Function at 0x14000b2e0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r15, rcx
mov qword [rbp - 0x68], rcx
xor r12d, r12d
mov dword [rsp + 0x5c], r12d
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::WMIData::ReadSysInfo
xor edx, edx
call fcn.14009cf00
mov qword [rbp - 0x50], r12
call fcn.140014190
cmp byte [rax + 0x64], r12b
je 0x14000b39d
lea ecx, [r12 + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000b396
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov rcx, rbx
call fcn.140098570
jmp 0x14000b399
mov rax, r12
mov qword [rbp - 0x50], rax
mov dword [rbp + 0x78], r12d
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x48], r12
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140104360]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140104390]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov esi, eax
test eax, eax
jns 0x14000b403
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.Failed_to_create_IWbemLocator_object.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000d507
call fcn.140014190
mov rcx, rax
lea r9, str.Started_reading_from_ROOTWMI
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000b46c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTwmi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d567
jmp 0x14000b46f
mov rbx, r12
mov qword [rbp - 0x20], rbx
test rbx, rbx
je 0x14000d5f6
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
mov esi, eax
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000b4f9
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000b4da
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000b4ec
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
jns 0x14000b544
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.Could_not_connect_to_ROOTwmi__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000d507
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
jmp 0x14000d507
mov rcx, qword [rbp + 0x40]
test rcx, rcx
jne 0x14000b577
call fcn.140014190
lea r9, str.IWbemServices____0x_08X
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000d491
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov esi, eax
test eax, eax
jns 0x14000b608
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.Could_not_set_proxy_blanket__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000b5e5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d507
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
jmp 0x14000d507
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000b651
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_MS_SystemInformation
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d572
jmp 0x14000b654
mov rbx, r12
mov qword [rbp - 0x18], rbx
test rbx, rbx
je 0x14000d5f6
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000b6aa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000d57d
jmp 0x14000b6ad
mov rdi, r12
mov qword [rbp - 0x10], rdi
test rdi, rdi
je 0x14000d601
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14000b728
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000b708
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000b71a
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000b765
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000b746
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000b758
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
jns 0x14000b7cd
call fcn.140014190
lea r9, str.Query_for_system_information_failed.__hr:0x_08X_
mov dword [rsp + 0x20], esi
mov rcx, rax
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000b7a7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d495
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov rcx, r12
mov qword [rbp + 0x40], rcx
jmp 0x14000d495
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000b7e7
call fcn.140014190
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x14000b559
lea r13, section..data
nop
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x78], 0
je 0x14000bc5a
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14000bc5a
test eax, eax
js 0x14000bc5a
lea r9, [r15 + 0x10]
mov byte [rsp + 0x20], 1
lea r8, str.SystemProductName
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000b870
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_SystemProductName
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov byte [rsp + 0x20], 1
lea r9, [r15 + 0x18]
lea r8, str.SystemSKU
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000b8b5
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_SystemSKU
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000b97c
mov rcx, qword [r15 + 0x18]
mov edi, dword [rcx - 0x10]
test edi, edi
jg 0x14000b8c5
mov eax, r14d
jmp 0x14000b8e0
mov edx, 0x23
call fcn.1400a4054
test rax, rax
jne 0x14000b8d9
mov eax, r14d
jmp 0x14000b8e0
sub rax, qword [r15 + 0x18]
sar rax, 1
sub edi, eax
mov qword [rbp - 0x48], r12
lea r8d, [rdi - 1]
lea rdx, [rbp - 0x48]
lea rcx, [r15 + 0x18]
call fcn.14000d860
nop
mov esi, r12d
lea rdi, [0x140133040]
mov rbx, qword [rbp - 0x48]
nop word [rax + rax]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000d617
mov rcx, rbx
call fcn.1400baed0
test eax, eax
je 0x14000b935
inc esi
add rdi, 8
cmp esi, 0x12
jb 0x14000b910
jmp 0x14000b95b
mov byte [r15 + 9], 1
call fcn.140014190
mov rcx, rax
lea r9, str.Set_m_bUseCtrlAltJ_to_TRUE
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b97c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov byte [rsp + 0x20], 1
lea r9, [r15 + 0x38]
lea r8, str.BIOSVersion
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000b9bc
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_BIOSVersion
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov r8d, 3
lea rdx, [0x1400e95e0]
lea rcx, [r15 + 0x38]
call fcn.140006a20
call fcn.140008ac0
mov rcx, rax
test rax, rax
je 0x14000d62d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov byte [rsp + 0x20], 1
lea r9, [rbp - 0x80]
lea r8, str.BIOSReleaseDate
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
mov rbx, qword [rbp - 0x80]
test eax, eax
jns 0x14000ba3e
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_BIOSReleaseDate
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000ba4e
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [r15 + 0x38]
call fcn.140006a20
lea r9, [r15 + 0x40]
mov byte [rsp + 0x20], 1
lea r8, str.BaseBoardVersion
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000ba8e
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_BaseBoardVersion
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov byte [rsp + 0x20], 1
lea r9, [r15 + 0x60]
lea r8, str.SystemFamily
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000bad3
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_SystemFamily
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000bc10
mov rcx, qword [r15 + 0x60]
cmp dword [rcx - 0x10], 0
jg 0x14000bae2
mov eax, r14d
jmp 0x14000bafd
mov edx, 0x20
call fcn.1400a4054
test rax, rax
jne 0x14000baf6
mov eax, r14d
jmp 0x14000bafd
sub rax, qword [r15 + 0x60]
sar rax, 1
mov qword [rsp + 0x70], r12
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [r15 + 0x60]
call fcn.1400094e0
nop
mov r8d, 2
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000d860
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000bb91
cmp dword [rbx + 0x10], 0
jl 0x14000bb82
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000bb82
call fcn.140006b80
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14000bb77
mov r8, qword [rbx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
mov rdx, rbx
mov rcx, r8
call qword [case.0x140014436.0]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14000bb91
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14000d9e0
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bbb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov esi, r12d
mov rdi, r13
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000d60c
mov rcx, rbx
call fcn.1400baed0
test eax, eax
je 0x14000bbe6
inc esi
add rdi, 8
cmp esi, 8
jb 0x14000bbc1
jmp 0x14000bbeb
mov byte [r15 + 8], 1
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bc0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov rbx, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000bc2a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x48], r12
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bc4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000b7f0
jmp 0x14000bca8
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000bca8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000bcc2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
call fcn.140014190
mov rcx, rax
lea r9, str.Completed_reading_from_ROOTwmi
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
lea r9, str.Started_reading_from_ROOTCIMV2
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000bd4b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d588
jmp 0x14000bd4e
mov rbx, r12
mov qword [rbp - 8], rbx
test rbx, rbx
je 0x14000d5f6
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000bdd1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000bdb2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000bdc4
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
jns 0x14000be1c
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.Could_not_connect_to_ROOTcimv2.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000d491
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
jmp 0x14000d491
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000b54d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov esi, eax
test eax, eax
jns 0x14000be6a
call fcn.140014190
lea r9, str.Could_not_set_proxy_blanket.__hr:0x_08X_
jmp 0x14000b775
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000beb3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_PhysicalMemory
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d593
jmp 0x14000beb6
mov rbx, r12
mov qword [rbp], rbx
test rbx, rbx
je 0x14000d5f6
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000bf0c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000d59e
jmp 0x14000bf0f
mov rdi, r12
mov qword [rbp + 8], rdi
test rdi, rdi
je 0x14000d622
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14000bf8a
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000bf6a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000bf7c
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000bfc7
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000bfa8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000bfba
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
js 0x14000b769
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000bff0
call fcn.140014190
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x14000b559
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x78], 0
je 0x14000c0f3
cmp qword [rbp + 0x48], 0
je 0x14000c0f3
test eax, eax
js 0x14000c0f3
call fcn.140008ac0
mov rcx, rax
test rax, rax
je 0x14000d62d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov byte [rsp + 0x20], 1
lea r9, [rbp - 0x40]
lea r8, str.Capacity
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
mov rbx, qword [rbp - 0x40]
test eax, eax
jns 0x14000c09e
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_Capacity
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000c0a9
mov rcx, rbx
call fcn.1400ba880
add qword [r15], rax
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000c0c3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x48], r12
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c0e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000bff0
jmp 0x14000c141
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000c141
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000c18a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_ComputerSystem
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d5a9
jmp 0x14000c18d
mov rbx, r12
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000d5f6
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000c1e3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000d5b4
jmp 0x14000c1e6
mov rdi, r12
mov qword [rbp + 0x18], rdi
test rdi, rdi
je 0x14000d638
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14000c261
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000c241
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000c253
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000c29e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000c27f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000c291
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
js 0x14000b769
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000c2c0
call fcn.140014190
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x14000b559
mov r12d, dword [0x140138258]
mov r13, qword gs:[0x58]
movsd xmm6, qword [0x1400eacb8]
movzx esi, byte [rsp + 0x50]
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x78], 0
je 0x14000cbb0
cmp qword [rbp + 0x48], 0
je 0x14000cbb0
test eax, eax
js 0x14000cbb0
lea rcx, [rbp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
call fcn.140008ac0
mov rcx, rax
test rax, rax
je 0x14000d72b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov byte [rsp + 0x20], 1
lea r9, [rbp - 0x70]
lea r8, str.TotalPhysicalMemory
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000c397
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_Capacity
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
jmp 0x14000c4d5
mov rcx, qword [rbp - 0x70]
call fcn.1400ba880
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and edx, 0x3ff
lea rbx, [rdx + rax]
sar rbx, 0xa
mov rax, qword [r15]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
mov qword [r15], rax
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], ax
lea r8d, [rax + 6]
lea rdx, str.usable
lea rcx, [rbp + 0x80]
call fcn.140013240
nop
lea rax, [rbp + 0x80]
lea rcx, [r15 + 0x28]
cmp rbx, 0x400
jl 0x14000c467
cmp qword [rbp + 0x98], 8
cmovae rax, qword [rbp + 0x80]
xorps xmm3, xmm3
cvtsi2sd xmm3, rbx
mulsd xmm3, xmm6
xorps xmm2, xmm2
cvtsi2sd xmm2, qword [r15]
mulsd xmm2, xmm6
mov qword [rsp + 0x20], rax
movq r9, xmm3
movq r8, xmm2
lea rdx, str._.2f_GB___.2f_GB__s_
call fcn.140006ee0
jmp 0x14000c48f
cmp qword [rbp + 0x98], 8
cmovae rax, qword [rbp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [r15]
lea rdx, str._lld_MB___lld_MB__s_
call fcn.140006ee0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14000c4d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d6e8
call fcn.140095e90
call fcn.140008ac0
mov rcx, rax
test rax, rax
je 0x14000d720
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.OEMStringArray
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
test eax, eax
js 0x14000cae8
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x78], ebx
test ecx, ecx
je 0x14000c75c
xor r15d, r15d
mov ecx, r15d
mov qword [rbp - 0x38], rcx
mov rax, qword [rax + 0x10]
mov r13, qword [rcx + rax]
mov qword [rbp - 0x78], r15
lea rax, [rdi - 0x18]
mov qword [rsp + 0x60], rax
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14000c583
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov rcx, rax
test rax, rax
jne 0x14000c5a7
call fcn.140008ac0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140014436.0]
mov rcx, rax
test rax, rax
je 0x14000d6f9
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
or dword [rsp + 0x5c], 1
test r13, r13
jne 0x14000c5d0
mov r14d, r15d
jmp 0x14000c5dc
inc r14
cmp word [r13 + r14*2], 0
jne 0x14000c5d0
movsxd r15, dword [rdi - 0x10]
lea r12d, [r14 + r15]
test r12d, r12d
js 0x14000d6ee
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14000c60f
mov edx, r12d
lea rcx, [rbp - 0x78]
call fcn.140009970
mov rbx, qword [rbp - 0x78]
add r15, r15
je 0x14000c639
test rbx, rbx
jne 0x14000c62b
call fcn.1400b95a0
mov dword [rax], SafeArrayCopy
call fcn.1400b1700
jmp 0x14000c639
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.1400a5110
lea rcx, [r15 + rbx]
movsxd r8, r14d
add r8, r8
je 0x14000c670
test rcx, rcx
je 0x14000c660
test r13, r13
je 0x14000c659
mov rdx, r13
call fcn.1400a5110
jmp 0x14000c670
xor edx, edx
call fcn.1400a57c0
call fcn.1400b95a0
mov dword [rax], SafeArrayCopy
call fcn.1400b1700
cmp r12d, dword [rbx - 0xc]
jg 0x14000d6ee
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
xor r15d, r15d
mov word [rbx + rax*2], r15w
lea rdi, [rbx - 0x18]
mov r14, qword [rsp + 0x60]
cmp rdi, r14
je 0x14000c6f2
cmp dword [r14 + 0x10], r15d
jl 0x14000c6e1
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x14000c6e1
mov rcx, rdi
call fcn.140006b80
mov rbx, rax
mov ecx, 0xffffffff
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x14000c6d6
mov r8, qword [r14]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
mov rdx, r14
mov rcx, r8
call qword [case.0x140014436.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x14000c6f2
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000d9e0
and dword [rsp + 0x5c], 0xfffffffe
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14000c71e
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov edx, dword [rsp + 0x78]
inc edx
mov dword [rsp + 0x78], edx
mov rcx, qword [rbp - 0x38]
add rcx, 8
mov qword [rbp - 0x38], rcx
mov rdi, qword [rsp + 0x68]
cmp edx, dword [rsp + 0x54]
jae 0x14000c748
mov rax, qword [rbp + 0x68]
jmp 0x14000c550
mov r15, qword [rbp - 0x68]
mov r12d, dword [0x140138258]
mov r13, qword gs:[0x58]
lea r14, [rdi - 0x10]
mov eax, dword [r14]
test eax, eax
je 0x14000cadf
js 0x14000c880
lea rdx, str.FBYTE
mov rcx, rdi
call fcn.1400a40d0
test rax, rax
je 0x14000c880
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14000c880
lea r8d, [rax + 6]
mov r9d, dword [r14]
sub r9d, r8d
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x68]
call fcn.1400097b0
or dword [rsp + 0x5c], 2
lea rdx, [rbp - 0x60]
lea rcx, [r15 + 0x50]
call fcn.140005c50
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c7ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
lea rdx, [0x1400e9a44]
mov rcx, qword [r15 + 0x50]
call fcn.1400badbc
mov rbx, rax
test rax, rax
je 0x14000c859
mov rdx, qword [r15 + 0x50]
sub rbx, rdx
sar rbx, 1
cmp ebx, 0xffffffff
je 0x14000c859
test ebx, ebx
js 0x14000d704
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14000c839
mov edx, ebx
lea rcx, [r15 + 0x50]
call fcn.140009970
mov rdx, qword [r15 + 0x50]
cmp ebx, dword [rdx - 0xc]
jg 0x14000d704
mov dword [rdx - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [r15 + 0x50]
xor edx, edx
mov word [rax + rcx*2], dx
mov rdi, qword [rsp + 0x68]
jmp 0x14000c8b0
call fcn.140014190
mov rcx, rax
lea r9, str.Do_not_see_any_semicolon_delimiter_after_FBYTE.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rdi, qword [rsp + 0x68]
jmp 0x14000c8b0
call fcn.140014190
mov rcx, rax
lea r9, str.Do_not_see_FBYTE_tag.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
lea rdx, [0x1400e9a40]
lea rcx, [r15 + 0x50]
call fcn.140005cf0
mov rcx, r15
call fcn.14000a390
test al, al
jne 0x14000cadf
cmp dword [r14], 0
jl 0x14000caaf
lea rdx, str.BUILDID
mov rcx, rdi
call fcn.1400a40d0
test rax, rax
je 0x14000caaf
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x14000caaf
lea r8d, [rax + 8]
mov r9d, dword [r14]
sub r9d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x68]
call fcn.1400097b0
or dword [rsp + 0x5c], 4
lea rdx, [rbp - 0x58]
lea rcx, [r15 + 0x20]
call fcn.140005c50
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c948
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
lea rdx, [0x1400e9a44]
mov rcx, qword [r15 + 0x20]
call fcn.1400badbc
mov rbx, rax
test rax, rax
je 0x14000c9b2
mov rdx, qword [r15 + 0x20]
sub rbx, rdx
sar rbx, 1
cmp ebx, r14d
je 0x14000c9b2
test ebx, ebx
js 0x14000d70f
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14000c997
mov edx, ebx
lea rcx, [r15 + 0x20]
call fcn.140009970
mov rdx, qword [r15 + 0x20]
cmp ebx, dword [rdx - 0xc]
jg 0x14000d70f
mov dword [rdx - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [r15 + 0x20]
xor ebx, ebx
mov word [rax + rcx*2], bx
jmp 0x14000c9d4
call fcn.140014190
mov rcx, rax
lea r9, str.Do_not_see_any_semicolon_delimiter_after_BUILDID.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
xor ebx, ebx
mov rdx, qword [r15 + 0x20]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000ca00
lea rcx, [rbp + 0xa0]
call fcn.140013240
nop
mov ecx, 4
mov rax, qword [r13 + r12*8]
mov ecx, dword [rcx + rax]
cmp dword [0x140137480], ecx
jg 0x14000d643
xor r8d, r8d
lea rdx, [0x140137458]
lea rcx, [rbp + 0xa0]
call fcn.140003960
test al, al
jne 0x14000ca62
mov r8d, SafeArrayCopy
lea rdx, str.__Recovery_Media_Used_
lea rcx, [r15 + 0x20]
call fcn.140006a20
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x14000caa8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000caa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d71a
call fcn.140095e90
mov rdi, qword [rsp + 0x68]
jmp 0x14000cae8
call fcn.140014190
mov rcx, rax
lea r9, str.Do_not_see_BUILDID_tag.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
lea rdx, [0x1400e9a40]
lea rcx, [r15 + 0x20]
call fcn.140005cf0
mov r14, 0xffffffffffffffff
xor ebx, ebx
lea rcx, [rbp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000cb0c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x48], rbx
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cb2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cb53
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140014436.0]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000c2e0
xor r12d, r12d
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000cc0a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_Processor
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d5bf
jmp 0x14000cc0d
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000cb60
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
xor r12d, r12d
mov qword [rbp + 0x50], r12
jmp 0x14000cb63
mov rbx, r12
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x14000d55c
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000cc63
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000d5ca
jmp 0x14000cc66
mov rdi, r12
mov qword [rbp + 0x28], rdi
test rdi, rdi
je 0x14000d736
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14000cce1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000ccc1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000ccd3
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000cd1e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000ccff
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000cd11
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
js 0x14000b769
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000cd40
call fcn.140014190
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x14000b559
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x78], 0
je 0x14000cddd
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14000cddd
test eax, eax
js 0x14000cddd
lea r9, [r15 + 0x30]
mov byte [rsp + 0x20], 1
lea r8, str.Name
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000cdb4
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_ProcessorName
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000cdce
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x48], r12
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000cd40
jmp 0x14000ce2b
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000ce2b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000ce74
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.Select__from_Win32_ComputerSystemProduct
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d5d5
jmp 0x14000ce77
mov rbx, r12
mov qword [rbp + 0x30], rbx
test rbx, rbx
je 0x14000d55c
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000cecd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x1400e9368]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000d5e0
jmp 0x14000ced0
mov rdi, r12
mov qword [rbp + 0x38], rdi
test rdi, rdi
je 0x14000d741
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, qword [rbx]
mov rdx, qword [rdi]
mov rax, qword [rax + 0xa0]
call qword [case.0x140014436.0]
mov esi, eax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14000cf4b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000cf2b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000cf3d
call fcn.140095e90
mov qword [rdi + 8], r12
mov edx, SafeArrayCopy
mov rcx, rdi
call fcn.140095e90
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000cf88
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000cf69
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000cf7b
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test esi, esi
js 0x14000b769
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000cfb0
call fcn.140014190
lea r9, str.IEnumWbemClassObject__0x_08X
jmp 0x14000b559
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x48]
mov r8d, 1
mov edx, r14d
mov rax, qword [rax + 0x20]
call qword [case.0x140014436.0]
mov ebx, eax
cmp dword [rbp + 0x78], 0
je 0x14000d04d
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14000d04d
test eax, eax
js 0x14000d04d
lea r9, [r15 + 0x48]
mov byte [rsp + 0x20], 1
lea r8, str.IdentifyingNumber
mov rcx, r15
call fcn.140008670
test eax, eax
jns 0x14000d024
call fcn.140014190
mov rcx, rax
lea r9, str.Failed_to_get_IdentifyingNumber
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000d03e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x48], r12
mov rcx, qword [rbp + 0x50]
test rcx, rcx
jne 0x14000cfb0
jmp 0x14000d09b
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.IWbemClassObject__0x_08X__uReturn___d___hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000d09b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d0b5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
call fcn.140014190
mov rcx, rax
lea r9, str.Completed_reading_from_ROOTCIMV2
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
lea r9, str.Started_reading_from_ROOThpinstrumentedbios
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov ecx, SafeArrayCopy
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000d13e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOThpinstrumentedbios
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000d5eb
jmp 0x14000d141
mov rbx, r12
mov qword [rbp - 0x28], rbx
test rbx, rbx
je 0x14000d55c
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x140014436.0]
mov edi, eax
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x14000d1c3
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d1a4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000d1b6
call fcn.140095e90
mov qword [rbx + 8], r12
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.140095e90
test edi, edi
jns 0x14000d22d
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_connect_to_ROOThpinstrumentedbios.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000d205
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
call fcn.140014190
mov rcx, rax
lea r9, str.Reset_return_code_to_0.
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov esi, r12d
jmp 0x14000d491
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x14000d2c2
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r9, str.Could_not_set_proxy_blanket.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000d29f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d205
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
jmp 0x14000d205
mov rdx, qword [rbp + 0x40]
mov rcx, r15
call fcn.14000acc0
mov ebx, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r9, str.ReadFeatureByte_Return.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rsi, qword [rbp + 0x40]
call fcn.140014190
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, str.IWbemServices__0x_x
lea r8, str.RpcServer::WMIData::ReadBiosPasswordStatus
xor edx, edx
call fcn.14009cf00
mov rbx, r12
mov qword [rbp - 0x68], rbx
mov r14, r12
call fcn.140014190
cmp byte [rax + 0x64], 0
je 0x14000d37b
mov ecx, 0x28
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14000d371
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::WMIData::ReadBiosPasswordStatus
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x14000d374
mov rbx, r12
mov qword [rbp - 0x68], rbx
mov r14, rbx
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x58], 0
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, r15
call fcn.1400099d0
mov edi, eax
lea r8, [rsp + 0x58]
mov rdx, rsi
mov rcx, r15
call fcn.140009e20
mov esi, eax
movzx edx, byte [rsp + 0x58]
xor dl, byte [rsp + 0x50]
and dl, 0xf
xor dl, byte [rsp + 0x58]
movzx r8d, dl
lea rcx, [r15 + 0x58]
lea rdx, str.0x_X
call fcn.140006ee0
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
lea r9, str.Password_Return_Value__0x_x__SureAdmin_Return_Value__0x_x
lea r8, str.RpcServer::WMIData::ReadBiosPasswordStatus
mov edx, 1
call fcn.14009cf00
or esi, edi
test r14, r14
je 0x14000d411
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.ReadFeatureByte_Return.__hr:0x_08X_
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000d44f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d469
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
call fcn.140014190
mov rcx, rax
lea r9, str.Completed_reading_from_ROOThpinstrumentedbios
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 2
call fcn.14009cf00
mov rcx, r15
call fcn.140006f10
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x50]
test rdx, rdx
je 0x14000d4b6
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x50], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000d4cc
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x40], r12
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000d4e6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140014436.0]
mov qword [rbp + 0x58], r12
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::WMIData::ReadSysInfo
mov edx, 1
call fcn.14009cf00
nop
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x14000d525
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, esi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
lea rcx, [0x140137480]
call fcn.140096290
cmp dword [0x140137480], 0xffffffff
jne 0x14000ca31
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140137458], xmm0
movups xmmword [0x140137468], xmm0
mov qword [0x140137478], rax
mov qword [0x140137458], rbx
lea rax, [0x140137460]
mov qword [rsp + 0x60], rax
mov cl, 1
call fcn.140072ef0
mov qword [0x140137478], rax
lea rcx, [0x140137460]
call fcn.14000eed0
nop
mov byte [rsp + 0x20], sil
mov r9d, 1
lea r8, [0x1400e8856]
lea rdx, str.w10_1w41w4__
lea rcx, [0x140137458]
call fcn.140002bf0
nop
lea rcx, [0x1400e3ab0]
call fcn.1400960e0
nop
lea rcx, [0x140137480]
call fcn.140096230
jmp 0x14000ca31
call fcn.1400b1720
nop
mov ecx, 0x80070057
call fcn.140006b40
int3
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x80070057
call fcn.140006b40
int3
mov ecx, 0x80070057
call fcn.140006b40
int3
call fcn.1400b1720
nop
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x80004005
call fcn.140006b40
nop
mov ecx, 0x8007000e
call fcn.140095940
nop
mov ecx, 0x8007000e
call fcn.140095940
int3