Function at 0x140041b10
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x1401080c0]
xor rax, rsp
mov qword [rbp + 0x590], rax
xor r15d, r15d
mov rdi, qword [0x140269fb0]
lea rsi, [0x140269fa0]
mov rbx, rsi
cmp qword [0x140269fb8], 0xf
cmova rbx, qword [0x140269fa0]
call fcn.1400d4dd8
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
lea r8, [rbp - 0x30]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14003f910
nop
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rcx, qword [rsp + 0x68]
mov r9d, 0xffffffff
lea r8d, [r15 + 3]
lea rdx, [rbp + 0x130]
call fcn.1400d5040
mov edx, eax
test eax, eax
jne 0x140041bf2
mov eax, dword [rbp + 0x140]
bt eax, 0xa
jae 0x140041be4
mov ecx, dword [rbp + 0x144]
cmp ecx, 0xa000000c
jne 0x140041bd5
lea eax, [rdx + 4]
jmp 0x140041c15
cmp ecx, 0xa0000003
jne 0x140041be4
mov eax, 0xa
jmp 0x140041c15
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x140041c15
mov dword [rbp - 0x1c], 0xffff
sub eax, 2
je 0x140041c10
sub eax, 1
je 0x140041c10
sub eax, 0x32
je 0x140041c10
cmp eax, 0x46
mov eax, r15d
jne 0x140041c15
mov eax, 1
mov dword [rbp - 0x40], edx
lea rcx, [0x140268838]
mov qword [rbp - 0x38], rcx
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x120], xmm0
test eax, eax
je 0x140041c78
cmp eax, 1
sete bl
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140041c89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041c84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041c84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test edx, edx
jne 0x140042dc6
jmp 0x140041c39
call fcn.1400d56e4
test bl, bl
je 0x140041d81
mov rbx, qword [0x140269fb0]
cmp qword [0x140269fb8], 0xf
cmova rsi, qword [0x140269fa0]
call fcn.1400d4dd8
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp - 0x78]
call fcn.14003f910
nop
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rcx, qword [rbp - 0x78]
call fcn.1400d4f14
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140042e21
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140041d2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041d25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041d25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d56e4
test bl, bl
jne 0x140041d81
lea rdx, str.Failed_to_create_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004b6f0
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.1400d5680
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140041d98
lea rdx, str.Failed_to_initialize_COM_library.
jmp 0x140041d35
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x140041ddc
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Failed_to_initialize_security.
jmp 0x140041d35
mov qword [rbp + 0x50], r15
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400e9758]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400e9768]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140041e19
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Failed_to_create_IWbemLocator_object.
jmp 0x140041d35
mov qword [rbp + 0x48], r15
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140041e71
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140042ddf
jmp 0x140041e74
mov rbx, r15
mov qword [rbp + 0x40], rbx
test rbx, rbx
je 0x140042e16
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x50]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140041eee
mov rcx, qword [rbx]
test rcx, rcx
je 0x140041ecf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140041ee1
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
test edi, edi
jns 0x140041f0e
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Failed_to_connect_to_WMI_namespace.
jmp 0x140041d35
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140041f66
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Failed_to_set_proxy_blanket.
jmp 0x140041d35
mov qword [rbp + 0x60], r15
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140041fb7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_BaseBoard
call fcn.1400d6910
mov qword [rbx], rax
jmp 0x140041fba
mov rbx, r15
mov qword [rbp - 0x10], rbx
test rbx, rbx
je 0x140042e16
mov rsi, qword [rbx]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140042009
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r15
mov dword [rdi + 0x10], 1
lea rcx, [0x1400f0290]
call fcn.1400d6910
mov qword [rdi], rax
jmp 0x14004200c
mov rdi, r15
mov qword [rbp - 8], rdi
test rdi, rdi
je 0x140042e31
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, Ordinal_50
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x48]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14004207c
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004205c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14004206e
call fcn.1400d56e4
mov qword [rdi + 8], r15
mov edx, Ordinal_26
mov rcx, rdi
call fcn.1400d56e4
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400420bb
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004209c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400420ae
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
test esi, esi
jns 0x1400420e5
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Failed_to_execute_WMI_query.
jmp 0x140041d35
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x98], r15d
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140042923
lea r13, [0x140269f20]
lea rsi, [0x140269ec0]
lea r14, [0x140269ea0]
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x98]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x58]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x98], 0
je 0x140042923
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, str.Manufacturer
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdi, qword [rbp + 0x70]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rbp], rax
test rax, rax
je 0x1400421bb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400421be
test rdi, rdi
jne 0x140042dea
jmp 0x1400421be
mov rbx, r15
mov qword [rbp + 8], rbx
test rbx, rbx
je 0x140042e52
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400421e0
mov rcx, qword [rbx]
call fcn.1400d67f0
mov qword [rbx + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140042200
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400045d0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140042259
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004223a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004224c
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, str.Product
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdi, qword [rbp + 0x70]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400422d2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400422d5
test rdi, rdi
jne 0x140042df5
jmp 0x1400422d5
mov rbx, r15
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x140042e47
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400422f7
mov rcx, qword [rbx]
call fcn.1400d67f0
mov qword [rbx + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140042316
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400045d0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14004236f
mov rcx, qword [rbx]
test rcx, rcx
je 0x140042350
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140042362
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdi, qword [rbp + 0x70]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400423e9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400423ec
test rdi, rdi
jne 0x140042e00
jmp 0x1400423ec
mov rbx, r15
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x140042e3c
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14004240e
mov rcx, qword [rbx]
call fcn.1400d67f0
mov qword [rbx + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042430
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400045d0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140042489
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004246a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004247c
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x370]
call sub.VCRUNTIME140.dll_memset
mov rdx, r13
cmp qword [0x140269f38], 0xf
cmova rdx, qword [0x140269f20]
mov r8d, 2
lea rcx, [rbp + 0x370]
call fcn.140044ad0
mov rax, qword [rbp + 0x370]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x370], r12
mov rax, qword [rbp + 0x370]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x36c], edx
cmp qword [rbp + 0x3f8], 0
je 0x14004256e
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x370]
call fcn.140050480
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x378]
call fcn.1400476b0
test rax, rax
jne 0x14004256e
mov rax, qword [rbp + 0x370]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x370]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
cmp qword [0x140269ed8], 0xf
cmova rdx, qword [0x140269ec0]
mov r8d, 2
lea rcx, [rbp + 0x260]
call fcn.140044ad0
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x260], r12
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x25c], edx
cmp qword [rbp + 0x2e8], 0
je 0x140042649
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x260]
call fcn.140050480
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x268]
call fcn.1400476b0
test rax, rax
jne 0x140042649
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x260]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x150]
call sub.VCRUNTIME140.dll_memset
mov rdx, r14
cmp qword [0x140269eb8], 0xf
cmova rdx, qword [0x140269ea0]
mov r8d, 2
lea rcx, [rbp + 0x150]
call fcn.140044ad0
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x150], r12
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x14c], edx
cmp qword [rbp + 0x1d8], 0
je 0x140042724
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rbp + 0x150]
call fcn.140050480
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x158]
call fcn.1400476b0
test rax, rax
jne 0x140042724
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x150]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x150], r12
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x14c], edx
lea rcx, [rbp + 0x158]
call fcn.1400457e0
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x260], r12
mov rax, qword [rbp + 0x260]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x25c], edx
lea rcx, [rbp + 0x268]
call fcn.1400457e0
lea rcx, [rbp + 0x270]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x308]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x370]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x370], r12
mov rax, qword [rbp + 0x370]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x36c], edx
lea rcx, [rbp + 0x378]
call fcn.1400457e0
lea rcx, [rbp + 0x380]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x418]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140042866
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042861
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042970
call fcn.1400d56e4
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x1400428c0
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400428bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042977
call fcn.1400d56e4
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140042916
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042911
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004297e
call fcn.1400d56e4
mov rcx, qword [rbp + 0x60]
test rcx, rcx
jne 0x140042120
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140042985
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_ComputerSystemProduct
call fcn.1400d6910
mov qword [rbx], rax
jmp 0x140042988
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, r15
mov qword [rbp + 0x28], rbx
test rbx, rbx
je 0x140042e16
mov rsi, qword [rbx]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400429d7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r15
mov dword [rdi + 0x10], 1
lea rcx, [0x1400f0290]
call fcn.1400d6910
mov qword [rdi], rax
jmp 0x1400429da
mov rdi, r15
mov qword [rbp + 0x30], rdi
test rdi, rdi
je 0x140042e5d
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, Ordinal_50
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x48]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140042a4a
mov rcx, qword [rdi]
test rcx, rcx
je 0x140042a2a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140042a3c
call fcn.1400d56e4
mov qword [rdi + 8], r15
mov edx, Ordinal_26
mov rcx, rdi
call fcn.1400d56e4
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140042a89
mov rcx, qword [rbx]
test rcx, rcx
je 0x140042a6a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140042a7c
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
test esi, esi
jns 0x140042aac
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140041d51
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140042a8d
lea rsi, [0x140269f60]
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x98]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x58]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
cmp dword [rbp + 0x98], 0
je 0x140042a8d
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, str.UUID
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdi, qword [rbp + 0x88]
mov ecx, Ordinal_26
call fcn.1400d56a0
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140042b5e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140042b61
test rdi, rdi
jne 0x140042e0b
jmp 0x140042b61
mov rbx, r15
mov qword [rbp + 0x38], rbx
test rbx, rbx
je 0x140042dbb
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140042b83
mov rcx, qword [rbx]
call fcn.1400d67f0
mov qword [rbx + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r15
mov qword [rbp + 0x118], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140042ba2
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400045d0
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140042bfb
mov rcx, qword [rbx]
test rcx, rcx
je 0x140042bdc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140042bee
call fcn.1400d56e4
mov qword [rbx + 8], r15
mov edx, Ordinal_26
mov rcx, rbx
call fcn.1400d56e4
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x480]
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
cmp qword [0x140269f78], 0xf
cmova rdx, qword [0x140269f60]
mov r8d, 8
lea rcx, [rbp + 0x480]
call fcn.140044ad0
mov rax, qword [rbp + 0x480]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x480], r12
mov rax, qword [rbp + 0x480]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x47c], edx
cmp qword [rbp + 0x508], 0
je 0x140042ce5
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0xf
cmova rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
lea rcx, [rbp + 0x480]
call fcn.140050480
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x488]
call fcn.1400476b0
test rax, rax
jne 0x140042d08
mov rax, qword [rbp + 0x480]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x480]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x140042d08
lea rdx, str.Failed_to_open_file_for_writing.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004b6f0
lea rdx, [0x14004b8c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, qword [rbp + 0x480]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x480], r12
mov rax, qword [rbp + 0x480]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x47c], edx
lea rcx, [rbp + 0x488]
call fcn.1400457e0
lea rcx, [rbp + 0x490]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x528]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140042da2
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042db4
call fcn.1400d56e4
mov rcx, qword [rbp + 0x60]
test rcx, rcx
jne 0x140042ac0
jmp 0x140042a8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x120]
lea rcx, str.exists
call fcn.140040650
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
shr rbx, 0x20
lea r8, [rbp - 0x78]
mov edx, ebx
call fcn.1400405e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
nop
mov ecx, 0x8007000e
call fcn.1400d67e0
int3