Function at 0x1400124c0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor r14d, r14d
mov edi, edx
mov ebx, r14d
mov qword [rsp + 0x50], r14
cmp qword [0x1400ed058], rbx
mov r8, rcx
jne 0x14001252a
mov eax, 0x80004005
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14006a480
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3b0
pop r14
pop rdi
pop rbp
ret
movzx ecx, byte [rcx]
test cl, cl
je 0x140012576
lea rax, [rsp + 0x70]
cmp cl, 0x5c
jne 0x140012542
inc ebx
mov byte [rax], cl
inc rax
mov byte [rax], cl
inc ebx
inc rax
inc r8
cmp ebx, 0xca
jae 0x14001255e
movzx ecx, byte [r8]
test cl, cl
jne 0x140012536
jmp 0x140012576
lea rdx, str.WMIWin32_Wake
mov ebx, 0xca
lea rcx, str._s:_Maximum_length_of_escaped_instance_id_reached._n
call fcn.14001dba0
movsxd rax, ebx
cmp rax, 0xcb
jae 0x1400127dd
mov byte [rsp + rax + 0x70], r14b
lea rcx, [rbp + 0x40]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, str.SELECT__FROM_MSPower_DeviceEnable_WHERE_InstanceName_LIKE___S___
mov edx, 0x25a
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.14000fcf0
test eax, eax
jne 0x140012507
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x3d0], rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [0x1400ed058]
xor r9d, r9d
mov rsi, rax
mov r8, rsi
mov rdx, qword [rcx]
mov rax, qword [rdx + 0xa0]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
mov rdx, qword [0x1400ed060]
mov qword [rsp + 0x20], r14
call qword [case.0x140007e54.0]
mov ebx, eax
test eax, eax
jne 0x1400127ae
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400127c5
mov qword [rsp + 0x40], r14
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], r14d
lea r9, [rsp + 0x40]
mov rax, qword [rcx]
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rdx
lea edx, [rbx - 1]
mov rax, qword [rax + 0x20]
call qword [case.0x140007e54.0]
mov ebx, eax
test eax, eax
jne 0x1400127ae
nop dword [rax + rax]
test edi, edi
je 0x1400126c1
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140012728
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], r14
lea rdx, str.Enable
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140007e54.0]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x1400127a1
mov eax, r14d
lea rdx, str.Enable
cmp edi, 2
sete al
mov word [rsp + 0x60], ax
jmp 0x140012708
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], r14
lea rdx, [0x140083408]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140007e54.0]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x1400127a1
mov word [rsp + 0x60], r14w
lea rdx, [0x140083408]
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov rax, qword [rax + 0x28]
call qword [case.0x140007e54.0]
mov ebx, eax
test eax, eax
jne 0x14001279c
mov rcx, qword [0x1400ed058]
xor r9d, r9d
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
lea r8d, [r9 + 1]
mov rax, qword [rax + 0x70]
call qword [case.0x140007e54.0]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
jne 0x1400127a8
call qword [case.0x140007e54.0]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x40]
mov edx, 0xffffffff
mov rax, qword [rcx]
lea r8d, [rdx + 2]
mov rax, qword [rax + 0x20]
call qword [case.0x140007e54.0]
test eax, eax
je 0x140012660
mov ebx, r14d
jmp 0x1400127ae
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140007e54.0]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400127c5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140007e54.0]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x3d0]
mov eax, ebx
jmp 0x140012507
call fcn.14006a624
int3