Function at 0x1400085f0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400a6188]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov r15, rcx
xor r13d, r13d
mov r12d, r13d
mov dword [rbp + 0xe8], r13d
call fcn.140010cf0
mov rcx, rax
lea r9, [0x140071118]
lea r8, str.RpcServer::WMIData::ReadSysInfo
xor edx, edx
call fcn.14002c750
mov qword [rbp - 0x70], r13
call fcn.140010cf0
cmp byte [rax + 0x64], r13b
je 0x1400086b9
lea ecx, [r13 + 0x28]
call fcn.140025d40
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400086b2
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
call fcn.140010cf0
mov rdx, rax
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov rcx, rbx
call fcn.140027d20
jmp 0x1400086b5
mov rax, r13
mov qword [rbp - 0x70], rax
mov dword [rbp + 0xe8], r13d
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x40], r13
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140082040]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140082030]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov edi, eax
test eax, eax
jns 0x140008722
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_create_IWbemLocator_object.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
jmp 0x14000a8af
call fcn.140010cf0
mov rcx, rax
lea r9, str.Started_reading_from_ROOTWMI
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140008787
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTwmi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a90f
jmp 0x14000878a
mov rbx, r13
mov qword [rbp - 0x40], rbx
test rbx, rbx
je 0x14000a9ca
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140010e16.0]
mov edi, eax
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140008814
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400087f5
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140008807
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x14000885f
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_connect_to_ROOTwmi__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000a8af
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
jmp 0x14000a8af
mov rcx, qword [rbp + 0x38]
test rcx, rcx
jne 0x140008892
call fcn.140010cf0
lea r9, str.IWbemServices____0x_08X
mov rcx, rax
mov qword [rsp + 0x20], r13
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
jmp 0x14000a839
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov edi, eax
test eax, eax
jns 0x140008923
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_set_proxy_blanket__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140008900
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a8af
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
jmp 0x14000a8af
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140008969
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_MS_SystemInformation
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a91a
jmp 0x14000896c
mov rbx, r13
mov qword [rbp - 0x38], rbx
test rbx, rbx
je 0x14000a9d5
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400089bf
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a925
jmp 0x1400089c2
mov rsi, r13
mov qword [rbp - 0x30], rsi
test rsi, rsi
je 0x14000a9e0
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140008a3d
mov rcx, qword [rsi]
test rcx, rcx
je 0x140008a1d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140008a2f
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140008a7a
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008a5b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140008a6d
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x140008ae2
call fcn.140010cf0
lea r9, str.Query_for_system_information_failed.__hr:0x_08X_
mov dword [rsp + 0x20], edi
mov rcx, rax
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140008abc
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a83d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov rcx, r13
mov qword [rbp + 0x38], rcx
jmp 0x14000a83d
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x140008b00
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov ebx, eax
cmp dword [rbp + 0xe8], 0
je 0x14000902d
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000902d
test eax, eax
js 0x14000902d
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.SystemProductName
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140008b8a
lea rcx, [r15 + 8]
mov rdx, qword [rbp + 0x60]
call fcn.140005960
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.SystemSKU
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140008bce
lea rcx, [r15 + 0x10]
mov rdx, qword [rbp + 0x60]
call fcn.140005960
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [r15 + 0x10]
mov ebx, dword [rcx - 0x10]
test ebx, ebx
jg 0x140008bde
mov eax, r14d
jmp 0x140008bf9
mov edx, 0x23
call fcn.14004a978
test rax, rax
jne 0x140008bf2
mov eax, r14d
jmp 0x140008bf9
sub rax, qword [r15 + 0x10]
sar rax, 1
sub ebx, eax
mov qword [rsp + 0x70], r13
lea r8d, [rbx - 1]
lea rdx, [rsp + 0x70]
lea rcx, [r15 + 0x10]
call fcn.14000ac10
nop
mov esi, r13d
lea rdi, [0x1400a6040]
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000aa44
mov rcx, rbx
call fcn.140053130
test eax, eax
je 0x140008c47
inc esi
add rdi, 8
cmp esi, 0x12
jb 0x140008c22
jmp 0x140008c6c
mov byte [r15 + 0x61], 1
call fcn.140010cf0
mov rcx, rax
lea r9, str.Set_m_bUseCtrlAltJ_to_TRUE
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
lea rbx, [r15 + 0x18]
test eax, eax
js 0x140008cb3
mov rdx, qword [rbp + 0x60]
mov rcx, rbx
call fcn.140005960
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.BIOSReleaseDate
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140008d05
lea rdx, [0x140071d00]
mov rcx, rbx
call fcn.140005d60
mov rdx, qword [rbp + 0x60]
mov rcx, rbx
call fcn.140005d60
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.BaseBoardVersion
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140008d49
lea rcx, [r15 + 0x20]
mov rdx, qword [rbp + 0x60]
call fcn.140005960
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.SystemFamily
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140008d8d
lea rcx, [r15 + 0x50]
mov rdx, qword [rbp + 0x60]
call fcn.140005960
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [r15 + 0x50]
cmp dword [rcx - 0x10], 0
jg 0x140008d9c
mov eax, r14d
jmp 0x140008db7
mov edx, 0x20
call fcn.14004a978
test rax, rax
jne 0x140008db0
mov eax, r14d
jmp 0x140008db7
sub rax, qword [r15 + 0x50]
sar rax, 1
mov edi, r13d
test eax, eax
cmovns edi, eax
mov rcx, qword [r15 + 0x50]
cmp edi, dword [rcx - 0x10]
jl 0x140008ddf
add rcx, 0xffffffffffffffe8
call fcn.140006840
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x140008e89
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140008dfd
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov r9, rax
test rax, rax
jne 0x140008e18
call fcn.140007c70
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140010e16.0]
mov r9, rax
mov rsi, qword [r15 + 0x50]
test r9, r9
je 0x14000aa39
test rsi, rsi
jne 0x140008e32
test edi, edi
jne 0x14000a9eb
mov rcx, qword [r9]
mov rax, qword [rcx]
mov r8d, 2
mov edx, edi
mov rcx, r9
call qword [case.0x140010e16.0]
test rax, rax
je 0x14000aa33
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
test edi, edi
js 0x14000aa28
cmp edi, dword [rbx - 0xc]
jg 0x14000aa28
mov dword [rbx - 0x10], edi
movsxd rax, edi
lea rdx, [rax + rax]
mov word [rdx + rbx], r13w
mov r9, rdx
mov r8, rsi
mov rcx, rbx
call fcn.1400122e0
mov rdi, rbx
movsxd rsi, dword [rbx - 0x10]
cmp esi, 2
jg 0x140008eab
lea rcx, [rbx - 0x18]
call fcn.140006840
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
jmp 0x140008f50
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140008ec9
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov r9, rax
test rax, rax
jne 0x140008ee4
call fcn.140007c70
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140010e16.0]
mov r9, rax
lea rdi, [rdi + rsi*2]
add rdi, 0xfffffffffffffffc
test r9, r9
je 0x14000aa1d
test rdi, rdi
je 0x14000aa12
mov rcx, qword [r9]
mov rax, qword [rcx]
mov edx, 2
mov r8d, edx
mov rcx, r9
call qword [case.0x140010e16.0]
test rax, rax
je 0x14000aa0c
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
cmp dword [rbx - 0xc], 2
jl 0x14000aa01
mov dword [rbx - 0x10], 2
mov word [rbx + 4], r13w
mov r9d, 4
mov r8, rdi
mov edx, r9d
mov rcx, rbx
call fcn.1400122e0
or r12d, 3
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140005790
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008f84
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
mov esi, r13d
lea rdi, section..data
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000a9f6
mov rcx, rbx
call fcn.140053130
test eax, eax
je 0x140008fb8
inc esi
add rdi, 8
cmp esi, 8
jb 0x140008f93
jmp 0x140008fbd
mov byte [r15 + 0x60], 1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140008fd7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008ff9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000901f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000907e
jmp 0x140008b00
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000907e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140009098
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
call fcn.140010cf0
mov rcx, rax
lea r9, str.Completed_reading_from_ROOTwmi
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
call fcn.140010cf0
mov rcx, rax
lea r9, str.Started_reading_from_ROOTCIMV2
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000911e
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a930
jmp 0x140009121
mov rbx, r13
mov qword [rbp - 0x28], rbx
test rbx, rbx
je 0x14000aa4f
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400091a4
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009185
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009197
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x1400091ef
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_connect_to_ROOTcimv2.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000a839
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
jmp 0x14000a839
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140008868
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov edi, eax
test eax, eax
jns 0x14000923d
call fcn.140010cf0
lea r9, str.Could_not_set_proxy_blanket.__hr:0x_08X_
jmp 0x140008a8a
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009283
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_PhysicalMemory
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a93b
jmp 0x140009286
mov rbx, r13
mov qword [rbp - 0x58], rbx
test rbx, rbx
je 0x14000aa5a
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400092d9
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a946
jmp 0x1400092dc
mov rsi, r13
mov qword [rbp - 0x50], rsi
test rsi, rsi
je 0x14000aa65
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140009357
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009337
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140009349
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009394
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009375
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009387
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
js 0x140008a7e
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x1400093c0
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov ebx, eax
cmp dword [rbp + 0xe8], 0
je 0x1400094a9
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400094a9
test eax, eax
js 0x1400094a9
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xd0]
xor r8d, r8d
lea rdx, str.Capacity
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140009480
mov qword [rsp + 0x78], r13
mov rdx, qword [rbp + 0xd8]
lea rcx, [rsp + 0x78]
call fcn.1400039b0
mov rcx, qword [rsp + 0x78]
call fcn.140052ec0
add qword [r15 + 0x58], rax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009480
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000949a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x1400093c0
jmp 0x1400094fa
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400094fa
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009540
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_ComputerSystem
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a951
jmp 0x140009543
mov rbx, r13
mov qword [rbp - 0x20], rbx
test rbx, rbx
je 0x14000aa70
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009596
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a95c
jmp 0x140009599
mov rsi, r13
mov qword [rbp - 0x18], rsi
test rsi, rsi
je 0x14000aa7b
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140009614
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400095f4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140009606
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009651
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009632
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009644
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
js 0x140008a7e
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x140009673
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
movsd xmm6, qword [0x140072ad8]
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov ebx, eax
cmp dword [rbp + 0xe8], 0
je 0x140009c5f
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140009c5f
test eax, eax
js 0x140009c5f
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.TotalPhysicalMemory
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140009892
mov qword [rsp + 0x60], r13
mov rdx, qword [rbp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.1400039b0
nop
mov rcx, qword [rsp + 0x60]
call fcn.140052ec0
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and edx, 0x3ff
lea rbx, [rdx + rax]
sar rbx, 0xa
mov rax, qword [r15 + 0x58]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
mov qword [r15 + 0x58], rax
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r13w
mov r8d, 6
lea rdx, str.usable
lea rcx, [rbp + 0xf0]
call fcn.14000fea0
nop
lea rax, [rbp + 0xf0]
lea rcx, [r15 + 0x28]
cmp rbx, 0x400
jl 0x1400097d9
cmp qword [rbp + 0x108], 8
cmovae rax, qword [rbp + 0xf0]
xorps xmm3, xmm3
cvtsi2sd xmm3, rbx
mulsd xmm3, xmm6
xorps xmm2, xmm2
cvtsi2sd xmm2, qword [r15 + 0x58]
mulsd xmm2, xmm6
mov qword [rsp + 0x20], rax
movq r9, xmm3
movq r8, xmm2
lea rdx, str._.2f_GB___.2f_GB__s_
call fcn.140006b00
jmp 0x140009801
cmp qword [rbp + 0x108], 8
cmovae rax, qword [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [r15 + 0x58]
lea rdx, str._lld_MB___lld_MB__s_
call fcn.140006b00
lea rcx, [rbp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x140009852
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000984d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa86
call fcn.140025d80
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r13w
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009892
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
call fcn.140007c70
mov rcx, rax
test rax, rax
je 0x14000aa92
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140010e16.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.OEMStringArray
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140009c16
mov r8, qword [rbp + 0x78]
mov eax, dword [r8 + 0x18]
test eax, eax
je 0x14000995f
mov rbx, r13
mov edi, eax
nop dword [rax + rax]
mov r8, qword [r8 + 0x10]
mov r8, qword [r8 + rbx]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.140005b80
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140005790
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000994a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
add rbx, 8
sub rdi, 1
je 0x14000995a
mov r8, qword [rbp + 0x78]
jmp 0x140009900
mov rbx, qword [rsp + 0x58]
lea rdi, [rbx - 0x10]
mov eax, dword [rdi]
test eax, eax
je 0x140009c16
js 0x140009a39
lea rdx, str.FBYTE
mov rcx, rbx
call fcn.14004aa0c
test rax, rax
je 0x140009a39
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140009a39
lea r8d, [rax + 6]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140008140
nop
mov rdx, rax
lea rcx, [r15 + 0x48]
call fcn.140005790
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400099df
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
lea rdx, [0x140072054]
mov rcx, qword [r15 + 0x48]
call fcn.1400530f0
test rax, rax
je 0x140009a12
sub rax, qword [r15 + 0x48]
sar rax, 1
cmp eax, 0xffffffff
je 0x140009a12
mov edx, eax
lea rcx, [r15 + 0x48]
call fcn.14000adf0
mov rbx, qword [rsp + 0x58]
jmp 0x140009a69
call fcn.140010cf0
mov rcx, rax
lea r9, str.Do_not_see_any_semicolon_delimiter_after_FBYTE.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rbx, qword [rsp + 0x58]
jmp 0x140009a69
call fcn.140010cf0
mov rcx, rax
lea r9, str.Do_not_see_FBYTE_tag.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
lea rcx, [r15 + 0x48]
lea rdx, [0x140072050]
call fcn.140005830
mov rcx, r15
call fcn.140008290
test al, al
jne 0x140009c16
cmp dword [rdi], 0
jl 0x140009be6
lea rdx, str.BUILDID
mov rcx, rbx
call fcn.14004aa0c
test rax, rax
je 0x140009be6
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140009be6
lea r8d, [rax + 8]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140008140
nop
mov rdx, rax
lea rcx, [r15 + 0x40]
call fcn.140005790
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009aee
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
lea rdx, [0x140072054]
mov rcx, qword [r15 + 0x40]
call fcn.1400530f0
test rax, rax
je 0x140009b1c
sub rax, qword [r15 + 0x40]
sar rax, 1
cmp eax, 0xffffffff
je 0x140009b1c
mov edx, eax
lea rcx, [r15 + 0x40]
call fcn.14000adf0
jmp 0x140009b3c
call fcn.140010cf0
mov rcx, rax
lea r9, str.Do_not_see_any_semicolon_delimiter_after_BUILDID.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rdx, qword [r15 + 0x40]
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r13w
mov r8, r14
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140009b60
lea rcx, [rbp + 0x110]
call fcn.14000fea0
nop
lea rcx, [rbp + 0x110]
call fcn.140007d90
test al, al
jne 0x140009b99
lea rdx, str.__Recovery_Media_Used_
lea rcx, [r15 + 0x40]
call fcn.140005d60
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 8
jb 0x140009bdf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000aa8c
call fcn.140025d80
mov rbx, qword [rsp + 0x58]
jmp 0x140009c16
call fcn.140010cf0
mov rcx, rax
lea r9, str.Do_not_see_BUILDID_tag.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
lea rcx, [r15 + 0x40]
lea rdx, [0x140072050]
call fcn.140005830
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140009c30
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009c51
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010e16.0]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140009cb0
jmp 0x140009680
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140009cb0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009cf6
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_Processor
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a967
jmp 0x140009cf9
mov rbx, r13
mov qword [rbp - 0x10], rbx
test rbx, rbx
je 0x14000aa9d
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009d4c
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a972
jmp 0x140009d4f
mov rsi, r13
mov qword [rbp - 8], rsi
test rsi, rsi
je 0x14000aaa8
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140009dca
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009daa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140009dbc
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009e07
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009de8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009dfa
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
js 0x140008a7e
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x140009e30
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov ebx, eax
cmp dword [rbp + 0xe8], 0
je 0x140009ee0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140009ee0
test eax, eax
js 0x140009ee0
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x88]
xor r8d, r8d
lea rdx, str.Name
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x140009eb7
lea rcx, [r15 + 0x30]
mov rdx, qword [rbp + 0x90]
call fcn.140005960
lea rcx, [rbp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140009ed1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x140009e30
jmp 0x140009f31
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140009f31
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009f77
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_ComputerSystemProduct
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a97d
jmp 0x140009f7a
mov rbx, r13
mov qword [rbp], rbx
test rbx, rbx
je 0x14000aab3
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009fcd
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a988
jmp 0x140009fd0
mov rsi, r13
mov qword [rbp + 8], rsi
test rsi, rsi
je 0x14000aabe
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14000a04b
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000a02b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000a03d
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000a088
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a069
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a07b
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
js 0x140008a7e
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x14000a0b0
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov ebx, eax
cmp dword [rbp + 0xe8], 0
je 0x14000a160
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000a160
test eax, eax
js 0x14000a160
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, str.IdentifyingNumber
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
test eax, eax
js 0x14000a137
lea rcx, [r15 + 0x38]
mov rdx, qword [rbp + 0xa8]
call fcn.140005960
lea rcx, [rbp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000a151
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x14000a0b0
jmp 0x14000a1b1
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000a1b1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a1cb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
call fcn.140010cf0
mov rcx, rax
lea r9, str.Completed_reading_from_ROOTCIMV2
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
call fcn.140010cf0
mov rcx, rax
lea r9, str.Started_reading_from_ROOThpinstrumentedbios
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a251
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.ROOThpinstrumentedbios
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a993
jmp 0x14000a254
mov rbx, r13
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000aac9
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140010e16.0]
mov edi, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000a2d7
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a2b8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a2ca
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x14000a341
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_connect_to_ROOThpinstrumentedbios.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000a319
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
call fcn.140010cf0
mov rcx, rax
lea r9, str.Reset_return_code_to_0.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov edi, r13d
jmp 0x14000a839
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14000a3d6
call fcn.140010cf0
mov dword [rsp + 0x20], ebx
lea r9, str.Could_not_set_proxy_blanket.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
mov rcx, rax
call fcn.14002c750
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000a3b3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a319
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
jmp 0x14000a319
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a41c
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_HPBIOS_BIOSString__WHERE_NameFeature_Byte
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a99e
jmp 0x14000a41f
mov rbx, r13
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000aad4
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a472
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a9a9
jmp 0x14000a475
mov rsi, r13
mov qword [rbp + 0x20], rsi
test rsi, rsi
je 0x14000aadf
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14000a4f0
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000a4d0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000a4e2
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000a52d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a50e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a520
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x14000a6cc
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Query_for_HPBIOS_BIOSString_Feature_Byte_failed_with_error__hr:0x_08X_._Trying_with_HP_BIOSSetting
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 4
call fcn.14002c750
mov ecx, 0x18
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a59f
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_HP_BIOSSetting__WHERE_NameFeature_Byte
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a9b4
jmp 0x14000a5a2
mov rbx, r13
mov qword [rbp + 0x28], rbx
test rbx, rbx
je 0x14000aaea
mov ecx, 0x18
call fcn.140025d40
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a5f5
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], 1
lea rcx, [0x140071b28]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000a9bf
jmp 0x14000a5f8
mov rsi, r13
mov qword [rbp + 0x30], rsi
test rsi, rsi
je 0x14000a904
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140010e16.0]
mov edi, eax
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14000a673
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000a653
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000a665
call fcn.140025d80
mov qword [rsi + 8], r13
mov edx, 0x18
mov rcx, rsi
call fcn.140025d80
nop
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x14000a6af
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a690
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a6a2
call fcn.140025d80
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025d80
test edi, edi
jns 0x14000a7dd
call fcn.140010cf0
mov dword [rsp + 0x20], edi
lea r9, str.Query_for_HP_BIOSSetting_Feature_Byte_failed.__hr:0x_08X_
jmp 0x14000a385
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x14000a6f0
call fcn.140010cf0
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x140008874
mov rax, qword [rcx]
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov edi, eax
cmp dword [rbp + 0xe8], 0
je 0x14000a7a6
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000a7a6
test eax, eax
js 0x14000a7a6
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0xb8]
xor r8d, r8d
lea rdx, str.Value
mov rax, qword [rax + 0x20]
call qword [case.0x140010e16.0]
mov edi, eax
test eax, eax
js 0x14000a77d
lea rcx, [r15 + 0x48]
mov rdx, qword [rbp + 0xc0]
call fcn.140005960
lea rcx, [rbp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000a797
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x40], r13
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x14000a6f0
jmp 0x14000a7f7
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x30], edi
mov eax, dword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000a7f7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a811
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
call fcn.140010cf0
mov rcx, rax
lea r9, str.Completed_reading_from_ROOThpinstrumentedbios
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14002c750
mov rcx, r15
call fcn.140006be0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14000a85e
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x48], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000a874
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x38], r13
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000a88e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010e16.0]
mov qword [rbp + 0x50], r13
call fcn.140010cf0
mov rcx, rax
lea r9, [0x140071118]
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 1
call fcn.14002c750
nop
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x14000a8cd
mov rcx, rbx
call fcn.1400287c0
mov edx, 0x28
mov rcx, rbx
call fcn.140025d80
mov eax, edi
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1400264a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
int3
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x80070057
call fcn.140006800
nop
mov ecx, 0x80004005
call fcn.140006800
int3
mov ecx, 0x80070057
call fcn.140006800
int3
call fcn.14000ade0
int3
mov ecx, 0x80070057
call fcn.140006800
int3
mov ecx, 0x80004005
call fcn.140006800
nop
mov ecx, 0x80070057
call fcn.140006800
int3
call fcn.14000ade0
int3
mov ecx, 0x80004005
call fcn.140006800
int3
mov ecx, 0x80004005
call fcn.140006800
nop
mov ecx, 0x8007000e
call fcn.140025af0
int3
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
call fcn.14004e3b0
nop
call fcn.14004e3b0
nop
mov ecx, 0x80004005
call fcn.140006800
int3
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
int3
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
nop
mov ecx, 0x8007000e
call fcn.140025af0
int3