Function at 0x434a40
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x1f0
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor esi, esi
mov dword [rsp + 0x50], esi
mov byte [rsp + 0x58], sil
lea edx, [rsi + 2]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov dword [rsp + 0x5c], eax
test eax, eax
js 0x434da2
mov byte [rsp + 0x58], 1
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x1d8], rsi
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
lea r9, [0x004b5b38]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x004b5b28]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0x434dd1
mov rdi, qword [rsp + 0x178]
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x434dfd
mov rax, qword [rdi]
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x18]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x434e07
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
test eax, eax
js 0x434e33
mov r14, qword [rsp + 0x168]
lea rcx, str.SELECT__FROM_Win32_OperatingSystem
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x434e5f
lea rcx, [0x004c0e08]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x434e6a
mov rax, qword [r14]
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0x30
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call qword [rax + 0xa0]
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
js 0x434e75
mov dword [rsp + 0x158], esi
mov qword [rsp + 0x160], rsi
mov rcx, qword [rsp + 0x170]
mov rax, qword [rcx]
lea rdx, [rsp + 0x158]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x160]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x160]
test eax, eax
jne 0x434d18
test rcx, rcx
je 0x434d18
cmp dword [rsp + 0x158], 1
jne 0x434d18
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rdi, qword [rsp + 0x160]
lea rcx, str.OperatingSystemSKU
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x434ea3
mov rax, qword [rdi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1c0]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x434ead
mov esi, dword [rsp + 0x1c8]
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x434d24
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x434d41
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x434d55
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x434d69
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x434d76
mov eax, esi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x98]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0x98]
call fcn.004a2510
nop
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0xb8]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0xb8]
call fcn.004a2510
mov ecx, 0x8007000e
call fcn.00431900
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, edi
lea rcx, [rsp + 0xd8]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0xd8]
call fcn.004a2510
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0xf8]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0xf8]
call fcn.004a2510
mov ecx, 0x8007000e
call fcn.00431900
nop
mov ecx, 0x8007000e
call fcn.00431900
nop
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, [rsp + 0x118]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0x118]
call fcn.004a2510
nop
mov ecx, 0x8007000e
call fcn.00431900
lfence
xor r9d, r9d
xor r8d, r8d
mov edx, edi
lea rcx, [rsp + 0x138]
call fcn.0042ad60
lea rdx, [0x004e7930]
lea rcx, [rsp + 0x138]
call fcn.004a2510
int3
jmp 0x434a40