Function at 0x14000bb20
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x14001a040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x29], r15
mov dword [rbp - 1], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000bcfc
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14000bcf6
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [0x140013868]
xor edx, edx
mov r8d, 1
lea rcx, [0x140013878]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000bcf6
mov rax, qword [rbp - 0x31]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.1400102a0
mov rbx, rax
mov qword [rbp - 0x49], rax
test rax, rax
je 0x14000bc2e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000c027
jmp 0x14000bc31
mov rbx, r15
mov qword [rbp - 0x49], rbx
test rbx, rbx
je 0x14000c048
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x31]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000bcab
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000bc8c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000bc9e
call fcn.14001051c
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14001051c
test edi, edi
js 0x14000bcec
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14000bd25
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140010160
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.1400102a0
mov rbx, rax
mov qword [rbp - 0x49], rax
test rax, rax
je 0x14000bd7b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000c032
jmp 0x14000bd7e
mov rbx, r15
mov qword [rbp - 0x49], rbx
test rbx, rbx
je 0x14000c048
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.1400102a0
mov rdi, rax
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14000bdd6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r15
mov dword [rdi + 0x10], 1
lea rcx, [0x140014378]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000c03d
jmp 0x14000bdd9
mov rdi, r15
mov qword [rbp - 0x41], rdi
test rdi, rdi
je 0x14000c01c
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x39]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14000be49
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000be29
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000be3b
call fcn.14001051c
mov qword [rdi + 8], r15
mov edx, 0x18
mov rcx, rdi
call fcn.14001051c
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000be88
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000be69
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000be7b
call fcn.14001051c
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14001051c
test esi, esi
js 0x14000bce2
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14000bff8
mov ebx, 8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x29]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp - 1], 0
je 0x14000bff8
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x27]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + 0x20]
test eax, eax
js 0x14000bfe1
lea rcx, [rbp + 7]
call fcn.14000a2e0
nop
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rbp - 0x19], bx
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
call fcn.14000fe30
mov qword [rbp - 0x11], rax
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x19]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + 0x28]
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, str.Spoofed_M3:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006b30
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov r8, qword [rbp + 0x17]
mov rcx, rax
call fcn.1400079f0
lea rdx, [0x140006d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14000bfe1
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c015
call fcn.14001051c
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
jne 0x14000beb0
mov rcx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x21]
jmp 0x14000bcf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x8007000e
call fcn.14000fe20
nop
mov ecx, 0x8007000e
call fcn.14000fe20
nop
mov ecx, 0x8007000e
call fcn.14000fe20
nop
mov ecx, 0x8007000e
call fcn.14000fe20
nop
mov ecx, 0x8007000e
call fcn.14000fe20
int3