Function at 0x1400a3430
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor r13d, r13d
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
lea rdi, [rcx + 0x20]
mov qword [rdi], r13
lea r14, [rcx + 0x28]
mov qword [r14], r13
lea r15, [rcx + 0x30]
mov qword [r15], r13
lea ecx, [r13 + 0x40]
call fcn.1400a96e4
mov rbx, rax
mov qword [rax + 8], r13
mov qword [rax + 0x28], r13
mov qword [rax], r13
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x20], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x90], rax
mov r8, r12
lea rdx, [rsp + 0x70]
call fcn.1400a0bb0
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rsp + 0x20], rdi
lea r9, [0x140381ba8]
xor edx, edx
lea r8d, [r13 + 1]
lea rcx, [0x140381bb8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x1400a35b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rdi], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a357f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a357a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3863
call fcn.1400a96a8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a35b4
mov rcx, rbx
call fcn.14009e470
mov edx, 0x40
mov rcx, rbx
call fcn.1400a96a8
nop
jmp 0x1400a3833
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTCIMV2
call qword [rax + 0x18]
test eax, eax
je 0x1400a3672
mov qword [r14], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a3638
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a3633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3863
call fcn.1400a96a8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a366d
mov rcx, rbx
call fcn.14009e470
mov edx, 0x40
mov rcx, rbx
call fcn.1400a96a8
nop
jmp 0x1400a3833
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r8, qword [rsp + 0x70]
mov rcx, qword [r14]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
mov r9d, 0x20
lea rdx, [0x140391c78]
call qword [rax + 0xa0]
test eax, eax
je 0x1400a3733
mov qword [r15], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a36f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a36f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3863
call fcn.1400a96a8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a372e
mov rcx, rbx
call fcn.14009e470
mov edx, 0x40
mov rcx, rbx
call fcn.1400a96a8
nop
jmp 0x1400a3833
mov edi, r13d
test edi, edi
jne 0x1400a37b3
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
lea edx, [rdi - 1]
lea r8d, [rdi + 1]
call qword [rax + 0x20]
mov edi, eax
test eax, eax
js 0x1400a3736
cmp dword [rsp + 0x68], 0
jbe 0x1400a3736
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rsi + 0x18]
je 0x1400a3792
mov qword [rdx], rax
mov rcx, r13
add qword [rsi + 0x10], 8
jmp 0x1400a37a5
lea r8, [rsp + 0x50]
lea rcx, [rsi + 8]
call fcn.1400a3a00
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400a37b1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x1400a3736
mov byte [rsi], 1
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a37f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a37f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a3863
call fcn.1400a96a8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a382c
mov rcx, rbx
call fcn.14009e470
mov edx, 0x40
mov rcx, rbx
call fcn.1400a96a8
nop
jmp 0x1400a3833
mov rax, rsi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a91a0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1402a4cc8
nop
int3