Function at 0x7ff65ed3d870
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r12, rcx
mov qword [rsp + 0xd8], rcx
xor esi, esi
mov dword [rsp + 0x70], esi
mov qword [r11 - 0xc0], rsi
mov qword [r11 - 0xb0], rsi
mov qword [r11 - 0xa8], 7
mov word [rsp + 0x148], si
mov qword [r11 - 0xe0], rsi
mov qword [r11 - 0xd0], rsi
mov qword [r11 - 0xc8], 7
mov word [rsp + 0x128], si
lea ecx, [rsi + 0x40]
call fcn.7ff65efe06d0
mov rdi, rax
mov qword [rsp + 0x58], rax
lea rbx, [rax + 0x40]
mov qword [rsp + 0x68], rbx
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov qword [rax + 0x20], rsi
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], 7
mov word [rax + 0x20], si
lea r14, [rax + 0x40]
mov qword [rsp + 0x60], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x7ff65ed3da3e
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rbx
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3d9b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3d9b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3da1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3da15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x7ff65ed3db65
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rbx
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3dadd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3dad8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3db41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3db3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff65f09d480]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x7ff65f09d470]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x7ff65ed3dc8f
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rbx
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3dc07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3dc02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3dc6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3dc66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov qword [rsp + 0x78], rsi
mov ecx, 0x18
call fcn.7ff65efe06d0
mov rbx, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x7ff65ed3dcd4
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [0x7ff65f151330]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x7ff65ed3ebd4
jmp 0x7ff65ed3dcd7
mov rbx, rsi
mov qword [rsp + 0xa0], rbx
test rbx, rbx
je 0x7ff65ed3ebdf
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov r15d, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff65ed3dd5e
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3dd3f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3dd51
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
test r15d, r15d
jns 0x7ff65ed3de6d
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rax
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3dde5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3dde0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3de49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3de44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x7ff65ed3dfb4
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rax
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3df2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3df27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3df90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3df8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov qword [rsp + 0x88], rsi
movdqa xmm6, xmmword [0x7ff65f153da0]
movdqu xmmword [rsp + 0x168], xmm6
movdqa xmm7, xmmword [0x7ff65f153d50]
movdqu xmmword [rsp + 0x178], xmm7
mov dword [rsp + 0x188], 0x4242415c
mov word [rsp + 0x18c], 0x5c4b
mov byte [rsp + 0x18e], 0x2e
mov r15d, 0x14
mov rax, qword gs:[0x58]
add r15, qword [rax]
mov eax, dword [r15]
cmp dword [0x7ff65f42f830], eax
jg 0x7ff65ed3ebe9
lea rdx, [0x7ff65f42f7a0]
cmp byte [0x7ff65f42f7c6], 0
je 0x7ff65ed3e06d
mov rax, rsi
movdqa xmm1, xmmword [0x7ff65f153b30]
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rdx]
pxor xmm0, xmm1
movdqu xmmword [rax + rdx], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x7ff65ed3e040
cmp rax, 0x27
jae 0x7ff65ed3e06d
nop
xor byte [rax + rdx], 0x2e
inc rax
cmp rax, 0x27
jb 0x7ff65ed3e060
lea rcx, [rsp + 0xc0]
call fcn.7ff65ed3c920
mov rbx, rax
mov ecx, dword [r15]
cmp dword [0x7ff65f42f77c], ecx
jg 0x7ff65ed3ec51
movzx eax, byte [0x7ff65f42f7d3]
test al, al
je 0x7ff65ed3e0b4
xor byte [0x7ff65f42f7d0], 0x2e
xor byte [0x7ff65f42f7d1], 0x2e
xor byte [0x7ff65f42f7d2], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f7d3], al
lea rdx, [0x7ff65f42f7d0]
lea rcx, [rsp + 0xa8]
call fcn.7ff65ed3c920
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e0d6
mov r8, qword [rcx]
jmp 0x7ff65ed3e0d9
mov r8, rsi
mov rax, qword [rax]
test rax, rax
je 0x7ff65ed3e0e6
mov rdx, qword [rax]
jmp 0x7ff65ed3e0e9
mov rdx, rsi
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rsi
mov r9d, 0x30
call qword [rax + 0xa0]
mov r15d, eax
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x7ff65ed3e16b
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff65ed3e163
test rbx, rbx
je 0x7ff65ed3e163
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e144
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3e156
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
mov qword [rsp + 0xa8], rsi
mov rbx, qword [rsp + 0xc0]
test rbx, rbx
je 0x7ff65ed3e1bc
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3e1bc
test rbx, rbx
je 0x7ff65ed3e1bc
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e19d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3e1af
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
test r15d, r15d
jns 0x7ff65ed3e2d6
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [r12], rdi
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], rax
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3e24e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3e249
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3e2b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3e2ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0x74], esi
lea r13, [0x7ff65f150144]
nop dword [rax]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x7ff65ed3e5bb
mov rax, qword [rcx]
lea rdx, [rsp + 0x74]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x74], 0
je 0x7ff65ed3e5b3
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rbx, qword [rsp + 0x100]
mov ecx, 0x18
call fcn.7ff65efe06d0
mov r14, rax
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x7ff65ed3e3a0
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
test rax, rax
jne 0x7ff65ed3e3a3
test rbx, rbx
jne 0x7ff65ed3ec92
jmp 0x7ff65ed3e3a3
mov r14, rsi
mov qword [rsp + 0xc8], r14
test r14, r14
je 0x7ff65ed3ec9d
lea rdi, [0x7ff65f146170]
cmp qword [rsp + 0x138], 0
cmova rdi, r13
mov ecx, 0x18
call fcn.7ff65efe06d0
mov rbx, rax
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x7ff65ed3e3fa
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
mov rcx, rdi
call fcn.7ff65efe1870
mov qword [rbx], rax
jmp 0x7ff65ed3e3fd
mov rbx, rsi
mov qword [rsp + 0x98], rbx
test rbx, rbx
je 0x7ff65ed3eca8
or dword [rsp + 0x70], 2
mov ecx, 0x18
call fcn.7ff65efe06d0
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x7ff65ed3e447
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.7ff65ed3ca90
mov r15, rax
jmp 0x7ff65ed3e44a
mov r15, rsi
test r15, r15
je 0x7ff65ed3ecb2
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3e492
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e473
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3e485
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
mov qword [rsp + 0x98], r15
mov r9, qword [r15]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x7ff65ed3e4a4
mov rcx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x140]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x7ff65ed3e501
lea rdi, [rcx + rdx]
mov qword [rsp + 0x138], rdi
lea rbx, [rsp + 0x128]
cmp r8, 8
cmovae rbx, qword [rsp + 0x128]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.7ff65efe2f30
mov word [rbx + rdi*2], si
jmp 0x7ff65ed3e513
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x128]
call fcn.7ff65ed4bd20
and dword [rsp + 0x70], 0xfffffffd
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3e558
mov rcx, qword [r15]
test rcx, rcx
je 0x7ff65ed3e539
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], rsi
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x7ff65ed3e54b
call fcn.7ff65efe070c
mov qword [r15 + 8], rsi
mov edx, 0x18
mov rcx, r15
call fcn.7ff65efe070c
mov qword [rsp + 0x98], rsi
mov eax, 0xffffffff
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3e5a0
mov rcx, qword [r14]
test rcx, rcx
je 0x7ff65ed3e581
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], rsi
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x7ff65ed3e593
call fcn.7ff65efe070c
mov qword [r14 + 8], rsi
mov edx, 0x18
mov rcx, r14
call fcn.7ff65efe070c
lea rcx, [rsp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x7ff65ed3e2f0
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x10]
movdqa xmm6, xmmword [0x7ff65f153da0]
movdqu xmmword [rsp + 0x190], xmm6
movdqa xmm7, xmmword [0x7ff65f153d60]
movdqu xmmword [rsp + 0x1a0], xmm7
mov byte [rsp + 0x1b0], 0x2e
mov edi, 0x14
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x7ff65f42f87c], eax
jg 0x7ff65ed3ecbd
lea rdx, [0x7ff65f42f7e0]
cmp byte [0x7ff65f42f800], 0
je 0x7ff65ed3e66d
mov rax, rsi
movdqa xmm1, xmmword [0x7ff65f153b30]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rdx]
pxor xmm0, xmm1
movdqu xmmword [rax + rdx], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x7ff65ed3e640
cmp rax, 0x21
jae 0x7ff65ed3e66d
nop
xor byte [rax + rdx], 0x2e
inc rax
cmp rax, 0x21
jb 0x7ff65ed3e660
lea rcx, [rsp + 0xd0]
call fcn.7ff65ed3c920
mov rbx, rax
mov ecx, dword [rdi]
cmp dword [0x7ff65f42f778], ecx
jg 0x7ff65ed3ed09
movzx eax, byte [0x7ff65f42f783]
test al, al
je 0x7ff65ed3e6b3
xor byte [0x7ff65f42f780], 0x2e
xor byte [0x7ff65f42f781], 0x2e
xor byte [0x7ff65f42f782], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f783], al
lea rdx, [0x7ff65f42f780]
lea rcx, [rsp + 0xb0]
call fcn.7ff65ed3c920
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e6d5
mov r8, qword [rcx]
jmp 0x7ff65ed3e6d8
mov r8, rsi
mov rax, qword [rax]
test rax, rax
je 0x7ff65ed3e6e5
mov rdx, qword [rax]
jmp 0x7ff65ed3e6e8
mov rdx, rsi
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r10, [rsp + 0x88]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rsi
mov r9d, 0x30
call qword [rax + 0xa0]
mov edi, eax
mov rbx, qword [rsp + 0xb0]
test rbx, rbx
je 0x7ff65ed3e769
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff65ed3e761
test rbx, rbx
je 0x7ff65ed3e761
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e742
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3e754
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
mov qword [rsp + 0xb0], rsi
mov rbx, qword [rsp + 0xd0]
test rbx, rbx
je 0x7ff65ed3e7ba
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x7ff65ed3e7ba
test rbx, rbx
je 0x7ff65ed3e7ba
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff65ed3e79b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x7ff65ed3e7ad
call fcn.7ff65efe070c
mov qword [rbx + 8], rsi
mov edx, 0x18
mov rcx, rbx
call fcn.7ff65efe070c
test edi, edi
jns 0x7ff65ed3e8e0
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
mov qword [r12], rax
mov qword [r12 + 8], rcx
mov qword [r12 + 0x10], rdx
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3e855
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3e850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed4a
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3e8b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3e8b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed50
call fcn.7ff65efe070c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], si
mov rax, r12
jmp 0x7ff65ed3eb9d
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x7ff65ed3ea1a
mov rax, qword [rcx]
lea rdx, [rsp + 0x74]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rsp + 0x74], 0
je 0x7ff65ed3ea1a
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x110]
xor r8d, r8d
lea rdx, str.Name
call qword [rax + 0x20]
mov rdi, qword [rsp + 0x118]
mov ecx, 0x18
call fcn.7ff65efe06d0
mov rbx, rax
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x7ff65ed3e990
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x7ff65ed3e993
test rdi, rdi
jne 0x7ff65ed3ed56
jmp 0x7ff65ed3e993
mov rbx, rsi
mov qword [rsp + 0xb8], rbx
test rbx, rbx
je 0x7ff65ed3ed61
lea rdx, [0x7ff65f146170]
cmp qword [rsp + 0x158], 0
cmova rdx, r13
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0xa0]
call fcn.7ff65ed3c9a0
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff65ed3e9db
mov rdx, qword [rdx]
jmp 0x7ff65ed3e9de
mov rdx, rsi
lea rcx, [rsp + 0x148]
call fcn.7ff65ed48ac0
nop
lea rcx, [rsp + 0xa0]
call fcn.7ff65ed3ca20
nop
lea rcx, [rsp + 0xb8]
call fcn.7ff65ed3ca20
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x7ff65ed3e8e0
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
jmp 0x7ff65ed3ea62
lea rax, [rsp + 0x148]
mov rbx, qword [rsp + 0x58]
cmp rbx, rax
je 0x7ff65ed3ea9e
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae rdx, qword [rsp + 0x148]
mov r8, qword [rsp + 0x158]
mov rcx, rbx
call fcn.7ff65ec85900
lea rcx, [rbx + 0x20]
lea rax, [rsp + 0x128]
cmp rcx, rax
je 0x7ff65ed3ead6
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 8
cmovae rdx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x138]
call fcn.7ff65ec85900
mov qword [r12], rbx
mov rax, qword [rsp + 0x60]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [r12 + 0x10], rax
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x7ff65ed3eb36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3eb31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed6c
call fcn.7ff65efe070c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x7ff65ed3eb9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3eb95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3ed72
call fcn.7ff65efe070c
mov rax, r12
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.7ff65efe06b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
lea rcx, [0x7ff65f42f830]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f830], 0xffffffff
jne 0x7ff65ed3e01c
movaps xmmword [0x7ff65f42f7a0], xmm6
movaps xmmword [0x7ff65f42f7b0], xmm7
mov eax, dword [rsp + 0x188]
mov dword [0x7ff65f42f7c0], eax
movzx eax, word [rsp + 0x18c]
mov word [0x7ff65f42f7c4], ax
mov byte [0x7ff65f42f7c6], 0x2e
lea rcx, [0x7ff65f019e10]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f830]
call fcn.7ff65efe0868
nop
jmp 0x7ff65ed3e01c
lea rcx, [0x7ff65f42f77c]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f77c], 0xffffffff
jne 0x7ff65ed3e08c
mov dword [0x7ff65f42f7d0], 0x2e627f79
lea rcx, [0x7ff65f019e40]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f77c]
call fcn.7ff65efe0868
nop
jmp 0x7ff65ed3e08c
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
lea rcx, [0x7ff65f42f87c]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f87c], 0xffffffff
jne 0x7ff65ed3e618
movaps xmmword [0x7ff65f42f7e0], xmm6
movaps xmmword [0x7ff65f42f7f0], xmm7
mov byte [0x7ff65f42f800], 0x2e
lea rcx, [0x7ff65f019de0]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f87c]
call fcn.7ff65efe0868
nop
jmp 0x7ff65ed3e618
lea rcx, [0x7ff65f42f778]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f778], 0xffffffff
jne 0x7ff65ed3e68b
mov dword [0x7ff65f42f780], 0x2e627f79
lea rcx, [0x7ff65f019e00]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f778]
call fcn.7ff65efe0868
nop
jmp 0x7ff65ed3e68b
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
mov ecx, 0x8007000e
call fcn.7ff65efe1860
nop
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
int3