Function at 0x140018070
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov r14, rcx
mov qword [rbp + 0x90], rcx
mov qword [rbp - 0x70], rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5c0], xmm1
mov qword [rbp + 0x5d0], r15
mov qword [rbp + 0x598], r15
mov qword [rbp + 0x550], r15
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x130
mov eax, dword [rcx + rbx]
test al, 1
jne 0x14001811e
or eax, 1
mov dword [rcx + rbx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, eax
cmp eax, 1
ja 0x140019278
lea rcx, [0x14005f460]
call fcn.14002f6d4
nop
mov eax, SafeArrayLock
mov eax, dword [rax + rbx]
cmp dword [0x140083294], eax
jg 0x1400192a7
lea rax, [rbp + 0x550]
mov qword [rsp + 0x20], rax
lea r9, [0x140060d10]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140060d20]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edx, eax
test eax, eax
js 0x140019305
mov rdi, qword [rbp + 0x550]
mov qword [rbp + 0x598], rdi
mov qword [rbp + 0x590], r15
test rdi, rdi
je 0x140019337
mov qword [rbp + 0x558], r15
mov rax, qword [rdi]
mov rsi, qword [rax + 0x18]
mov ecx, SafeArrayPutElement
call fcn.14002ec80
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400181d6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.._rootCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14001923b
jmp 0x1400181d9
mov rbx, r15
mov qword [rbp + 0x98], rbx
test rbx, rbx
je 0x14001935e
lea rax, [rbp + 0x558]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
mov rax, rsi
call qword [0x140060458]
mov edi, eax
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140018262
mov rcx, qword [rbx]
test rcx, rcx
je 0x140018243
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018255
call fcn.14002ef0c
mov qword [rbx + 8], r15
mov edx, SafeArrayPutElement
mov rcx, rbx
call fcn.14002ef0c
test edi, edi
js 0x140019369
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x590], rax
mov esi, 2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x578], xmm0
mov qword [rbp + 0x588], rax
lea rax, str.SELECT__FROM_Win32_NetworkAdapter_WHERE_PhysicalAdapter__True
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 0x3f
lea rax, [0x1400714f0]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 3
movaps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x2f0], xmm0
movaps xmm1, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x2e0], xmm1
lea r9, [rbp + 0x2f0]
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x578]
lea rcx, [rbp + 0x590]
call fcn.140023390
nop
cmp byte [rbp + 0x588], 0
je 0x140019194
lea r13, vtable.std::_Ref_count_obj2_class_json11::JsonString_.0
movabs r12, 0x7ffffffffffffffe
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
or esi, 8
mov dword [rsp + 0x50], esi
mov rbx, qword [rbp + 0x580]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
cmp word [rsp + 0x58], 0
je 0x140018362
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Name
mov rcx, rbx
mov rax, rdi
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x140019246
and esi, 0xfffffff7
or esi, 4
lea rdx, [rbp + 0x638]
lea rcx, [rsp + 0x58]
call fcn.140022df0
nop
cmp word [rsp + 0x58], 0
je 0x1400183bd
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
or esi, 0x20
mov dword [rsp + 0x50], esi
mov rbx, qword [rbp + 0x580]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
cmp word [rbp + 0x20], 0
je 0x1400183fa
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.ServiceName
mov rcx, rbx
mov rax, rdi
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x140019209
and esi, 0xffffffdf
or esi, 0x10
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x20]
call fcn.140022df0
nop
cmp word [rbp + 0x20], 0
je 0x140018451
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
bts esi, 7
mov dword [rsp + 0x50], esi
mov rbx, qword [rbp + 0x580]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
cmp word [rbp - 0x10], 0
je 0x14001848f
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, rbx
mov rax, rdi
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x14001941f
btr esi, 7
or esi, 0x40
lea rdx, [rbp + 0x618]
lea rcx, [rbp - 0x10]
call fcn.140022df0
nop
cmp word [rbp - 0x10], 0
je 0x1400184e7
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
bts esi, 9
mov dword [rsp + 0x50], esi
mov rbx, qword [rbp + 0x580]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
cmp word [rbp - 0x28], 0
je 0x140018525
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x28]
xor r8d, r8d
lea rdx, str.AdapterType
mov rcx, rbx
mov rax, rdi
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x1400193ed
btr esi, 9
bts esi, 8
lea rdx, [rbp + 0x5f8]
lea rcx, [rbp - 0x28]
call fcn.140022df0
nop
cmp word [rbp - 0x28], 0
je 0x14001857e
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
bts esi, 0xb
mov dword [rsp + 0x50], esi
mov rbx, qword [rbp + 0x580]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
cmp word [rbp + 8], 0
je 0x1400185bc
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 8]
xor r8d, r8d
lea rdx, str.NetEnabled
mov rcx, rbx
mov rax, rdi
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x1400193bb
btr esi, 0xb
bts esi, 0xa
lea rdx, [rbp + 0x5d8]
lea rcx, [rbp + 8]
call fcn.140022df0
nop
cmp word [rbp + 8], 0
je 0x140018614
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov rdi, qword [rbp + 0x5b0]
lea r14, [rbp + 0x5a0]
cmp qword [rbp + 0x5b8], 8
cmovae r14, qword [rbp + 0x5a0]
cmp rdi, 8
jae 0x140018656
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x30], 7
jmp 0x14001868c
mov rbx, rdi
or rbx, 7
cmp rbx, r12
cmova rbx, r12
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x48]
call fcn.140003380
mov qword [rbp - 0x48], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140034100
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x660]
call fcn.140017540
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x560], xmm0
mov qword [rbp + 0x560], r15
mov qword [rbp + 0x568], r15
mov ecx, 0x50
call fcn.14002ec80
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x560], rax
lea rax, [rbp + 0x638]
cmp qword [rbp + 0x650], 8
cmovae rax, qword [rbp + 0x638]
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x148], rax
movaps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x2d0], xmm0
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x3b8]
call fcn.140027be0
mov rbx, rax
mov ecx, 0x38
call fcn.14002ec80
mov qword [rbp + 0x550], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], r13
lea r13, [rax + 0x10]
lea rcx, vtable.json11::Value_3__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [r13], rcx
mov qword [r13 + 8], r15
mov qword [r13 + 0x18], r15
mov qword [r13 + 0x20], r15
movups xmm0, xmmword [rbx]
movups xmmword [r13 + 8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r13 + 0x18], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], 0
lea rcx, vtable.json11::JsonString.0
mov qword [r13], rcx
bts esi, 0xc
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], rax
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], SafeArrayLock
mov byte [rsp + 0x70], 0
mov r8d, 4
lea rdx, str.name
lea rcx, [rsp + 0x70]
call fcn.140003080
nop
mov r14, qword [rbp + 0x560]
mov qword [rbp + 0x548], r14
mov rbx, qword [r14 + 8]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], r15d
mov rdi, r14
mov rax, qword [rbp - 0x78]
mov r12, qword [rbp - 0x80]
mov r15, qword [rsp + 0x70]
cmp byte [rbx + 0x19], 0
jne 0x140018883
cmp rax, 0x10
setae r14b
nop dword [rax + rax]
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + 0x20]
lea r8, [rsp + 0x70]
test r14b, r14b
cmovne r8, r15
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140018843
mov rcx, qword [rcx]
mov r9, r12
call fcn.1400034f0
test eax, eax
je 0x140018864
shr eax, 0x1f
test al, al
je 0x140018864
mov dword [rsp + 0x60], 0
mov rbx, qword [rbx + 0x10]
jmp 0x140018872
mov dword [rsp + 0x60], 1
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140018820
mov r14, qword [rbp + 0x548]
mov rax, qword [rbp - 0x78]
cmp byte [rdi + 0x19], 0
jne 0x1400188cd
lea r8, [rdi + 0x20]
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14001889b
mov r8, qword [r8]
lea rcx, [rsp + 0x70]
cmp rax, 0x10
cmovae rcx, r15
mov rdx, r12
call fcn.1400034f0
test eax, eax
je 0x1400188bb
shr eax, 0x1f
test al, al
jne 0x1400188cd
xor r15d, r15d
movabs r12, 0x333333333333333
jmp 0x14001895a
movabs r12, 0x333333333333333
cmp qword [rbp + 0x568], r12
je 0x1400193b5
lea rax, [rbp + 0x560]
mov qword [rbp + 0x150], rax
xor r15d, r15d
mov qword [rbp + 0x158], r15
lea ecx, [r15 + 0x50]
call fcn.14002ec80
mov rbx, rax
lea rcx, [rax + 0x20]
lea rax, [rsp + 0x70]
mov qword [rbp + 0x78], rax
lea r8, [rbp + 0x78]
call fcn.1400041b0
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], r15w
mov qword [rbp + 0x158], r15
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rbp + 0x260], xmm0
mov r8, rbx
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x560]
call fcn.140003950
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
mov qword [rdi + 0x40], r13
mov rcx, qword [rdi + 0x48]
mov rax, qword [rbp + 0x550]
mov qword [rdi + 0x48], rax
test rcx, rcx
je 0x140018983
call fcn.140001ef0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400189bf
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400189ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001939d
call fcn.14002ef0c
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], SafeArrayLock
mov byte [rsp + 0x70], 0
lea rcx, [rbp + 0x3b8]
call fcn.140002d40
lea rax, [rbp + 0x618]
cmp qword [rbp + 0x630], 8
cmovae rax, qword [rbp + 0x618]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x178], rax
movaps xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x250], xmm0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x398]
call fcn.140027be0
nop
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.14002a1c0
nop
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], SafeArrayLock
mov byte [rbp - 0x68], 0
mov r8d, SafeArrayGetElemsize
lea rdx, str.manufacturer
lea rcx, [rbp - 0x68]
call fcn.140003080
nop
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x560]
call fcn.140003f50
mov rbx, qword [rbp + 0x298]
cmp byte [rbx + 0x19], 0
jne 0x140018ac6
lea r8, [rbx + 0x20]
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140018a9c
mov r8, qword [r8]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x58]
call fcn.1400034f0
test eax, eax
je 0x140018b56
shr eax, 0x1f
test al, al
je 0x140018b56
cmp qword [rbp + 0x568], r12
je 0x1400193af
mov rdi, qword [rbp + 0x560]
lea rax, [rbp + 0x560]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], r15
mov ecx, 0x50
call fcn.14002ec80
mov rbx, rax
lea rcx, [rax + 0x20]
lea rax, [rbp - 0x68]
mov qword [rbp + 0x80], rax
lea r8, [rbp + 0x80]
call fcn.1400041b0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rbp + 0x188], r15
movups xmm0, xmmword [rbp + 0x288]
movaps xmmword [rbp + 0x200], xmm0
mov r8, rbx
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x560]
call fcn.140003950
mov rbx, rax
movaps xmm1, xmmword [rbp + 0x190]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x190], xmm0
movq qword [rbx + 0x40], xmm1
psrldq xmm1, 8
mov rcx, qword [rbx + 0x48]
movq qword [rbx + 0x48], xmm1
test rcx, rcx
je 0x140018b86
call fcn.140001ef0
nop
lea rcx, [rbp - 0x68]
call fcn.140002d40
nop
lea rcx, [rbp + 0x398]
call fcn.140002d40
lea rax, [rbp + 0x5f8]
cmp qword [rbp + 0x610], 8
cmovae rax, qword [rbp + 0x5f8]
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x608]
mov qword [rbp + 0x1a8], rax
movaps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x230], xmm0
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x378]
call fcn.140027be0
nop
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.14002a1c0
nop
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], SafeArrayLock
mov byte [rbp + 0x58], 0
mov r8d, 4
lea rdx, str.type
lea rcx, [rbp + 0x58]
call fcn.140003080
nop
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x560]
call fcn.140003f50
mov rbx, qword [rbp + 0x2b0]
cmp byte [rbx + 0x19], 0
jne 0x140018c5f
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x58]
call fcn.140004070
test al, al
je 0x140018cef
cmp qword [rbp + 0x568], r12
je 0x1400193a9
mov rdi, qword [rbp + 0x560]
lea rax, [rbp + 0x560]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], r15
mov ecx, 0x50
call fcn.14002ec80
mov rbx, rax
lea rcx, [rax + 0x20]
lea rax, [rbp + 0x58]
mov qword [rbp + 0x88], rax
lea r8, [rbp + 0x88]
call fcn.1400041b0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rbp + 0x1b8], r15
movups xmm0, xmmword [rbp + 0x2a0]
movaps xmmword [rbp + 0x270], xmm0
mov r8, rbx
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x560]
call fcn.140003950
mov rbx, rax
movaps xmm1, xmmword [rbp + 0x1c0]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1c0], xmm0
movq qword [rbx + 0x40], xmm1
psrldq xmm1, 8
mov rcx, qword [rbx + 0x48]
movq qword [rbx + 0x48], xmm1
test rcx, rcx
je 0x140018d1f
call fcn.140001ef0
nop
lea rcx, [rbp + 0x58]
call fcn.140002d40
nop
lea rcx, [rbp + 0x378]
call fcn.140002d40
lea rax, [rbp + 0x5d8]
cmp qword [rbp + 0x5f0], 8
cmovae rax, qword [rbp + 0x5d8]
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x5e8]
mov qword [rbp + 0x1d8], rax
movaps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x1f0], xmm0
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x358]
call fcn.140027be0
nop
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.14002a1c0
nop
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], SafeArrayLock
mov byte [rbp + 0x38], 0
mov r8d, 7
lea rdx, str.enabled
lea rcx, [rbp + 0x38]
call fcn.140003080
nop
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x560]
call fcn.140003f50
mov rbx, qword [rbp + 0x2c8]
cmp byte [rbx + 0x19], 0
jne 0x140018df8
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x38]
call fcn.140004070
test al, al
je 0x140018e82
cmp qword [rbp + 0x568], r12
je 0x1400193a3
mov rdi, qword [rbp + 0x560]
lea rax, [rbp + 0x560]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], r15
mov ecx, 0x50
call fcn.14002ec80
mov rbx, rax
lea rcx, [rax + 0x20]
lea rax, [rbp + 0x38]
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x70]
call fcn.1400041b0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rbp + 0x1e8], r15
movups xmm0, xmmword [rbp + 0x2b8]
movaps xmmword [rbp + 0x210], xmm0
mov r8, rbx
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x560]
call fcn.140003950
mov rbx, rax
movaps xmm1, xmmword [rbp + 0xc0]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
movq qword [rbx + 0x40], xmm1
psrldq xmm1, 8
mov rcx, qword [rbx + 0x48]
movq qword [rbx + 0x48], xmm1
test rcx, rcx
je 0x140018eb2
call fcn.140001ef0
nop
lea rcx, [rbp + 0x38]
call fcn.140002d40
nop
lea rcx, [rbp + 0x358]
call fcn.140002d40
lea rax, [rbp + 0x5a0]
cmp qword [rbp + 0x5b8], 8
cmovae rax, qword [rbp + 0x5a0]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x5b0]
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0x220], xmm0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x3e8]
call fcn.140027be0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14002a1c0
nop
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], SafeArrayLock
mov byte [rbp + 0xa0], 0
mov r8d, 7
lea rdx, str.service
lea rcx, [rbp + 0xa0]
call fcn.140003080
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x560]
call fcn.140002b90
mov rcx, rax
lea rdx, [rbp + 0xe0]
call fcn.140002b00
nop
lea rcx, [rbp + 0xa0]
call fcn.140002d40
nop
lea rcx, [rbp + 0xe0]
call fcn.140002090
nop
lea rcx, [rbp + 0x3e8]
call fcn.140002d40
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x110]
call fcn.14002a130
nop
lea rdx, str.driver
lea rcx, [rbp + 0x320]
call fcn.140002da0
nop
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x560]
call fcn.140002b90
mov rcx, rax
lea rdx, [rbp + 0x110]
call fcn.140002b00
nop
lea rcx, [rbp + 0x320]
call fcn.140002d40
nop
lea rcx, [rbp + 0x110]
call fcn.140002090
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0xf0]
call fcn.14002a130
nop
lea rdx, str.version
lea rcx, [rbp + 0x300]
call fcn.140002da0
nop
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x560]
call fcn.140002b90
mov rcx, rax
lea rdx, [rbp + 0xf0]
call fcn.140002b00
nop
lea rcx, [rbp + 0x300]
call fcn.140002d40
nop
lea rcx, [rbp + 0xf0]
call fcn.140002090
lea rdx, [rbp + 0x560]
lea rcx, [rbp + 0x100]
call fcn.14002a300
nop
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x5c0]
call fcn.14001b840
nop
lea rcx, [rbp + 0x100]
call fcn.140002090
nop
lea rcx, [rbp + 0x560]
call fcn.140002c60
nop
lea rcx, [rbp + 0x660]
call fcn.140017fc0
nop
lea rcx, [rbp + 0x5d8]
call fcn.140002cd0
nop
lea rcx, [rbp + 0x5f8]
call fcn.140002cd0
nop
lea rcx, [rbp + 0x618]
call fcn.140002cd0
nop
lea rcx, [rbp + 0x5a0]
call fcn.140002cd0
nop
lea rcx, [rbp + 0x638]
call fcn.140002cd0
mov rcx, qword [rbp + 0x578]
test rcx, rcx
je 0x14001917d
mov dword [rbp + 0x570], r15d
mov qword [rbp + 0x548], r15
mov rax, qword [rcx]
lea rdx, [rbp + 0x570]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x548]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
mov rax, qword [rax + 0x20]
call qword [0x140060458]
cmp dword [rbp + 0x570], 0
je 0x14001917d
test eax, eax
js 0x14001917d
mov rcx, qword [rbp + 0x580]
mov rax, qword [rbp + 0x548]
mov qword [rbp + 0x580], rax
test rcx, rcx
je 0x140019179
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140060458]
nop
mov al, 1
jmp 0x14001917f
xor al, al
mov byte [rbp + 0x588], al
test al, al
jne 0x14001830f
mov r14, qword [rbp + 0x90]
lea rcx, [rbp + 0x578]
call fcn.140017f80
lea rdx, [rbp + 0x5c0]
mov rcx, r14
call fcn.14002a260
nop
lea rcx, [rbp + 0x590]
call fcn.140013560
nop
lea rcx, [rbp + 0x598]
call fcn.140013560
nop
lea rcx, [rbp + 0x5c0]
call fcn.14001cd80
mov rax, r14
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.14002ec60
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rbp + 0x4f8]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x4f8]
call fcn.140033e04
nop
mov ecx, 0x8007000e
call fcn.140032ac0
nop
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rbp + 0x520]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x520]
call fcn.140033e04
nop
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_initialise_COM
lea rcx, [rbp + 0x430]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x430]
call fcn.140033e04
nop
lea rcx, [0x140083294]
call fcn.14002f368
cmp dword [0x140083294], 0xffffffff
jne 0x140018132
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x40
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rcx, [0x140083294]
call fcn.14002f308
jmp 0x140018132
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_create_IWbemLocator_object
lea rcx, [rbp + 0x458]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x458]
call fcn.140033e04
nop
lea rdx, str.Null_IWbemLocator_pointer_given_to_function_Sophos::WbemServer::WbemServer_IWbemLocator_loc_
lea rcx, [rbp + 0x340]
call fcn.140004630
lea rdx, [0x14007d148]
lea rcx, [rbp + 0x340]
call fcn.140033e04
int3
mov ecx, 0x8007000e
call fcn.140032ac0
int3
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_connect
mov edx, edi
lea rcx, [rbp + 0x408]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x408]
call fcn.140033e04
nop
call fcn.1400385e8
nop
call fcn.140002070
nop
call fcn.140002070
nop
call fcn.140002070
nop
call fcn.140002070
nop
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rbp + 0x480]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x480]
call fcn.140033e04
nop
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rbp + 0x4a8]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x4a8]
call fcn.140033e04
nop
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rbp + 0x4d0]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rbp + 0x4d0]
call fcn.140033e04
int3