 0x50]
mov ecx, 0x18
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140006871
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140006874
test rdi, rdi
jne 0x140006a71
jmp 0x140006874
mov rbx, r13
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x140006a7c
cmp qword [rbx + 8], 0
jne 0x140006895
mov rcx, qword [rbx]
call fcn.14000ac00
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
cmp byte [rdx], 0
jne 0x1400068a3
mov r8, r13
jmp 0x1400068ba
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400068b0
lea rcx, [rbp - 0x18]
call fcn.140007570
nop
lock dec dword [rbx + 0x10]
jne 0x1400068f7
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400068db
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400068ee
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rbx + 8], r13
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rdi, qword [rbp - 8]
lea r15, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r15, qword [rbp - 0x18]
test rdi, rdi
je 0x140006a87
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1400069a1
cmp rdi, rbx
ja 0x1400069a1
sub rbx, rdi
inc rbx
lea r14, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r14, qword [rbp - 0x38]
nop
test rbx, rbx
je 0x140006999
movsx edx, byte [r15]
mov r8, rbx
mov rcx, r14
call qword [sym.imp.MSVCR120.dll_memchr]
mov rsi, rax
test rax, rax
je 0x140006999
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.MSVCR120.dll_memcmp
test eax, eax
je 0x14000697e
sub r14, rsi
dec r14
add rbx, r14
lea r14, [rsi + 1]
jmp 0x140006940
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rax, qword [rbp - 0x38]
sub rsi, rax
cmp rsi, 0xffffffffffffffff
jne 0x140006a87
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rbp - 8]
lea r15, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r15, qword [rbp - 0x38]
test rbx, rbx
je 0x140006a87
test rdi, rdi
je 0x140006a2b
cmp rbx, rdi
ja 0x140006a2b
sub rdi, rbx
inc rdi
lea r14, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r14, qword [rbp - 0x18]
test rdi, rdi
je 0x140006a2b
movsx edx, byte [r15]
mov r8, rdi
mov rcx, r14
call qword [sym.imp.MSVCR120.dll_memchr]
mov rsi, rax
test rax, rax
je 0x140006a2b
mov r8, rbx
mov rdx, r15
mov rcx, rax
call sub.MSVCR120.dll_memcmp
test eax, eax
je 0x140006a14
sub r14, rsi
dec r14
add rdi, r14
lea r14, [rsi + 1]
jmp 0x1400069d6
lea rax, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rax, qword [rbp - 0x18]
sub rsi, rax
cmp rsi, 0xffffffffffffffff
jne 0x140006a87
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp qword [rbp + 0x20], 0x10
jb 0x140006a47
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r13
mov byte [rbp + 8], 0
cmp qword [rbp], 0x10
jb 0x1400067a4
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x1400067a4
mov ecx, 0x8007000e
call fcn.14000abf0
nop
mov ecx, 0x8007000e
call fcn.14000abf0
int3
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
xor r8d, r8d
lea rdx, str.DriverDate
call qword [rax + 0x20]
test eax, eax
js 0x140006b87
mov rdi, qword [rbp - 0x50]
mov ecx, 0x18
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140006b02
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140006b05
test rdi, rdi
je 0x140006b05
mov ecx, 0x8007000e
call fcn.14000abf0
int3
mov rbx, r13
mov qword [rsp + 0x78], rbx
test rbx, rbx
jne 0x140006b1a
mov ecx, 0x8007000e
call fcn.14000abf0
nop
cmp qword [rbx + 8], 0
jne 0x140006b2d
mov rcx, qword [rbx]
call fcn.14000ac00
mov qword [rbx + 8], rax
mov rdx, qword [rbx + 8]
cmp byte [rdx], 0
jne 0x140006b3b
mov r8, r13
jmp 0x140006b4a
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140006b40
lea rcx, [rbp + 8]
call fcn.140007570
nop
lock dec dword [rbx + 0x10]
jne 0x140006b87
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006b6b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006b7e
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rbx + 8], r13
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rdx, qword [rbp + 0x28]
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
mov rbx, qword [rbp + 0x38]
mov r8, rbx
mov rdi, qword [rbp + 0x18]
cmp rdi, rbx
cmovb r8, rdi
test r8, r8
jne 0x140006bc9
mov eax, r13d
jmp 0x140006bce
call sub.MSVCR120.dll_memcmp
cdqe
test rax, rax
jne 0x140006be8
cmp rdi, rbx
jae 0x140006bdf
or eax, 0xffffffff
jmp 0x140006be8
mov eax, r13d
cmp rdi, rbx
setne al
test eax, eax
sets r12b
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp qword [rbp + 0x20], 0x10
jb 0x140006c0a
mov rcx, qword [rbp + 8]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r13
mov byte [rbp + 8], 0
cmp qword [rbp], 0x10
jb 0x140006c2b
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rbp - 0x78]
jmp 0x140006c35
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140006c40
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140006c4f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140006c5e
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
cmp qword [rbp + 0x40], 0x10
jb 0x140006c76
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0x40], 0xf
mov qword [rbp + 0x38], r13
mov byte [rbp + 0x28], 0
cmp qword [rbp - 0x20], 0x10
jb 0x140006c97
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r13
mov byte [rbp - 0x38], 0
lea rcx, [rbp + 0x50]
call fcn.140004680
movzx eax, r12b
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14000afe0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret