Function at 0x14004a4b0
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x220
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rsp + 0x260], rbx
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rdx
xor r14d, r14d
mov word [rcx], r14w
lea r8, str.getHDDSerial_start
lea rdx, str.INFO
mov rcx, rdi
call fcn.140018920
cmp qword [0x1400b7ed8], r14
je 0x14004a561
lea r8, str.getHDDSerial__used_cached_value
lea rdx, str.INFO
mov rcx, rdi
call fcn.140018920
lea rcx, [0x1400b7ec8]
call fcn.1400018c0
mov r9, rax
lea r8, [0x140088fa8]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
jmp 0x14004aa69
mov dword [rsp + 0xf0], 0x114
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0xf4]
call fcn.140062200
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0xf4], 6
jae 0x14004a5a9
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aa69
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14004a600
lea r8, str.Failed_to_initialize_security._Error_code__0x
lea rdx, str.ERROR
mov rcx, rdi
call fcn.140018920
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aabc
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140087158]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140087228]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14004a653
lea r8, str.Failed_to_create_IWbemLocator_object._Err_code__0x
lea rdx, str.ERROR
mov rcx, rdi
call fcn.140018920
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aabc
mov qword [rsp + 0x50], r14
mov ecx, 0x18
call fcn.14005baec
mov rsi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004a699
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x14004a69c
mov ecx, 0x8007000e
call fcn.1400790c0
mov rsi, r14
mov qword [rsp + 0xc0], rsi
test rsi, rsi
jne 0x14004a6b4
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
call qword [rax + 0x18]
mov r12d, eax
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
dec ecx
jne 0x14004a719
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004a703
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004a711
call fcn.14005c954
mov rcx, rsi
call fcn.14005ba88
test r12d, r12d
jns 0x14004a74f
lea r8, str.Could_not_connect._Error_code__0x
lea rdx, str.ERROR
mov rcx, rdi
call fcn.140018920
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aabc
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14004a7be
lea r8, str.Could_not_set_proxy_blanket.Error_code__0x
lea rdx, str.ERROR
mov rcx, rdi
call fcn.140018920
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aabc
mov qword [rsp + 0x70], r14
mov ecx, 0x18
call fcn.14005baec
mov r12, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004a7f7
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.Select__from_Win32_DiskDrive_where_InterfaceType__IDE
call fcn.140078f30
mov qword [r12], rax
jmp 0x14004a7fa
mov r12, r14
mov qword [rsp + 0x90], r12
test r12, r12
jne 0x14004a812
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov ecx, 0x18
call fcn.14005baec
mov rsi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004a845
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x1400907c8]
call fcn.140078f30
mov qword [rsi], rax
jmp 0x14004a848
mov rsi, r14
mov qword [rsp + 0x98], rsi
test rsi, rsi
jne 0x14004a860
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov r8, qword [r12]
mov rdx, qword [rsi]
call qword [rax + SHCreateDirectory]
mov r13d, eax
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
dec ecx
jne 0x14004a8be
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004a8a7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004a8b5
call fcn.14005c954
mov rcx, rsi
call fcn.14005ba88
nop
or eax, 0xffffffff
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14004a8f2
mov rcx, qword [r12]
test rcx, rcx
je 0x14004a8db
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14004a8ea
call fcn.14005c954
mov rcx, r12
call fcn.14005ba88
test r13d, r13d
jns 0x14004a933
lea r8, str.Query_for_operating_system_name_failed.
lea rdx, str.ERROR
mov rcx, rdi
call fcn.140018920
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
jmp 0x14004aabc
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x68], r14d
nop dword [rax]
cmp qword [rsp + 0x70], 0
je 0x14004aa15
lea r8, str.getHDDSerial__process_item
lea rdx, str.INFO
mov rcx, rdi
call fcn.140018920
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x68], 0
je 0x14004aa15
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + 0x20]
mov r9, qword [rsp + 0xa8]
lea r8, [0x140088fa8]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbx
call fcn.140004640
lea rcx, [rsp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp word [rbx], 0
je 0x14004a940
lea r8, str.getHDDSerial__serial_is_founded__break_loop
lea rdx, str.INFO
mov rcx, rdi
call fcn.140018920
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14004aa49
cmp word [rbx], 0
jne 0x14004aa5a
mov rdx, rdi
mov rcx, rbx
call fcn.14004a410
mov rdx, rbx
lea rcx, [0x1400b7ec8]
call fcn.1400026b0
lea rdx, str.getHDDSerial_end__result:
lea rcx, [rsp + 0xc8]
call fcn.14000264c
nop
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.140002680
lea rcx, [rsp + 0xc8]
call fcn.1400018c0
mov r8, rax
lea rdx, str.INFO
mov rcx, rdi
call fcn.140018920
nop
lea rcx, [rsp + 0xc8]
call fcn.140001624
nop
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14005ba60
mov rbx, qword [rsp + 0x260]
add rsp, 0x220
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret