Function at 0x1401de470
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x54], r8d
mov r13, rcx
mov qword [rsp + 0x58], rcx
test rcx, rcx
je 0x1401df5ba
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xor r12d, r12d
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov r8d, reloc.SinoSPE.dll_Ordinal_32
lea rdx, str.FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
lea rcx, [rbp - 0x40]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x1403f56f0]
xor edx, edx
mov r8d, 1
lea rcx, [0x1403f5700]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rsi, 0xffffffffffffffff
test eax, eax
js 0x1401df1e3
mov qword [rsp + 0x70], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1401de584
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x1401df5f1
jmp 0x1401de587
mov rdi, r12
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x1401df5fc
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
call qword [rax + reloc.SinoSPE.dll_Ordinal_24]
mov ebx, eax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1401de605
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401de5e6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401de5f8
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
test ebx, ebx
js 0x1401df1d8
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1401df1cd
mov qword [rsp + 0x68], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1401de689
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, str.SELECT_UUID_FROM_Win32_ComputerSystemProduct
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401de68c
mov rdi, r12
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x1401df5e6
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401de6d8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401de6db
mov rbx, r12
mov qword [rbp - 0x68], rbx
test rbx, rbx
je 0x1401df607
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1401de751
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401de731
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401de743
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1401de78d
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401de76e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401de780
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
test r14d, r14d
js 0x1401de9d5
mov qword [rsp + 0x60], r12
mov dword [rbp - 0x68], r12d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401de9cf
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x68], 0
jbe 0x1401de9ca
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, str.UUID
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401de9b5
cmp word [rbp - 0x20], 8
jne 0x1401de9b5
mov r9, qword [rbp - 0x18]
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401de820
mov rax, qword [rbp - 0x28]
cmp rdx, rax
ja 0x1401de85e
lea rbx, [rbp - 0x40]
cmp rax, 7
cmova rbx, qword [rbp - 0x40]
mov qword [rbp - 0x30], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx], r12w
jmp 0x1401de867
lea rcx, [rbp - 0x40]
call fcn.140004f70
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1401de9b5
lea rax, [rbp - 0x40]
mov rdi, qword [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rax, rdi
lea r14, [rax + rcx*2]
lea rax, [rbp - 0x40]
cmova rax, rdi
lea rbx, [rax + rcx*2]
lea rcx, [rbp - 0x40]
cmova rcx, rdi
mov r8d, Ordinal_48
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401de8da
lea rcx, [rax + 2]
cmp rcx, rbx
je 0x1401de8da
nop dword [rax]
movzx eax, word [rcx]
cmp ax, 0x2d
je 0x1401de8d1
mov word [r8], ax
add r8, 2
add rcx, 2
cmp rcx, rbx
jne 0x1401de8c0
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rax, qword [rbp - 0x40]
mov rdi, r8
sub rdi, rax
sar rdi, 1
sub r14, r8
sar r14, 1
mov rbx, qword [rbp - 0x30]
mov rax, rbx
sub rax, rdi
cmp rax, r14
cmovb r14, rax
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rax, qword [rbp - 0x40]
lea rcx, [rax + rdi*2]
sub rbx, r14
mov r8, rbx
sub r8, rdi
lea r8, [r8*2 + 2]
lea rdx, [rcx + r14*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x40]
mov rdx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x28]
cmp rdi, 7
cmova rax, rdx
add rbx, rbx
movabs r8, 0x40000000400001
nop dword [rax]
lea rcx, [rbp - 0x40]
cmp rdi, 7
cmova rcx, rdx
add rcx, rbx
cmp rax, rcx
je 0x1401de98d
movzx ecx, word [rax]
sub cx, 0x30
cmp cx, 0x36
ja 0x1401de98d
bt r8, rcx
jae 0x1401de98d
add rax, 2
jmp 0x1401de960
lea rcx, [rbp - 0x40]
cmp rdi, 7
cmova rcx, rdx
add rcx, rbx
cmp rax, rcx
jne 0x1401de9b5
mov qword [rbp - 0x30], r12
lea rax, [rbp - 0x40]
cmp rdi, 7
cmova rax, rdx
mov word [rax], r12w
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov r14d, esi
mov qword [rsp + 0x68], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1401dea1c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, str.SELECT_DiskIndex_FROM_Win32_DiskPartition_WHERE_BootableTrue
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dea1f
mov rdi, r12
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x1401df5e6
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401dea6b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dea6e
mov rbx, r12
mov qword [rbp - 0x68], rbx
test rbx, rbx
je 0x1401df612
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov r15d, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1401deae4
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401deac4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dead6
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1401deb20
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401deb01
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401deb13
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
test r15d, r15d
js 0x1401df1cd
mov qword [rsp + 0x60], r12
mov dword [rbp - 0x68], r12d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401debb3
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x68], 0
jbe 0x1401debae
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, str.DiskIndex
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401deb99
cmp word [rbp - 0x20], 3
cmove r14d, dword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
test r14d, r14d
js 0x1401df1cd
cmp r14d, 0xa
jge 0x1401df1cd
movaps xmm0, xmmword [str.SELECT_SerialNumber_FROM_Win32_DiskDrive_WHERE__SerialNumber_IS_NOT_NULL__AND__Index0_]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm1, xmmword [0x140443670]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm0, xmmword [0x140443680]
movaps xmmword [rbp + 0x70], xmm0
movaps xmm1, xmmword [0x140443690]
movaps xmmword [rbp + 0x80], xmm1
movaps xmm0, xmmword [0x1404436a0]
movaps xmmword [rbp + 0x90], xmm0
movsd xmm0, qword [0x1404436b0]
movsd qword [rbp + 0xa0], xmm0
add r14b, 0x30
lea rax, [rbp + 0x50]
mov rcx, rsi
lea rcx, [rcx + 1]
cmp byte [rax + rcx], 0
jne 0x1401dec24
lea rax, [rbp + 0x50]
mov byte [rcx + rax - 2], r14b
mov qword [rsp + 0x68], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1401dec78
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [rbp + 0x50]
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dec7b
mov rdi, r12
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x1401df61d
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401decc7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401decca
mov rbx, r12
mov qword [rbp - 0x68], rbx
test rbx, rbx
je 0x1401df628
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1401ded40
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401ded20
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401ded32
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1401ded7c
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401ded5d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401ded6f
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
test r14d, r14d
js 0x1401df1cd
mov qword [rsp + 0x60], r12
mov dword [rbp - 0x68], r12d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401df1c7
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x68], 0
jbe 0x1401df1c2
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401df1ad
cmp word [rbp - 0x80], 8
jne 0x1401df1ad
mov r9, qword [rbp - 0x78]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dee10
mov rax, qword [rbp - 0x48]
cmp rdx, rax
ja 0x1401dee4e
lea rbx, [rbp - 0x60]
cmp rax, 7
cmova rbx, qword [rbp - 0x60]
mov qword [rbp - 0x50], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dee57
lea rcx, [rbp - 0x60]
call fcn.140004f70
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401df1ad
lea rax, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, rdi
lea r14, [rax + rcx*2]
lea rax, [rbp - 0x60]
cmova rax, rdi
lea rbx, [rax + rcx*2]
lea rcx, [rbp - 0x60]
cmova rcx, rdi
mov r8d, reloc.SinoSPE.dll_Ordinal_32
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401deeca
lea rcx, [rax + 2]
cmp rcx, rbx
je 0x1401deeca
nop dword [rax]
movzx eax, word [rcx]
cmp ax, 0x20
je 0x1401deec1
mov word [r8], ax
add r8, 2
add rcx, 2
cmp rcx, rbx
jne 0x1401deeb0
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
mov rdi, r8
sub rdi, rax
sar rdi, 1
sub r14, r8
sar r14, 1
mov rbx, qword [rbp - 0x50]
mov rax, rbx
sub rax, rdi
cmp rax, r14
cmovb r14, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
lea rcx, [rax + rdi*2]
sub rbx, r14
mov r8, rbx
sub r8, rdi
lea r8, [r8*2 + 2]
lea rdx, [rcx + r14*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rbx
lea rax, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, rdi
lea r14, [rax + rbx*2]
lea rax, [rbp - 0x60]
cmova rax, rdi
lea rbx, [rax + rbx*2]
lea rcx, [rbp - 0x60]
cmova rcx, rdi
mov r8d, Ordinal_48
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401def8a
lea rcx, [rax + 2]
cmp rcx, rbx
je 0x1401def8a
movzx eax, word [rcx]
cmp ax, 0x2d
je 0x1401def81
mov word [r8], ax
add r8, 2
add rcx, 2
cmp rcx, rbx
jne 0x1401def70
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
mov rdi, r8
sub rdi, rax
sar rdi, 1
sub r14, r8
sar r14, 1
mov rbx, qword [rbp - 0x50]
mov rax, rbx
sub rax, rdi
cmp rax, r14
cmovb r14, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
lea rcx, [rax + rdi*2]
sub rbx, r14
mov r8, rbx
sub r8, rdi
lea r8, [r8*2 + 2]
lea rdx, [rcx + r14*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rbx
lea rax, [rbp - 0x60]
mov rdi, qword [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, rdi
lea r14, [rax + rbx*2]
lea rax, [rbp - 0x60]
cmova rax, rdi
lea rbx, [rax + rbx*2]
lea rcx, [rbp - 0x60]
cmova rcx, rdi
mov r8d, 0x5f
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401df04a
add rax, 2
cmp rax, rbx
je 0x1401df04a
movzx ecx, word [rax]
cmp cx, 0x5f
je 0x1401df041
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401df030
mov r9, r14
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.1401e6830
lea r14, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x48]
cmp rdi, 7
cmova r14, r8
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rax]
add r14, rcx
lea rbx, [rbp - 0x60]
cmp rdi, 7
cmova rbx, r8
add rbx, rcx
lea rcx, [rbp - 0x60]
cmp rdi, 7
cmova rcx, r8
mov r8d, Ordinal_51
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401df0cd
add rax, 2
cmp rax, rbx
je 0x1401df0cd
movzx ecx, word [rax]
cmp cx, 0x2e
je 0x1401df0c4
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401df0b3
mov r9, r14
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.1401e6830
lea r14, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x48]
cmp rdi, 7
cmova r14, r8
mov rax, qword [rbp - 0x50]
lea rcx, [rax + rax]
add r14, rcx
lea rbx, [rbp - 0x60]
cmp rdi, 7
cmova rbx, r8
add rbx, rcx
lea rcx, [rbp - 0x60]
cmp rdi, 7
cmova rcx, r8
mov r8d, 0x7c
mov rdx, rbx
call fcn.1403c9db0
mov rdi, rax
cmp rax, rbx
je 0x1401df14f
lea rcx, [rax + 2]
cmp rcx, rbx
je 0x1401df14f
movzx eax, word [rcx]
cmp ax, 0x7c
je 0x1401df146
mov word [rdi], ax
add rdi, 2
add rcx, 2
cmp rcx, rbx
jne 0x1401df136
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
mov r9, rdi
sub r9, rax
sar r9, 1
sub r14, rdi
sar r14, 1
mov rdi, qword [rbp - 0x50]
mov rax, rdi
sub rax, r9
cmp rax, r14
cmovb r14, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rax, qword [rbp - 0x60]
lea rcx, [rax + r9*2]
sub rdi, r14
mov r8, rdi
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + r14*2]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x50], rdi
lea rcx, [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea rdi, [rbp]
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
mov ebx, r12d
mov r12, qword [rbp - 0x50]
test r12, r12
je 0x1401df3b2
test r12b, 1
lea r9d, [r12 - 1]
cmove r9d, r12d
mov eax, 8
cmp r9d, eax
cmovg r9d, eax
lea rax, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov r15, qword [rbp - 0x28]
cmp r15, 7
cmova rax, r14
mov r13, qword [rbp - 0x30]
lea rcx, [rax + r13*2]
lea rdi, [rbp - 0x60]
mov r10, qword [rbp - 0x60]
mov r11, qword [rbp - 0x48]
cmp r11, 7
cmova rdi, r10
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x40]
cmp r15, 7
cmova rax, r14
cmp rcx, rax
je 0x1401df2b6
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov edx, reloc.SinoSPE.dll_Ordinal_16
sub edx, eax
cmp ebx, edx
jge 0x1401df2b6
movzx eax, word [rcx - 2]
cmp ax, 0x61
jb 0x1401df2a6
cmp ax, 0x7a
ja 0x1401df2a6
sub al, 0x20
mov byte [rbp + r8], al
inc ebx
inc r8
sub rcx, 4
jmp 0x1401df270
lea rdx, [r12 - 1]
lea rdx, [rdi + rdx*2]
nop
lea rcx, [rbp - 0x60]
cmp r11, 7
cmova rcx, r10
lea rax, [rdx + 2]
cmp rax, rcx
je 0x1401df2fc
cmp r8, 0x10
jge 0x1401df2fc
movzx eax, word [rdx]
cmp ax, 0x61
jb 0x1401df2ec
cmp ax, 0x7a
ja 0x1401df2ec
sub al, 0x20
mov byte [rbp + r8], al
inc ebx
inc r8
sub rdx, 4
jmp 0x1401df2c0
lea rax, [rbp - 0x60]
cmp r11, 7
cmova rax, r10
lea rcx, [r12 - 1]
lea rcx, [rax + rcx*2]
lea rax, [rbp - 0x60]
cmp r11, 7
cmova rax, r10
cmp rcx, rax
je 0x1401df353
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
add eax, 0x10
cmp ebx, eax
jge 0x1401df353
movzx eax, word [rcx - 2]
cmp ax, 0x61
jb 0x1401df343
cmp ax, 0x7a
ja 0x1401df343
sub al, 0x20
mov byte [rbp + r8], al
inc ebx
inc r8
sub rcx, 4
jmp 0x1401df311
lea rax, [rbp - 0x40]
cmp r15, 7
cmova rax, r14
lea rax, [rax + r13*2]
add rax, 0xfffffffffffffffe
nop word [rax + rax]
lea rcx, [rbp - 0x40]
cmp r15, 7
cmova rcx, r14
cmp rax, rcx
je 0x1401df469
cmp r8, 0x20
jge 0x1401df469
movzx ecx, word [rax - 2]
cmp cx, 0x61
jb 0x1401df3a2
cmp cx, 0x7a
ja 0x1401df3a2
sub cl, 0x20
mov byte [rbp + r8], cl
inc ebx
inc r8
sub rax, 4
jmp 0x1401df370
lea rax, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x28]
cmp r9, 7
cmova rax, r8
mov r11, qword [rbp - 0x30]
lea rax, [rax + r11*2]
xor r14d, r14d
mov edx, r14d
mov r10, rax
mov rcx, rax
lea rdi, [rbp - 0x40]
cmp r9, 7
jbe 0x1401df3e7
mov rdi, r8
cmp rcx, rdi
je 0x1401df414
cmp rdx, 0x20
jge 0x1401df414
movzx ecx, word [rax - 2]
cmp cx, 0x61
jb 0x1401df405
cmp cx, 0x7a
ja 0x1401df405
sub cl, 0x20
mov byte [rbp + rdx], cl
inc ebx
inc rdx
add rax, 0xfffffffffffffffc
jmp 0x1401df3d4
lea rax, [rbp - 0x40]
cmp r9, 7
cmova rax, r8
lea rax, [rax + r11*2]
add rax, 0xfffffffffffffffe
nop dword [rax + rax]
lea rcx, [rbp - 0x40]
cmp r9, 7
cmova rcx, r8
cmp rax, rcx
je 0x1401df471
cmp rdx, 0x20
jge 0x1401df471
movzx ecx, word [rax - 2]
cmp cx, 0x61
jb 0x1401df45a
cmp cx, 0x7a
ja 0x1401df45a
sub cl, 0x20
mov byte [rbp + rdx], cl
inc ebx
inc rdx
sub rax, 4
jmp 0x1401df430
xor r14d, r14d
mov r13, qword [rsp + 0x58]
cmp byte [rbp + 0x120], 0
jne 0x1401df50e
mov r8, qword [rbp + 0x128]
test r8, r8
je 0x1401df4c4
nop word [rax + rax]
inc rsi
cmp word [r8 + rsi*2], 0
jne 0x1401df490
movsxd rdi, esi
test esi, esi
jle 0x1401df4c4
movsxd rax, ebx
mov rcx, r14
lea rdx, [rbp]
add rdx, rax
add ebx, esi
movzx eax, byte [r8 + rcx*2]
mov byte [rdx], al
lea rdx, [rdx + 1]
inc rcx
cmp rcx, rdi
jl 0x1401df4b1
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov r9d, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
lea rdx, str._d_d
lea rcx, [rbp - 0x20]
call fcn.1401e6c10
lea rdx, [rbp - 0x20]
movsxd rax, ebx
lea rcx, [rbp - 0x20]
sub rax, rcx
lea rdi, [rbp]
add rdi, rax
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx + rdi], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401df500
lea rdx, [rbp]
mov rcx, r13
call fcn.140233f70
movzx edi, al
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1401df560
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401df55b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401df55b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1401df5b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401df5af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401df5af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
movzx eax, dil
jmp 0x1401df5bc
xor al, al
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1403ca460
mov rbx, qword [rsp + 0x208]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
int3