Function at 0x140009360
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rbp + 0x100], r12
mov qword [rbp + 0xf8], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x1400093ff
lea rdx, str.Failed_to_initialize_COM__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000a641
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
jns 0x140009440
lea rdx, str.Failed_to_initialize_security__error_code__0x
jmp 0x14000a604
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [0x140017850]
xor edx, edx
mov r8d, 1
lea rcx, [0x140017860]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000a5fd
mov rax, qword [rbp + 0x100]
test rax, rax
je 0x14000a5fd
mov rax, qword [rax]
mov rsi, qword [rax + 0x18]
mov ecx, 0x18
call fcn.1400139f0
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400094d2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a678
jmp 0x1400094d5
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000a66d
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x100]
call rsi
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140009556
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009537
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009549
call fcn.140013d44
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140013d44
test esi, esi
js 0x14000a5ab
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14000a5ab
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x1400095fc
lea rdx, str.Could_not_set_proxy_blanket__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000a63b
mov qword [rbp + 0x110], r12
mov rax, qword [rbp + 0xf8]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
cmp qword [rdi + 0x18], 0xf
jbe 0x14000961e
mov rdi, qword [rdi]
mov ecx, 0x18
call fcn.1400139f0
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140009659
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.1400148b0
mov qword [rbx], rax
jmp 0x14000965c
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000a66d
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.1400139f0
mov rdi, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x1400096ab
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r12
mov dword [rdi + 0x10], 1
lea rcx, [0x140018140]
call fcn.1400148b0
mov qword [rdi], rax
jmp 0x1400096ae
mov rdi, r12
mov qword [rbp - 0x60], rdi
test rdi, rdi
je 0x14000a683
lea rax, [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0xf8]
call r14
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x140009724
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009704
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009716
call fcn.140013d44
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140013d44
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009763
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009744
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009756
call fcn.140013d44
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140013d44
test esi, esi
js 0x14000a581
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x14000a581
mov qword [rbp + 0x108], r12
mov dword [rbp + 0x130], r12d
lea r13, str.0123456789ABCDEF
mov rax, qword [rcx]
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x108]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x130], 0
je 0x14000a4ed
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x20]
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x1400097dc
mov rdi, qword [r15]
mov ecx, 0x18
call fcn.1400139f0
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140009816
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.1400148b0
mov qword [rbx], rax
jmp 0x140009819
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000a699
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x158]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x108]
call rsi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140009888
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009869
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000987b
call fcn.140013d44
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140013d44
test edi, edi
js 0x14000a492
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov rdi, r12
mov qword [rbp - 0x70], r12
mov esi, 0xf
mov qword [rbp - 0x68], rsi
mov byte [rbp - 0x80], dil
mov ebx, dword [rsp + 0x50]
or ebx, 1
mov dword [rsp + 0x50], ebx
mov r14d, 0xc
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400098d4
dec eax
or eax, 0xfffffff0
inc eax
movsxd rcx, eax
movzx r9d, byte [rcx + r13]
cmp rdi, rsi
jae 0x140009901
lea rax, [rdi + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x80]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x14000990a
lea rcx, [rbp - 0x80]
call fcn.140007dd0
sub r14, 1
je 0x14000991a
mov rsi, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x70]
jmp 0x1400098c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp], 0xf
or ebx, 2
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009940
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x18], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000995e
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x17], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000997c
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x16], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14000999a
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 8], 4
mov byte [rbp - 0x15], cl
mov byte [rbp - 0x14], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x20], 0xf
or ebx, 4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400099d6
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x38], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x1400099f4
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x37], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009a12
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x36], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009a30
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 0x28], 4
mov byte [rbp - 0x35], cl
mov byte [rbp - 0x34], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x40], 0xf
or ebx, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009a6c
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x58], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009a8a
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x57], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009aa8
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx eax, byte [rax + r13]
mov byte [rbp - 0x56], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009ac6
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx ecx, byte [rax + r13]
mov qword [rbp - 0x48], 4
mov byte [rbp - 0x55], cl
mov byte [rbp - 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
or ebx, 0x10
mov dword [rsp + 0x50], ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009b12
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009b4b
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009b55
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009b69
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009ba2
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009bac
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009bc0
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009bf9
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009c03
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009c17
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009c50
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009c5a
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009c6e
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009ca7
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009cb1
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009cc5
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009cfe
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009d08
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009d1c
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009d55
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009d5f
lea rcx, [rsp + 0x58]
call fcn.140007dd0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x140009d73
dec eax
or eax, 0xfffffff0
inc eax
cdqe
movzx r9d, byte [rax + r13]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140009dac
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009db6
lea rcx, [rsp + 0x58]
call fcn.140007dd0
mov r8d, 1
lea rdx, [0x14001816c]
lea rcx, [rsp + 0x58]
call fcn.140006ca0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
or ebx, 0x20
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x58]
lea r8, [rbp + 0xc8]
lea rcx, [rbp + 0x48]
call fcn.14000de80
or ebx, 0x40
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001816c]
lea rcx, [rbp + 0x48]
call fcn.140006ca0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts ebx, 7
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x38]
lea r8, [rbp + 0xa8]
lea rcx, [rbp + 0x28]
call fcn.14000de80
bts ebx, 8
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001816c]
lea rcx, [rbp + 0x28]
call fcn.140006ca0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r12
mov byte [rax], 0
bts ebx, 9
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x88]
lea rcx, [rbp + 8]
call fcn.14000de80
bts ebx, 0xa
mov dword [rsp + 0x50], ebx
mov r8d, 1
lea rdx, [0x14001816c]
lea rcx, [rbp + 8]
call fcn.140006ca0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts ebx, 0xb
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x68]
lea rcx, [rbp + 0x138]
call fcn.14000de80
bts ebx, 0xc
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140009f62
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a526
call fcn.140013d44
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140009f9d
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a52d
call fcn.140013d44
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140009fef
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a534
call fcn.140013d44
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14000a02a
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a025
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a53b
call fcn.140013d44
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14000a07c
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a076
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a542
call fcn.140013d44
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000a0b7
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a549
call fcn.140013d44
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14000a108
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a103
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a550
call fcn.140013d44
and ebx, 0xffffffef
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000a148
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a557
call fcn.140013d44
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000a199
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a194
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a55e
call fcn.140013d44
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14000a1d7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a565
call fcn.140013d44
and ebx, 0xfffffffd
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14000a215
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a210
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a56c
call fcn.140013d44
and ebx, 0xfffffffe
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000a257
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a252
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a573
call fcn.140013d44
mov eax, 8
mov word [rbp + 0x118], ax
lea rdi, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rdi, qword [rbp + 0x138]
mov ecx, 0x18
call fcn.1400139f0
mov rbx, rax
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14000a2b7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.1400148b0
mov qword [rbx], rax
jmp 0x14000a2ba
mov rbx, r12
test rbx, rbx
je 0x14000a68e
mov rax, qword [rbx]
mov qword [rbp + 0x120], rax
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000a30c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a2ed
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a2ff
call fcn.140013d44
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140013d44
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x28]
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000a327
mov rdi, qword [r15]
mov ecx, 0x18
call fcn.1400139f0
mov rbx, rax
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x14000a364
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call fcn.1400148b0
mov qword [rbx], rax
jmp 0x14000a367
mov rbx, r12
mov qword [rsp + 0x78], rbx
test rbx, rbx
je 0x14000a68e
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x118]
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x108]
call rsi
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000a3d1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a3b2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a3c4
call fcn.140013d44
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140013d44
test edi, edi
jns 0x14000a405
lea rdx, str.Failed_to_set_property_value__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
jmp 0x14000a431
lea rdx, str.Spoofed___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400071f0
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000a425
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rax
call fcn.1400085c0
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0xf
jbe 0x14000a4d0
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a48b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a57a
call fcn.140013d44
jmp 0x14000a4d0
lea rdx, str.Failed_to_get_property_value__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x108]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x110]
test rcx, rcx
jne 0x140009790
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x14000a519
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x14000a643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.WMI_query_failed__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
jmp 0x1400095c4
lea rdx, str.Could_not_connect_to_WMI_namespace_rootCIMv2__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x100]
test rcx, rcx
je 0x14000a63b
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000a63b
lea rdx, str.Failed_to_create_iwbemlocator_obj__error_code__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400071f0
lea rdx, [0x1400091e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x1400073d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400139d0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400148a0
nop
mov ecx, 0x8007000e
call fcn.1400148a0
nop
mov ecx, 0x8007000e
call fcn.1400148a0
nop
mov ecx, 0x8007000e
call fcn.1400148a0
nop
mov ecx, 0x8007000e
call fcn.1400148a0
int3