Function at 0x140038400
Capabilities:
Connect to wmi namespace via wbemlocator
Get system information on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
movaps xmmword [rax - 0x48], xmm6
mov rdi, rcx
mov dword [rax + 0x10], 1
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov dword [rax + 0x10], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm6, xmmword [0x1400f79d0]
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], r13b
movups xmmword [rsp + 0x70], xmm0
movdqa xmmword [rax - 0x228], xmm6
mov byte [rsp + 0x70], r13b
movups xmmword [rax - 0x218], xmm0
movdqa xmmword [rax - 0x208], xmm6
mov byte [rax - 0x218], r13b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140038625
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x14003851b
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x14003852b
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
mov dword [rsp + 0x2b8], r13d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140038576
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x1400385c7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400385c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140038612
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003860d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rax, rdi
jmp 0x140039a0c
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov r14, 0xffffffffffffffff
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x1400387fe
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x1400386ee
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x1400386fe
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x2b8], r13d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x14003874f
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003874a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x1400387a0
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003879b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400387eb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400387e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rax, rdi
jmp 0x140039a0c
mov qword [rsp + 0xc8], r13
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da1d0]
xor edx, edx
mov r8d, 1
lea rcx, [0x1400da1e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400389d1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x1400388c1
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x1400388d1
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x2b8], r13d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140038922
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003891d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x140038973
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003896e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400389be
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400389b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rax, rdi
jmp 0x140039a0c
mov qword [rsp + 0xc0], r13
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x18]
mov ecx, Ordinal_26
call fcn.140084be8
mov rbx, rax
mov qword [rsp + 0x2c0], rax
test rax, rax
je 0x140038a28
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140039a27
jmp 0x140038a2b
mov rbx, r13
mov qword [rsp + 0x2c0], rbx
test rbx, rbx
je 0x140039a32
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0xc8]
call rsi
mov esi, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140038aaf
mov rcx, qword [rbx]
test rcx, rcx
je 0x140038a90
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140038aa2
call fcn.140084f34
mov qword [rbx + 8], r13
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140084f34
test esi, esi
jns 0x140038c5f
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140038b41
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x140038b51
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x2b8], r13d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140038bb0
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x140038c01
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038bfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140038c4c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rax, rdi
jmp 0x140039a0c
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140038e4f
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140038d24
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x140038d34
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rsp + 0x2b8], r13d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140038da1
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038d9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x140038dee
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038e30
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140038e3c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038e37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
movdqa xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rax, rdi
jmp 0x140039a0c
mov qword [rsp + 0x110], r13
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
mov ecx, Ordinal_26
call fcn.140084be8
mov rbx, rax
mov qword [rsp + 0x2c0], rax
test rax, rax
je 0x140038e9f
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, str.SELECT_Manufacturer__SMBIOSBIOSVersion__ReleaseDate_FROM_Win32_BIOS
call fcn.140085dd0
mov qword [rbx], rax
jmp 0x140038ea2
mov rbx, r13
mov qword [rsp + 0x2c0], rbx
test rbx, rbx
je 0x140039a3c
mov r15, qword [rbx]
mov ecx, Ordinal_26
call fcn.140084be8
mov rsi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x140038eec
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
lea rcx, [0x1400f3104]
call fcn.140085dd0
mov qword [rsi], rax
jmp 0x140038eef
mov rsi, r13
mov qword [rsp + 0xd0], rsi
test rsi, rsi
je 0x140039a47
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, Ordinal_50
mov r8, r15
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0xc0]
call r12
mov r15d, eax
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x140038f6a
mov rcx, qword [rsi]
test rcx, rcx
je 0x140038f4a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140038f5c
call fcn.140084f34
mov qword [rsi + 8], r13
mov edx, Ordinal_26
mov rcx, rsi
call fcn.140084f34
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140038fa7
mov rcx, qword [rbx]
test rcx, rcx
je 0x140038f88
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140038f9a
call fcn.140084f34
mov qword [rbx + 8], r13
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140084f34
test r15d, r15d
jns 0x140038fc8
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Error_with_BIOS__restart_checker
lea rcx, [rsp + 0x50]
call fcn.1400380d0
jmp 0x140039765
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0x2c0], r13d
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x140039765
mov rax, qword [rcx]
lea rdx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xd0]
mov r8d, 1
mov edx, r14d
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rsp + 0x2c0], 0
je 0x140039757
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140039757
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x118]
xor r8d, r8d
lea rdx, [0x1400f3108]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x140039135
cmp word [rsp + 0x118], 8
jne 0x140039135
mov rsi, qword [rsp + 0x120]
mov ecx, Ordinal_26
call fcn.140084be8
mov rbx, rax
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x1400390ae
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400390b1
test rsi, rsi
jne 0x140039a52
jmp 0x1400390b1
mov rbx, r13
mov qword [rsp + 0xe0], rbx
test rbx, rbx
je 0x140039a5d
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400390d7
mov rcx, qword [rbx]
call fcn.140085cb0
mov qword [rbx + 8], rax
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400390e0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400380d0
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140039135
mov rcx, qword [rbx]
test rcx, rcx
je 0x140039116
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140039128
call fcn.140084f34
mov qword [rbx + 8], r13
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140084f34
lea rcx, [rsp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x118]
xor r8d, r8d
lea rdx, str.SMBIOSBIOSVersion
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x140039255
cmp word [rsp + 0x118], 8
jne 0x140039255
mov rsi, qword [rsp + 0x120]
mov ecx, Ordinal_26
call fcn.140084be8
mov rbx, rax
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x1400391cd
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400391d0
test rsi, rsi
jne 0x140039a68
jmp 0x1400391d0
mov rbx, r13
mov qword [rsp + 0xe0], rbx
test rbx, rbx
je 0x140039a73
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400391f6
mov rcx, qword [rbx]
call fcn.140085cb0
mov qword [rbx + 8], rax
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140039200
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400380d0
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140039255
mov rcx, qword [rbx]
test rcx, rcx
je 0x140039236
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140039248
call fcn.140084f34
mov qword [rbx + 8], r13
mov edx, Ordinal_26
mov rcx, rbx
call fcn.140084f34
lea rcx, [rsp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x118]
xor r8d, r8d
lea rdx, str.ReleaseDate
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
js 0x14003973b
cmp word [rsp + 0x118], 8
jne 0x14003973b
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], r13
mov qword [rsp + 0x100], r13
mov rdx, qword [rsp + 0x120]
nop word [rax + rax]
inc r14
cmp word [rdx + r14*2], 0
jne 0x1400392d0
mov r8, r14
lea rcx, [rsp + 0xe8]
call fcn.14003b290
nop
cmp qword [rsp + 0xf8], 8
jb 0x1400396f0
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova r8, qword [rsp + 0xe8]
add r8, 8
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x1f8]
call fcn.14003afe0
mov r14, rax
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova r8, qword [rsp + 0xe8]
add r8, 0x10
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova rdx, qword [rsp + 0xe8]
add rdx, 0xc
lea rcx, [rsp + 0x1b8]
call fcn.14003afe0
mov rsi, rax
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova r8, qword [rsp + 0xe8]
add r8, 0xc
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 7
cmova rdx, qword [rsp + 0xe8]
add rdx, 8
lea rcx, [rsp + 0x198]
call fcn.14003afe0
nop
mov r8d, 1
lea rdx, [0x1400f3168]
mov rcx, rax
call fcn.14003aee0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x178], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x188], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rsp + 0x2b8], reloc.WS2_32.dll_recvfrom
mov r9, rsi
lea r8, [rsp + 0x178]
lea rcx, [rsp + 0x138]
call fcn.14003b720
mov dword [rsp + 0x2b8], reloc.WS2_32.dll_send
mov r8d, 1
lea rdx, [0x1400f3168]
lea rcx, [rsp + 0x138]
call fcn.14003aee0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x168], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rsp + 0x2b8], reloc.WS2_32.dll_socket
mov r9, r14
lea r8, [rsp + 0x158]
lea rcx, [rsp + 0x1d8]
call fcn.14003b720
mov dword [rsp + 0x2b8], Ordinal_35
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x1400394f6
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400394f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400394f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
movups xmm0, xmmword [rsp + 0x1d8]
movaps xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rsp + 0x1e8]
movaps xmmword [rsp + 0xa0], xmm1
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14003955d
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039557
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
nop
mov rdx, qword [rsp + 0x150]
cmp rdx, 0xf
jbe 0x1400395a3
inc rdx
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003959e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003959e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
movdqu xmmword [rsp + 0x148], xmm6
mov byte [rsp + 0x138], 0
mov rdx, qword [rsp + 0x190]
cmp rdx, 0xf
jbe 0x1400395fb
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400395f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400395f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0xf
jbe 0x140039641
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003963c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003963c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
movdqu xmmword [rsp + 0x1a8], xmm6
mov byte [rsp + 0x198], 0
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 0xf
jbe 0x140039698
inc rdx
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039693
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039693
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
movdqu xmmword [rsp + 0x1c8], xmm6
mov byte [rsp + 0x1b8], 0
mov rdx, qword [rsp + 0x210]
cmp rdx, 0xf
jbe 0x1400396f0
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400396ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400396ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 7
jbe 0x14003973b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039736
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
lea rcx, [rsp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x110]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x218]
cmp ax, 9
je 0x14003978e
test ax, ax
mov byte [rsp + 0xb0], 0
jne 0x140039796
mov byte [rsp + 0xb0], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
lea rdx, [rsp + 0xd0]
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.tbs.dll_Tbsi_GetDeviceInfo]
test eax, eax
sete byte [rsp + 0xb1]
mov dword [rsp + 0x2c8], r13d
mov dword [rsp + 0x108], 4
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140039856
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140039848
cmp dword [rsp + 0x2c8], 1
sete byte [rsp + 0xb2]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
xor ecx, ecx
cpuid
test ecx, 0x80000000
setne byte [rsp + 0xb3]
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x1400398e0
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14003a900
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003a900
nop
lea rcx, [rbx + 0x40]
lea rdx, [rsp + 0x90]
call fcn.14003a900
movzx eax, byte [rsp + 0xb0]
mov byte [rbx + 0x60], al
movzx eax, byte [rsp + 0xb1]
mov byte [rbx + 0x61], al
movzx eax, byte [rsp + 0xb2]
mov byte [rbx + 0x62], al
movzx eax, byte [rsp + 0xb3]
mov byte [rbx + 0x63], al
add qword [rdi + 8], 0x68
jmp 0x1400398f0
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14003bb50
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
jmp 0x140039925
mov rdi, qword [rsp + 0x2b0]
movdqa xmm6, xmmword [0x1400f79d0]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140039968
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400399f7
call fcn.140084f34
movdqa xmmword [rsp + 0xa0], xmm6
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x1400399b5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400399b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400399f7
call fcn.140084f34
movdqa xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140039a09
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039a03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039a03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
jmp 0x140039915
call fcn.140084f34
nop
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x260]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
nop
mov ecx, 0x8007000e
call fcn.140085ca0
int3