Function at 0x14004e290
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rsi, rcx
xor r12d, r12d
mov dword [rbp - 9], r12d
mov qword [rbp - 0x69], r12
mov qword [rbp + 0x7f], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14004e320
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, Ordinal_50
call fcn.14012aef8
mov qword [rsi], rax
mov qword [rsi + 0x10], reloc.WLDAP32.dll_Ordinal_32
mov qword [rsi + 0x18], Ordinal_50
movups xmm0, xmmword [str.Failed_to_initialize_COM_library]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140172f10]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], r12b
mov rax, rsi
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14004e3b4
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14012aef8
mov rdx, rax
mov qword [rsi], rax
mov qword [rsi + 0x10], Ordinal_33
mov qword [rsi + 0x18], Ordinal_33
movups xmm0, xmmword [str.Failed_to_initialize_security]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140172f38]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140172f40]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x140172f44]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], r12b
jmp 0x14004e30b
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9, [0x14015b548]
xor edx, edx
mov r8d, 1
lea rcx, [0x14015b558]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14004e42f
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, Ordinal_50
call fcn.14012aef8
mov qword [rsi], rax
mov qword [rsi + 0x10], Ordinal_41
mov qword [rsi + 0x18], Ordinal_50
movups xmm0, xmmword [str.Failed_to_create_IWbemLocator_object]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140172f58]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140172f68]
mov dword [rax + 0x20], ecx
mov byte [rax + 0x24], r12b
jmp 0x14004e30b
mov rax, qword [rbp - 0x69]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, Ordinal_26
call fcn.14012aef8
mov rbx, rax
mov qword [rbp + 0x77], rax
test rax, rax
je 0x14004e476
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14004eb3c
jmp 0x14004e479
mov rbx, r12
mov qword [rbp + 0x77], rbx
test rbx, rbx
je 0x14004eb58
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x69]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14004e4f3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004e4d4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004e4e6
call fcn.14012b174
mov qword [rbx + 8], r12
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14012b174
test edi, edi
jns 0x14004e542
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14012aef8
mov qword [rsi], rax
mov qword [rsi + 0x10], Ordinal_30
mov qword [rsi + 0x18], Ordinal_33
movups xmm0, xmmword [str.Could_not_connect_to_WMI]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140172f98]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
jmp 0x14004e30b
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14004e5d8
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14012aef8
mov rdx, rax
mov qword [rsi], rax
mov qword [rsi + 0x10], reloc.WLDAP32.dll_Ordinal_27
mov qword [rsi + 0x18], Ordinal_33
movups xmm0, xmmword [str.Could_not_set_proxy_blanket]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140172fb8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140172fc0]
mov word [rax + 0x18], cx
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], 0
jmp 0x14004e30b
mov qword [rbp - 0x61], r12
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
mov ecx, Ordinal_26
call fcn.14012aef8
mov rbx, rax
mov qword [rbp + 0x77], rax
test rax, rax
je 0x14004e61c
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.SELECT_SerialNumber_FROM_Win32_PhysicalMedia
call fcn.14012c1d0
mov qword [rbx], rax
jmp 0x14004e61f
mov rbx, r12
mov qword [rbp + 0x77], rbx
test rbx, rbx
je 0x14004eb58
mov r14, qword [rbx]
mov ecx, Ordinal_26
call fcn.14012aef8
mov rdi, rax
mov qword [rbp - 0x31], rax
test rax, rax
je 0x14004e661
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x140172ff8]
call fcn.14012c1d0
mov qword [rdi], rax
jmp 0x14004e664
mov rdi, r12
mov qword [rbp - 0x31], rdi
test rdi, rdi
je 0x14004eb63
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, Ordinal_50
mov r8, r14
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x7f]
call r15
mov r14d, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14004e6d5
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004e6b5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14004e6c7
call fcn.14012b174
mov qword [rdi + 8], r12
mov edx, Ordinal_26
mov rcx, rdi
call fcn.14012b174
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14004e714
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004e6f5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004e707
call fcn.14012b174
mov qword [rbx + 8], r12
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14012b174
xorps xmm0, xmm0
test r14d, r14d
jns 0x14004e77a
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov ecx, Ordinal_50
call fcn.14012aef8
mov rdx, rax
mov qword [rsi], rax
mov qword [rsi + 0x10], reloc.WLDAP32.dll_Ordinal_35
mov qword [rsi + 0x18], Ordinal_50
movups xmm0, xmmword [str.Query_for_disk_serial_number_failed]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140173010]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140173020]
mov word [rax + 0x20], cx
movzx eax, byte [0x140173022]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
jmp 0x14004e30b
mov qword [rbp - 0x59], r12
mov dword [rbp + 0x6f], r12d
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14004e8e7
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x59]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x6f], 0
je 0x14004e8e7
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x51]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdi, qword [rbp - 0x49]
mov ecx, Ordinal_26
call fcn.14012aef8
mov rbx, rax
mov qword [rbp - 0x31], rax
test rax, rax
je 0x14004e83b
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14004e83e
test rdi, rdi
jne 0x14004eb47
jmp 0x14004e83e
mov rbx, r12
mov qword [rbp + 0x77], rbx
test rbx, rbx
je 0x14004eb6e
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14004e860
mov rcx, qword [rbx]
call fcn.14012c0b0
mov qword [rbx + 8], rax
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004e870
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140029ce0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14004e8c6
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004e8a7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004e8b9
call fcn.14012b174
mov qword [rbx + 8], r12
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14012b174
lea rcx, [rbp - 0x51]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x61]
test rcx, rcx
jne 0x14004e7b0
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdi, qword [rbp - 0x19]
xorps xmm0, xmm0
test rdi, rdi
jne 0x14004e966
movups xmmword [rbp - 1], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14012aef8
mov qword [rbp - 1], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_22]
movdqu xmmword [rbp + 0xf], xmm0
movups xmm0, xmmword [str.No_Serial_Number_found]
movups xmmword [rax], xmm0
mov ecx, dword [0x140173058]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14017305c]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], dil
lea rax, [rbp - 1]
mov ebx, 2
jmp 0x14004ea44
movups xmmword [rbp - 0x51], xmm0
lea r14, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova r14, qword [rbp - 0x29]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x14004eb36
cmp rdi, 0xf
ja 0x14004e9aa
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x51], xmm0
jmp 0x14004ea3b
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14004e9e6
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14012aef8
mov rcx, rax
test rax, rax
je 0x14004eae2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004ea20
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14004ea03
mov rax, r12
jmp 0x14004ea20
cmp rcx, 0x1000
jb 0x14004ea1b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004eb52
jmp 0x14004e9c4
call fcn.14012aef8
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x51]
mov ebx, 4
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or ebx, 1
test bl, 4
je 0x14004eaab
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x39]
cmp rdx, 0xf
jbe 0x14004eaab
inc rdx
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eaa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eaa5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b174
nop
test bl, 2
je 0x14004eaef
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x14004eaef
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eae9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b174
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14004e30b
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eb2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eb2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b174
jmp 0x14004e30b
call fcn.140020ed0
nop
mov ecx, 0x8007000e
call fcn.14012c0a0
nop
mov ecx, 0x8007000e
call fcn.14012c0a0
nop
call fcn.140002b20
nop
mov ecx, 0x8007000e
call fcn.14012c0a0
nop
mov ecx, 0x8007000e
call fcn.14012c0a0
nop
mov ecx, 0x8007000e
call fcn.14012c0a0
int3