Function at 0x14005a870
Capabilities:
Reference wmi statements

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x370
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x3a0], rbx
mov rax, qword [0x14035c8c0]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r14, rdx
xor edi, edi
mov dword [rsp + 0x34], edi
cmp byte [rcx + 0x28], dil
jne 0x14005a8b8
xor al, al
jmp 0x14005ad4b
xor sil, sil
mov byte [rsp + 0x30], sil
lea r8, [rsp + 0x68]
lea rdx, str.SELECT__FROM_Win32_CDROMDrive
call fcn.14005c790
test al, al
je 0x14005ad40
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x48], edi
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
lea r8d, [rbx + 2]
mov edx, ebx
call qword [rax + 0x20]
mov dword [rsp + 0xe0], eax
test eax, eax
jne 0x14005ad34
lea rax, vtable.srl::Value.0
mov qword [rsp + 0x70], rax
lea rax, vtable.srl::Name.0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
call fcn.1400154a0
lea rcx, [rsp + 0x80]
call fcn.1400154a0
lea rcx, [rsp + 0x88]
call fcn.1400154a0
lea rcx, [rsp + 0x90]
call fcn.1400154a0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea r9, [rsp + 0x50]
lea r8, str.Name
mov rdx, qword [rsp + 0x38]
call fcn.14005c0a0
test al, al
je 0x14005aae7
mov qword [rsp + 0x40], rdi
cmp word [rsp + 0x50], 8
jne 0x14005a9aa
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.14005e140
jmp 0x14005aa06
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [rsp + 0xe8], eax
test eax, eax
js 0x14005ad6f
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x40]
call fcn.14005e140
nop
lea rcx, [rsp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14005aa15
mov rdx, qword [rax]
jmp 0x14005aa18
mov rdx, rdi
lea rcx, [rsp + 0x340]
call fcn.14000983c
mov rdx, rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0xf8], rax
cmp qword [rax + 0x18], 8
jb 0x14005aa4a
mov rdx, qword [rax]
mov qword [rsp + 0xf8], rdx
test rdx, rdx
jne 0x14005aa53
mov eax, edi
jmp 0x14005aa60
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x14005aa56
mov dword [rsp + 0x4c], eax
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x340]
call fcn.140009824
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005aae7
mov qword [rsp + 0x100], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
mov dword [rsp + 0xf0], eax
jne 0x14005aae2
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x14005aae2
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005aac3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14005aad5
call fcn.14008ae10
mov qword [rsi + 8], rdi
mov edx, 0x18
mov rcx, rsi
call fcn.140004518
mov qword [rsp + 0x40], rdi
lea r9, [rsp + 0x50]
lea r8, str.PNPDeviceID
mov rdx, qword [rsp + 0x38]
call fcn.14005c0a0
test al, al
je 0x14005ab8f
xor eax, eax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14005ad77
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
jne 0x14005ab63
mov eax, edi
jmp 0x14005ab70
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x14005ab66
mov r8d, eax
lea rcx, [rsp + 0x88]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x50]
lea r8, str.Drive
mov rdx, qword [rsp + 0x38]
call fcn.14005c0a0
test al, al
je 0x14005ac39
xor eax, eax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14005ad7f
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
jne 0x14005ac0b
mov eax, edi
jmp 0x14005ac1a
mov rax, rbx
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x14005ac10
mov r8d, eax
lea rcx, [rsp + 0x90]
call fcn.140002a7c
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x50]
lea r8, str.MediaType
mov rdx, qword [rsp + 0x38]
call fcn.14005c0a0
test al, al
je 0x14005acdc
xor eax, eax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14005ad87
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x14005acbd
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14005acb1
mov edi, ebx
mov r8d, edi
lea rcx, [rsp + 0x80]
call fcn.140002a7c
nop
lea rcx, [rsp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [r14 + 8]
cmp qword [r14 + 0x10], rax
je 0x14005acfa
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14002ca60
add qword [r14 + 8], 0x28
jmp 0x14005ad0a
lea r8, [rsp + 0x70]
mov rdx, rax
mov rcx, r14
call fcn.14005d830
mov sil, 1
mov byte [rsp + 0x30], sil
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x70]
call fcn.14002bc60
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x14005ad47
movzx eax, sil
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140229da0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x370
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.14022b140
nop
mov ecx, eax
call fcn.140002d3c
nop
mov ecx, eax
call fcn.140002d3c
nop
mov ecx, eax
call fcn.140002d3c
int3