Function at 0x140006890
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14003f0a0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x2f], rdi
mov ebx, edi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x1f], rdi
mov dword [rbp + 0x3f], edi
mov dword [rbp + 0x43], edi
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140006a35
mov qword [rsp + 0x40], rdi
lea edx, [rdi - 1]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140006a35
lea rax, [rbp + 0x37]
xor edx, edx
lea r9, [0x14002e9e8]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x14002ea18]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140006a35
lea rcx, str.._rootcimv2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x140006a35
mov rcx, qword [rbp + 0x37]
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov r10, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x18]
test eax, eax
js 0x140006a35
lea rax, [rbp + 0x17]
xor edx, edx
lea r9, [0x14002e9f8]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x14002ea28]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140006a35
mov rcx, qword [rbp + 0x17]
lea r8, [rbp + 0x27]
lea rdx, [0x14002ea08]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140006a35
mov rcx, qword [rbp + 0x27]
lea rdx, [rbp + 0x3f]
mov qword [rsp + 0x30], rdx
lea r8, str.Win32_Perf
lea rdx, [rbp + 0x1f]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], rdi
call qword [rax + 0x38]
test eax, eax
js 0x140006a35
mov rcx, qword [rbp + 0x17]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x140006a35
mov rcx, qword [rbp + 0x1f]
lea rdx, [rbp + 0x43]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x140006a44
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x140006a53
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140006a62
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140006a71
mov rax, qword [rcx]
call qword [rax + 0x10]
test rbx, rbx
je 0x140006a7f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x37]
test rcx, rcx
je 0x140006a8e
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14000a4c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret