Function at 0x1400c5470
Capabilities:
Parse pe header
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push r12
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
xor ebx, ebx
mov r12, r8
mov qword [rbp - 9], rbx
mov r14, rdx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], rbx
call fcn.1400c5320
mov rcx, rax
test rax, rax
jne 0x1400c54b9
lea eax, [rbx + 0x7e]
add rsp, 0xb8
pop r14
pop r12
pop rbx
pop rbp
ret
mov eax, 0x5a4d
mov qword [rsp + 0xa8], r13
cmp word [rcx], ax
jne 0x1400c5581
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1400c5581
cmp dword [rdx + rcx], 0x4550
jne 0x1400c5581
lea r8, [rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c5581
cmp dword [r8 + 4], ebx
je 0x1400c5581
lea r9, [rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DllGetClassObject
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1400c5581
lea r8, [rbp + 0x17]
lea rdx, [0x140187ac0]
lea rcx, [0x140187980]
call qword [case.0x140101f48.0]
mov r13d, eax
test eax, eax
js 0x1400c5578
mov rcx, qword [rbp + 0x17]
lea r9, [rbp - 9]
lea r8, [0x140187990]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp + 0x17]
mov r13d, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
test r13d, r13d
js 0x1400c597b
mov rcx, qword [rbp - 9]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
lea rdx, str.rootCIMV2
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rax, qword [rcx]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140101f48.0]
mov r13d, eax
test eax, eax
js 0x1400c597b
mov qword [rsp + 0xe8], rsi
lea rcx, str.SELECT_Namespace_Provider_User___PATH_FROM_Msft_Providers_WHERE_HostProcessIdentifier_
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa0], r15
call sym.ProcessHacker.exe_PhCountStringZ
mov rsi, rax
mov rcx, r14
add rsi, rsi
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword [0x140213b58]
mov rdi, rax
add rdi, rdi
lea rbx, [rdi + rsi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov qword [rbp + 0x1f], rax
mov r8, rsi
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
lea rdx, str.SELECT_Namespace_Provider_User___PATH_FROM_Msft_Providers_WHERE_HostProcessIdentifier_
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword ds:[r15 + 8]
mov r8, rdi
add rcx, rsi
mov rdx, r14
call fcn.140165120
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x19]
mov r8, qword [r15 + 8]
xor ebx, ebx
mov qword [rsp + 0x28], rdx
lea rdx, [0x1401c4c38]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
lea r9d, [rbx + 0x30]
mov rax, qword [rax + 0xa0]
call qword [case.0x140101f48.0]
lea esi, ds:[rbx - 1]
mov r13d, eax
test eax, eax
js 0x1400c5950
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp + 0x7f]
mov dword [rbp + 0x7f], ebx
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rdx
lea r8d, [rbx + 1]
mov edx, esi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140101f48.0]
test eax, eax
js 0x1400c5950
nop word [rax + rax]
cmp dword [rbp + 0x7f], 0
je 0x1400c594c
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
lea rdx, str.Namespace
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140101f48.0]
test eax, eax
js 0x1400c5722
mov rcx, qword ds:[rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov r15, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov r14, rbx
mov qword [rsp + 0x20], rbx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
lea rdx, str.Provider
call qword [case.0x140101f48.0]
nop
test eax, eax
js 0x1400c576a
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdi, rbx
mov qword [rsp + 0x20], rbx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
lea rdx, str.User
call qword [case.0x140101f48.0]
test eax, eax
js 0x1400c57b6
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, ds:[rbp - 1]
mov rdi, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
xor r8d, r8d
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea rdx, str.__PATH
call qword [case.0x140101f48.0]
test eax, eax
js 0x1400c57fb
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov rbx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r15, r15
je 0x1400c589f
test r14, r14
je 0x1400c589f
nop dword [rax]
test rdi, rdi
je 0x1400c589f
test rbx, rbx
je 0x1400c58bf
mov rcx, qword ds:[r12 + 8]
xor r8d, r8d
mov rdx, r15
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400c58a4
mov rcx, qword [r12]
xor r8d, r8d
mov rdx, r14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400c58a4
mov rcx, qword [r12 + 0x18]
xor r8d, r8d
mov rdx, rdi
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400c58a4
mov rdx, qword [rbp - 0x21]
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov rax, qword [rcx]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x20], r8
mov r8, qword [rbp + 0x67]
mov rax, qword [rax + 0xc0]
call qword [case.0x140101f48.0]
mov r13d, eax
jmp 0x1400c58a4
test rbx, rbx
je 0x1400c58ba
lea rcx, ds:[rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c58ba
call fcn.140106290
test rdi, rdi
je 0x1400c58d5
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c58d5
nop
call fcn.140106290
test r14, r14
je 0x1400c58ef
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c58ef
call fcn.140106290
nop
test r15, r15
je 0x1400c590a
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c590a
call fcn.140106290
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp + 0x7f]
xor ebx, ebx
mov qword [rsp + 0x20], rdx
mov dword [rbp + 0x7f], ebx
lea r9, [rbp - 0x21]
mov edx, esi
mov rax, qword [rcx]
lea r8d, [rbx + 1]
mov rax, qword [rax + 0x20]
call qword [case.0x140101f48.0]
test eax, eax
jns 0x1400c56d0
mov r15, qword [rbp + 0x1f]
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], esi
mov r15, qword [rsp + 0xa0]
cmp esi, 1
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xb0]
jne 0x1400c597b
call fcn.140106290
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400c5996
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400c59ac
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400c59c2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov eax, r13d
mov r13, qword [rsp + 0xa8]
add rsp, 0xb8
pop r14
pop r12
pop rbx
pop rbp
ret