Function at 0x140006950
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140015010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov qword [rbp - 0x30], r13
mov rax, qword [rcx]
mov r15, qword [rax + 0xa0]
lea ecx, [r13 + 0x18]
call fcn.14000b8d0
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400069d6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140006cf1
jmp 0x1400069d9
mov rbx, r13
mov qword [rbp - 0x48], rbx
test rbx, rbx
je 0x140006cfc
mov r14, qword [rbx]
mov ecx, 0x18
call fcn.14000b8d0
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140006a27
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x14000ebe8]
call fcn.14000c740
mov qword [rdi], rax
jmp 0x140006a2a
mov rdi, r13
mov qword [rbp - 0x40], rdi
test rdi, rdi
je 0x140006ce6
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, r14
mov rdx, qword [rdi]
mov rcx, rsi
call r15
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140006a99
mov rcx, qword [rdi]
test rcx, rcx
je 0x140006a79
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140006a8b
call fcn.14000b914
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.14000b914
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140006ad8
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006ab9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006acb
call fcn.14000b914
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.14000b914
test esi, esi
jns 0x140006b1f
lea rdx, str.Failed_to_execute_WMI_query._Error_code:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
lea rdx, [0x140002530]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006cbd
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x10], r13d
mov r14d, 1
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140006cb7
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x38]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
mov esi, eax
cmp dword [rbp - 0x10], 0
je 0x140006cb3
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x28]
xor r8d, r8d
lea rdx, str.Capacity
call qword [rax + 0x20]
mov esi, eax
test eax, eax
js 0x140006ca4
mov rdi, r13
cmp word [rbp - 0x28], 8
jne 0x140006bcc
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
cqo
and edx, 0xfffff
lea rdi, [rdx + rax]
sar rdi, 0x14
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x20]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x28]
xor r8d, r8d
lea rdx, str.Speed
call r10
mov esi, eax
test eax, eax
js 0x140006c9a
mov ebx, dword [rbp - 0x20]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, str.RAM_STICK_
mov rcx, r12
call fcn.140001eb0
mov edx, r14d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.RAM:_Capacity
mov rcx, r12
call fcn.140001eb0
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000f04c]
call fcn.140001eb0
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.RAM:_Speed
mov rcx, r12
call fcn.140001eb0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, str._MHz_n
call fcn.140001eb0
inc r14d
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x140006b40
jmp 0x140006cb7
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000b8b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14000c610
nop
mov ecx, 0x8007000e
call fcn.14000c610
nop
mov ecx, 0x8007000e
call fcn.14000c610
int3