Function at 0x180001770
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov r14, rcx
mov qword [rbp - 0x40], rcx
xor r13d, r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1800017fc
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x180001817
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], r13b
jmp 0x1800021be
mov qword [rbp - 0x48], r13
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x1800649e8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1800649f8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800017f6
mov qword [rbp - 0x50], r13
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.1800611cc
mov rbx, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x180001899
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800021fe
jmp 0x18000189c
mov rbx, r13
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x180002225
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x48]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180001916
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800018f7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001909
call fcn.1800610e0
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.1800610e0
test edi, edi
js 0x180001956
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x180001982
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
jmp 0x1800021be
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov qword [rbp - 0x38], r13
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.1800611cc
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1800019ea
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_Processor
call fcn.180060d90
mov qword [rbx], rax
jmp 0x1800019ed
mov rbx, r13
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x180002230
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.1800611cc
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180001a3c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x180064b48]
call fcn.180060d90
mov qword [rdi], rax
jmp 0x180001a3f
mov rdi, r13
mov qword [rbp - 0x68], rdi
test rdi, rdi
je 0x18000223b
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r15
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x180001aaf
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001a8f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180001aa1
call fcn.1800610e0
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1800610e0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180001aee
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001acf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001ae1
call fcn.1800610e0
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.1800610e0
test esi, esi
js 0x180001c93
mov qword [rbp - 0x28], r13
mov dword [rbp + 0x10], r13d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x180001c8d
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x28]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x10], 0
je 0x180001c89
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, str.ProcessorId
call qword [rax + 0x20]
test eax, eax
js 0x180001c70
mov rbx, qword [rbp - 0x18]
mov ecx, 0x18
call fcn.1800611cc
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180001bae
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x180001bb1
test rbx, rbx
jne 0x180002209
jmp 0x180001bb1
mov rdi, r13
mov qword [rbp + 0x58], rdi
test rdi, rdi
je 0x180002246
mov rax, qword [rdi + 8]
test rax, rax
jne 0x180001bd3
mov rcx, qword [rdi]
call fcn.180060c70
mov qword [rdi + 8], rax
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180001be0
mov rcx, qword [rbp + 0x50]
cmp rsi, rcx
ja 0x180001c17
lea rbx, [rbp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x38]
mov qword [rbp + 0x48], rsi
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x180001c26
mov r9, rax
mov rdx, rsi
lea rcx, [rbp + 0x38]
call fcn.180003cc0
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x180001c70
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001c51
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180001c63
call fcn.1800610e0
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1800610e0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
jne 0x180001b10
jmp 0x180001c8d
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov qword [rbp - 0x30], r13
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r15, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.1800611cc
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180001cfb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_BIOS
call fcn.180060d90
mov qword [rbx], rax
jmp 0x180001cfe
mov rbx, r13
mov qword [rbp - 0x60], rbx
test rbx, rbx
je 0x180002251
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.1800611cc
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180001d4d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x180064b48]
call fcn.180060d90
mov qword [rdi], rax
jmp 0x180001d50
mov rdi, r13
mov qword [rbp - 0x58], rdi
test rdi, rdi
je 0x18000225c
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x50]
call r15
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x180001dc0
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001da0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180001db2
call fcn.1800610e0
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1800610e0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180001dff
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001de0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001df2
call fcn.1800610e0
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.1800610e0
test esi, esi
js 0x180001fa3
mov qword [rbp - 0x40], r13
mov dword [rbp + 0x14], r13d
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180001f9d
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x14]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x14], 0
je 0x180001f99
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 8]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + 0x20]
test eax, eax
js 0x180001f80
mov rbx, qword [rbp]
mov ecx, 0x18
call fcn.1800611cc
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180001ebe
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x180001ec1
test rbx, rbx
jne 0x180002214
jmp 0x180001ec1
mov rdi, r13
mov qword [rbp + 0x60], rdi
test rdi, rdi
je 0x180002267
mov rax, qword [rdi + 8]
test rax, rax
jne 0x180001ee3
mov rcx, qword [rdi]
call fcn.180060c70
mov qword [rdi + 8], rax
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180001ef0
mov rcx, qword [rbp + 0x30]
cmp rsi, rcx
ja 0x180001f27
lea rbx, [rbp + 0x18]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x18]
mov qword [rbp + 0x28], rsi
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x180001f36
mov r9, rax
mov rdx, rsi
lea rcx, [rbp + 0x18]
call fcn.180003cc0
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x180001f80
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001f61
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180001f73
call fcn.1800610e0
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.1800610e0
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x180001e20
jmp 0x180001f9d
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r15, qword [rbp + 0x48]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 5
jb 0x1800021f8
lea r12, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova r12, qword [rbp + 0x38]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rsi, [r15 + 5]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp rsi, rbx
jbe 0x180002088
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x180002049
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800611cc
test rax, rax
je 0x18000211d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180002083
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180002071
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000221f
jmp 0x18000202a
test rcx, rcx
je 0x180002080
call fcn.1800611cc
mov rdi, rax
jmp 0x180002083
mov rdi, r13
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
mov eax, dword [str.SAGO_]
mov dword [rdi], eax
movzx eax, byte [0x180064ba8]
mov byte [rdi + 4], al
lea rcx, [rdi + 5]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.180003730
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x180002129
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002124
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800610e0
movups xmmword [r14], xmm6
movups xmmword [r14 + 0x10], xmm7
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x180002170
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000216b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000216b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800610e0
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x1800021be
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800021b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800021b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800610e0
mov rax, r14
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.1800610c0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800012b0
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
call fcn.180001210
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
nop
mov ecx, 0x8007000e
call fcn.180060c60
int3