Function at 0x1800f0ac0
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x150], rax
movzx r13d, cx
xor r14d, r14d
mov r12d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x58], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x1800f0b27
xor eax, eax
jmp 0x1800f1272
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov edi, 3
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov r15d, 0xffffffff
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1800f124b
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x180142b28]
xor edx, edx
lea r8d, [rdi - 2]
lea rcx, [0x180142bf8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800f124b
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov qword [rbp - 0x20], r14
lea ecx, [rdi + 0x15]
cmp dword [rbp + 0x34], 6
jae 0x1800f0c01
call fcn.1800f3074
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1800f0bef
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], 1
lea rcx, [0x180164650]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800f12ad
jmp 0x1800f0bf2
mov rbx, r14
mov qword [rbp - 0x20], rbx
test rbx, rbx
je 0x1800f12b8
jmp 0x1800f0c51
call fcn.1800f3074
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1800f0c41
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], 1
lea rcx, str.._rootCIMV2TerminalServices
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800f12c3
jmp 0x1800f0c44
mov rbx, r14
mov qword [rbp - 0x20], rbx
test rbx, rbx
je 0x1800f12e4
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
test eax, eax
js 0x1800f120a
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1800f120a
mov qword [rbp - 0x60], r14
mov ecx, 0x18
call fcn.1800f3074
mov rdi, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1800f0cfd
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r14
mov dword [rdi + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_TerminalServiceSetting
call fcn.180111960
mov qword [rdi], rax
jmp 0x1800f0d00
mov rdi, r14
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x1800f12ef
mov ecx, 0x18
call fcn.1800f3074
mov rsi, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1800f0d49
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r14
mov dword [rsi + 0x10], 1
lea rcx, [0x1801646dc]
call fcn.180111960
mov qword [rsi], rax
jmp 0x1800f0d4c
mov rsi, r14
mov qword [rsp + 0x68], rsi
test rsi, rsi
je 0x1800f12fa
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov r8, qword [rdi]
mov rdx, qword [rsi]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, r15d
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x1800f0dca
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800f0da6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1800f0dbc
call sym.SafeBase64.dll_SafeBase_free
mov qword [rsi + 8], 0
mov edx, 0x18
mov rcx, rsi
call fcn.18001cc90
nop
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1800f0e0f
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800f0dec
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800f0e02
call sym.SafeBase64.dll_SafeBase_free
mov qword [rdi + 8], 0
mov edx, 0x18
mov rcx, rdi
call fcn.18001cc90
test r14d, r14d
jns 0x1800f0e61
test rbx, rbx
je 0x1800f124b
lock xadd dword [rbx + 0x10], r15d
cmp r15d, 1
jne 0x1800f124b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f0e42
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800f123e
call sym.SafeBase64.dll_SafeBase_free
mov qword [rbx + 8], 0
jmp 0x1800f123e
xor r14d, r14d
mov qword [rbp - 0x68], r14
mov dword [rbp - 0x28], r14d
mov r12d, r14d
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1800f1204
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x68]
mov r8d, 1
mov edx, r15d
call qword [rax + 0x20]
mov edi, eax
cmp dword [rbp - 0x28], 0
je 0x1800f1204
test eax, eax
js 0x1800f0ef6
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 8]
xor r8d, r8d
lea rdx, [0x1801646e0]
call qword [rax + 0x20]
mov edi, eax
test eax, eax
js 0x1800f0eec
cmp word [rbp + 8], 3
jne 0x1800f0eec
cmp dword [rbp + 0x10], 0
jne 0x1800f0ee9
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1800f0e6f
inc r12d
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r12d, r12d
je 0x1800f1204
test edi, edi
js 0x1800f0e6f
movzx ecx, r13w
call sym.SafeBase64.dll_CloseConnect
cmp eax, 2
jne 0x1800f0f1e
lea ecx, [rax + 0x62]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x18
call fcn.1800f3074
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1800f0f64
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r14
mov dword [rdi + 0x10], 1
lea rcx, str.SetAllowTSConnections
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1800f12ce
jmp 0x1800f0f67
mov rdi, r14
mov qword [rbp + 0x20], rdi
test rdi, rdi
je 0x1800f12a2
mov ecx, 0x18
call fcn.1800f3074
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800f0fba
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r14
mov dword [rsi + 0x10], 1
lea rcx, str.Win32_TerminalServiceSetting
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x1800f12d9
jmp 0x1800f0fbd
mov rsi, r14
mov qword [rbp + 0x28], rsi
test rsi, rsi
je 0x1800f1305
mov qword [rbp - 0x50], r14
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
call qword [rax + 0x30]
mov r14d, eax
xor r8d, r8d
mov ecx, r8d
mov qword [rbp - 0x48], rcx
test eax, eax
js 0x1800f1023
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x48]
mov rdx, qword [rdi]
call qword [rax + 0x98]
mov r14d, eax
mov rcx, qword [rbp - 0x48]
xor r8d, r8d
mov r10, r8
mov qword [rbp - 0x78], r8
test r14d, r14d
js 0x1800f1045
mov rax, qword [rcx]
lea r8, [rbp - 0x78]
xor edx, edx
call qword [rax + 0x78]
mov r14d, eax
mov r10, qword [rbp - 0x78]
xor r8d, r8d
mov eax, 3
mov word [rbp - 0x10], ax
mov dword [rbp - 8], r8d
test r14d, r14d
js 0x1800f10ae
mov rax, qword [r10]
mov dword [rsp + 0x20], r8d
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x1801646e0]
mov rcx, r10
call qword [rax + 0x28]
mov r14d, eax
test eax, eax
js 0x1800f10a7
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.__PATH
call qword [rax + 0x20]
mov r14d, eax
xor r8d, r8d
mov r10, qword [rbp - 0x78]
mov qword [rbp - 0x70], r8
test r14d, r14d
js 0x1800f10e9
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r8
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r8
xor r9d, r9d
mov r8, qword [rdi]
mov rdx, qword [rbp - 0x38]
call qword [rax + 0xc0]
mov r14d, eax
movzx ecx, r13w
call sym.SafeBase64.dll_CloseConnect
cmp eax, 2
jne 0x1800f1102
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14d, r14d
js 0x1800f1168
mov dword [rbp - 8], 1
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x1801646e0]
call qword [rax + 0x28]
test eax, eax
js 0x1800f116b
mov rcx, qword [rbp - 0x80]
mov r10, qword [rcx]
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, qword [rdi]
mov rdx, qword [rbp - 0x38]
call qword [r10 + 0xc0]
jmp 0x1800f116b
xor r14d, r14d
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov eax, r15d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x1800f11be
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800f119e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r14
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1800f11b0
call sym.SafeBase64.dll_SafeBase_free
mov qword [rsi + 8], r14
mov edx, 0x18
mov rcx, rsi
call fcn.18001cc90
nop
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1800f0e6f
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800f11e0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r14
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800f11f2
call sym.SafeBase64.dll_SafeBase_free
mov qword [rdi + 8], r14
mov edx, 0x18
mov rcx, rdi
call fcn.18001cc90
jmp 0x1800f0e6f
mov r12d, 1
test rbx, rbx
je 0x1800f124b
lock xadd dword [rbx + 0x10], r15d
cmp r15d, 1
jne 0x1800f124b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f122c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800f123e
call sym.SafeBase64.dll_SafeBase_free
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.18001cc90
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1800f125a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800f1269
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, r12d
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
int3
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
nop
mov ecx, 0x8007000e
call fcn.180111950
int3