Function at 0x14001c3c0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3e0
mov rax, qword [0x14009b010]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r12, r8
mov qword [rsp + 0xa0], rdx
mov r14, rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x168], r8
xor esi, esi
mov dword [rsp + 0x60], esi
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x2e0]
call fcn.14004a420
lea rcx, [rsp + 0x2e0]
call fcn.140021c80
nop
lea rdx, str.SELECT__FROM_Win32_SystemDriver_WHERE_Name_
lea rcx, [rsp + 0x2e0]
call fcn.1400275a0
mov r13, rax
mov rbx, qword [r12 + 0x10]
mov rdi, r12
cmp qword [r12 + 0x18], 8
jb 0x14001c457
mov rdi, qword [r12]
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x1f0]
call fcn.14004a420
lea rcx, [rsp + 0x1f0]
call fcn.140021c80
nop
lea rcx, [rsp + 0x1f0]
call fcn.140027e50
lea r15, [rdi + rbx*2]
cmp rdi, r15
je 0x14001c4d3
movzx ebx, word [rdi]
cmp bx, 0x22
je 0x14001c4af
cmp bx, 0x27
je 0x14001c4af
cmp bx, 0x5c
je 0x14001c4af
lea rax, [rsp + 0x1f0]
jmp 0x14001c4bf
movzx edx, bx
lea rcx, [rsp + 0x1f0]
call fcn.1400278a0
movzx edx, bx
mov rcx, rax
call fcn.1400278a0
add rdi, 2
cmp rdi, r15
jne 0x14001c490
lea rcx, [rsp + 0x1f0]
call fcn.140027e50
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x1f8]
call fcn.140024de0
mov dword [rsp + 0x60], 6
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x1f8]
call fcn.140021970
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ec], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x278], rax
lea rcx, [rsp + 0x278]
call fcn.140046c2c
nop
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
mov rcx, r13
call fcn.14002eff0
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x14001c5ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c5fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cd92
call fcn.1400452ac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2e8]
call fcn.140024de0
nop
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
mov qword [rsp + 0xe0], rcx
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001c656
mov qword [rsp + 0xe8], rax
lea rax, [0x140089f70]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 3
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x100], xmm0
movaps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x110], xmm1
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0xa0]
call fcn.140038900
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x14001c713
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c70e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cd98
call fcn.1400452ac
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], si
cmp byte [rsp + 0x1c0], 0
je 0x14001ccce
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x60], 0x2c
mov rbx, qword [rsp + 0x1b8]
mov rax, qword [rbx]
mov r15, qword [rax + 0x20]
cmp word [rsp + 0x68], 0
je 0x14001c781
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.PathName
mov rcx, rbx
mov rax, r15
call qword [0x140077500]
mov edx, eax
test eax, eax
js 0x14001cd9e
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x68]
call fcn.140038360
nop
cmp word [rsp + 0x68], 0
je 0x14001c7d6
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], 8
setae r9b
mov r8, qword [rsp + 0x170]
cmovae rdx, r8
mov rbx, qword [rsp + 0x180]
test rbx, rbx
je 0x14001c8ad
lea rcx, [rbx - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14001c833
cmp rcx, rdx
je 0x14001c8ad
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14001c820
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14001c8ad
inc rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rbx, rcx
jb 0x14001cdd2
lfence
mov rax, qword [rsp + 0x180]
sub rax, rcx
cmp rax, 0xffffffffffffffff
cmovb rdi, rax
lea rax, [rsp + 0x170]
test r9b, r9b
cmovne rax, qword [rsp + 0x170]
lea rdx, [rax + rcx*2]
mov r8, rdi
lea rcx, [rsp + 0x40]
call fcn.140005330
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x14001c929
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r15, [rsp + 0x170]
test r9b, r9b
cmovne r15, r8
cmp rbx, 8
jae 0x14001c8e1
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
mov edi, 7
jmp 0x14001c91f
mov rdi, rbx
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140005780
mov qword [rsp + 0x40], rax
lea r8, [rbx*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.14004a640
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp rdi, 8
jb 0x14001c93f
mov rdx, qword [rsp + 0x40]
lea r8, [rdx + rbx*2]
jmp 0x14001c948
lea r8, [rax + rbx*2]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1c8]
call fcn.14002f2d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001c998
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cdd8
call fcn.1400452ac
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], SafeArrayGetLBound
mov byte [rsp + 0x190], 0
mov r8d, 7
lea rdx, str.unknown
lea rcx, [rsp + 0x190]
call fcn.140005460
nop
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x120]
call fcn.14001be30
mov rbx, rax
lea rax, [rsp + 0x190]
cmp rax, rbx
je 0x14001ca80
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x14001ca52
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cdde
call fcn.1400452ac
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x190], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x1a0], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], SafeArrayGetLBound
mov byte [rbx], 0
nop dword [rax + rax]
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x14001cac4
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cabe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cdde
call fcn.1400452ac
nop
jmp 0x14001cad8
lea rbx, vtable.std::ios_base.0
lea r15, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdi, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rdx, [rsp + 0x190]
mov rcx, r14
call fcn.140004f60
nop
lea rcx, [r14 + 0x20]
lea rdx, [rsp + 0x1c8]
call fcn.140004f60
nop
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x14001cb54
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cde4
call fcn.1400452ac
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x14001cb97
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cdea
call fcn.1400452ac
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1e0], SafeArrayGetLBound
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 8
jb 0x14001cbfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cbf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cdf0
call fcn.1400452ac
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], si
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x14001cc32
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140077500]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x14001cc4d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140077500]
nop
mov rax, qword [rsp + 0x2e0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x2e0], rdi
mov rax, qword [rsp + 0x2e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2dc], edx
lea rcx, [rsp + 0x2e8]
call fcn.140021970
mov rax, qword [rsp + 0x2e0]
movsxd rdx, dword [rax + 4]
mov qword [rsp + rdx + 0x2e0], r15
mov rdx, qword [rsp + 0x2e0]
movsxd r8, dword [rdx + 4]
lea r9d, [r8 - 0x10]
mov dword [rsp + r8 + 0x2dc], r9d
mov qword [rsp + 0x368], rbx
lea rcx, [rsp + 0x368]
call fcn.140046c2c
nop
jmp 0x14001cd64
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], SafeArrayGetLBound
mov byte [r14], 0
mov r8d, 7
lea rdx, str.unknown
mov rcx, r14
call fcn.140005460
nop
lea rcx, [r14 + 0x20]
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], SafeArrayGetLBound
mov byte [rcx], 0
mov r8d, 7
lea rdx, str.unknown
call fcn.140005460
nop
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x14001cd3b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140077500]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x14001cd56
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140077500]
nop
lea rcx, [rsp + 0x2e0]
call fcn.14001bac0
nop
mov rcx, r12
call fcn.1400024b0
mov rax, r14
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140045000
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14004eb2c
nop
call fcn.14004eb2c
nop
lfence
call fcn.1400170a0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rsp + 0x140]
call fcn.140016e20
lea rdx, [0x1400990b0]
lea rcx, [rsp + 0x140]
call fcn.14004a344
nop
call fcn.140005760
nop
call fcn.14004eb2c
nop
call fcn.14004eb2c
nop
call fcn.14004eb2c
nop
call fcn.14004eb2c
nop
call fcn.14004eb2c
int3