Function at 0x140038890
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rdx, rcx
lea rcx, str.ROOTCIMV2
jmp 0x1400388a0
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebp, ebp
or rsi, 0xffffffffffffffff
mov rbx, rdx
mov rdi, rcx
lea edx, [rsi + 0x61]
lea ecx, [rsi + 2]
mov r12d, ebp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
call fcn.140022b68
lea edx, [rsi + 9]
lea ecx, [rsi + 2]
mov r15, rax
call fcn.140022b68
xor edx, edx
mov qword [rax], r15
mov r13, rax
lea rax, [0x140039300]
mov qword [r15 + 0x28], rax
lea rax, [0x140039250]
xor ecx, ecx
mov qword [r15 + 0x30], rax
lea rax, [0x140039190]
mov qword [r15 + 8], rbp
mov qword [r15 + 0x38], rax
lea rax, [0x140038f70]
mov qword [r15 + 0x10], rbp
mov qword [r15 + 0x40], rax
lea rax, [0x140038e60]
mov qword [r15 + 0x20], rbp
mov qword [r15 + 0x48], rax
lea rax, [0x140038df0]
mov qword [r15 + 0x50], rax
lea rax, [0x140038e40]
mov qword [r15 + 0x58], rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov r14d, eax
mov dword [r15], eax
mov eax, 0x80000000
lea ecx, [r14 + rax]
test eax, ecx
jne 0x140038998
cmp r14d, 0x80010106
je 0x140038998
test rbx, rbx
je 0x140038a28
mov r10, qword [rbx + 8]
test r10, r10
je 0x140038a28
mov rcx, qword [rbx]
lea edx, [rsi + 0xf]
mov r9d, 0x20b
mov r8d, r14d
call r10
jmp 0x140038a28
test rdi, rdi
je 0x1400389f1
mov r9, rsi
inc r9
cmp byte [rdi + r9], bpl
jne 0x1400389a0
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, eax
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r9, rsi
mov r12, rax
inc r9
cmp byte [rdi + r9], 0
jne 0x1400389d1
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rsi
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400389f4
movsxd rax, ebp
cmp rcx, rax
je 0x140038a5c
test rbx, rbx
je 0x140038a26
mov rax, qword [rbx + 8]
test rax, rax
je 0x140038a26
mov rcx, qword [rbx]
mov r9d, 0x211
mov r8d, r14d
mov edx, InitCommonControls
call rax
xor ebp, ebp
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140038a44
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test esi, esi
je 0x140038bff
mov rcx, r13
call fcn.140038c20
mov rax, rbp
jmp 0x140038c02
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov edx, esi
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140038ac4
cmp eax, 0x80010119
je 0x140038ac4
test rbx, rbx
je 0x140038a28
mov r10, qword [rbx + 8]
test r10, r10
je 0x140038a28
mov rcx, qword [rbx]
lea edx, [rbp + 0xe]
mov r9d, 0x218
mov r8d, eax
call r10
jmp 0x140038a28
xor edx, edx
lea rax, [rsp + 0xa8]
lea r9, [0x14011a6c0]
lea r8d, [rdx + 1]
lea rcx, [0x14011a6b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140038b1e
test rbx, rbx
je 0x140038a28
mov r10, qword [rbx + 8]
test r10, r10
je 0x140038a28
mov rcx, qword [rbx]
mov r9d, 0x220
mov r8d, eax
mov edx, InitCommonControls
call r10
jmp 0x140038a28
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jns 0x140038b88
test rbx, rbx
je 0x140038a28
mov r10, qword [rbx + 8]
test r10, r10
je 0x140038a28
mov rcx, qword [rbx]
mov r9d, 0x227
mov r8d, eax
mov edx, InitCommonControls
call r10
jmp 0x140038a28
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x38], ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea edx, [r9 + 0xa]
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140038bec
test rbx, rbx
je 0x140038a28
mov r10, qword [rbx + 8]
test r10, r10
je 0x140038a28
mov rcx, qword [rbx]
mov r9d, 0x237
mov r8d, eax
mov edx, InitCommonControls
call r10
jmp 0x140038a28
mov rax, qword [rsp + 0xa0]
mov esi, ebp
mov qword [r15 + 0x10], rax
jmp 0x140038a28
mov rax, r13
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret