Function at 0x140009440
Capabilities:
Acquire debug privileges
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x240
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1400321a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r14, rdx
cmp ecx, 2
je 0x14000948a
mov eax, 1
jmp 0x14000a337
mov rdx, qword [rdx + 8]
lea rcx, str.TaskKill__s_n
call fcn.14000aa90
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.140004180
test eax, eax
jne 0x1400094cc
lea rdx, str.SeDebugPrivilege
lea rcx, str.Unable_to_enable__s_n
call fcn.14000aa90
mov eax, 1
jmp 0x14000a337
mov edx, 1
lea rcx, str.SeRestorePrivilege
call fcn.140004180
test eax, eax
jne 0x1400094fe
lea rdx, str.SeRestorePrivilege
lea rcx, str.Unable_to_enable__s_n
call fcn.14000aa90
mov eax, 1
jmp 0x14000a337
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x1400095b6
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
xor edi, edi
test rax, rax
jne 0x140009534
mov rcx, rdi
jmp 0x14000953e
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x140009587
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov ebp, 4
cmp eax, 0xffffffff
cmove edi, ebp
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x1400095ac
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x1400095a4
or edx, 4
xor r8d, r8d
call fcn.140005010
mov eax, 1
jmp 0x14000a337
xor edi, edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14000968e
lea rdx, str.Failed_to_initialize_security._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x14000960d
mov rcx, rdi
jmp 0x140009617
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x140009660
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov ebp, 4
cmp eax, 0xffffffff
cmove edi, ebp
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x14000a2fc
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x140009681
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a2fc
mov qword [rsp + 0x80], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x14002cca8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14002cd78]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x140009777
lea rdx, str.Failed_to_create_IWbemLocator_object.
lea rcx, [0x140033a60]
call fcn.140007ea0
mov rcx, rax
lea rdx, str.Err_code__0x
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x1400096f6
mov rcx, rdi
jmp 0x140009700
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x140009749
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov ebp, 4
cmp eax, 0xffffffff
cmove edi, ebp
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x14000a2fc
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14000976a
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a2fc
mov qword [rsp + 0x50], rdi
lea rdx, str..ROOTCIMV2
lea rcx, [rsp + 0xa8]
call fcn.140004450
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x14000979e
mov rdx, qword [rcx]
jmp 0x1400097a1
mov rdx, rdi
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x18]
mov esi, eax
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x140009817
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
jne 0x140009817
test rbx, rbx
je 0x140009817
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009801
call qword [0x1400292b8]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000980f
call fcn.14000a9a0
mov rcx, rbx
call fcn.14000a430
test esi, esi
jns 0x1400098c0
lea rdx, str.Could_not_connect._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x14000983f
mov rcx, rdi
jmp 0x140009849
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, esi
mov rcx, r11
call fcn.140008580
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x140009892
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov ebp, 4
cmp eax, 0xffffffff
cmove edi, ebp
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x14000a2fc
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x1400098b3
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a2fc
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x140009999
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x140009918
mov rcx, rdi
jmp 0x140009922
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rbx, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x14000996b
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
mov ebp, 4
cmp eax, 0xffffffff
cmove edi, ebp
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x14000a2fc
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14000998c
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a2fc
mov qword [rsp + 0x78], rdi
mov ecx, 0x18
call fcn.14000a900
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400099d1
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_Process
call fcn.140025720
mov qword [rbx], rax
jmp 0x1400099d4
mov rbx, rdi
mov qword [rsp + 0xf8], rbx
test rbx, rbx
jne 0x1400099ec
mov ecx, 0x8007000e
call fcn.1400258d0
nop
mov ecx, 0x18
call fcn.14000a900
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140009a1f
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x140029c10]
call fcn.140025720
mov qword [rsi], rax
jmp 0x140009a22
mov rsi, rdi
mov qword [rsp + 0x120], rsi
test rsi, rsi
jne 0x140009a3a
mov ecx, 0x8007000e
call fcn.1400258d0
nop
test rbx, rbx
je 0x140009a44
mov r8, qword [rbx]
jmp 0x140009a47
mov r8, rdi
test rsi, rsi
je 0x140009a51
mov rdx, qword [rsi]
jmp 0x140009a54
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
test rsi, rsi
je 0x140009ab0
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
add ecx, 0xffffffff
jne 0x140009ab0
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009a99
call qword [0x1400292b8]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140009aa7
call fcn.14000a9a0
mov rcx, rsi
call fcn.14000a430
nop
test rbx, rbx
je 0x140009ae6
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x140009ae6
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009ad0
call qword [0x1400292b8]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009ade
call fcn.14000a9a0
mov rcx, rbx
call fcn.14000a430
test ebp, ebp
js 0x14000a2fc
mov dword [rsp + 0x60], edi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a30c
mov ebp, 4
nop
nop
nop
mov qword [rsp + 0x70], rdi
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x60], 0
je 0x14000a2fc
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.ExecutablePath
call qword [rax + 0x20]
test eax, eax
js 0x14000a2e1
cmp word [rsp + 0xb0], 8
jne 0x14000a2d3
mov rcx, qword [rsp + 0xb8]
call fcn.1400042c0
mov rdx, rax
mov rcx, qword [r14 + 8]
call fcn.14001e2a0
test eax, eax
jne 0x14000a2d3
mov rdx, qword [rsp + 0xb8]
lea rcx, str.Terminiate_Process__s_n
call fcn.14000bba0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x108]
xor r8d, r8d
lea rdx, str.ProcessId
call qword [rax + 0x20]
test eax, eax
js 0x14000a2fc
movsx ebx, word [rsp + 0x110]
lea rcx, [rsp + 0x108]
call qword [0x1400292a8]
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x98], rdi
lea rcx, str.Win32_Process
call qword [0x1400292c0]
mov r13, rax
mov word [rsp + 0x130], 0
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0x132]
call fcn.14000b610
mov r8d, ebx
lea rdx, str.Win32_Process.Handle__i_
lea rcx, [rsp + 0x130]
call fcn.140004000
lea rcx, [rsp + 0x130]
call qword [0x1400292c0]
mov r12, rax
mov rcx, qword [rsp + 0x50]
mov r10, qword [rcx]
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
call qword [r10 + 0x30]
mov ebx, eax
test eax, eax
jns 0x140009d39
lea rdx, str.Could_not_get_the_Class._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x140009cbb
mov rcx, rdi
jmp 0x140009cc5
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140009d0b
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140009d2c
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.Terminate
call qword [rax + 0x98]
mov ebx, eax
test eax, eax
jns 0x140009e09
lea rdx, str.Could_not_get_the_method._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x140009d8b
mov rcx, rdi
jmp 0x140009d95
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140009ddb
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140009dfc
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
xor edx, edx
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
jns 0x140009ec6
lea rdx, str.Could_not_SpawnInstance._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x140009e48
mov rcx, rdi
jmp 0x140009e52
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140009e98
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140009eb9
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
lea rcx, [rsp + 0xe0]
call qword [0x1400292b0]
mov word [rsp + 0xe0], 3
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0xe0]
xor r8d, r8d
lea rdx, str.Reason
call qword [rax + 0x28]
mov ebx, eax
test eax, eax
jns 0x140009fa7
lea rdx, str.Could_not_Put._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x140009f29
mov rcx, rdi
jmp 0x140009f33
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x140009f79
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140009f9a
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
mov rcx, qword [rsp + 0x50]
mov r10, qword [rcx]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.Terminate
mov rdx, r12
call qword [r10 + 0xc0]
mov ebx, eax
test eax, eax
jns 0x14000a08c
lea rdx, str.Could_not_execute_method._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x14000a00e
mov rcx, rdi
jmp 0x14000a018
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, ebx
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x14000a05e
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000a07f
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
lea rdx, str.ReturnValue
lea rcx, [rsp + 0xa0]
call fcn.140004450
nop
mov rcx, qword [rax]
test rcx, rcx
je 0x14000a0ae
mov rdx, qword [rcx]
jmp 0x14000a0b1
mov rdx, rdi
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc8]
xor r8d, r8d
call qword [rax + 0x20]
mov esi, eax
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14000a121
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
jne 0x14000a119
test rbx, rbx
je 0x14000a119
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a103
call qword [0x1400292b8]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a111
call fcn.14000a9a0
mov rcx, rbx
call fcn.14000a430
mov qword [rsp + 0xa0], rdi
test esi, esi
jns 0x14000a1c7
lea rdx, str.Fail_to_get_return_value._Error_code__0x
lea rcx, [0x140033a60]
call fcn.140007ea0
mov r11, rax
test rax, rax
jne 0x14000a149
mov rcx, rdi
jmp 0x14000a153
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r11
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov edx, esi
mov rcx, r11
call fcn.140008580
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x14000a199
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a26a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000a1ba
or edx, 4
xor r8d, r8d
call fcn.140005010
jmp 0x14000a26a
cmp word [rsp + 0xd0], 0
je 0x14000a25c
lea rdx, str.Could_terminate_process._Error_code_
lea rcx, [0x140033a60]
call fcn.140007ea0
mov rcx, rax
movzx edx, word [rsp + 0xd0]
call fcn.140008230
mov rsi, rax
mov dl, 0xa
mov rcx, rax
call fcn.1400088b0
mov ebx, edi
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x14000a227
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x60]
cmp eax, 0xffffffff
cmove ebx, ebp
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x14000a24c
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000a244
or edx, 4
xor r8d, r8d
call fcn.140005010
lea rcx, [rsp + 0xc8]
call qword [0x1400292a8]
jmp 0x14000a26a
lea rcx, [rsp + 0xc8]
call qword [0x1400292a8]
lea rcx, [rsp + 0xe0]
call qword [0x1400292a8]
mov rcx, r13
call qword [0x1400292b8]
mov rcx, r12
call qword [0x1400292b8]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14000a29d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000a2ad
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000a2c0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000a2d3
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0xb0]
call qword [0x1400292a8]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jne 0x140009b10
jmp 0x14000a30c
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a30c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000a31f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a32f
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000abb0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret