Function at 0x1400a7e50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor r13d, r13d
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
lea rdi, [rcx + 0x20]
mov qword [rdi], r13
lea r14, [rcx + 0x28]
mov qword [r14], r13
lea r15, [rcx + 0x30]
mov qword [r15], r13
lea ecx, [r13 + 0x40]
call fcn.1400ae104
mov rbx, rax
mov qword [rax + 8], r13
mov qword [rax + 0x28], r13
mov qword [rax], r13
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x20], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x90], rax
mov r8, r12
lea rdx, [rsp + 0x70]
call fcn.1400a5330
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rsp + 0x20], rdi
lea r9, [0x140387c28]
xor edx, edx
lea r8d, [r13 + 1]
lea rcx, [0x140387c38]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x1400a7fd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rdi], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a7f9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a7f9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a8283
call fcn.1400ae0c8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a7fd4
mov rcx, rbx
call fcn.1400a2120
mov edx, 0x40
mov rcx, rbx
call fcn.1400ae0c8
nop
jmp 0x1400a8253
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTCIMV2
call qword [rax + 0x18]
test eax, eax
je 0x1400a8092
mov qword [r14], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a8058
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8053
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a8283
call fcn.1400ae0c8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a808d
mov rcx, rbx
call fcn.1400a2120
mov edx, 0x40
mov rcx, rbx
call fcn.1400ae0c8
nop
jmp 0x1400a8253
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r8, qword [rsp + 0x70]
mov rcx, qword [r14]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
mov r9d, 0x20
lea rdx, [0x140397f98]
call qword [rax + 0xa0]
test eax, eax
je 0x1400a8153
mov qword [r15], r13
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a8119
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a8283
call fcn.1400ae0c8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a814e
mov rcx, rbx
call fcn.1400a2120
mov edx, 0x40
mov rcx, rbx
call fcn.1400ae0c8
nop
jmp 0x1400a8253
mov edi, r13d
test edi, edi
jne 0x1400a81d3
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
lea edx, [rdi - 1]
lea r8d, [rdi + 1]
call qword [rax + 0x20]
mov edi, eax
test eax, eax
js 0x1400a8156
cmp dword [rsp + 0x68], 0
jbe 0x1400a8156
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rsi + 0x18]
je 0x1400a81b2
mov qword [rdx], rax
mov rcx, r13
add qword [rsi + 0x10], 8
jmp 0x1400a81c5
lea r8, [rsp + 0x50]
lea rcx, [rsi + 8]
call fcn.1400a8420
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400a81d1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x1400a8156
mov byte [rsi], 1
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1400a8217
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a8212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a8283
call fcn.1400ae0c8
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x1400a824c
mov rcx, rbx
call fcn.1400a2120
mov edx, 0x40
mov rcx, rbx
call fcn.1400ae0c8
nop
jmp 0x1400a8253
mov rax, rsi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400adbc0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1402a9118
nop
int3