Function at 0x14002a420
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400c0040]
xor rax, rsp
mov qword [rbp + 0x248], rax
mov r12, rdx
mov qword [rbp - 0x78], rdx
mov r15, rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x50], esi
call fcn.140029f30
test al, al
jne 0x14002a496
lea rdx, str.No_permissions_or_WMI_service_isnt_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14002ba95
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14002a4ed
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x140004790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Attempting_fallback_spoofing_via_registry_manipulation.
jmp 0x14002a473
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x14002a52c
lea rdx, str.Failed_to_initialize_security._Error_code__0x
jmp 0x14002ba53
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x140099018]
xor edx, edx
mov r8d, 1
lea rcx, [0x140099028]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14002ba4c
mov r14, qword [rsp + 0x70]
mov qword [rbp - 0x68], r14
test r14, r14
je 0x14002ba4c
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x68], rsi
mov rax, qword [r14]
mov rdi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.14008f660
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14002a5bf
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002baca
jmp 0x14002a5c2
mov rbx, rsi
mov qword [rbp - 0x80], rbx
test rbx, rbx
je 0x14002bae0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002a63d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002a61e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a630
call fcn.14008fbb0
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.14008fbb0
test edi, edi
js 0x14002b9fb
mov rsi, qword [rsp + 0x68]
mov qword [rbp - 0x80], rsi
test rsi, rsi
je 0x14002b9fb
mov qword [rbp - 0x38], rsi
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14002a6d5
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x140004790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x14002b9ea
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140027a20
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp + 0x160]
call fcn.140027a20
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 7
jb 0x14002a7b1
lea rax, [r8 + 7]
mov qword [rdi + 0x10], rax
mov r12, rdi
cmp rcx, 7
jbe 0x14002a727
mov r12, qword [rdi]
lea rax, [0x1400a975e]
lea rcx, str.SELECT
cmp rax, r12
jbe 0x14002a75a
lea rax, [r12 + r8*2]
cmp rcx, rax
ja 0x14002a75a
cmp r12, rcx
ja 0x14002a74f
xor eax, eax
mov r15d, eax
jmp 0x14002a760
mov r15, r12
sub r15, rcx
sar r15, 1
jmp 0x14002a760
mov r15d, 7
lea rcx, [r12 + 0xe]
lea r8, [r8*2 + 2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.SELECT
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.SELECT
lea rdx, [rdx + 0xe]
lea rdx, [rdx + r15*2]
lea rcx, [r12 + rbx]
mov r8d, 7
sub r8, r15
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14002a7ca
mov qword [rsp + 0x28], 7
mov edx, 7
mov rcx, rdi
call fcn.14002d0f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xb0], xmm1
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
bts r13d, 0xe
mov r8d, 6
lea rdx, str._FROM
lea rcx, [rbp + 0xa0]
call fcn.14000a7d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r13d, 0xf
mov r9, qword [rsp + 0x50]
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.14002c7a0
bts r13d, 0xd
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14002a8a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a8a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a8a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fbb0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14002a8f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a8eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a8eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fbb0
movdqa xmm0, xmmword [0x1400ae0d0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r15w
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x14002a959
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a94c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a94c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fbb0
movdqa xmm0, xmmword [0x1400ae0d0]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r15w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x14002a9ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a9ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a9ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fbb0
movdqa xmm0, xmmword [0x1400ae0d0]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r15w
mov qword [rsp + 0x78], r15
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rbx, qword [rbp + 0xe0]
mov ecx, 0x18
call fcn.14008f660
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002aa33
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14002aa36
test rbx, rbx
jne 0x14002bad5
jmp 0x14002aa36
mov rdi, r15
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14002baeb
mov r15, qword [rdi]
mov ecx, 0x18
call fcn.14008f660
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14002aa7d
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
lea rcx, [0x1400a9340]
call fcn.140091370
mov qword [rbx], rax
xor ecx, ecx
jmp 0x14002aa81
xor ecx, ecx
mov ebx, ecx
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14002baf6
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call r12
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002aafc
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002aad9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r12d, r12d
mov qword [rbx], r12
jmp 0x14002aadc
xor r12d, r12d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002aaee
call fcn.14008fbb0
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14008fbb0
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14002ab41
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002ab20
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov qword [rdi], rbx
jmp 0x14002ab22
xor ebx, ebx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002ab34
call fcn.14008fbb0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14008fbb0
test r15d, r15d
js 0x14002b947
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14002b947
mov qword [rbp - 0x70], rdi
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov rax, qword [rdi]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
jne 0x14002b8cf
mov rbx, qword [rsp + 0x58]
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002abc7
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008f660
mov r15, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002abfa
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.140091370
mov qword [r15], rax
xor eax, eax
jmp 0x14002abfd
mov r15, rax
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002babf
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [r15 + 0x10], ecx
cmp ecx, 1
jne 0x14002ac6e
mov rcx, qword [r15]
test rcx, rcx
je 0x14002ac4d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov qword [r15], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002ac61
call fcn.14008fbb0
xor eax, eax
mov qword [r15 + 8], rax
mov edx, 0x18
mov rcx, r15
call fcn.14008fbb0
test r12d, r12d
js 0x14002b888
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor eax, eax
mov r15d, eax
mov qword [rbp + 0x50], rax
mov r12d, 0xf
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x40], al
or r13d, 0x20
mov dword [rsp + 0x50], r13d
mov r14d, 0xc
lea rsi, [0x14009f930]
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002acc4
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
cmp r15, r12
jae 0x14002acf2
lea rax, [r15 + 1]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x40]
cmp r12, 0xf
cmova rax, qword [rbp + 0x40]
mov byte [r15 + rax], r9b
mov byte [r15 + rax + 1], 0
jmp 0x14002acfb
lea rcx, [rbp + 0x40]
call fcn.14000c410
sub r14, 1
je 0x14002ad0b
mov r12, qword [rbp + 0x58]
mov r15, qword [rbp + 0x50]
jmp 0x14002acb0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0xf
or r13d, 0x40
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x68]
jge 0x14002ad3a
dec eax
or eax, 0xfffffff0
inc eax
cdqe
lea r15, [0x14009f930]
movzx eax, byte [rax + r15]
mov byte [rbp + 0x20], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad5f
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x21], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad7d
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x22], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ad9b
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x30], 4
mov byte [rbp + 0x23], cl
mov byte [rbp + 0x24], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x98], 0xf
bts r13d, 7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002addf
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x80], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae00
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x81], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae21
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x82], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae42
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x90], 4
mov byte [rbp + 0x83], cl
mov byte [rbp + 0x84], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], 0xf
bts r13d, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002ae89
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x60], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002aea7
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x61], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002aec5
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x62], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002aee3
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x70], 4
mov byte [rbp + 0x63], cl
mov byte [rbp + 0x64], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
bts r13d, 9
mov dword [rsp + 0x50], r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002af31
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002af65
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002af6e
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002af82
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002afb6
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002afbf
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002afd3
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b007
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b010
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b024
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b058
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b061
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b075
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b0a9
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b0b2
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b0c6
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b0fa
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b103
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b117
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b14b
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b154
lea rcx, [rbp]
call fcn.14000c410
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002b168
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002b19c
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002b1a5
lea rcx, [rbp]
call fcn.14000c410
mov r8d, 1
lea rdx, [0x1400a931c]
lea rcx, [rbp]
call fcn.14000b0f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], r12b
bts r13d, 0xa
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x140]
call fcn.14002cb00
bts r13d, 0xb
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a931c]
lea rcx, [rbp + 0x140]
call fcn.14000b0f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts r13d, 0xc
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x1e0]
lea rcx, [rbp + 0x120]
call fcn.14002cb00
or r13d, 1
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a931c]
lea rcx, [rbp + 0x120]
call fcn.14000b0f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or r13d, 4
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0x100]
call fcn.14002cb00
or r13d, 2
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a931c]
lea rcx, [rbp + 0x100]
call fcn.14000b0f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 8
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0x220]
call fcn.14002cb00
or r13d, 0x10
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14002b37d
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8e5
call fcn.14008fbb0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14002b3be
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b3b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8ec
call fcn.14008fbb0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14002b419
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8f3
call fcn.14008fbb0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14002b45a
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b455
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b8fa
call fcn.14008fbb0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14002b4b5
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b4af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b901
call fcn.14008fbb0
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14002b4f6
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b4f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b908
call fcn.14008fbb0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14002b550
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b54b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b90f
call fcn.14008fbb0
btr r13d, 9
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14002b590
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b58b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b916
call fcn.14008fbb0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
btr r13d, 8
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14002b5e0
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b91d
call fcn.14008fbb0
btr r13d, 7
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14002b626
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b621
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b924
call fcn.14008fbb0
and r13d, 0xffffffbf
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14002b665
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b660
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b92b
call fcn.14008fbb0
and r13d, 0xffffffdf
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14002b6a4
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b69f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b932
call fcn.14008fbb0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xc0]
call fcn.140027a20
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov word [rbp - 0x58], ax
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14002b7c3
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002b717
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008f660
mov r15, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14002b74b
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.140091370
mov qword [r15], rax
xor r12d, r12d
jmp 0x14002b751
xor r12d, r12d
mov r15d, r12d
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002bb01
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
nop
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x14002b7b7
mov rcx, qword [r15]
test rcx, rcx
je 0x14002b798
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], r12
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14002b7aa
call fcn.14008fbb0
mov qword [r15 + 8], r12
mov edx, 0x18
mov rcx, r15
call fcn.14008fbb0
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14002b7e7
lea rdx, str.Failed_to_allocate_BSTR_for_new_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14002b82d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b828
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b939
call fcn.14008fbb0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14002b888
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b883
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b940
call fcn.14008fbb0
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rbx, rbx
je 0x14002b8a2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
je 0x14002ab92
mov bl, 1
test rdi, rdi
je 0x14002b8e0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
jmp 0x14002b988
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.WMI_query_failed._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x140004790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14002b9d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b9cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b9cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008fbb0
movdqa xmm0, xmmword [0x1400ae0d0]
movdqu xmmword [rbp + 0xf0], xmm0
xor eax, eax
mov word [rbp + 0xe0], ax
test rsi, rsi
je 0x14002b9f9
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
jmp 0x14002ba3b
lea rdx, str.Could_not_connect_to_WMI_namespace._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x140004790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
test r14, r14
je 0x14002ba4a
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
nop
jmp 0x14002ba8c
lea rdx, str.Failed_to_create_IWbemLocator_object._Err_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b600
lea rdx, [0x140004790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x14000bba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, bl
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.14008f640
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
nop
mov ecx, 0x8007000e
call fcn.140091360
int3