Function at 0x1400046a0
Capabilities:
Reference sql statements

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov r13, rcx
xor r14d, r14d
mov esi, r14d
mov r12d, r14d
mov rdx, qword [rcx + 0x10]
cmp dword [rdx + 4], r14d
jbe 0x140004dac
mov eax, r12d
imul rcx, rax, 0x20c
add rcx, 0xc8c
add rcx, rdx
mov edx, 0x5c
call fcn.14001b7c4
mov r15, rax
test rax, rax
je 0x140004cba
add r15, 2
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004740
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM___InstanceCreationEvent_WITHIN_3_WHERE_TargetInstance_ISA_Win32_Process_AND_TargetInstance.Name__
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004cd0
jmp 0x140004743
mov rbx, r14
mov qword [rbp + 0x50], rbx
test rbx, rbx
je 0x140004da1
mov ecx, 0x18
call fcn.14001ae80
mov rdi, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14000478d
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x140004790
test r15, r15
jne 0x140004cdb
jmp 0x140004790
mov rdi, r14
mov qword [rbp + 0x60], rdi
test rdi, rdi
je 0x140004d96
mov ecx, 0x18
call fcn.14001ae80
mov qword [rbp + 0x48], rax
test rax, rax
je 0x1400047c5
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.140002a20
mov rsi, rax
jmp 0x1400047c8
mov rsi, r14
test rsi, rsi
je 0x140004d8b
lock dec dword [rbx + 0x10]
jne 0x140004802
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400047e8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400047fa
call fcn.140024264
mov qword [rbx + 8], r14
mov rcx, rbx
call fcn.14001ada0
mov qword [rbp + 0x50], rsi
lock dec dword [rdi + 0x10]
jne 0x140004837
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000481d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r14
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000482f
call fcn.140024264
mov qword [rdi + 8], r14
mov rcx, rdi
call fcn.14001ada0
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004873
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
lea rcx, [0x1400528b8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004ce6
jmp 0x140004876
mov rbx, r14
mov qword [rbp - 0x38], rbx
test rbx, rbx
je 0x140004d80
mov ecx, 0x18
call fcn.14001ae80
mov qword [rbp + 0x48], rax
test rax, rax
je 0x1400048a9
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.140002a20
mov r14, rax
test r14, r14
je 0x140004d75
lock dec dword [rsi + 0x10]
jne 0x1400048eb
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400048cd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400048e3
call fcn.140024264
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.14001ada0
mov qword [rbp + 0x50], r14
lock dec dword [rbx + 0x10]
jne 0x140004928
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000490a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004920
call fcn.140024264
mov qword [rbx + 8], 0
mov rcx, rbx
call fcn.14001ada0
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
xor edi, edi
test rax, rax
je 0x140004966
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400528c0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004cf1
jmp 0x140004969
mov rbx, rdi
mov qword [rbp - 0x18], rbx
test rbx, rbx
je 0x140004d6a
mov rcx, qword [r13 + 8]
mov r10, qword [rcx]
mov rax, qword [r13 + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, qword [r14]
mov rdx, qword [rbx]
call qword [r10 + VarDecFix]
mov esi, eax
lock dec dword [rbx + 0x10]
jne 0x1400049ce
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400049b4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400049c6
call fcn.140024264
mov qword [rbx + 8], rdi
mov rcx, rbx
call fcn.14001ada0
test esi, esi
js 0x140004c82
mov ecx, 0x18
call fcn.14001ae80
mov rdi, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004a16
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM___InstanceDeletionEvent_WITHIN_3_WHERE_TargetInstance_ISA_Win32_Process_AND_TargetInstance.Name__
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x140004cfc
jmp 0x140004a18
xor edi, edi
mov qword [rbp + 0x58], rdi
test rdi, rdi
je 0x140004d5f
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004a69
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140004a64
test r15, r15
jne 0x140004d07
xor r15d, r15d
jmp 0x140004a6f
xor r15d, r15d
mov ebx, r15d
mov qword [rbp - 0x30], rbx
test rbx, rbx
je 0x140004d54
mov ecx, 0x18
call fcn.14001ae80
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004aa4
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.140002a20
mov rsi, rax
jmp 0x140004aa7
mov rsi, r15
test rsi, rsi
je 0x140004d49
mov rcx, rdi
call fcn.140005110
mov qword [rbp + 0x58], rsi
lock dec dword [rbx + 0x10]
jne 0x140004aed
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004ad3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004ae5
call fcn.140024264
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.14001ada0
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004b29
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x1400528b8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004d12
jmp 0x140004b2c
mov rbx, r15
mov qword [rbp - 0x28], rbx
test rbx, rbx
je 0x140004d3e
mov ecx, 0x18
call fcn.14001ae80
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004b61
lea r8, [rbp - 0x28]
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.140002a20
mov rdi, rax
jmp 0x140004b64
mov rdi, r15
test rdi, rdi
je 0x140004d33
mov rcx, rsi
call fcn.140005110
mov qword [rbp + 0x58], rdi
lock dec dword [rbx + 0x10]
jne 0x140004baa
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004b90
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004ba2
call fcn.140024264
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.14001ada0
mov ecx, 0x18
call fcn.14001ae80
mov rbx, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140004be6
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x1400528c0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140004d1d
jmp 0x140004be9
mov rbx, r15
mov qword [rbp - 0x10], rbx
test rbx, rbx
je 0x140004d28
mov rcx, qword [r13 + 8]
mov r10, qword [rcx]
mov rax, qword [r13 + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [rdi]
mov rdx, qword [rbx]
call qword [r10 + VarDecFix]
mov esi, eax
lock dec dword [rbx + 0x10]
jne 0x140004c4f
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004c34
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004c46
call fcn.140024264
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.14001ada0
nop
lock dec dword [rdi + 0x10]
jne 0x140004c85
mov rcx, qword [rdi]
test rcx, rcx
je 0x140004c66
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140004c78
call fcn.140024264
mov qword [rdi + 8], r15
mov rcx, rdi
call fcn.14001ada0
jmp 0x140004c85
xor r15d, r15d
lock dec dword [r14 + 0x10]
jne 0x140004cb7
mov rcx, qword [r14]
test rcx, rcx
je 0x140004c9d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r15
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140004caf
call fcn.140024264
mov qword [r14 + 8], r15
mov rcx, r14
call fcn.14001ada0
xor r14d, r14d
inc r12d
mov rdx, qword [r13 + 0x10]
cmp r12d, dword [rdx + 4]
jae 0x140004dac
jmp 0x1400046d6
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
int3
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
nop
mov ecx, 0x8007000e
call fcn.14001aa10
int3
mov eax, esi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret