Function at 0x140057b10
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x20], rbx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140057d5d
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140057d57
lea rax, [rbp + 0x28]
xor edx, edx
lea r9, [0x1401665e0]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x1401665f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140057d57
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
lea rdx, str.ROOTCIMV2
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rax, qword [rcx]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [rax + Ordinal_26]
test eax, eax
js 0x140057d4d
mov rcx, qword [rbp + 0x20]
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov edx, 0xa
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov rcx, qword [rbp + 0x20]
test eax, eax
js 0x140057d47
mov qword [rbp + 0x30], rbx
lea rdx, [rbp + 0x30]
mov rax, qword [rcx]
lea r8, str.SELECT__FROM_Win32_BIOS
mov qword [rsp + 0x28], rdx
mov r9d, Ordinal_50
lea rdx, [0x140177bc8]
mov qword [rsp + 0x20], rbx
call qword [rax + 0xa0]
test eax, eax
js 0x140057d43
mov rcx, qword [rbp + 0x30]
mov qword [rbp - 0x28], rbx
mov dword [rbp + 0x18], ebx
test rcx, rcx
je 0x140057d3d
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x28]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x18], ebx
je 0x140057d39
mov rcx, qword [rbp - 0x28]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x28], rbx
lea rdx, str.Manufacturer
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, qword [rbp - 0x18]
lea rdx, str.VirtualBox
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140057cf8
mov rcx, qword [rbp - 0x18]
lea rdx, str.VMware
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140057cf8
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x140057c60
jmp 0x140057d3d
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
add rsp, 0x78
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
add rsp, 0x78
pop rbx
pop rbp
ret