Function at 0x14004f7a0
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x320
mov rax, qword [0x140309918]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r14, rdx
xor edi, edi
cmp byte [rcx + 0x28], dil
jne 0x14004f7d4
xor al, al
jmp 0x14004fbc5
xor sil, sil
mov byte [rsp + 0x30], sil
lea r8, [rsp + 0x60]
lea rdx, str.SELECT__FROM_Win32_CDROMDrive
call fcn.1400517b0
test al, al
je 0x14004fbba
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
lea r8d, [rbx + 2]
mov edx, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x14004fbae
lea rcx, [rsp + 0xc0]
call fcn.1400277b0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea r9, [rsp + 0x48]
lea r8, str.Name
mov rdx, qword [rsp + 0x38]
call fcn.140051020
test al, al
je 0x14004f979
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140052740
nop
mov rax, qword [rax]
test rax, rax
je 0x14004f882
mov rdx, qword [rax]
jmp 0x14004f885
mov rdx, rdi
lea rcx, [rsp + 0x2d0]
call fcn.140009744
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14004f89f
mov rdx, qword [rax]
test rdx, rdx
jne 0x14004f8a8
mov eax, edi
jmp 0x14004f8ba
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004f8b0
mov r8d, eax
lea rcx, [rsp + 0xc8]
call fcn.140002aa8
mov rdx, qword [rsp + 0x2e8]
cmp rdx, 8
jb 0x14004f912
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f90d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fbe9
call fcn.14000410c
mov qword [rsp + 0x2e0], rdi
mov qword [rsp + 0x2e8], 7
mov word [rsp + 0x2d0], di
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14004f979
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14004f979
test rsi, rsi
je 0x14004f979
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004f95a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004f96c
call fcn.1400743a4
mov qword [rsi + 8], rdi
mov edx, 0x18
mov rcx, rsi
call fcn.14000410c
lea r9, [rsp + 0x48]
lea r8, str.PNPDeviceID
mov rdx, qword [rsp + 0x38]
call fcn.140051020
test al, al
je 0x14004fa0c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14004fbef
mov rdx, qword [rsp + 0x80]
test rdx, rdx
jne 0x14004f9e3
mov eax, edi
jmp 0x14004f9f0
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004f9e6
mov r8d, eax
lea rcx, [rsp + 0xd8]
call fcn.140002aa8
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x48]
lea r8, str.Drive
mov rdx, qword [rsp + 0x38]
call fcn.140051020
test al, al
je 0x14004faaf
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14004fbf7
mov rdx, qword [rsp + 0x98]
test rdx, rdx
jne 0x14004fa83
mov eax, edi
jmp 0x14004fa90
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004fa86
mov r8d, eax
lea rcx, [rsp + 0xe0]
call fcn.140002aa8
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x48]
lea r8, str.MediaType
mov rdx, qword [rsp + 0x38]
call fcn.140051020
test al, al
je 0x14004fb4d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xa8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14004fbff
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x14004fb2e
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14004fb22
mov edi, ebx
mov r8d, edi
lea rcx, [rsp + 0xd0]
call fcn.140002aa8
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
je 0x14004fb6e
lea rdx, [rsp + 0xc0]
mov rcx, rax
call fcn.140028340
add qword [r14 + 8], 0x28
jmp 0x14004fb81
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, r14
call fcn.1400522d0
mov sil, 1
mov byte [rsp + 0x30], sil
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0xc0]
call fcn.140027990
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x14004fbc1
movzx eax, sil
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1402113c0
mov rbx, qword [rsp + 0x350]
add rsp, 0x320
pop r14
pop rdi
pop rsi
ret
call fcn.14021a3fc
nop
mov ecx, eax
call fcn.140002d2c
nop
mov ecx, eax
call fcn.140002d2c
nop
mov ecx, eax
call fcn.140002d2c
int3