Function at 0x140043ac0
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r14d, r14d
test cl, cl
jne 0x14000995e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Device_Scanner__Retrieving_mices_VID_and_PID..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400089c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140009987
lfence
mov edx, eax
lea rcx, str.COM_Initialization
call fcn.140009720
jmp 0x1400099e5
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140009a12
cmp eax, 0x80010119
je 0x140009a12
lfence
mov edx, eax
lea rcx, str.COM_Security_Initialization
call fcn.140009720
nop dword [rax]
call fcn.1400096c0
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400486f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rax, [0x14006cfa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400503d0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400503e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140009a4a
lfence
mov edx, eax
lea rcx, str.WbemLocator_Creation
jmp 0x1400099d7
mov rax, qword [0x14006cfa0]
mov rcx, qword ds:[rax]
mov rdi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.140048718
mov rbx, rax
mov qword [rbp - 0x51], rax
test rax, rax
je 0x140009a97
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a14b
jmp 0x140009a9a
mov rbx, r14
mov qword ds:[rbp - 0x49], rbx
test rbx, rbx
je 0x14000a156
lea rax, [0x14006cf90]
mov qword ss:[rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x14006cfa0]
mov rax, rdi
call qword [0x14004fd60]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140009b28
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009b09
nop
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009b1b
call fcn.140048710
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140048710
test edi, edi
jns 0x140009b3d
lfence
mov edx, edi
lea rcx, str.WMI_Connection
jmp 0x1400099d7
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [0x14006cf90]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140009b85
lfence
mov edx, eax
lea rcx, str.Proxy_Blanket_Configuration
jmp 0x1400099d7
mov qword ds:[rbp - 0x61], r14
mov rax, qword [0x14006cf90]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.140048718
mov rbx, rax
mov qword [rbp - 0x49], rax
test rax, rax
je 0x140009bcd
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_PnPEntity_WHERE_Caption_LIKE__Mouse_
call fcn.1400484b0
mov qword [rbx], rax
jmp 0x140009bd0
mov rbx, r14
mov qword [rbp - 0x51], rbx
test rbx, rbx
je 0x14000a156
mov rdi, qword [rbx]
mov ecx, 0x18
call fcn.140048718
mov rbx, rax
mov qword [rbp - 0x49], rax
test rax, rax
je 0x140009c12
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x1400513c8]
call fcn.1400484b0
mov qword [rbx], rax
jmp 0x140009c15
mov rbx, r14
mov qword ds:[rbp - 0x41], rbx
test rbx, rbx
je 0x14000a166
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 0x30
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [0x14006cf90]
mov rax, rsi
call qword [0x14004fd60]
mov ebx, eax
lea rcx, [rbp - 0x41]
call fcn.140007500
nop
lea rcx, [rbp - 0x51]
call fcn.140007500
test ebx, ebx
js 0x1400099e5
mov qword ds:[rbp - 0x59], r14
mov dword [rbp - 0x69], r14d
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14000a0fe
lea r12, str.VID_
lea r15, str.PID_
nop word [rax + rax]
mov rax, qword ds:[rcx]
lea rdx, [rbp - 0x69]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x59]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
mov rax, qword [rax + 0x20]
call qword [0x14004fd60]
cmp dword [rbp - 0x69], 0
je 0x14000a0fa
lea rcx, [rbp - 0x39]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword ds:[rbp - 0x59]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x39]
xor r8d, r8d
lea rdx, str.DeviceID
mov rax, qword [rax + 0x20]
call qword [0x14004fd60]
test eax, eax
js 0x14000a0c5
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r14
mov rdx, qword [rbp - 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140009d30
lea rcx, ds:[rbp - 0x21]
call fcn.140006d20
nop
lea r9, [rbp - 0x21]
cmp qword [rbp - 9], 8
setae sil
mov rbx, qword [rbp - 0x21]
cmovae r9, rbx
mov r11, qword [rbp - 0x11]
cmp r11, 4
jb 0x140009de2
lea r10, [r11 - 3]
lea r10, [r9 + r10*2]
mov rdi, r9
nop word [rax + rax]
mov rax, r10
sub rax, rdi
sar rax, 1
mov rcx, r14
je 0x140009daa
cmp word [rdi], 0x56
je 0x140009da7
cmp rax, 1
je 0x140009daa
dec rax
add rdi, 2
cmp word [rdi], 0x56
jne 0x140009d94
mov rcx, rdi
mov rdi, rcx
test rcx, rcx
je 0x140009de2
mov edx, 4
mov rcx, r12
mov r8, rdi
sub r8, r12
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140009ddc
add rcx, 2
sub rdx, 1
jne 0x140009dc0
sub rdi, r9
sar rdi, 1
jmp 0x140009de9
add rdi, 2
jmp 0x140009d80
mov rdi, 0xffffffffffffffff
lea r9, [rbp - 0x21]
test sil, sil
cmovne r9, rbx
cmp r11, 4
jb 0x140009e75
lea r10, [r11 - 3]
lea r10, [r9 + r10*2]
mov rbx, r9
nop word [rax + rax]
mov rax, r10
sub rax, rbx
sar rax, 1
mov rcx, r14
je 0x140009e3a
cmp word [rbx], 0x50
je 0x140009e37
cmp rax, 1
je 0x140009e3a
dec rax
add rbx, 2
cmp word [rbx], 0x50
jne 0x140009e24
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140009e75
mov edx, 4
mov rcx, r15
mov r8, rbx
sub r8, r15
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140009e6f
add rcx, 2
sub rdx, 1
jne 0x140009e53
sub rbx, r9
sar rbx, 1
jmp 0x140009e7c
add rbx, 2
jmp 0x140009e10
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp rdi, 0xffffffffffffffff
je 0x14000a073
cmp rbx, 0xffffffffffffffff
je 0x14000a073
lea rdx, str.___VID_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
mov rsi, rax
add rdi, 4
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
cmp qword [rbp - 0x11], rdi
jb 0x14000a145
lfence
mov rcx, qword [rbp - 0x11]
sub rcx, rdi
mov r8d, 4
cmp rcx, r8
cmovb r8, rcx
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
lea rdx, [rax + rdi*2]
lea rcx, [rbp - 1]
call fcn.140006d20
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rsi
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140009f6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a0e5
call fcn.140048710
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r14w
lea rdx, str.___PID_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
mov rdi, rax
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], r14
cmp qword [rbp - 0x11], rbx
jb 0x14000a171
lfence
mov rcx, qword [rbp - 0x11]
sub rcx, rbx
mov r8d, 4
cmp rcx, r8
cmovb r8, rcx
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
lea rdx, [rax + rbx*2]
lea rcx, [rbp + 0x1f]
call fcn.140006d20
nop
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 0x2f]
mov rcx, rdi
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x14000a05c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a057
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a0ec
call fcn.140048710
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], 7
mov word [rbp + 0x1f], r14w
inc dword [0x14006cf98]
lea rcx, [rbp - 0x39]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14000a0c5
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a0f3
nop
call fcn.140048710
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14004fd60]
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14000a0fe
nop
jmp 0x140009ca0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rbp - 0x61]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14004fd60]
cmp dword [0x14006cf98], 2
jl 0x1400099dc
lea rdx, str.____Check_in_the_Windows_configuation___Bluetooth__Devices_if_more_than_two_mices_are_plugged._If_so__ban_the_user.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400089c0
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop dword [rax + rax]
jmp 0x1400099dc
call fcn.1400089a0
nop
mov ecx, 0x8007000e
call fcn.1400484a0
nop
mov ecx, 0x8007000e
call fcn.1400484a0
nop
mov ecx, 0x8007000e
call fcn.1400484a0
nop
call fcn.1400089a0
int3
movzx ecx, dl
jmp 0x1400098e0