Function at 0x14000e4a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rbp + 0x100], r12
mov qword [rbp + 0xf8], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14000e53f
lea rdx, str.Failed_to_initialize_com_library._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000f781
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14000e580
lea rdx, str.Failed_to_initialize_security._error_code__0x
jmp 0x14000f744
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [0x14001b9f0]
xor edx, edx
mov r8d, 1
lea rcx, [0x14001ba00]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000f73d
mov rax, qword [rbp + 0x100]
test rax, rax
je 0x14000f73d
mov rax, qword [rax]
mov rsi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.140017380
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000e612
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000f7b8
jmp 0x14000e615
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000f7ad
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x100]
call rsi
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000e696
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000e677
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000e689
call fcn.1400176d4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400176d4
test esi, esi
js 0x14000f6eb
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14000f6eb
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14000e73c
lea rdx, str.Could_not_set_proxy_blanket._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000f77b
mov qword [rbp + 0x110], r12
mov rax, qword [rbp + 0xf8]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
cmp qword [rdi + 0x18], 0xf
jbe 0x14000e75e
mov rdi, qword [rdi]
mov ecx, 0x18
call fcn.140017380
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000e799
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.140018250
mov qword [rbx], rax
jmp 0x14000e79c
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000f7ad
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.140017380
mov rdi, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14000e7eb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x14001c710]
call fcn.140018250
mov qword [rdi], rax
jmp 0x14000e7ee
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x14000f7c3
lea rax, [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0xf8]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14000e864
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000e844
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000e856
call fcn.1400176d4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.1400176d4
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000e8a3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000e884
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000e896
call fcn.1400176d4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400176d4
test esi, esi
js 0x14000f6c1
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x14000f6c1
mov qword [rbp + 0x108], r12
mov dword [rbp + 0x130], r12d
lea r13, str.0123456789ABCDEF
mov rax, qword [rcx]
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x108]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x130], 0
je 0x14000f62d
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x20]
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000e91c
mov rdi, qword [r15]
mov ecx, 0x18
call fcn.140017380
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14000e956
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.140018250
mov qword [rbx], rax
jmp 0x14000e959
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000f7d9
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x158]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x108]
call rsi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000e9c8
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000e9a9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000e9bb
call fcn.1400176d4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400176d4
test edi, edi
js 0x14000f5d2
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov rdi, r12
mov qword [rbp - 0x70], r12
mov esi, 0xf
mov qword [rbp - 0x68], rsi
mov byte [rbp - 0x80], dil
mov ebx, dword [rsp + 0x50]
or ebx, 1
mov dword [rsp + 0x50], ebx
mov r14d, 0xc
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ea14
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + r13]
cmp rdi, rsi
jae 0x14000ea41
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x80]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x14000ea4a
lea rcx, [rbp - 0x80]
call fcn.140007db0
sub r14, 1
je 0x14000ea5a
mov rsi, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x70]
jmp 0x14000ea00
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp], 0xf
or ebx, 2
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ea80
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x18], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ea9e
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x17], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eabc
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x16], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eada
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 8], 4
mov byte [rbp - 0x15], cl
mov byte [rbp - 0x14], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x20], 0xf
or ebx, 4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eb16
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x38], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eb34
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x37], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eb52
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x36], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eb70
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 0x28], 4
mov byte [rbp - 0x35], cl
mov byte [rbp - 0x34], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x40], 0xf
or ebx, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ebac
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x58], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ebca
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x57], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ebe8
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x56], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ec06
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 0x48], 4
mov byte [rbp - 0x55], cl
mov byte [rbp - 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
or ebx, 0x10
mov dword [rsp + 0x50], ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ec52
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ec8b
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ec95
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eca9
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ece2
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ecec
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ed00
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ed39
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ed43
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ed57
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ed90
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ed9a
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000edae
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ede7
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000edf1
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ee05
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ee3e
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ee48
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000ee5c
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000ee95
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ee9f
lea rcx, [rsp + 0x58]
call fcn.140007db0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000eeb3
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000eeec
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000eef6
lea rcx, [rsp + 0x58]
call fcn.140007db0
mov r8d, 1
lea rdx, [0x14001c424]
lea rcx, [rsp + 0x58]
call fcn.140006c90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or ebx, 0x20
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x58]
lea r8, [rbp + 0xc8]
lea rcx, [rbp + 0x48]
call fcn.1400109f0
or ebx, 0x40
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001c424]
lea rcx, [rbp + 0x48]
call fcn.140006c90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts ebx, 7
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x38]
lea r8, [rbp + 0xa8]
lea rcx, [rbp + 0x28]
call fcn.1400109f0
bts ebx, 8
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001c424]
lea rcx, [rbp + 0x28]
call fcn.140006c90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts ebx, 9
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x88]
lea rcx, [rbp + 8]
call fcn.1400109f0
bts ebx, 0xa
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001c424]
lea rcx, [rbp + 8]
call fcn.140006c90
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts ebx, 0xb
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x68]
lea rcx, [rbp + 0x138]
call fcn.1400109f0
bts ebx, 0xc
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x14000f0a2
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f09c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f666
call fcn.1400176d4
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x14000f0dd
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f0d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f66d
call fcn.1400176d4
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14000f12f
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f674
call fcn.1400176d4
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14000f16a
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f165
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f67b
call fcn.1400176d4
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14000f1bc
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f1b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f682
call fcn.1400176d4
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000f1f7
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f1f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f689
call fcn.1400176d4
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14000f248
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f243
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f690
call fcn.1400176d4
and ebx, 0xffffffef
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000f288
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f697
call fcn.1400176d4
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000f2d9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f2d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f69e
call fcn.1400176d4
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14000f317
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f312
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f6a5
call fcn.1400176d4
and ebx, 0xfffffffd
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14000f355
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f6ac
call fcn.1400176d4
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000f397
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f6b3
call fcn.1400176d4
mov eax, 8
mov word [rbp + 0x118], ax
lea rdi, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rdi, qword [rbp + 0x138]
mov ecx, 0x18
call fcn.140017380
mov rbx, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14000f3f7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.140018250
mov qword [rbx], rax
jmp 0x14000f3fa
mov rbx, r12
test rbx, rbx
je 0x14000f7ce
mov rax, qword [rbx]
mov qword [rbp + 0x120], rax
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000f44c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000f42d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000f43f
call fcn.1400176d4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400176d4
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x28]
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000f467
mov rdi, qword [r15]
mov ecx, 0x18
call fcn.140017380
mov rbx, rax
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x14000f4a4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.140018250
mov qword [rbx], rax
jmp 0x14000f4a7
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000f7ce
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x118]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x108]
call rsi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000f511
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000f4f2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000f504
call fcn.1400176d4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.1400176d4
test edi, edi
jns 0x14000f545
lea rdx, str.Failed_to_set_property_value._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
jmp 0x14000f571
lea rdx, str.Spoofed___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071d0
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000f565
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rax
call fcn.1400085a0
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x14000f610
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f5cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f6ba
call fcn.1400176d4
jmp 0x14000f610
lea rdx, str.Failed_to_get_property_value._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x108]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x110]
test rcx, rcx
jne 0x14000e8d0
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x14000f659
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x14000f783
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.WMI_query_Failed._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
jmp 0x14000e704
lea rdx, str.Could_not_connect_to_wmi_namespace_rootcimv2._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x14000f77b
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000f77b
lea rdx, str.Failed_to_create_iwbemlocator_object._error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071d0
lea rdx, [0x14000bef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140017360
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140018240
nop
mov ecx, 0x8007000e
call fcn.140018240
nop
mov ecx, 0x8007000e
call fcn.140018240
nop
mov ecx, 0x8007000e
call fcn.140018240
nop
mov ecx, 0x8007000e
call fcn.140018240
int3