Function at 0x10007377
Capabilities:
Connect to wmi namespace via wbemlocator
Get hostname
Query or enumerate registry value
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
sub esp, 0x654
lea ebp, [esp - 4]
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x654], eax
push 0x104
mov eax, 0x10022689
call fcn.10010f10
mov eax, dword [ebp + 0x660]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
jge 0x100073d1
cmp eax, 0x80010119
jne 0x10007942
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x34]
push eax
push 0x10024f9c
push 1
push ebx
push 0x1002506c
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x10007931
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x34]
push 0x10026920
lea esi, [ebp - 0x18]
call fcn.10001f77
lea edx, [ebp - 0x28]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ecx, dword [edi]
push ebx
push eax
push edi
call dword [ecx + 0xc]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
call edi
cmp esi, ebx
jl 0x10007921
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
cmp eax, ebx
jl 0x10007921
mov dword [ebp - 0x110], str.SELECT__FROM_Win32_BIOS_WHERE__SerialNumber_IS_NOT_NULL_
mov dword [ebp - 0x10c], str.SoftwareElementID
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], str.SELECT__FROM_Win32_Processor_WHERE__ProcessorId_IS_NOT_NULL_
mov dword [ebp - 0x100], str.ProcessorId
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], str.SELECT__FROM_Win32_DiskDrive_WHERE__PNPDeviceID_IS_NOT_NULL__AND__NOT__InterfaceType__USB__
mov dword [ebp - 0xf4], str.Signature
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], str.SELECT__FROM_Win32_NetworkAdapter_WHERE__MACAddress_IS_NOT_NULL__AND__NOT__PNPDeviceID_LIKE_ROOT___
mov dword [ebp - 0xe8], str.MACAddress
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0xe0], str.SELECT__FROM_Win32_BaseBoard_WHERE__SerialNumber_IS_NOT_NULL_
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], str.SELECT__FROM_Win32_OperatingSystem
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], str.SELECT__FROM_Win32_PhysicalMemory
mov dword [ebp - 0xc4], str.PartNumber
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], str.SELECT__FROM_Win32_UserAccount
mov dword [ebp - 0xb8], 0x10026d90
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], str.SELECT__FROM_Win32_SoundDevice_WHERE__PNPDeviceID_IS_NOT_NULL_
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], 0x1b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x50]
jge 0x10007921
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
push dword [ebp + eax*4 - 0x110]
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x1c], ecx
call fcn.10001f77
mov dword [ebp - 0x18], eax
push 0x10026e18
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.1000200b
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
lea esi, [ebp - 0x20]
push esi
push ebx
push 0x30
push ecx
push eax
push dword [ebp - 0x1c]
call dword [edx + 0x50]
push dword [ebp - 0x44]
mov esi, eax
call edi
push dword [ebp - 0x4c]
call edi
cmp esi, ebx
jl 0x100078e5
cmp dword [ebp - 0x20], ebx
je 0x100078e5
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x30], ebx
mov word [ebp + 0x20], ax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x100078bf
mov dword [ebp - 0x1c], ebx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x1c]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 8
mov ecx, dword [eax]
push eax
mov dword [ebp - 0x18], 0x80004005
call dword [ecx + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 7
jmp 0x1000761e
cmp dword [ebp - 0x18], ebx
jl 0x100078ae
cmp dword [ebp - 0x1c], ebx
je 0x100078ae
cmp dword [ebp - 0x30], ebx
je 0x100078ae
push 0x10026e1c
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 0x11], bl
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1c]
push str.SerialNumber
lea esi, [ebp - 0x54]
mov dword [ebp - 0x18], eax
call fcn.1000200b
push ebx
push ebx
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x74]
push esi
push ebx
push eax
push ecx
call dword [edx + 0x10]
mov byte [ebp - 4], 0xa
push dword [ebp - 0x54]
mov esi, eax
call edi
cmp esi, ebx
jl 0x100076ad
cmp word [ebp - 0x74], 8
jne 0x100076ad
cmp dword [ebp - 0x6c], ebx
je 0x100076ad
push dword [ebp - 0x6c]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
mov byte [ebp - 0x11], 1
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x1c]
push str.PNPDeviceID
lea esi, [ebp - 0x38]
mov dword [ebp - 0x18], eax
call fcn.1000200b
push ebx
push ebx
mov byte [ebp - 4], 0xd
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x64]
push esi
push ebx
push eax
push ecx
call dword [edx + 0x10]
mov byte [ebp - 4], 0xc
push dword [ebp - 0x38]
mov esi, eax
call edi
cmp esi, ebx
jl 0x10007710
cmp word [ebp - 0x64], 8
jne 0x10007710
cmp dword [ebp - 0x5c], ebx
je 0x10007710
push dword [ebp - 0x5c]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + eax*4 - 0x10c]
cmp esi, ebx
je 0x1000777d
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push ebx
push ebx
lea edx, [ebp - 0x94]
push edx
push ebx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x1000776c
cmp word [ebp - 0x94], 8
jne 0x1000776c
cmp dword [ebp - 0x8c], ebx
je 0x1000776c
push dword [ebp - 0x8c]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
mov byte [ebp - 0x11], 1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x94]
push eax
call esi
jmp 0x10007783
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp byte [ebp - 0x11], bl
je 0x10007896
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x1c]
push str.name
lea esi, [ebp - 0x40]
mov dword [ebp - 0x18], eax
call fcn.1000200b
push ebx
push ebx
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0x84]
push esi
push ebx
push eax
push ecx
call dword [edx + 0x10]
mov byte [ebp - 4], 0xf
push dword [ebp - 0x40]
mov esi, eax
call edi
cmp esi, ebx
jl 0x10007802
cmp word [ebp - 0x84], 8
jne 0x10007802
cmp dword [ebp - 0x7c], ebx
je 0x10007802
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
push 0x10026e48
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1c]
push str.Manufacturer
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x18], eax
call fcn.1000200b
push ebx
push ebx
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
lea esi, [ebp - 0xa4]
push esi
push ebx
push eax
push ecx
call dword [edx + 0x10]
mov byte [ebp - 4], 0x11
push dword [ebp - 0x3c]
mov esi, eax
call edi
cmp esi, ebx
jl 0x1000787e
cmp word [ebp - 0xa4], 8
jne 0x1000787e
cmp dword [ebp - 0x9c], ebx
je 0x1000787e
push dword [ebp - 0x9c]
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
push 0x10026e48
lea eax, [ebp + 0x1c]
push eax
call fcn.10004474
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xa4]
push eax
call esi
lea eax, [ebp - 0x84]
push eax
call esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x108], ebx
lea eax, [ebp - 0x64]
push eax
jne 0x100078ff
call esi
lea eax, [ebp - 0x74]
push eax
call esi
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x100078bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x10026e5c
push dword [ebp - 0x2c]
call fcn.10004474
mov ecx, dword [ebp - 0x2c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1c]
call fcn.10002882
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.10001c67
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x100078f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add dword [ebp - 0x24], 3
jmp 0x10007540
call esi
lea eax, [ebp - 0x74]
push eax
call esi
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x100075cf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100075cf
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x10007931
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x10007942
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], ebx
jne 0x10007aaf
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x44c], ax
lea eax, [ebp + 0x44e]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x44c]
push eax
lea eax, [ebp - 0x20]
push eax
mov edi, 0x10026e60
push edi
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100079bc
cmp word [ebp + 0x44c], bx
je 0x100079bc
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x44c]
call fcn.10001bed
jmp 0x10007a4c
call fcn.10003904
test eax, eax
je 0x10007a4c
lea eax, [ebp - 0x28]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007a4c
cmp dword [ebp - 0x28], ebx
je 0x10007a4c
push 0x208
lea eax, [ebp + 0x44c]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x44c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007a43
cmp word [ebp + 0x44c], bx
je 0x10007a43
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x44c]
call fcn.10001bed
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push esi
mov word [ebp + 0x244], ax
lea eax, [ebp + 0x246]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x244]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Default_User_ID
push str.Identities
push SysReAllocStringLen
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10007aaf
cmp word [ebp + 0x244], bx
je 0x10007aaf
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp + 0x244]
call fcn.10001bed
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.10001cae
push 0x13
pop esi
lea eax, [ebp]
mov dword [ebp - 4], esi
push eax
mov byte [ebp - 4], 0x14
call fcn.10007157
pop ecx
mov dword [ebp - 4], esi
jmp 0x10007ae7
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 4]
jae 0x10007af3
lea ecx, [ebp + 4]
lea eax, [ebp + 0x1c]
push eax
call fcn.10003a58
pop ecx
mov ecx, dword [ebp - 0x2c]
push 0xffffffffffffffff
push ebx
mov byte [ebp - 4], 0x16
call fcn.10002882
push ebx
push 1
lea esi, [ebp + 0x1c]
mov byte [ebp - 4], 0x13
call fcn.10001c67
xor eax, eax
push 0x208
mov word [ebp + 0x38], ax
lea eax, [ebp + 0x3a]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push 4
mov dword [ebp - 0x48], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x2c]
call fcn.10004474
push ebx
push 1
lea ecx, [ebp]
call fcn.10001b16
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x654]
xor ecx, ebp
call fcn.1000e51f
add ebp, 0x658
leave
ret