Function at 0x1000955c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xb8
mov eax, 0x10085834
call fcn.1006d55a
xor ebx, ebx
mov dword [ebp - 0xa8], ebx
lea eax, [ebp - 0xa8]
push eax
push 0x1008ae74
push 0x17
push ebx
push 0x100b8f68
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x100097b7
mov dword [ebp - 0xac], ebx
mov esi, dword [ebp - 0xa8]
push str.rootcimv2
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.10009083
mov ecx, dword [esi]
lea edx, [ebp - 0xac]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [eax]
mov byte [ebp - 4], 2
push esi
call dword [ecx + 0xc]
push dword [ebp - 0xa0]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
call edi
test esi, esi
js 0x100097a3
mov dword [ebp - 0xa4], ebx
push str.Select_Name_from_Win32_ComputerSystemProduct
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.10009083
mov esi, dword [ebp - 0xac]
push 4
pop eax
push 0x1008aef8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], al
call fcn.1000904e
mov ecx, dword [esi]
lea edx, [ebp - 0xa4]
push edx
push ebx
push 0x20
push dword [ebp - 0xa0]
mov byte [ebp - 4], 5
push dword [eax]
push esi
call dword [ecx + 0x50]
push dword [ebp - 0x14]
mov esi, eax
call edi
test esi, esi
js 0x10009787
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xb4]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0xb0]
push edx
push 1
push 0xffffffffffffffff
push eax
mov byte [ebp - 4], 6
call dword [ecx + 0x10]
test eax, eax
js 0x10009771
push 0x10
lea eax, [ebp - 0xc4]
push ebx
push eax
call fcn.1006de50
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [0x100c47a0]
imul eax, eax
push 0x11
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 7
cmp edx, 0xa
jne 0x100096e9
mov eax, dword [str.sZj7RKx]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1008af80]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.1006d400
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
add esp, 0xc
mov eax, dword [ebp - 0xb0]
push ebx
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0xc4]
push edx
push ebx
push 0x1008af84
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10009764
cmp dword [ebp - 0xbc], 0
je 0x10009764
push 3
push dword [ebp - 0xbc]
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
call fcn.10009950
push str.VirtualBox
push dword [ebp - 0x9c]
call fcn.1006e4b0
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [ebp - 0x98]
pop ecx
inc bl
pop ecx
cmp dword [ebp - 0x9c], eax
je 0x10009764
push dword [ebp - 0x9c]
call fcn.1006e57a
pop ecx
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 4
pop eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x10009787
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0xa0]
call edi
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 4], 1
test eax, eax
je 0x100097a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0
test eax, eax
je 0x100097b7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xa8]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100097cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
call fcn.1006d509
ret