Function at 0x4c8700
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x4c8c9d
mov edi, ecx
mov ebx, dword [ebp + 8]
add ecx, 0x10
lea eax, [ebp - 0x20]
mov dword [eax], ebx
lea edx, [ebp - 0xd0]
lea esi, [ebp - 0xc4]
push edx
push eax
push 0x745e09
push ebx
push esi
call fcn.004c9090
mov esi, dword [esi]
cmp dword [esi + 0x1c], 0
je 0x4c876d
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x28]
je 0x4c87eb
mov dword [eax], ecx
add eax, 4
mov dword [esi + 0x24], eax
mov bl, 1
jmp 0x4c8c9f
mov dword [ebp - 0xd4], edi
lea eax, [esi + 0x1c]
mov dword [ebp - 0xdc], eax
push 0x759fce
push 0x1c
call fcn.005f2b00
add esp, 8
test eax, eax
mov dword [ebp - 0xe8], esi
je 0x4c8840
mov edi, eax
mov ebx, eax
mov dword [edi + 8], 1
mov dword [edi], 0x73efd0
mov esi, dword [0x7aee1c]
test esi, esi
je 0x4c87c2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
call dword [section..00cfg]
push esi
call ecx
mov dword [ebx], 0x73efb0
add edi, 0xc
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
js 0x4c88b3
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
movsd xmm0, qword [edx]
movsd qword [edi], xmm0
jmp 0x4c88bf
sub eax, dword [esi + 0x20]
mov edi, eax
sar edi, 2
lea ecx, [edi + 1]
cmp ecx, 0x40000000
jae 0x4c8d05
mov edx, eax
sar edx, 1
cmp edx, ecx
cmovbe edx, ecx
cmp eax, 0x7ffffffc
mov ebx, 0x3fffffff
cmovb ebx, edx
test ebx, ebx
mov dword [ebp - 0xe8], esi
je 0x4c884d
cmp ebx, 0x40000000
jae 0x4c8d0a
lea eax, [ebx*4]
push eax
call fcn.0064cd3e
add esp, 4
jmp 0x4c884f
xor ebx, ebx
mov edi, dword [ebp - 0xd4]
jmp 0x4c88f5
xor eax, eax
lea esi, [eax + edi*4]
lea edx, [eax + ebx*4]
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
lea edi, [eax + edi*4]
add edi, 4
mov ebx, dword [ebp - 0xe8]
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
sub ecx, eax
sub esi, ecx
test ecx, ecx
jle 0x4c8892
push ecx
push eax
push esi
mov dword [ebp - 0xd4], edi
mov edi, edx
call fcn.00650080
mov edx, edi
mov edi, dword [ebp - 0xd4]
add esp, 0xc
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edx
mov bl, 1
test eax, eax
je 0x4c8c9f
push eax
call fcn.0064cd6e
add esp, 4
jmp 0x4c8c9f
mov ecx, edi
push dword [edx + 4]
push dword [edx]
call fcn.005df860
mov edi, dword [ebp - 0xd4]
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x7b1224]
bt ecx, eax
jae 0x4c88e6
push edi
call fcn.005e5030
add esp, 4
jmp 0x4c88f2
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x7b9224], 1
mov dword [ebx + 0x18], edi
lea esi, [ebp - 0x14]
mov dword [esi], 0
mov edi, dword [edi + 8]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call dword [section..00cfg]
push esi
push ebx
push edi
call ecx
mov edi, dword [ebp - 0xdc]
mov esi, dword [edi]
test esi, esi
je 0x4c8931
mov dword [edi], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [section..00cfg]
push edi
push 0x71c530
mov dword [ebp - 0xec], ebx
push ebx
call ecx
push 0xf0
call fcn.0064cd3e
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x80000078
mov dword [ebp - 0x1c], 0x72
push 0xe4
push str.SELECT__FROM___InstanceCreationEvent_WITHIN_1_WHERE_TargetInstance_ISA_Win32_ProcessAND_TargetInstance.Name__
push eax
call fcn.00650080
add esp, 0xc
mov word [esi + 0xe4], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 0xb]
mov edx, ecx
test al, al
jns 0x4c8998
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
lea edi, [ebp - 0x20]
mov ecx, edi
push eax
push edx
call fcn.005df8c0
mov ecx, edi
push 0x745b2c
call fcn.0053be70
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov al, byte [edi + 0xb]
mov byte [ebp - 0xd5], al
mov esi, dword [edi]
push 0xc
call fcn.0064cd3e
add esp, 4
mov ebx, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 1
push 0x745b30
call fcn.0064cb90
mov dword [ebp - 0xf0], eax
mov dword [ebx], eax
test ebx, ebx
je 0x4c8cfb
cmp byte [ebp - 0xd5], 0
cmovs edi, esi
mov esi, dword [ebp - 0xe4]
mov eax, dword [esi]
mov ecx, dword [eax + 0x5c]
call dword [section..00cfg]
push dword [ebp - 0xe0]
push 0
push 0x80
push edi
push dword [ebp - 0xf0]
push esi
call ecx
mov edi, eax
lock dec dword [ebx + 8]
jne 0x4c8a79
mov eax, dword [ebx]
test eax, eax
je 0x4c8a59
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebx], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4c8a70
push eax
call fcn.0064cdac
add esp, 4
mov dword [ebx + 4], 0
push ebx
call fcn.0064cd6e
add esp, 4
test edi, edi
js 0x4c8ada
push 0xf0
call fcn.0064cd3e
add esp, 4
mov esi, eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xc8], 0x80000078
mov dword [ebp - 0xcc], 0x72
push 0xe4
push str.SELECT__FROM___InstanceDeletionEvent_WITHIN_1_WHERE_TargetInstance_ISA_Win32_ProcessAND_TargetInstance.Name__
push eax
call fcn.00650080
add esp, 0xc
mov word [esi + 0xe4], 0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x4c8b32
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov esi, dword [ebp - 0xd4]
jmp 0x4c8b3a
xor ebx, ebx
inc ebx
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x4c8c4a
lea esi, [ebp - 0xc4]
mov ecx, esi
push 2
push 0x121
push str.....operadesktopwindowsprocess_monitorprocess_monitor_impl.cc
call fcn.005417e0
lea eax, [ebp - 0xbc]
push 0x2f
push str.ExecNotificationQueryAsync_failed_with_error_
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, eax
push edi
call fcn.004a3040
mov ecx, esi
call fcn.00541c20
jmp 0x4c8c4a
mov esi, dword [ebp - 0xd4]
mov edx, ecx
mov edi, dword [ebp - 0xdc]
lea ebx, [ebp - 0xd0]
mov ecx, ebx
push eax
push edx
call fcn.005df8c0
mov ecx, ebx
push 0x745b2c
call fcn.0053be70
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xd4], eax
mov eax, dword [edi]
mov dword [ebp - 0xdc], eax
mov al, byte [ebx + 0xb]
mov byte [ebp - 0xe0], al
mov esi, dword [ebx]
push 0xc
call fcn.0064cd3e
add esp, 4
mov edi, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 1
push 0x745b30
call fcn.0064cb90
mov dword [ebp - 0xe4], eax
mov dword [edi], eax
test edi, edi
je 0x4c8cfb
cmp byte [ebp - 0xe0], 0
cmovs ebx, esi
mov esi, dword [ebp - 0xd4]
mov eax, dword [esi]
mov ecx, dword [eax + 0x5c]
call dword [section..00cfg]
push dword [ebp - 0xdc]
push 0
push 0x80
push ebx
push dword [ebp - 0xe4]
push esi
call ecx
mov esi, eax
lock dec dword [edi + 8]
jne 0x4c8c18
mov eax, dword [edi]
test eax, eax
je 0x4c8bf8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4c8c0f
push eax
call fcn.0064cdac
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.0064cd6e
add esp, 4
xor ebx, ebx
test esi, esi
jns 0x4c8c33
xor ebx, ebx
inc ebx
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x4c8cb8
cmp byte [ebp - 0xc5], 0
jns 0x4c8c4a
push dword [ebp - 0xd0]
call fcn.0064cd6e
add esp, 4
cmp byte [ebp - 0x15], 0
jns 0x4c8c5b
push dword [ebp - 0x20]
call fcn.0064cd6e
add esp, 4
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4c8c77
mov dword [ebp - 0x14], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov esi, dword [ebp - 0xec]
test esi, esi
je 0x4c8c8f
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
test ebx, ebx
mov esi, dword [ebp - 0xe8]
je 0x4c874f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edi, [ebp - 0xc4]
mov ecx, edi
push 2
push 0x12f
push str.....operadesktopwindowsprocess_monitorprocess_monitor_impl.cc
call fcn.005417e0
lea eax, [ebp - 0xbc]
push 0x2f
push str.ExecNotificationQueryAsync_failed_with_error_
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, eax
push esi
call fcn.004a3040
mov ecx, edi
call fcn.00541c20
jmp 0x4c8c33
push 0x8007000e
call fcn.0064cd20
call fcn.006626d0
call fcn.0067fe60
int3