Function at 0x180002cd0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x180002d40
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
lea rcx, [0x18005cce0]
call fcn.18000c390
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, ebx
mov rcx, rax
call fcn.1800091c0
mov rcx, rax
call fcn.18000c610
xor eax, eax
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x180002dca
lea rdx, str.Failed_to_initialize_security._Error_code__0x
lea rcx, [0x18005cce0]
call fcn.18000c390
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, ebx
mov rcx, rax
call fcn.1800091c0
mov rcx, rax
call fcn.18000c610
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbp + 0x7f], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [0x1800452b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1800452c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x180002e03
lea rdx, str.Failed_to_create_IWbemLocator_object._Error_code__0x
jmp 0x180002d7e
mov qword [rbp + 0x77], r14
mov ecx, 0x18
call fcn.180019800
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x180002e43
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800032c0
jmp 0x180002e46
mov rbx, r14
mov qword [rbp + 7], rbx
test rbx, rbx
je 0x1800032cb
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180002ec4
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002ea5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002eb7
call fcn.1800197f8
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.1800197f8
test edi, edi
jns 0x180002f14
lea rdx, str.Could_not_connect._Error_code__0x
lea rcx, [0x18005cce0]
call fcn.18000c390
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, edi
mov rcx, rax
call fcn.1800091c0
mov rcx, rax
call fcn.18000c610
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180002db4
lea rdx, str.Connected_to_ROOTCIMV2_WMI_namespace
lea rcx, [0x18005ca20]
call fcn.18000c390
mov rcx, rax
call fcn.18000c610
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x180002fb9
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
lea rcx, [0x18005cce0]
call fcn.18000c390
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, ebx
mov rcx, rax
call fcn.1800091c0
mov rcx, rax
call fcn.18000c610
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180002db4
mov qword [rbp - 1], r14
mov ecx, 0x18
call fcn.180019800
mov rbx, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x180002fef
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_ComputerSystem
call fcn.1800194e0
mov qword [rbx], rax
jmp 0x180002ff2
mov rbx, r14
mov qword [rbp + 0xf], rbx
test rbx, rbx
je 0x1800032cb
mov ecx, 0x18
call fcn.180019800
mov rdi, rax
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x180003031
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x180052334]
call fcn.1800194e0
mov qword [rdi], rax
jmp 0x180003034
mov rdi, r14
mov qword [rbp + 0x17], rdi
test rdi, rdi
je 0x1800032b5
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
lea rdx, [rbp - 1]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1800030aa
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000308a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r14
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18000309c
call fcn.1800197f8
mov qword [rdi + 8], r14
mov edx, 0x18
mov rcx, rdi
call fcn.1800197f8
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1800030e9
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800030ca
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800030dc
call fcn.1800197f8
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.1800197f8
test esi, esi
jns 0x180003143
lea rdx, str.Query_for_operating_system_name_failed._Error_code__0x
lea rcx, [0x18005cce0]
call fcn.18000c390
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
add rdx, rax
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, esi
mov rcx, rax
call fcn.1800091c0
mov rcx, rax
call fcn.18000c610
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180002db4
mov qword [rbp - 9], r14
mov dword [rbp + 0x67], r14d
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x180003292
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 9]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x67], 0
je 0x180003292
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x1f]
xor r8d, r8d
lea rdx, str.Manufacturer
call qword [rax + 0x20]
test eax, eax
js 0x180003240
mov rdx, qword [rbp + 0x27]
lea rcx, str.Manufacturer:__s_n
call fcn.180001350
lea rcx, [rbp + 0x1f]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, str.VMware
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
lea rdx, str.VirtualBox
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
lea rdx, str.Hyper_V
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
lea rdx, str.Parallels
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
lea rdx, [0x180052448]
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
lea rdx, str.QEMU
mov rcx, qword [rbp + 0x27]
call fcn.18001b5f8
test rax, rax
jne 0x18000324f
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000314b
lea rcx, str.Virtual_Machine_Detected__n
call fcn.180001350
mov rcx, qword [rbp - 9]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x77]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 1]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180002db4
mov ecx, 0x8007000e
call fcn.1800194d0
nop
mov ecx, 0x8007000e
call fcn.1800194d0
nop
mov ecx, 0x8007000e
call fcn.1800194d0
int3