Function at 0x140068f40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov esi, ecx
xor edi, edi
lea rcx, str.ROOTCIMV2
mov rbx, rdx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
test rbx, rbx
je 0x140068f95
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140068f95
mov rcx, qword [rbx]
lea r8, str.WMI_Vm_Detection_Mechanism
lea edx, [rdi + 9]
mov r9d, 0x161
call rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebp, eax
test eax, eax
jns 0x140068fe4
cmp eax, 0x80010106
je 0x140068fe4
test rbx, rbx
je 0x140068fd4
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140068fd4
mov rcx, qword [rbx]
lea r8, str.WMI_CoInitializeEx_failure
mov r9d, 0x168
mov edx, 9
call rax
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
jmp 0x1400692cb
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14006904c
cmp eax, 0x80010119
je 0x14006904c
test rbx, rbx
je 0x140069249
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140069249
mov rcx, qword [rbx]
lea r8, str.WMI_CoInitializeSecurity_failure
mov r9d, 0x171
mov edx, 9
call rax
jmp 0x140069249
xor edx, edx
lea rax, [rsp + 0x80]
lea r9, [0x14010d250]
lea r8d, [rdx + 1]
lea rcx, [0x14010d320]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400690a9
test rbx, rbx
je 0x140069249
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140069249
mov rcx, qword [rbx]
lea r8, str.WMI_CoCreateInstance_failure
mov r9d, 0x17a
mov edx, 9
call rax
jmp 0x140069249
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x78]
xor r9d, r9d
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [rax + 0x18]
test eax, eax
jns 0x140069113
test rbx, rbx
je 0x140069249
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140069249
mov rcx, qword [rbx]
lea r8, str.WMI_ConnectServer_failure
mov r9d, 0x182
mov edx, 9
call rax
jmp 0x140069249
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea edx, [r9 + 0xa]
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140069177
test rbx, rbx
je 0x140069249
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140069249
mov rcx, qword [rbx]
lea r8, str.WMI_CoSetProxyBlanket_failure
mov r9d, 0x193
mov edx, 9
call rax
jmp 0x140069249
cmp esi, 1
jne 0x1400691ae
test rbx, rbx
je 0x14006919f
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14006919f
mov rcx, qword [rbx]
lea r8, str.WMI_checking_for_VM_WMI_HYPERV
lea edx, [rsi + 8]
mov r9d, 0x199
call rax
lea rcx, [rsp + 0x78]
call fcn.1400688a0
jmp 0x140069247
test esi, esi
jne 0x1400691e1
test rbx, rbx
je 0x1400691d5
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400691d5
mov rcx, qword [rbx]
lea r8, str.WMI_checking_for_VM_WMI_VMWARE
lea edx, [rsi + 9]
mov r9d, 0x19e
call rax
lea rcx, [rsp + 0x78]
call fcn.140068a30
jmp 0x140069247
cmp esi, 2
jne 0x140069215
test rbx, rbx
je 0x140069209
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140069209
mov rcx, qword [rbx]
lea r8, str.WMI_checking_for_VM_WMI_VIRTUALBOX
lea edx, [rsi + 7]
mov r9d, 0x1a3
call rax
lea rcx, [rsp + 0x78]
call fcn.140068bd0
jmp 0x140069247
cmp esi, 4
jne 0x140069249
test rbx, rbx
je 0x14006923d
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14006923d
mov rcx, qword [rbx]
lea r8, str.WMI_checking_for_VM_WMI_PARALLELS
lea edx, [rsi + 5]
mov r9d, 0x1a8
call rax
lea rcx, [rsp + 0x78]
call fcn.140068db0
mov edi, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140069259
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14006926c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
cmp ebp, 0x80010106
je 0x14006927a
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x1400692a4
test rbx, rbx
je 0x1400692c9
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400692c9
mov r9d, 0x1c2
lea r8, str.WMI_Vm_Detection_Mechanism_positive_result
jmp 0x1400692bf
test rbx, rbx
je 0x1400692c9
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400692c9
mov r9d, 0x1c6
lea r8, str.WMI_Vm_Detection_Mechanism_negative_result
mov rcx, qword [rbx]
mov edx, 9
call rax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret