Function at 0x1401dc450
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rcx
mov qword [rbp - 0x20], rcx
xor r12d, r12d
cmp byte [0x1404b9e28], r12b
jne 0x1401dc4bd
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
xor r8d, r8d
lea rdx, [0x140419d94]
call fcn.140006340
jmp 0x1401de3dd
lea r14, [0x1404b0370]
cmp qword [0x1404b0380], r12
jne 0x1401de3d2
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r12w
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r12w
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r12w
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r12w
movups xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1404530e0]
movdqu xmmword [rbp + 0x100], xmm1
mov word [rbp + 0xf0], r12w
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r12w
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r12w
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r12w
mov qword [rbp - 0x20], r12
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [0x1403f56f0]
xor edx, edx
mov r8d, 1
lea rcx, [0x1403f5700]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, 0x7c
test eax, eax
js 0x1401ddab9
mov qword [rbp - 0x28], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401dc647
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1401de41b
jmp 0x1401dc64a
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1401de426
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_24]
mov edi, eax
mov rsi, 0xffffffffffffffff
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x1401dc6cc
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dc6ad
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dc6bf
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
test edi, edi
js 0x1401ddaaa
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1401ddaa0
mov qword [rbp - 0x48], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401dc74d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT_Manufacturer_SystemFamily_Model_Name_UserName_FROM_Win32_ComputerSystem
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dc750
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1401de410
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1401dc79b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dc79e
mov rdi, r12
mov qword [rbp - 0x18], rdi
test rdi, rdi
je 0x1401de431
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1401dc812
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dc7f2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401dc804
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1401dc84e
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dc82f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dc841
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
mov r15d, reloc.SinoSPE.dll_Ordinal_44
test r14d, r14d
js 0x1401dcdb2
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x18], r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401dcdac
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x18], 0
jbe 0x1401dcda8
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Manufacturer
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dc983
cmp word [rbp - 0x40], 8
jne 0x1401dc983
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dc8e0
mov rax, qword [rbp + 0xe8]
cmp rdx, rax
ja 0x1401dc92a
lea rdi, [rbp + 0xd0]
cmp rax, 7
cmova rdi, qword [rbp + 0xd0]
mov qword [rbp + 0xe0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dc936
lea rcx, [rbp + 0xd0]
call fcn.140004f70
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rdx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0xd0]
cmova rax, qword [rbp + 0xd0]
cmp rax, r9
je 0x1401dc983
nop dword [rax]
cmp word [rax], 0x7c
jne 0x1401dc97a
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dc970
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.SystemFamily
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dca73
cmp word [rbp - 0x40], 8
jne 0x1401dca73
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dc9d0
mov rax, qword [rbp + 0xc8]
cmp rdx, rax
ja 0x1401dca1a
lea rdi, [rbp + 0xb0]
cmp rax, 7
cmova rdi, qword [rbp + 0xb0]
mov qword [rbp + 0xc0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dca26
lea rcx, [rbp + 0xb0]
call fcn.140004f70
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rdx, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xc0]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0xb0]
cmova rax, qword [rbp + 0xb0]
cmp rax, r9
je 0x1401dca73
nop dword [rax]
cmp word [rax], 0x7c
jne 0x1401dca6a
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dca60
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Model
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dcb63
cmp word [rbp - 0x40], 8
jne 0x1401dcb63
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dcac0
mov rax, qword [rbp + 0xa8]
cmp rdx, rax
ja 0x1401dcb0a
lea rdi, [rbp + 0x90]
cmp rax, 7
cmova rdi, qword [rbp + 0x90]
mov qword [rbp + 0xa0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dcb16
lea rcx, [rbp + 0x90]
call fcn.140004f70
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rdx, qword [rbp + 0x90]
mov rax, qword [rbp + 0xa0]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0x90]
cmova rax, qword [rbp + 0x90]
cmp rax, r9
je 0x1401dcb63
nop dword [rax]
cmp word [rax], 0x7c
jne 0x1401dcb5a
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dcb50
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dcc33
cmp word [rbp - 0x40], 8
jne 0x1401dcc33
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dcbb0
mov rax, qword [rbp + 0x48]
cmp rdx, rax
ja 0x1401dcbee
lea rdi, [rbp + 0x30]
cmp rax, 7
cmova rdi, qword [rbp + 0x30]
mov qword [rbp + 0x40], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dcbf7
lea rcx, [rbp + 0x30]
call fcn.140004f70
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x40]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0x30]
cmova rax, qword [rbp + 0x30]
cmp rax, r9
je 0x1401dcc33
nop dword [rax + rax]
cmp word [rax], 0x7c
jne 0x1401dcc2a
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dcc20
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.UserName
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dcd94
cmp word [rbp - 0x40], 8
jne 0x1401dcd94
mov rdx, qword [rbp - 0x38]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401dcc80
lea rcx, [rbp + 0xf0]
call fcn.140003f40
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0x100]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0xf0]
cmova rax, qword [rbp + 0xf0]
cmp rax, r9
je 0x1401dcce3
nop dword [rax]
cmp word [rax], 0x7c
jne 0x1401dccda
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dccd0
cmp qword [rbp + 0x40], 0
je 0x1401dcd94
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
xor r8d, r8d
lea rdx, [0x140419d94]
lea rcx, [rsp + 0x70]
call fcn.140006340
nop
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x40]
sub rax, rcx
cmp rax, 1
jb 0x1401de43c
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
mov qword [rsp + 0x30], 1
lea rax, [0x14043f8d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.1400d1c70
nop
cmp qword [rbp + 0x100], 0
je 0x1401dcd80
lea r8, [rbp + 0xf0]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.1401f7250
nop
lea rcx, [rbp - 0x70]
call fcn.140006060
nop
lea rcx, [rsp + 0x70]
call fcn.140006060
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov qword [rbp - 0x48], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401dcdf4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT_UUID_FROM_Win32_ComputerSystemProduct
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dcdf7
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1401de410
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1401dce42
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dce45
mov rdi, r12
mov qword [rbp - 0x18], rdi
test rdi, rdi
je 0x1401de442
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1401dceb9
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dce99
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401dceab
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1401dcef5
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dced6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dcee8
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
test r14d, r14d
js 0x1401dd136
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x18], r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401dd130
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x18], 0
jbe 0x1401dd12c
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.UUID
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dd118
cmp word [rbp - 0x40], 8
jne 0x1401dd118
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dcf80
mov rax, qword [rbp + 0x28]
cmp rdx, rax
ja 0x1401dcfbe
lea rdi, [rbp + 0x10]
cmp rax, 7
cmova rdi, qword [rbp + 0x10]
mov qword [rbp + 0x20], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dcfc7
lea rcx, [rbp + 0x10]
call fcn.140004f70
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1401dd0c8
lea rax, [rbp + 0x10]
mov r8, qword [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rax, r8
lea rdi, [rax + rcx*2]
lea rax, [rbp + 0x10]
cmova rax, r8
lea rbx, [rax + rcx*2]
lea rcx, [rbp + 0x10]
cmova rcx, r8
mov r8d, Ordinal_48
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401dd03a
add rax, 2
cmp rax, rbx
je 0x1401dd03a
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x1401dd031
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401dd020
mov r9, rdi
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x10]
call fcn.1401e6830
lea rax, [rbp + 0x10]
mov rdx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x28]
cmp r8, 7
cmova rax, rdx
mov rcx, qword [rbp + 0x20]
lea r9, [rcx + rcx]
movabs r10, 0x40000000400001
lea rcx, [rbp + 0x10]
cmp r8, 7
cmova rcx, rdx
add rcx, r9
cmp rax, rcx
je 0x1401dd09e
movzx ecx, word [rax]
sub cx, 0x30
cmp cx, 0x36
ja 0x1401dd09e
bt r10, rcx
jae 0x1401dd09e
add rax, 2
jmp 0x1401dd071
lea rcx, [rbp + 0x10]
cmp r8, 7
cmova rcx, rdx
add rcx, r9
cmp rax, rcx
jne 0x1401dd118
mov qword [rbp + 0x20], r12
lea rax, [rbp + 0x10]
cmp r8, 7
cmova rax, rdx
mov word [rax], r12w
jmp 0x1401dd118
mov rax, qword [rbp + 0x28]
cmp rax, 0x20
jb 0x1401dd103
lea rbx, [rbp + 0x10]
cmp rax, 7
cmova rbx, qword [rbp + 0x10]
mov qword [rbp + reloc.SinoSPE.dll_Ordinal_32], 0x20
mov r8d, 0x40
lea rdx, str.FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x40], r12w
jmp 0x1401dd118
lea r9, str.FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
mov edx, reloc.SinoSPE.dll_Ordinal_32
lea rcx, [rbp + 0x10]
call fcn.140004f70
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov qword [rbp - 0x48], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401dd179
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT_Caption_Version_FROM_Win32_OperatingSystem
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dd17c
mov rbx, r12
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x1401de410
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401dd1c8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dd1cb
mov rdi, r12
mov qword [rbp - 0x50], rdi
test rdi, rdi
je 0x1401de44d
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov r14d, eax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1401dd23f
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dd21f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401dd231
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1401dd27b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dd25c
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dd26e
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
test r14d, r14d
js 0x1401dd482
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x18], r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401dd47c
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x18], 0
jbe 0x1401dd478
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Caption
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dd393
cmp word [rbp - 0x40], 8
jne 0x1401dd393
mov r9, qword [rbp - 0x38]
mov rdx, rsi
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dd304
mov rax, qword [rbp + 0x88]
cmp rdx, rax
ja 0x1401dd348
lea rdi, [rbp + 0x70]
cmp rax, 7
cmova rdi, qword [rbp + 0x70]
mov qword [rbp + 0x80], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r12w
jmp 0x1401dd351
lea rcx, [rbp + 0x70]
call fcn.140004f70
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
lea r9, [rdx + rax*2]
lea rax, [rbp + 0x70]
cmova rax, qword [rbp + 0x70]
cmp rax, r9
je 0x1401dd393
nop dword [rax + rax]
cmp word [rax], 0x7c
jne 0x1401dd38a
mov word [rax], r15w
add rax, 2
cmp rax, r9
jne 0x1401dd380
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Version
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dd464
cmp word [rbp - 0x40], 8
jne 0x1401dd464
mov r9, qword [rbp - 0x38]
mov rdx, rsi
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x1401dd3e0
mov rax, qword [rbp + 0x68]
cmp rdx, rax
ja 0x1401dd41e
lea rdi, [rbp + 0x50]
cmp rax, 7
cmova rdi, qword [rbp + 0x50]
mov qword [rbp + 0x60], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rbx], r12w
jmp 0x1401dd427
lea rcx, [rbp + 0x50]
call fcn.140004f70
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
lea rcx, [rbp + 0x50]
cmova rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x60]
lea rdx, [rcx + rax*2]
cmp r8, rdx
je 0x1401dd464
nop dword [rax + rax]
cmp word [r8], 0x7c
jne 0x1401dd45b
mov word [r8], r15w
add r8, 2
cmp r8, rdx
jne 0x1401dd450
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov r14d, esi
mov qword [rbp - 0x48], r12
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401dd4c8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT_DiskIndex_FROM_Win32_DiskPartition_WHERE_BootableTrue
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dd4cb
mov rbx, r12
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x1401de410
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401dd517
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rdi], rax
jmp 0x1401dd51a
mov rdi, r12
mov qword [rbp - 0x50], rdi
test rdi, rdi
je 0x1401de458
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xa0]
mov r15d, eax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1401dd58e
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401dd56e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401dd580
call fcn.1403ca488
mov qword [rdi + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rdi
call fcn.1403ca488
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1401dd5ca
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401dd5ab
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401dd5bd
call fcn.1403ca488
mov qword [rbx + 8], r12
mov edx, reloc.SinoSPE.dll_Ordinal_24
mov rcx, rbx
call fcn.1403ca488
test r15d, r15d
js 0x1401dda99
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x18], r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401dd657
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x18], 0
jbe 0x1401dd653
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.DiskIndex
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dd63f
cmp word [rbp - 0x40], 3
cmove r14d, dword [rbp - 0x38]
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
test r14d, r14d
js 0x1401dda99
cmp r14d, 0xa
jge 0x1401dda99
movaps xmm0, xmmword [str.SELECT_SerialNumber_FROM_Win32_DiskDrive_WHERE__SerialNumber_IS_NOT_NULL__AND__Index0_]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm1, xmmword [0x140443670]
movaps xmmword [rbp + 0x120], xmm1
movaps xmm0, xmmword [0x140443680]
movaps xmmword [rbp + 0x130], xmm0
movaps xmm1, xmmword [0x140443690]
movaps xmmword [rbp + 0x140], xmm1
movaps xmm0, xmmword [0x1404436a0]
movaps xmmword [rbp + 0x150], xmm0
movsd xmm0, qword [0x1404436b0]
movsd qword [rbp + 0x160], xmm0
add r14b, 0x30
lea rax, [rbp + 0x110]
mov rdx, rsi
lea rdx, [rdx + 1]
cmp byte [rax + rdx], 0
jne 0x1401dd6d4
lea rax, [rbp + 0x110]
mov byte [rdx + rax - 2], r14b
mov qword [rbp - 0x48], r12
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x18]
call fcn.1401a8300
mov rdi, rax
mov ecx, reloc.SinoSPE.dll_Ordinal_24
call fcn.1403ca490
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1401dd740
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1404434c0]
call fcn.1403ca130
mov qword [rbx], rax
jmp 0x1401dd743
mov rbx, r12
mov qword [rbp - 0x50], rbx
test rbx, rbx
je 0x1401de463
mov rax, qword [rdi]
test rax, rax
je 0x1401dd75d
mov r8, qword [rax]
jmp 0x1401dd760
mov r8, r12
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, reloc.SinoSPE.dll_Ordinal_48
mov rdx, qword [rbx]
call qword [rax + 0xa0]
mov ebx, eax
lea rcx, [rbp - 0x50]
call fcn.140018110
nop
lea rcx, [rbp - 0x18]
call fcn.140018110
test ebx, ebx
js 0x1401dda99
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x18], r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1401dda93
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
mov r8d, 1
mov edx, esi
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
cmp dword [rbp - 0x18], 0
jbe 0x1401dda8f
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.SerialNumber
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
test eax, eax
js 0x1401dda7b
cmp word [rbp - 0x40], 8
jne 0x1401dda7b
mov rdx, qword [rbp - 0x38]
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1401dd820
mov r8, rsi
lea rcx, [rbp - 0x10]
call fcn.1400050d0
mov rcx, qword [rbp]
test rcx, rcx
je 0x1401dda7b
lea rax, [rbp - 0x10]
mov r9, qword [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rax, r9
lea rdi, [rax + rcx*2]
lea rax, [rbp - 0x10]
cmova rax, r9
lea rbx, [rax + rcx*2]
lea rcx, [rbp - 0x10]
cmova rcx, r9
mov r8d, reloc.SinoSPE.dll_Ordinal_32
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401dd8aa
add rax, 2
cmp rax, rbx
je 0x1401dd8aa
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x20
je 0x1401dd8a1
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401dd890
mov r9, rdi
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.1401e6830
mov byte [rsp + 0x50], Ordinal_48
lea rbx, [rbp - 0x10]
mov r11, qword [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rbx, r11
mov rax, qword [rbp]
lea r8, [rax + rax]
add rbx, r8
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, r11
lea rax, [rbp - 0x10]
cmova rax, r11
add r8, rax
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1401e6b80
mov r9, rbx
mov r8, qword [rax]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.1401e6830
mov byte [rsp + 0x50], 0x5f
lea rbx, [rbp - 0x10]
mov r11, qword [rbp - 0x10]
mov r10, qword [rbp + 8]
cmp r10, 7
cmova rbx, r11
mov rax, qword [rbp]
lea rcx, [rax + rax]
add rbx, rcx
lea r8, [rbp - 0x10]
cmp r10, 7
cmova r8, r11
add r8, rcx
lea rdx, [rbp - 0x10]
cmp r10, 7
cmova rdx, r11
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1401e6b80
mov r9, rbx
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.1401e6830
lea rdi, [rbp - 0x10]
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp + 8]
cmp r8, 7
cmova rdi, r9
mov rax, qword [rbp]
lea rcx, [rax + rax]
add rdi, rcx
lea rbx, [rbp - 0x10]
cmp r8, 7
cmova rbx, r9
add rbx, rcx
lea rcx, [rbp - 0x10]
cmp r8, 7
cmova rcx, r9
mov r8d, Ordinal_51
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401dd9ec
add rax, 2
cmp rax, rbx
je 0x1401dd9ec
movzx ecx, word [rax]
cmp cx, 0x2e
je 0x1401dd9e3
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401dd9d2
mov r9, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.1401e6830
lea rdi, [rbp - 0x10]
mov r9, qword [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdi, r9
mov rax, qword [rbp]
lea rdx, [rax + rax]
add rdi, rdx
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, r9
lea rbx, [rbp - 0x10]
cmova rbx, r9
add rbx, rdx
mov r8d, 0x7c
mov rdx, rbx
call fcn.1403c9db0
mov r8, rax
cmp rax, rbx
je 0x1401dda6a
add rax, 2
cmp rax, rbx
je 0x1401dda6a
movzx ecx, word [rax]
cmp cx, 0x7c
je 0x1401dda61
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rbx
jne 0x1401dda50
mov r9, rdi
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.1401e6830
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
lea r14, [0x1404b0370]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov ebx, 0x7c
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
mov rcx, r14
call fcn.1400050d0
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddb15
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401ddb20
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov rdi, qword [rbp + 0xc0]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401ddb91
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401ddba1
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddbd7
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401ddbe2
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova r9, qword [rbp + 0x90]
mov rdi, qword [rbp + 0xa0]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401ddc53
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401ddc63
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddc99
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401ddca4
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x40]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401ddd09
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401ddd19
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddd4f
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401ddd5a
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova r9, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0x100]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401dddcb
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401ddddb
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401dde11
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401dde1c
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova r9, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x80]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401dde87
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401dde97
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddecd
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401dded8
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r9, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x60]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401ddf3d
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401ddf4d
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401ddf83
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401ddf8e
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r9, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x20]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401ddff3
lea rax, [rsi + rdi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
mov ebx, 0x7c
jmp 0x1401de003
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
mov rcx, qword [0x1404b0380]
mov rdx, qword [reloc.SinoSPE.dll_Ordinal_7]
cmp rcx, rdx
jae 0x1401de039
lea rax, [rcx + 1]
mov qword [0x1404b0380], rax
mov rax, r14
cmp rdx, 7
cmova rax, qword [0x1404b0370]
mov dword [rax + rcx*2], 0x7c
jmp 0x1401de044
mov r9d, ebx
mov rcx, r14
call fcn.140003990
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova r9, qword [rbp - 0x10]
mov rdi, qword [rbp]
mov rsi, qword [0x1404b0380]
mov rcx, qword [reloc.SinoSPE.dll_Ordinal_7]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x1401de0a4
lea rax, [rdi + rsi]
mov qword [0x1404b0380], rax
mov rbx, r14
cmp rcx, 7
cmova rbx, qword [0x1404b0370]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401de0b5
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r14
call fcn.140003d80
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x1401de0f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de0f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de0f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp], r12
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r12w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x1401de14c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de147
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de147
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x1401de1a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de19b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de19b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r12w
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x1401de1f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de1f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de1f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x1401de257
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de252
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de252
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
movdqa xmm0, xmmword [0x1404530e0]
movdqu xmmword [rbp + 0x100], xmm0
mov word [rbp + 0xf0], r12w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x1401de2b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de2ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de2ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r12w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x1401de30c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de307
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r12w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x1401de36f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de36a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de36a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r12w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x1401de3d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401de3cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401de3cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
mov rdx, r14
mov rcx, r13
call fcn.140005e80
mov rax, r13
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
call fcn.140006110
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
nop
mov ecx, 0x8007000e
call fcn.1403c9f50
int3