Function at 0x1002ec40
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov eax, 0x10068fc1
call fcn.100575f8
sub esp, 0xb4
mov eax, dword [0x10084500]
push ebx
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 0x10077848
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0x10077918
mov dword [ebp - 0x84], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x1002ec89
xor al, al
jmp 0x1002f137
push 0x1006ce48
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], ebx
call fcn.10001e42
mov eax, dword [eax]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x1002eca6
mov ecx, dword [eax]
jmp 0x1002eca8
xor ecx, ecx
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
push esi
lea esi, [ebp - 0x80]
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x7c]
or dword [ebp - 4], 0xffffffff
cmp ecx, ebx
mov esi, eax
je 0x1002ecd2
call fcn.10002036
cmp esi, ebx
jge 0x1002ece9
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x1002f136
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, ebx
jge 0x1002ed0b
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1002ecd6
push 0x1006ce44
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x90], ebx
call fcn.10001dee
push str.SELECT__FROM_Win32_Processor
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], edi
call fcn.10001dee
mov eax, dword [eax]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x1002ed48
mov edx, dword [eax]
jmp 0x1002ed4a
xor edx, edx
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x1002ed58
mov ecx, dword [eax]
jmp 0x1002ed5a
xor ecx, ecx
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
lea edi, [ebp - 0x78]
push edi
push ebx
push 0x30
push edx
push ecx
push eax
call dword [esi + 0x50]
mov ecx, dword [ebp - 0x7c]
cmp ecx, ebx
mov esi, eax
mov byte [ebp - 4], 1
je 0x1002ed7e
call fcn.10002036
cmp esi, ebx
jge 0x1002eddc
jmp 0x1002ef1e
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
push edx
lea edx, [ebp - 0x88]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x90], ebx
je 0x1002ede5
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0xc0]
push edx
push ebx
push str.Architecture
push eax
call dword [ecx + 0x10]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x78]
cmp eax, ebx
jne 0x1002ed87
jmp 0x1002ede8
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.SELECT__FROM_Win32_PhysicalMemory
lea ecx, [ebp - 0x7c]
call fcn.10001dee
mov eax, dword [eax]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x1002ee09
mov edx, dword [eax]
jmp 0x1002ee0b
xor edx, edx
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x1002ee19
mov ecx, dword [eax]
jmp 0x1002ee1b
xor ecx, ecx
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
lea edi, [ebp - 0x78]
push edi
push ebx
push 0x30
push edx
push ecx
push eax
call dword [esi + 0x50]
mov ecx, dword [ebp - 0x7c]
cmp ecx, ebx
mov esi, eax
mov byte [ebp - 4], 1
je 0x1002ee3f
call fcn.10002036
cmp esi, ebx
jge 0x1002eeb7
jmp 0x1002ef1e
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
push edx
lea edx, [ebp - 0x88]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x90], ebx
je 0x1002eec0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0xc0]
push edx
push ebx
push str.Capacity
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x1002eeaa
cmp word [ebp - 0xc0], 8
jne 0x1002eeaa
push dword [ebp - 0xb8]
call fcn.10057abb
pop ecx
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x78]
cmp eax, ebx
jne 0x1002ee48
jmp 0x1002eec3
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.SELECT__FROM_Win32_SystemEnclosure
lea ecx, [ebp - 0x7c]
call fcn.10001dee
mov eax, dword [eax]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x1002eee4
mov edx, dword [eax]
jmp 0x1002eee6
xor edx, edx
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x1002eef4
mov ecx, dword [eax]
jmp 0x1002eef6
xor ecx, ecx
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
lea edi, [ebp - 0x78]
push edi
push ebx
push 0x30
push edx
push ecx
push eax
call dword [esi + 0x50]
mov ecx, dword [ebp - 0x7c]
cmp ecx, ebx
mov esi, eax
mov byte [ebp - 4], 1
je 0x1002ef1a
call fcn.10002036
cmp esi, ebx
jge 0x1002ef4b
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x8c]
cmp ecx, ebx
je 0x1002ece2
call fcn.10002036
jmp 0x1002ece2
xor esi, esi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], ebx
mov byte [ebp - 4], 5
jmp 0x1002efd9
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x88]
push ecx
push 1
push 0xffffffffffffffff
push dword [ebp - 0x78]
call dword [eax + 0x10]
cmp dword [ebp - 0x90], ebx
je 0x1002f045
push 0x10
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.10056960
add esp, 0xc
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0xb0]
push edx
push ebx
push str.ChassisTypes
push eax
call dword [ecx + 0x10]
test eax, eax
jge 0x1002efe0
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x78], ebx
jne 0x1002ef65
jmp 0x1002f045
cmp dword [ebp - 0xa8], ebx
je 0x1002f045
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 1
push dword [ebp - 0xa8]
call esi
test eax, eax
jne 0x1002f03f
mov eax, dword [ebp - 0xa8]
mov cx, word [eax]
cmp cx, 1
jb 0x1002f03f
cmp cx, bx
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x7c], ebx
jbe 0x1002f03f
push 2
push edi
call esi
cmp eax, 1
je 0x1002f03f
push edi
lea ecx, [ebp - 0xa0]
call fcn.1002e939
mov eax, dword [ebp - 0xa8]
movzx eax, word [eax]
inc edi
inc edi
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], eax
jl 0x1002f016
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x18
mov byte [ebp - 0x74], bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
push str.DesktopSystem:
mov ecx, edi
call fcn.10003017
mov eax, dword [ebp - 0x9c]
cmp eax, ebx
je 0x1002f0a1
sub esi, eax
sar esi, 1
mov dword [ebp + 8], esi
jne 0x1002f0a8
push str.undefined
jmp 0x1002f107
movzx eax, word [eax]
cdq
cmp eax, 3
jne 0x1002f0bc
cmp edx, ebx
jne 0x1002f0bc
push str.Desktop
jmp 0x1002f107
cmp eax, 9
jne 0x1002f0cc
cmp edx, ebx
jne 0x1002f0cc
push str.Laptop
jmp 0x1002f107
cmp eax, 0xa
jne 0x1002f0dc
cmp edx, ebx
jne 0x1002f0dc
push str.Notebook
jmp 0x1002f107
push 0xa
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.1005b43a
add esp, 0xc
push str.Other_
mov ecx, edi
call fcn.10003017
lea eax, [ebp - 0x74]
push eax
mov ecx, edi
call fcn.10003017
push 0x1006ebc0
mov ecx, edi
call fcn.10003017
push 0x1006ca8c
mov ecx, edi
call fcn.10003017
lea ecx, [ebp - 0xa0]
call fcn.1004f53d
mov ecx, dword [ebp - 0x8c]
cmp ecx, ebx
je 0x1002f134
call fcn.10002036
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.100568ae
leave
ret