Function at 0x14002a3a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400bf040]
xor rax, rsp
mov qword [rbp + 0x248], rax
mov r12, rdx
mov qword [rbp - 0x78], rdx
mov r15, rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x50], esi
call fcn.140029eb0
test al, al
jne 0x14002a416
lea rdx, str.No_permissions_or_WMI_service_isnt_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14002ba15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14002a46d
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x1400046c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Attempting_fallback_spoofing_via_registry_manipulation.
jmp 0x14002a3f3
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14002a4ac
lea rdx, str.Failed_to_initialize_security._Error_code__0x
jmp 0x14002b9d3
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x140098018]
xor edx, edx
mov r8d, 1
lea rcx, [0x140098028]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14002b9cc
mov r14, qword [rsp + 0x70]
mov qword [rbp - 0x68], r14
test r14, r14
je 0x14002b9cc
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x68], rsi
mov rax, qword [r14]
mov rdi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.14008ded0
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14002a53f
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002ba4a
jmp 0x14002a542
mov rbx, rsi
mov qword [rbp - 0x80], rbx
test rbx, rbx
je 0x14002ba60
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002a5bd
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002a59e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a5b0
call fcn.14008e420
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.14008e420
test edi, edi
js 0x14002b97b
mov rsi, qword [rsp + 0x68]
mov qword [rbp - 0x80], rsi
test rsi, rsi
je 0x14002b97b
mov qword [rbp - 0x38], rsi
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14002a655
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x1400046c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x14002b96a
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.1400279a0
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp + 0x160]
call fcn.1400279a0
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 7
jb 0x14002a731
lea rax, [r8 + 7]
mov qword [rdi + 0x10], rax
mov r12, rdi
cmp rcx, 7
jbe 0x14002a6a7
mov r12, qword [rdi]
lea rax, [0x1400a85ee]
lea rcx, str.SELECT
cmp rax, r12
jbe 0x14002a6da
lea rax, [r12 + r8*2]
cmp rcx, rax
ja 0x14002a6da
cmp r12, rcx
ja 0x14002a6cf
xor eax, eax
mov r15d, eax
jmp 0x14002a6e0
mov r15, r12
sub r15, rcx
sar r15, 1
jmp 0x14002a6e0
mov r15d, 7
lea rcx, [r12 + 0xe]
lea r8, [r8*2 + 2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.SELECT
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.SELECT
lea rdx, [rdx + 0xe]
lea rdx, [rdx + r15*2]
lea rcx, [r12 + rbx]
mov r8d, 7
sub r8, r15
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14002a74a
mov qword [rsp + 0x28], 7
mov edx, 7
mov rcx, rdi
call fcn.14002d070
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xb0], xmm1
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
bts r13d, 0xe
mov r8d, 6
lea rdx, str._FROM
lea rcx, [rbp + 0xa0]
call fcn.14000a620
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r13d, 0xf
mov r9, qword [rsp + 0x50]
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.14002c720
bts r13d, 0xd
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14002a827
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a821
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a821
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008e420
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14002a870
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a86b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a86b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008e420
movdqa xmm0, xmmword [0x1400aceb0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r15w
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x14002a8d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a8cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a8cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008e420
movdqa xmm0, xmmword [0x1400aceb0]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r15w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14002a93a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a92d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a92d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008e420
movdqa xmm0, xmmword [0x1400aceb0]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r15w
mov qword [rsp + 0x78], r15
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rbx, qword [rbp + 0xe0]
mov ecx, 0x18
call fcn.14008ded0
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002a9b3
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14002a9b6
test rbx, rbx
jne 0x14002ba55
jmp 0x14002a9b6
mov rdi, r15
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14002ba6b
mov r15, qword [rdi]
mov ecx, 0x18
call fcn.14008ded0
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14002a9fd
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
lea rcx, [0x1400a81d0]
call fcn.14008fbe0
mov qword [rbx], rax
xor ecx, ecx
jmp 0x14002aa01
xor ecx, ecx
mov ebx, ecx
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14002ba76
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call r12
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002aa7c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002aa59
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r12d, r12d
mov qword [rbx], r12
jmp 0x14002aa5c
xor r12d, r12d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002aa6e
call fcn.14008e420
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14008e420
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14002aac1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002aaa0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov qword [rdi], rbx
jmp 0x14002aaa2
xor ebx, ebx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002aab4
call fcn.14008e420
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14008e420
test r15d, r15d
js 0x14002b8c7
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14002b8c7
mov qword [rbp - 0x70], rdi
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov rax, qword [rdi]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
jne 0x14002b84f
mov rbx, qword [rsp + 0x58]
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002ab47
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008ded0
mov r15, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002ab7a
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.14008fbe0
mov qword [r15], rax
xor eax, eax
jmp 0x14002ab7d
mov r15, rax
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002ba3f
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [r15 + 0x10], ecx
cmp ecx, 1
jne 0x14002abee
mov rcx, qword [r15]
test rcx, rcx
je 0x14002abcd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov qword [r15], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002abe1
call fcn.14008e420
xor eax, eax
mov qword [r15 + 8], rax
mov edx, 0x18
mov rcx, r15
call fcn.14008e420
test r12d, r12d
js 0x14002b808
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor eax, eax
mov r15d, eax
mov qword [rbp + 0x50], rax
mov r12d, 0xf
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x40], al
or r13d, 0x20
mov dword [rsp + 0x50], r13d
mov r14d, 0xc
lea rsi, [0x14009e8e0]
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ac44
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
cmp r15, r12
jae 0x14002ac72
lea rax, [r15 + 1]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x40]
cmp r12, 0xf
cmova rax, qword [rbp + 0x40]
mov byte [r15 + rax], r9b
mov byte [r15 + rax + 1], 0
jmp 0x14002ac7b
lea rcx, [rbp + 0x40]
call fcn.14000c260
sub r14, 1
je 0x14002ac8b
mov r12, qword [rbp + 0x58]
mov r15, qword [rbp + 0x50]
jmp 0x14002ac30
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0xf
or r13d, 0x40
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x68]
jge 0x14002acba
dec eax
or eax, 0xfffffff0
inc eax
cdqe
lea r15, [0x14009e8e0]
movzx eax, byte [rax + r15]
mov byte [rbp + 0x20], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002acdf
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x21], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002acfd
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x22], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad1b
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x30], 4
mov byte [rbp + 0x23], cl
mov byte [rbp + 0x24], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x98], 0xf
bts r13d, 7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad5f
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x80], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad80
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x81], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ada1
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x82], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002adc2
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x90], 4
mov byte [rbp + 0x83], cl
mov byte [rbp + 0x84], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], 0xf
bts r13d, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae09
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x60], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae27
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x61], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae45
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x62], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae63
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x70], 4
mov byte [rbp + 0x63], cl
mov byte [rbp + 0x64], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
bts r13d, 9
mov dword [rsp + 0x50], r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002aeb1
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002aee5
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002aeee
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002af02
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002af36
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002af3f
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002af53
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002af87
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002af90
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002afa4
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002afd8
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002afe1
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002aff5
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b029
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b032
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b046
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b07a
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b083
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b097
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b0cb
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b0d4
lea rcx, [rbp]
call fcn.14000c260
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b0e8
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b11c
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b125
lea rcx, [rbp]
call fcn.14000c260
mov r8d, 1
lea rdx, [0x1400a81ac]
lea rcx, [rbp]
call fcn.14000af40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], r12b
bts r13d, 0xa
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x140]
call fcn.14002ca80
bts r13d, 0xb
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a81ac]
lea rcx, [rbp + 0x140]
call fcn.14000af40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts r13d, 0xc
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x1e0]
lea rcx, [rbp + 0x120]
call fcn.14002ca80
or r13d, 1
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a81ac]
lea rcx, [rbp + 0x120]
call fcn.14000af40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or r13d, 4
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0x100]
call fcn.14002ca80
or r13d, 2
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a81ac]
lea rcx, [rbp + 0x100]
call fcn.14000af40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 8
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0x220]
call fcn.14002ca80
or r13d, 0x10
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14002b2fd
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b2f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b865
call fcn.14008e420
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14002b33e
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b86c
call fcn.14008e420
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14002b399
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b393
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b873
call fcn.14008e420
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14002b3da
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b3d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b87a
call fcn.14008e420
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14002b435
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b42f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b881
call fcn.14008e420
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14002b476
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b471
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b888
call fcn.14008e420
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14002b4d0
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b4cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b88f
call fcn.14008e420
btr r13d, 9
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14002b510
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b50b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b896
call fcn.14008e420
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
btr r13d, 8
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14002b560
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b55b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b89d
call fcn.14008e420
btr r13d, 7
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14002b5a6
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8a4
call fcn.14008e420
and r13d, 0xffffffbf
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14002b5e5
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8ab
call fcn.14008e420
and r13d, 0xffffffdf
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14002b624
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b61f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8b2
call fcn.14008e420
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xc0]
call fcn.1400279a0
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov word [rbp - 0x58], ax
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14002b743
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002b697
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008ded0
mov r15, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14002b6cb
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.14008fbe0
mov qword [r15], rax
xor r12d, r12d
jmp 0x14002b6d1
xor r12d, r12d
mov r15d, r12d
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002ba81
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
nop
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x14002b737
mov rcx, qword [r15]
test rcx, rcx
je 0x14002b718
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], r12
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002b72a
call fcn.14008e420
mov qword [r15 + 8], r12
mov edx, 0x18
mov rcx, r15
call fcn.14008e420
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14002b767
lea rdx, str.Failed_to_allocate_BSTR_for_new_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14002b7ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b7a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8b9
call fcn.14008e420
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14002b808
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8c0
call fcn.14008e420
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rbx, rbx
je 0x14002b822
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
je 0x14002ab12
mov bl, 1
test rdi, rdi
je 0x14002b860
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
jmp 0x14002b908
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.WMI_query_failed._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x1400046c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14002b951
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b94c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b94c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008e420
movdqa xmm0, xmmword [0x1400aceb0]
movdqu xmmword [rbp + 0xf0], xmm0
xor eax, eax
mov word [rbp + 0xe0], ax
test rsi, rsi
je 0x14002b979
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
jmp 0x14002b9bb
lea rdx, str.Could_not_connect_to_WMI_namespace._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x1400046c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
test r14, r14
je 0x14002b9ca
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
nop
jmp 0x14002ba0c
lea rdx, str.Failed_to_create_IWbemLocator_object._Err_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b450
lea rdx, [0x1400046c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, bl
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.14008deb0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
nop
mov ecx, 0x8007000e
call fcn.14008fbd0
int3