Function at 0x14001c4a0
Capabilities:
Connect to wmi namespace via wbemlocator
Create directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe8
mov rbx, r9
mov r13, r8
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov rcx, qword [r8]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsi], rax
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsi + 8], rax
mov rcx, qword [rbp + 0x6f]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsi + 0x10], rax
mov eax, dword [rbp + 0x77]
mov dword [rsi + 0x18], eax
mov rcx, qword [rbp + 0x7f]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], r14
mov dword [rsi + 0x30], r15d
mov dword [rsi + 0x34], 0x1010101
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x40], r15
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x50], r15
mov qword [rsi + 0x58], r15
lea rbx, [rsi + 0x60]
mov qword [rsp + 0x50], rbx
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14001cbc1
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x1401e3cf8]
mov rcx, rbx
call fcn.140031e00
test al, al
jne 0x14001c5a8
xor r8d, r8d
lea rdx, [0x1401e3cf8]
mov rcx, rbx
call fcn.140032190
nop
mov qword [rsi + 0x68], r15
mov qword [rsi + 0x70], r15
mov qword [rsi + 0x78], r15
mov qword [rsi + 0x80], r15
mov qword [rsi + 0x88], r15
lea rdi, [rsi + 0x90]
mov qword [rsp + 0x50], rdi
mov qword [rdi], r15
mov qword [rdi + 8], r15
lea rbx, [rdi + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x40
call fcn.1401833e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
mov ecx, 0x21c
call qword [sym.imp.wlanapi.dll_WlanAllocateMemory]
mov qword [rdi + 0x20], rax
xor edx, edx
mov r8d, 0x21c
mov rcx, rax
call fcn.140185af0
mov ecx, 0x27c
call qword [sym.imp.wlanapi.dll_WlanAllocateMemory]
mov qword [rdi + 0x28], rax
xor edx, edx
mov r8d, 0x27c
mov rcx, rax
call fcn.140185af0
nop
mov qword [rsi + 0xd0], r15
mov qword [rsi + 0xd8], r15
mov qword [rsi + 0xe0], r15
mov dword [rsi + 0xf8], r15d
mov r14d, 0xffffffff
mov qword [rsi + 0xe8], 0xffffffffffffffff
mov qword [rsi + 0xf0], 0xffffffffffffffff
mov dword [rsi + 0x10c], r15d
mov qword [rsi + 0xfc], 0xffffffffffffffff
mov qword [rsi + 0x104], 0xffffffffffffffff
mov dword [rsi + 0x120], r15d
mov qword [rsi + 0x110], 0xffffffffffffffff
mov qword [rsi + 0x118], 0xffffffffffffffff
mov qword [rsi + 0x128], r15
mov qword [rsi + 0x138], r15
mov qword [rsi + 0x140], SafeArrayPutElement
mov dword [rsi + 0x150], 1
lea rbx, [rsi + 0x158]
mov qword [rbx], r15
mov qword [rsi + 0x160], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rsp + 0x20], rbx
lea r9, [0x1401c82b0]
xor edx, edx
lea r8d, [r14 + 2]
lea rcx, [0x1401c82c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov qword [rsi + 0x148], rax
cmp rax, 0xffffffffffffffff
jne 0x14001c75f
mov dword [rsi + 0x150], r15d
mov qword [rsi + 0x168], r15
mov dword [rsi + 0x170], 0
mov byte [rsi + 0x174], 0
mov qword [rsi + 0x17c], r15
mov dword [rsi + 0x184], r15d
lea rcx, [rsi + 0x188]
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
xor r8d, r8d
lea rdx, [0x1401e3cf8]
call fcn.140030750
nop
mov qword [rsi + 0x1e0], r15
mov ecx, 0x70
call fcn.140191d68
mov qword [rsi + 0x38], rax
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x39], r15
mov r8d, 0x10
lea rdx, str.QWptcWdsZUN0Y2xy
lea rcx, [rbp - 0x51]
call fcn.140030750
nop
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x71], r15
mov qword [rbp - 0x69], r15
lea r15, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
setae r12b
cmovae r15, qword [rbp - 0x51]
movabs rbx, 0x7ffffffffffffffe
mov rdi, qword [rbp - 0x41]
cmp rdi, rbx
ja 0x14001cbcc
mov qword [rbp - 0x69], 7
cmp rdi, 8
jae 0x14001c83c
mov qword [rbp - 0x71], rdi
mov r8d, 0x10
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140185440
jmp 0x14001c885
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x14001c857
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.140030fc0
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x71], rdi
mov qword [rbp - 0x69], rbx
lea r8, [rdi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140185440
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.14004bc20
mov r9, qword [rax]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x50], rax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c8c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 1
mov rcx, rsi
call fcn.14000f270
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
xor r8d, r8d
lea rdx, [0x14001dbb0]
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, 0x78
call fcn.1401833e0
mov qword [rsp + 0x58], rax
mov rdx, rsi
mov rcx, rax
call fcn.14006c7f0
nop
mov qword [rsi + 0x68], rax
mov ecx, 0x68
call fcn.1401833e0
mov rdi, rax
mov qword [rsp + 0x58], rax
mov byte [rax], 1
lea rbx, [rax + 8]
mov qword [rbp - 0x31], rbx
xor r15d, r15d
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x28]
call fcn.1401833e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rdi + 0x18]
lea edx, [r15 + 2]
call fcn.140162544
nop
mov qword [rsi + 0x70], rdi
mov rbx, qword [rsi + 0x68]
lea ecx, [r15 + 0x10]
call fcn.1401833e0
mov qword [rax], rbx
lea rcx, [0x14006d5c0]
mov qword [rax + 8], rcx
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140028150]
xor edx, edx
xor ecx, ecx
call fcn.14019290c
mov qword [rbp - 0x61], rax
test rax, rax
je 0x14001cbb2
cmp dword [rbx + 0x18], r15d
jne 0x14001cbac
xorps xmm0, xmm0
movaps xmmword [rbp - 0x21], xmm0
movaps xmm1, xmmword [rbp - 0x61]
movaps xmmword [rbp - 0x11], xmm1
movdqa xmmword [rbp - 0x61], xmm0
movups xmmword [rbx + 0x10], xmm1
lea ecx, [r15 + 0x68]
call fcn.1401833e0
mov rbx, rax
mov qword [rsp + 0x58], rax
mov dword [rax + 0x10], r15d
mov dword [rax + 0x14], 1
mov dword [rax + 0x18], 1
mov dword [rax + 0x20], r15d
mov qword [rax + 0x40], r15
mov dword [rax + 0x48], r15d
mov dword [rax + 0x4c], 0xeeeeee
mov dword [rax + 0x50], 0x101010
mov qword [rax + 0x54], 1
mov qword [rax + 0x5c], 1
mov rax, qword [rbp + 0x57]
mov qword [rbx], rax
lea edx, [r15 + 0x7c]
mov rcx, rbx
call fcn.14006e570
mov qword [rbx + 0x38], rax
lea edx, [r15 + 0x7b]
mov rcx, rbx
call fcn.14006e570
mov qword [rbx + 0x30], rax
lea edx, [r15 + 0x7a]
mov rcx, rbx
call fcn.14006e570
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x1c], 0x1f1f1f
mov qword [rsi + 0x88], rbx
cmp qword [0x140223260], r15
jne 0x14001ca94
mov ecx, 0xa8
call fcn.1401833e0
mov qword [rsp + 0x58], rax
lea r8, [rsi + 0x10]
mov rdx, rsi
mov rcx, rax
call fcn.140072780
nop
mov qword [0x140223260], rax
lea r8, str.download
lea rdx, [rsi + 8]
lea rcx, [rbp + 0x57]
call fcn.140023e50
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rbp + 0x57]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cad2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test r12b, r12b
je 0x14001cb12
mov rax, qword [rbp - 0x39]
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cbd2
call fcn.140183144
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cb31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x67]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cb53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp + 0x6f]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cb75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp + 0x7f]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14001cb95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140191d3c
nop
mov dword [rbp - 0x59], r15d
mov ecx, 6
call fcn.14015cc58
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140030df0
nop
call fcn.140189c24
int3