Function at 0x14007e770
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
jns 0x14007e7c9
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Error:_Failed_to_initialize_COM_library.
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14007e821
lea rdx, str.Error:_Failed_to_initialize_COM_security.
lea r8, str.Error
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14007e7b3
mov qword [rbp + 0x7f], r12
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [0x1401db990]
xor edx, edx
mov r8d, 1
lea rcx, [0x1401db9a0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14007e857
lea rdx, str.Error:_Failed_to_create_IWbemLocator_instance.
jmp 0x14007e804
mov qword [rbp + 0x77], r12
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.14015d5ac
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14007e898
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.ROOTSecurityCenter2
call fcn.140162020
mov qword [rbx], rax
jmp 0x14007e89b
mov rbx, r12
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14007ed1b
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x7f]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14007e915
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007e8f6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14007e908
call fcn.14015d5e8
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14015d5e8
test edi, edi
jns 0x14007e94a
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Error:_Failed_to_connect_to_WMI_server.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14007e7b3
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14007e9b8
lea rdx, str.Error:_Failed_to_set_proxy_blanket.
lea r8, str.Error
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14007e7b3
mov qword [rbp - 0x31], r12
mov rax, qword [rbp + 0x77]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.14015d5ac
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x14007e9fc
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_AntiVirusProduct
call fcn.140162020
mov qword [rbx], rax
jmp 0x14007e9ff
mov rbx, r12
mov qword [rbp + 0x6f], rbx
test rbx, rbx
je 0x14007ed1b
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.14015d5ac
mov rdi, rax
mov qword [rbp - 0x29], rax
test rax, rax
je 0x14007ea41
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1401f93d4]
call fcn.140162020
mov qword [rdi], rax
jmp 0x14007ea44
mov rdi, r12
mov qword [rbp - 0x29], rdi
test rdi, rdi
je 0x14007ed26
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x77]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14007eab4
mov rcx, qword [rdi]
test rcx, rcx
je 0x14007ea94
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14007eaa6
call fcn.14015d5e8
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.14015d5e8
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14007eaf3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007ead4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14007eae6
call fcn.14015d5e8
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14015d5e8
test esi, esi
jns 0x14007eb03
lea rdx, str.Error:_Failed_to_execute_WMI_query.
jmp 0x14007e984
mov qword [rbp - 0x39], r12
mov dword [rbp + 0x67], r12d
xor r15b, r15b
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14007ec9b
movabs r13, 0x2073776f646e6957
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x39]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x67], 0
je 0x14007ec9b
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x21]
xor r8d, r8d
lea rdx, str.displayName
call qword [rax + 0x20]
test eax, eax
js 0x14007ec84
cmp word [rbp - 0x21], 8
jne 0x14007ec84
mov rcx, qword [rbp - 0x19]
call fcn.140161f00
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007ebb0
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140008100
nop
lea rsi, [rbp - 9]
mov rbx, qword [rbp - 9]
mov r14, qword [rbp + 0xf]
cmp r14, 0xf
cmova rsi, rbx
mov rax, qword [rbp + 7]
cmp rax, 0x10
jb 0x14007ec42
lea rdi, [rax + rsi]
lea r8, [rdi - 0xf]
sub r8, rsi
mov edx, 0x57
mov rcx, rsi
call fcn.1401a3850
test rax, rax
je 0x14007ec42
cmp qword [rax], r13
jne 0x14007ec17
movabs rcx, 0x7265646e65666544
cmp qword [rax + 8], rcx
je 0x14007ec35
inc rax
lea r8, [rdi - 0xf]
sub r8, rax
mov edx, 0x57
mov rcx, rax
call fcn.1401a3850
test rax, rax
jne 0x14007ec02
jmp 0x14007ec42
sub rax, rsi
cmp rax, 0xffffffffffffffff
jne 0x14007ecc8
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
cmp r14, 0xf
jbe 0x14007ec84
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007ec7c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ed15
mov rcx, rbx
call fcn.14015d5e8
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
jne 0x14007eb30
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x7f]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, r15b
jmp 0x14007e7b5
mov r15b, 1
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
cmp r14, 0xf
jbe 0x14007ec9b
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007ed0b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ed15
mov rcx, rbx
call fcn.14015d5e8
jmp 0x14007ec9b
call fcn.140170074
int3
mov ecx, 0x8007000e
call fcn.140161ef0
nop
mov ecx, 0x8007000e
call fcn.140161ef0
int3