Function at 0x14003f6e0
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400cc010]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor r12d, r12d
mov eax, dword [rdx + rcx]
cmp dword [0x1400d1270], eax
jle 0x14003f810
lea rcx, [0x1400d1270]
call fcn.14005df68
cmp dword [0x1400d1270], 0xffffffff
jne 0x14003f810
mov qword [0x1400d11c0], r12
mov qword [0x1400d11c8], 7
mov word [0x1400d11b0], r12w
mov qword [0x1400d11e0], r12
mov qword [0x1400d11e8], 7
mov word [0x1400d11d0], r12w
mov qword [0x1400d1200], r12
mov qword [0x1400d1208], 7
mov word [0x1400d11f0], r12w
mov qword [0x1400d1220], r12
mov qword [0x1400d1228], 7
mov word [0x1400d1210], r12w
mov qword [0x1400d1240], r12
mov qword [0x1400d1248], 7
mov word [0x1400d1230], r12w
mov qword [0x1400d1260], r12
mov qword [0x1400d1268], 7
mov word [0x1400d1250], r12w
lea rcx, [0x140092100]
call fcn.14005dd3c
lea rcx, [0x1400d1270]
call fcn.14005df08
cmp qword [0x1400d11c0], r12
jne 0x14003ff78
mov ecx, 0x48
call fcn.14005da5c
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov rcx, rax
call fcn.14005b210
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rdx, str.ROOTWMI
mov rcx, rax
call fcn.14005b2e0
lea rdx, str.SELECT__FROM_MSSmBios_RawSMBiosTables
mov rcx, rbx
call fcn.14005b4b0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14005d600
mov ecx, SafeArrayPutElement
call fcn.14005da5c
mov qword [rbp - 0x48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140045120
mov r15, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], SafeArrayPutElement
mov byte [rbp + 0x80], 0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], SafeArrayPutElement
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], SafeArrayPutElement
mov byte [rbp + 0xc0], 0
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140045300
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.1400455d0
mov ecx, r12d
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
sub r8, rdx
sar r8, 5
test r8, r8
je 0x14003f9b3
mov rax, r12
nop dword [rax + rax]
shl rax, 5
cmp dword [rax + rdx], 3
je 0x14003f9f1
inc ecx
mov eax, ecx
cmp rax, r8
jb 0x14003f9a0
movzx ebx, byte [rsp + 0x30]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r8, qword [rbp + 0x90]
lea rcx, [rbp - 0x68]
test r8, r8
je 0x14003fa02
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
jmp 0x14003fa14
mov eax, ecx
shl rax, 5
mov rax, qword [rax + rdx + 8]
movzx ebx, byte [rax + 5]
jmp 0x14003f9b8
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
call fcn.1400027a0
lea rcx, [rbp - 0x68]
call fcn.140002f70
lea rdx, [0x1400d11b0]
lea rcx, [rbp - 0x68]
call fcn.14003f5d0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea r14, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae r14, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x40]
cmp rsi, 0x10
jae 0x14003fa6b
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x60], 0xf
jmp 0x14003faeb
mov rdi, rsi
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rax, [rdi + 1]
cmp rax, 0x1000
jb 0x14003fac0
lea rcx, [rax + 0x27]
mov rdx, 0xffffffffffffffff
cmp rcx, rax
cmovbe rcx, rdx
call fcn.14005da5c
mov rcx, rax
test rax, rax
je 0x14003ffb5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003fad2
test rax, rax
je 0x14003facf
mov rcx, rax
call fcn.14005da5c
jmp 0x14003fad2
mov rax, r12
mov qword [rsp + 0x48], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140062a50
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x48]
call fcn.140002f70
lea rdx, [0x1400d11d0]
lea rcx, [rsp + 0x48]
call fcn.14003f5d0
movzx eax, bl
add eax, 0xfffffffd
mov r13d, 8
cmp eax, 0x1d
ja case.0x14003fb37.4
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x3ffec]
mov ecx, dword [rdx + rax*4 + 0x3ffd0]
add rcx, rdx
jmp rcx
lea rdx, str.Desktop
jmp 0x14003fb91
mov r8d, 0xa
lea rdx, str.All_in_One
jmp 0x14003fb97
mov r8, r13
lea rdx, str.Notebook
jmp 0x14003fb97
mov r8d, 6
lea rdx, str.Tablet
jmp 0x14003fb97
mov r8d, 0xb
lea rdx, str.Convertible
jmp 0x14003fb97
mov r8d, 0xa
lea rdx, str.Detachable
jmp 0x14003fb97
lea rdx, str.Unknown
mov r8d, 7
lea rcx, [0x1400d11f0]
call fcn.140001a40
mov ecx, 0x48
call fcn.14005da5c
mov qword [rbp - 0x40], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov rcx, rax
call fcn.14005b210
mov rdi, rax
mov qword [rbp - 0x40], rax
lea rdx, str.ROOTcimv2
mov rcx, rax
call fcn.14005b2e0
lea rdx, str.SELECT__FROM_Win32_ComputerSystem
mov rcx, rdi
call fcn.14005b4b0
nop
mov ebx, r12d
cmp dword [rdi + 0x20], r12d
jle 0x14003fc5e
mov rax, qword [rdi + 0x18]
cmp qword [rax], rbx
je 0x14003fc5e
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.PCSystemType
call qword [rax + 0x20]
test eax, eax
jne 0x14003fc5e
cmp word [rbp - 0x80], 2
jb 0x14003fc5e
mov r14b, 1
movzx eax, word [rbp - 0x78]
mov word [rsp + 0x30], ax
jmp 0x14003fc61
xor r14b, r14b
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [rdi + 0x20], ebx
jle 0x14003fcc1
mov rax, qword [rdi + 0x18]
cmp qword [rax], rbx
je 0x14003fcc1
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.PCSystemTypeEx
call qword [rax + 0x20]
test eax, eax
jne 0x14003fcc1
cmp word [rbp - 0x80], 2
jb 0x14003fcc1
mov sil, 1
movzx eax, word [rbp - 0x78]
mov word [rsp + 0x34], ax
jmp 0x14003fcc4
xor sil, sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r14b, r14b
je 0x14003fcf0
mov eax, 1
cmp ax, word [rsp + 0x30]
jne 0x14003fce3
mov ebx, eax
jmp 0x14003fcf0
mov eax, 2
cmp ax, word [rsp + 0x30]
cmove ebx, eax
test sil, sil
je 0x14003fd03
mov eax, 3
cmp r13w, word [rsp + 0x34]
cmove ebx, eax
lea rcx, [0x1400d11f0]
test ebx, ebx
je 0x14003fd3f
sub ebx, 1
je 0x14003fd36
sub ebx, 1
je 0x14003fd2a
cmp ebx, 1
jne 0x14003fd3f
lea r8d, [rbx + 5]
lea rdx, str.Tablet
jmp 0x14003fd4c
mov r8, r13
lea rdx, str.Notebook
jmp 0x14003fd4c
lea rdx, str.Desktop
jmp 0x14003fd46
lea rdx, str.Unknown
mov r8d, 7
call fcn.140001a40
mov ecx, 0x48
call fcn.14005da5c
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov rcx, rax
call fcn.14005b210
mov rbx, rax
mov qword [rbp - 0x38], rax
lea rdx, str.ROOTcimv2
mov rcx, rax
call fcn.14005b2e0
lea rdx, str.SELECT__FROM_Win32_OperatingSystem
mov rcx, rbx
call fcn.14005b4b0
nop
lea r9, [0x1400d1210]
lea r8, str.Caption
xor edx, edx
mov rcx, rbx
call fcn.14005b860
lea r9, [0x1400d1230]
lea r8, str.OSArchitecture
xor edx, edx
mov rcx, rbx
call fcn.14005b860
lea r9, [0x1400d1250]
lea r8, str.Version
xor edx, edx
mov rcx, rbx
call fcn.14005b860
nop
test rbx, rbx
je 0x14003fe09
mov rcx, rbx
call fcn.14005be60
nop
mov rcx, rdi
call fcn.14005be60
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14003fe4f
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fe4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ffbb
call fcn.14005da54
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14003fe9d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fe98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ffc1
call fcn.14005da54
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
lea rcx, [rbp + 0x60]
call fcn.1400020b0
nop
lea rcx, [rbp - 0x30]
call fcn.1400020b0
nop
mov rcx, qword [r15]
test rcx, rcx
je 0x14003ff15
mov rdx, qword [r15 + 8]
call fcn.140045f40
mov rcx, qword [r15]
mov rdx, qword [r15 + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x14003ff05
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ffaf
mov rcx, r8
call fcn.14005da54
mov qword [r15], r12
mov qword [r15 + 8], r12
mov qword [r15 + 0x10], r12
mov edx, SafeArrayPutElement
mov rcx, r15
call fcn.14005da54
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003ff69
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ff56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ffc7
call fcn.14005da54
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003ff78
call fcn.14005be60
lea rax, [0x1400d11b0]
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14005da30
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140064eec
nop
call fcn.140064eec
int3
call fcn.140064eec
nop
call fcn.140064eec
nop
call fcn.140064eec
int3