Function at 0x100eef4f
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push 0x120
mov eax, 0x101389b8
call fcn.1011094a
and dword [ebp - 0x88], 0
mov esi, 0x1014ad1c
push esi
mov ecx, 0x101d94fc
call fcn.10063887
push esi
lea ecx, [ebp - 0x4c]
call fcn.10063887
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push esi
call fcn.10063887
push str.MachineGuid
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.10063887
push str.SOFTWAREMicrosoftCryptography
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
mov dword [ebp - 0x88], 1
call fcn.10063887
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.10063887
add esp, 0xc
test eax, eax
jne 0x100eefe4
cmp dword [ebp - 0x3c], eax
je 0x100eefe4
mov bl, 1
jmp 0x100eefe6
xor bl, bl
lea ecx, [ebp - 0xb4]
call fcn.10015273
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], 2
call fcn.10015273
lea ecx, [ebp - 0x2c]
test bl, bl
je 0x100ef015
lea eax, [ebp - 0x4c]
push eax
call fcn.10063887
jmp 0x100ef01b
push esi
call fcn.10063887
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x100ef3ae
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x100ef3a8
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], ebx
push eax
push 0x101a5578
push 1
push ebx
push 0x101a5568
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x100ef3a8
push str.ROOTCIMV2
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x68], ebx
call fcn.100eecbe
mov eax, dword [eax]
mov byte [ebp - 4], 4
test eax, eax
je 0x100ef088
mov ecx, dword [eax]
jmp 0x100ef08a
mov ecx, ebx
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
push edx
push ebx
push ebx
mov esi, dword [eax]
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, dword [esi + 0xc]
push eax
call dword [0x1014488c]
call dword [esi + 0xc]
mov ecx, dword [ebp - 0x8c]
mov esi, eax
mov byte [ebp - 4], 2
test ecx, ecx
je 0x100ef0c2
call fcn.100f3e41
mov dword [ebp - 0x8c], ebx
test esi, esi
js 0x100ef18c
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x68]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x100ef179
push str.SELECT__FROM_Win32_ComputerSystemProduct
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x74], ebx
call fcn.100eec6e
mov esi, eax
push 0x101a159c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 5
call fcn.100eec6e
mov ecx, dword [esi]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x100ef11c
mov edx, dword [ecx]
jmp 0x100ef11e
mov edx, ebx
mov eax, dword [eax]
test eax, eax
je 0x100ef128
mov ecx, dword [eax]
jmp 0x100ef12a
mov ecx, ebx
mov eax, dword [ebp - 0x68]
lea edi, [ebp - 0x74]
push edi
push ebx
push 0x30
mov esi, dword [eax]
push edx
push ecx
push eax
mov ecx, dword [esi + 0x50]
call dword [0x1014488c]
call dword [esi + 0x50]
mov ecx, dword [ebp - 0x90]
mov esi, eax
test ecx, ecx
je 0x100ef15c
call fcn.100f3e41
mov dword [ebp - 0x90], ebx
mov ecx, dword [ebp - 0x88]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x100ef175
call fcn.100f3e41
mov dword [ebp - 0x88], ebx
test esi, esi
jns 0x100ef194
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1014488c]
call esi
mov eax, dword [ebp - 0x6c]
jmp 0x100ef398
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x100ef36f
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [esi + 0x10]
push 1
push 0xffffffffffffffff
push eax
call dword [0x1014488c]
call dword [esi + 0x10]
cmp dword [ebp - 0x34], 0
je 0x100ef36f
xor eax, eax
lea edi, [ebp - 0x84]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x84]
push ebx
push ebx
push ecx
stosd dword es:[edi], eax
push ebx
push str.UUID
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x70]
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x10]
call dword [0x1014488c]
call dword [esi + 0x10]
push dword [ebp - 0x7c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x64]
call fcn.10063887
push dword [0x101d9440]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.10063887
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 8
push ecx
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10063887
lea ecx, [ebp - 0x2c]
add esp, 0xc
cmp ecx, eax
je 0x100ef257
mov byte [ebp - 0x94], bl
push dword [ebp - 0x94]
push eax
call fcn.10063887
lea ecx, [ebp - 0xe4]
call fcn.10015273
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.10015273
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmovae edx, dword [ebp - 0x2c]
push edx
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x9c]
push ecx
push eax
call fcn.10063887
add esp, 0x14
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1014488c]
call esi
mov dword [ebp - 0x70], ebx
call fcn.100e1984
mov ecx, eax
call fcn.100e1a88
push dword [0x101d9440]
mov bl, al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.10063887
add esp, 0xc
mov edx, 0x101a1dd0
mov byte [ebp - 4], 9
test bl, bl
mov ecx, 0x10157938
cmove ecx, edx
push ecx
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.10063887
lea ecx, [ebp - 0x2c]
add esp, 0xc
xor ebx, ebx
cmp ecx, eax
je 0x100ef331
mov byte [ebp - 0x98], bl
push dword [ebp - 0x98]
push eax
call fcn.10063887
lea ecx, [ebp - 0x114]
call fcn.10015273
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 7
call fcn.10015273
push 0x101d94fc
lea eax, [ebp - 0x2c]
push eax
push 1
lea ecx, [ebp - 0x2d]
call fcn.1005a016
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.10015273
jmp 0x100ef197
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1014488c]
call esi
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1014488c]
call esi
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1014488c]
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x2c]
call fcn.10015273
lea ecx, [ebp - 0x4c]
call fcn.10015273
call fcn.10110897
ret