Function at 0x14002c8e0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400c4040]
xor rax, rsp
mov qword [rbp + 0x248], rax
mov r12, rdx
mov qword [rbp - 0x78], rdx
mov r15, rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x50], esi
call fcn.14002c3f0
test al, al
jne 0x14002c956
lea rdx, str.No_permissions_or_WMI_service_isnt_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14002df55
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14002c9ad
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x140004880]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Attempting_fallback_spoofing_via_registry_manipulation.
jmp 0x14002c933
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14002c9ec
lea rdx, str.Failed_to_initialize_security._Error_code__0x
jmp 0x14002df13
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x14009c018]
xor edx, edx
mov r8d, 1
lea rcx, [0x14009c028]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14002df0c
mov r14, qword [rsp + 0x70]
mov qword [rbp - 0x68], r14
test r14, r14
je 0x14002df0c
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x68], rsi
mov rax, qword [r14]
mov rdi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.140092900
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14002ca7f
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [0x1400ac2f0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002df8a
jmp 0x14002ca82
mov rbx, rsi
mov qword [rbp - 0x80], rbx
test rbx, rbx
je 0x14002dfa0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002cafd
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002cade
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002caf0
call fcn.140092e50
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.140092e50
test edi, edi
js 0x14002debb
mov rsi, qword [rsp + 0x68]
mov qword [rbp - 0x80], rsi
test rsi, rsi
je 0x14002debb
mov qword [rbp - 0x38], rsi
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14002cb95
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x140004880]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x14002deaa
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140029ee0
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp + 0x160]
call fcn.140029ee0
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 7
jb 0x14002cc71
lea rax, [r8 + 7]
mov qword [rdi + 0x10], rax
mov r12, rdi
cmp rcx, 7
jbe 0x14002cbe7
mov r12, qword [rdi]
lea rax, [0x1400ac766]
lea rcx, str.SELECT
cmp rax, r12
jbe 0x14002cc1a
lea rax, [r12 + r8*2]
cmp rcx, rax
ja 0x14002cc1a
cmp r12, rcx
ja 0x14002cc0f
xor eax, eax
mov r15d, eax
jmp 0x14002cc20
mov r15, r12
sub r15, rcx
sar r15, 1
jmp 0x14002cc20
mov r15d, 7
lea rcx, [r12 + 0xe]
lea r8, [r8*2 + 2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.SELECT
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.SELECT
lea rdx, [rdx + 0xe]
lea rdx, [rdx + r15*2]
lea rcx, [r12 + rbx]
mov r8d, 7
sub r8, r15
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14002cc8a
mov qword [rsp + 0x28], 7
mov edx, 7
mov rcx, rdi
call fcn.14002f390
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xb0], xmm1
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
bts r13d, 0xe
mov r8d, 6
lea rdx, str._FROM
lea rcx, [rbp + 0xa0]
call fcn.14000a8c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r13d, 0xf
mov r9, qword [rsp + 0x50]
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.14002ec40
bts r13d, 0xd
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14002cd67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cd61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002cd61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092e50
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14002cdb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cdab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002cdab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092e50
movdqa xmm0, xmmword [0x1400b1150]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r15w
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x14002ce19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ce0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ce0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092e50
movdqa xmm0, xmmword [0x1400b1150]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r15w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14002ce7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ce6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ce6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092e50
movdqa xmm0, xmmword [0x1400b1150]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r15w
mov qword [rsp + 0x78], r15
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rbx, qword [rbp + 0xe0]
mov ecx, 0x18
call fcn.140092900
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002cef3
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14002cef6
test rbx, rbx
jne 0x14002df95
jmp 0x14002cef6
mov rdi, r15
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14002dfab
mov r15, qword [rdi]
mov ecx, 0x18
call fcn.140092900
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14002cf3d
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
lea rcx, [0x1400ac3a0]
call fcn.140094610
mov qword [rbx], rax
xor ecx, ecx
jmp 0x14002cf41
xor ecx, ecx
mov ebx, ecx
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14002dfb6
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call r12
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002cfbc
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002cf99
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r12d, r12d
mov qword [rbx], r12
jmp 0x14002cf9c
xor r12d, r12d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002cfae
call fcn.140092e50
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140092e50
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14002d001
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002cfe0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov qword [rdi], rbx
jmp 0x14002cfe2
xor ebx, ebx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002cff4
call fcn.140092e50
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.140092e50
test r15d, r15d
js 0x14002de07
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14002de07
mov qword [rbp - 0x70], rdi
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov rax, qword [rdi]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
jne 0x14002dd8f
mov rbx, qword [rsp + 0x58]
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002d087
mov r12, qword [rax]
mov ecx, 0x18
call fcn.140092900
mov r15, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002d0ba
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.140094610
mov qword [r15], rax
xor eax, eax
jmp 0x14002d0bd
mov r15, rax
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002df7f
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [r15 + 0x10], ecx
cmp ecx, 1
jne 0x14002d12e
mov rcx, qword [r15]
test rcx, rcx
je 0x14002d10d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov qword [r15], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002d121
call fcn.140092e50
xor eax, eax
mov qword [r15 + 8], rax
mov edx, 0x18
mov rcx, r15
call fcn.140092e50
test r12d, r12d
js 0x14002dd48
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor eax, eax
mov r15d, eax
mov qword [rbp + 0x50], rax
mov r12d, 0xf
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x40], al
or r13d, 0x20
mov dword [rsp + 0x50], r13d
mov r14d, 0xc
lea rsi, [0x1400a2930]
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d184
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
cmp r15, r12
jae 0x14002d1b2
lea rax, [r15 + 1]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x40]
cmp r12, 0xf
cmova rax, qword [rbp + 0x40]
mov byte [r15 + rax], r9b
mov byte [r15 + rax + 1], 0
jmp 0x14002d1bb
lea rcx, [rbp + 0x40]
call fcn.14000c520
sub r14, 1
je 0x14002d1cb
mov r12, qword [rbp + 0x58]
mov r15, qword [rbp + 0x50]
jmp 0x14002d170
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0xf
or r13d, 0x40
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x68]
jge 0x14002d1fa
dec eax
or eax, 0xfffffff0
inc eax
cdqe
lea r15, [0x1400a2930]
movzx eax, byte [rax + r15]
mov byte [rbp + 0x20], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d21f
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x21], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d23d
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x22], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d25b
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x30], 4
mov byte [rbp + 0x23], cl
mov byte [rbp + 0x24], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x98], 0xf
bts r13d, 7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d29f
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x80], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d2c0
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x81], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d2e1
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x82], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d302
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x90], 4
mov byte [rbp + 0x83], cl
mov byte [rbp + 0x84], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], 0xf
bts r13d, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d349
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x60], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d367
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x61], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d385
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x62], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d3a3
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x70], 4
mov byte [rbp + 0x63], cl
mov byte [rbp + 0x64], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
bts r13d, 9
mov dword [rsp + 0x50], r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d3f1
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d425
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d42e
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d442
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d476
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d47f
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d493
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d4c7
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d4d0
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d4e4
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d518
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d521
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d535
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d569
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d572
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d586
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d5ba
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d5c3
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d5d7
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d60b
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d614
lea rcx, [rbp]
call fcn.14000c520
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002d628
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002d65c
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002d665
lea rcx, [rbp]
call fcn.14000c520
mov r8d, 1
lea rdx, [0x1400ac308]
lea rcx, [rbp]
call fcn.14000b200
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], r12b
bts r13d, 0xa
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x140]
call fcn.1400270b0
bts r13d, 0xb
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400ac308]
lea rcx, [rbp + 0x140]
call fcn.14000b200
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts r13d, 0xc
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x1e0]
lea rcx, [rbp + 0x120]
call fcn.1400270b0
or r13d, 1
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400ac308]
lea rcx, [rbp + 0x120]
call fcn.14000b200
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or r13d, 4
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0x100]
call fcn.1400270b0
or r13d, 2
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400ac308]
lea rcx, [rbp + 0x100]
call fcn.14000b200
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 8
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0x220]
call fcn.1400270b0
or r13d, 0x10
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14002d83d
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d837
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002dda5
call fcn.140092e50
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14002d87e
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d879
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddac
call fcn.140092e50
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14002d8d9
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d8d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddb3
call fcn.140092e50
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14002d91a
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddba
call fcn.140092e50
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14002d975
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d96f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddc1
call fcn.140092e50
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14002d9b6
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d9b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddc8
call fcn.140092e50
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14002da10
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddcf
call fcn.140092e50
btr r13d, 9
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14002da50
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddd6
call fcn.140092e50
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
btr r13d, 8
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14002daa0
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002dddd
call fcn.140092e50
btr r13d, 7
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14002dae6
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002dae1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002dde4
call fcn.140092e50
and r13d, 0xffffffbf
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14002db25
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002db20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddeb
call fcn.140092e50
and r13d, 0xffffffdf
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14002db64
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002db5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddf2
call fcn.140092e50
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xc0]
call fcn.140029ee0
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov word [rbp - 0x58], ax
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14002dc83
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002dbd7
mov r12, qword [rax]
mov ecx, 0x18
call fcn.140092900
mov r15, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14002dc0b
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.140094610
mov qword [r15], rax
xor r12d, r12d
jmp 0x14002dc11
xor r12d, r12d
mov r15d, r12d
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002dfc1
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
nop
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x14002dc77
mov rcx, qword [r15]
test rcx, rcx
je 0x14002dc58
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], r12
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002dc6a
call fcn.140092e50
mov qword [r15 + 8], r12
mov edx, 0x18
mov rcx, r15
call fcn.140092e50
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14002dca7
lea rdx, str.Failed_to_allocate_BSTR_for_new_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14002dced
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002dce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddf9
call fcn.140092e50
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14002dd48
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002dd43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002de00
call fcn.140092e50
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rbx, rbx
je 0x14002dd62
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
je 0x14002d052
mov bl, 1
test rdi, rdi
je 0x14002dda0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
jmp 0x14002de48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.WMI_query_failed._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x140004880]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14002de91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002de8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002de8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092e50
movdqa xmm0, xmmword [0x1400b1150]
movdqu xmmword [rbp + 0xf0], xmm0
xor eax, eax
mov word [rbp + 0xe0], ax
test rsi, rsi
je 0x14002deb9
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
jmp 0x14002defb
lea rdx, str.Could_not_connect_to_WMI_namespace._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x140004880]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
test r14, r14
je 0x14002df0a
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
nop
jmp 0x14002df4c
lea rdx, str.Failed_to_create_IWbemLocator_object._Err_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b710
lea rdx, [0x140004880]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bcb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, bl
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.1400928e0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
nop
mov ecx, 0x8007000e
call fcn.140094600
int3