Function at 0x140028990
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400ba040]
xor rax, rsp
mov qword [rbp + 0x248], rax
mov r12, rdx
mov qword [rbp - 0x78], rdx
mov r15, rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x50], esi
call fcn.1400284a0
test al, al
jne 0x140028a06
lea rdx, str.No_permissions_or_WMI_service_isnt_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14002a005
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140028a5d
lea rdx, str.Failed_to_initialize_COM_library._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x1400027d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Attempting_fallback_spoofing_via_registry_manipulation.
jmp 0x1400289e3
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x140028a9c
lea rdx, str.Failed_to_initialize_security._Error_code__0x
jmp 0x140029fc3
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x140094ff8]
xor edx, edx
mov r8d, 1
lea rcx, [0x140095008]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x140029fbc
mov r14, qword [rsp + 0x70]
mov qword [rbp - 0x68], r14
test r14, r14
je 0x140029fbc
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x68], rsi
mov rax, qword [r14]
mov rdi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.14008c680
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140028b2f
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [0x1400a45b0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002a03a
jmp 0x140028b32
mov rbx, rsi
mov qword [rbp - 0x80], rbx
test rbx, rbx
je 0x14002a050
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call rdi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140028bad
mov rcx, qword [rbx]
test rcx, rcx
je 0x140028b8e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140028ba0
call fcn.14008cbd0
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.14008cbd0
test edi, edi
js 0x140029f6b
mov rsi, qword [rsp + 0x68]
mov qword [rbp - 0x80], rsi
test rsi, rsi
je 0x140029f6b
mov qword [rbp - 0x38], rsi
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x140028c45
lea rdx, str.Could_not_set_proxy_blanket._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x1400027d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x140029f5a
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140025f90
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rbp + 0x160]
call fcn.140025f90
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 7
jb 0x140028d21
lea rax, [r8 + 7]
mov qword [rdi + 0x10], rax
mov r12, rdi
cmp rcx, 7
jbe 0x140028c97
mov r12, qword [rdi]
lea rax, [0x1400a4a26]
lea rcx, str.SELECT
cmp rax, r12
jbe 0x140028cca
lea rax, [r12 + r8*2]
cmp rcx, rax
ja 0x140028cca
cmp r12, rcx
ja 0x140028cbf
xor eax, eax
mov r15d, eax
jmp 0x140028cd0
mov r15, r12
sub r15, rcx
sar r15, 1
jmp 0x140028cd0
mov r15d, 7
lea rcx, [r12 + 0xe]
lea r8, [r8*2 + 2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.SELECT
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.SELECT
lea rdx, [rdx + 0xe]
lea rdx, [rdx + r15*2]
lea rcx, [r12 + rbx]
mov r8d, 7
sub r8, r15
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140028d3a
mov qword [rsp + 0x28], 7
mov edx, 7
mov rcx, rdi
call fcn.14002b660
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xb0], xmm1
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
bts r13d, 0xe
mov r8d, 6
lea rdx, str._FROM
lea rcx, [rbp + 0xa0]
call fcn.140008730
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r13d, 0xf
mov r9, qword [rsp + 0x50]
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.14002ad10
bts r13d, 0xd
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140028e17
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028e11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028e11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cbd0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x140028e60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028e5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028e5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cbd0
movdqa xmm0, xmmword [0x1400a9270]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r15w
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x140028ec9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028ebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028ebc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cbd0
movdqa xmm0, xmmword [0x1400a9270]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r15w
mov rdx, qword [rbp + 0x198]
cmp rdx, 7
jbe 0x140028f2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028f1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028f1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cbd0
movdqa xmm0, xmmword [0x1400a9270]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r15w
mov qword [rsp + 0x78], r15
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov r12, qword [rcx + 0xa0]
lea rbx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rbx, qword [rbp + 0xe0]
mov ecx, 0x18
call fcn.14008c680
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140028fa3
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140028fa6
test rbx, rbx
jne 0x14002a045
jmp 0x140028fa6
mov rdi, r15
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x14002a05b
mov r15, qword [rdi]
mov ecx, 0x18
call fcn.14008c680
mov rbx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140028fed
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
lea rcx, [0x1400a4660]
call fcn.14008e390
mov qword [rbx], rax
xor ecx, ecx
jmp 0x140028ff1
xor ecx, ecx
mov ebx, ecx
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x14002a066
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
mov r8, r15
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call r12
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14002906c
mov rcx, qword [rbx]
test rcx, rcx
je 0x140029049
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r12d, r12d
mov qword [rbx], r12
jmp 0x14002904c
xor r12d, r12d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002905e
call fcn.14008cbd0
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.14008cbd0
nop
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x1400290b1
mov rcx, qword [rdi]
test rcx, rcx
je 0x140029090
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov qword [rdi], rbx
jmp 0x140029092
xor ebx, ebx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400290a4
call fcn.14008cbd0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.14008cbd0
test r15d, r15d
js 0x140029eb7
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140029eb7
mov qword [rbp - 0x70], rdi
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov rax, qword [rdi]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
jne 0x140029e3f
mov rbx, qword [rsp + 0x58]
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140029137
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008c680
mov r15, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14002916a
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.14008e390
mov qword [r15], rax
xor eax, eax
jmp 0x14002916d
mov r15, rax
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002a02f
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
mov r12d, eax
mov ecx, 0xffffffff
lock xadd dword [r15 + 0x10], ecx
cmp ecx, 1
jne 0x1400291de
mov rcx, qword [r15]
test rcx, rcx
je 0x1400291bd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov qword [r15], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1400291d1
call fcn.14008cbd0
xor eax, eax
mov qword [r15 + 8], rax
mov edx, 0x18
mov rcx, r15
call fcn.14008cbd0
test r12d, r12d
js 0x140029df8
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor eax, eax
mov r15d, eax
mov qword [rbp + 0x50], rax
mov r12d, 0xf
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x40], al
or r13d, 0x20
mov dword [rsp + 0x50], r13d
mov r14d, 0xc
lea rsi, [0x14009b8c0]
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029234
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
cmp r15, r12
jae 0x140029262
lea rax, [r15 + 1]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x40]
cmp r12, 0xf
cmova rax, qword [rbp + 0x40]
mov byte [r15 + rax], r9b
mov byte [r15 + rax + 1], 0
jmp 0x14002926b
lea rcx, [rbp + 0x40]
call fcn.14000a370
sub r14, 1
je 0x14002927b
mov r12, qword [rbp + 0x58]
mov r15, qword [rbp + 0x50]
jmp 0x140029220
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0xf
or r13d, 0x40
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x68]
jge 0x1400292aa
dec eax
or eax, 0xfffffff0
inc eax
cdqe
lea r15, [0x14009b8c0]
movzx eax, byte [rax + r15]
mov byte [rbp + 0x20], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400292cf
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x21], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400292ed
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x22], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002930b
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x30], 4
mov byte [rbp + 0x23], cl
mov byte [rbp + 0x24], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x98], 0xf
bts r13d, 7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14002934f
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x80], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029370
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x81], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029391
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x82], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400293b2
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x90], 4
mov byte [rbp + 0x83], cl
mov byte [rbp + 0x84], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], 0xf
bts r13d, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400293f9
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x60], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029417
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x61], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029435
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r15]
mov byte [rbp + 0x62], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029453
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r15]
mov qword [rbp + 0x70], 4
mov byte [rbp + 0x63], cl
mov byte [rbp + 0x64], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor r12d, r12d
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
bts r13d, 9
mov dword [rsp + 0x50], r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400294a1
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x1400294d5
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x1400294de
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400294f2
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x140029526
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x14002952f
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029543
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x140029577
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x140029580
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029594
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x1400295c8
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x1400295d1
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400295e5
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x140029619
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x140029622
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029636
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002966a
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x140029673
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140029687
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x1400296bb
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x1400296c4
lea rcx, [rbp]
call fcn.14000a370
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400296d8
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r15]
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rcx, rdx
jae 0x14002970c
lea rax, [rcx + 1]
mov qword [rbp + 0x10], rax
lea rax, [rbp]
cmp rdx, 0xf
cmova rax, qword [rbp]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r12b
jmp 0x140029715
lea rcx, [rbp]
call fcn.14000a370
mov r8d, 1
lea rdx, [0x1400a45c8]
lea rcx, [rbp]
call fcn.140009050
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], r12b
bts r13d, 0xa
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x200]
lea rcx, [rbp + 0x140]
call fcn.14002b070
bts r13d, 0xb
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a45c8]
lea rcx, [rbp + 0x140]
call fcn.140009050
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts r13d, 0xc
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x1e0]
lea rcx, [rbp + 0x120]
call fcn.14002b070
or r13d, 1
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a45c8]
lea rcx, [rbp + 0x120]
call fcn.140009050
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or r13d, 4
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 0x100]
call fcn.14002b070
or r13d, 2
mov dword [rsp + 0x50], r13d
mov r8d, 1
lea rdx, [0x1400a45c8]
lea rcx, [rbp + 0x100]
call fcn.140009050
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 8
mov dword [rsp + 0x50], r13d
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0x220]
call fcn.14002b070
or r13d, 0x10
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x1400298ed
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400298e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e55
call fcn.14008cbd0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14002992e
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e5c
call fcn.14008cbd0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x140029989
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029983
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e63
call fcn.14008cbd0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x1400299ca
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400299c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e6a
call fcn.14008cbd0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x140029a25
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e71
call fcn.14008cbd0
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140029a66
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029a61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e78
call fcn.14008cbd0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x140029ac0
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029abb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e7f
call fcn.14008cbd0
btr r13d, 9
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140029b00
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029afb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e86
call fcn.14008cbd0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
btr r13d, 8
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140029b50
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029b4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e8d
call fcn.14008cbd0
btr r13d, 7
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140029b96
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029b91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e94
call fcn.14008cbd0
and r13d, 0xffffffbf
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140029bd5
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029bd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029e9b
call fcn.14008cbd0
and r13d, 0xffffffdf
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140029c14
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029c0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029ea2
call fcn.14008cbd0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xc0]
call fcn.140025f90
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov word [rbp - 0x58], ax
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140029d33
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x78]
mov r12, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140029c87
mov r12, qword [rax]
mov ecx, 0x18
call fcn.14008c680
mov r15, rax
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140029cbb
xor eax, eax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 1
mov rcx, r12
call fcn.14008e390
mov qword [r15], rax
xor r12d, r12d
jmp 0x140029cc1
xor r12d, r12d
mov r15d, r12d
mov qword [rbp - 0x60], r15
test r15, r15
je 0x14002a071
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x58]
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x50]
nop
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x140029d27
mov rcx, qword [r15]
test rcx, rcx
je 0x140029d08
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], r12
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140029d1a
call fcn.14008cbd0
mov qword [r15 + 8], r12
mov edx, 0x18
mov rcx, r15
call fcn.14008cbd0
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140029d57
lea rdx, str.Failed_to_allocate_BSTR_for_new_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x140029d9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029d98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029ea9
call fcn.14008cbd0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x140029df8
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029eb0
call fcn.14008cbd0
lea rcx, [rbp - 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
test rbx, rbx
je 0x140029e12
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
test eax, eax
je 0x140029102
mov bl, 1
test rdi, rdi
je 0x140029e50
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
jmp 0x140029ef8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.WMI_query_failed._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x1400027d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x140029f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029f3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008cbd0
movdqa xmm0, xmmword [0x1400a9270]
movdqu xmmword [rbp + 0xf0], xmm0
xor eax, eax
mov word [rbp + 0xe0], ax
test rsi, rsi
je 0x140029f69
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
jmp 0x140029fab
lea rdx, str.Could_not_connect_to_WMI_namespace._Error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x1400027d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
test r14, r14
je 0x140029fba
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
nop
jmp 0x140029ffc
lea rdx, str.Failed_to_create_IWbemLocator_object._Err_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140009560
lea rdx, [0x1400027d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140009b00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, bl
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.14008c660
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
nop
mov ecx, 0x8007000e
call fcn.14008e380
int3