Function at 0x140052e40
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14031a940]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov r14, rdx
xor edi, edi
cmp byte [rcx + 0x28], dil
jne 0x140052e74
xor al, al
jmp 0x140053296
xor sil, sil
mov byte [rsp + 0x30], sil
lea r8, [rsp + 0x48]
lea rdx, str.SELECT__FROM_Win32_CDROMDrive
call fcn.1400550d0
test al, al
je 0x14005328b
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
lea r8d, [rbx + 2]
mov edx, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x14005327f
lea rcx, [rsp + 0x200]
call fcn.140029640
nop
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea r9, [rsp + 0x1e0]
lea r8, str.Name
mov rdx, qword [rsp + 0x38]
call fcn.140054810
test al, al
je 0x140053019
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x58]
call fcn.140056830
nop
mov rax, qword [rax]
test rax, rax
je 0x140052f2b
mov rdx, qword [rax]
jmp 0x140052f2e
mov rdx, rdi
lea rcx, [rsp + 0x248]
call fcn.1400095cc
cmp qword [rax + 0x18], 8
jb 0x140052f45
mov rax, qword [rax]
test rax, rax
jne 0x140052f4f
mov r8d, edi
jmp 0x140052f5d
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140052f52
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.140002b2c
mov rdx, qword [rsp + 0x260]
cmp rdx, 8
jb 0x140052fb5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052fb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400532ba
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x258], xmm0
mov word [rsp + 0x248], di
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x140053019
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140053019
test rsi, rsi
je 0x140053019
mov rcx, qword [rsi]
test rcx, rcx
je 0x140052ffa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], rdi
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14005300c
call fcn.1400041d4
mov qword [rsi + 8], rdi
mov edx, 0x18
mov rcx, rsi
call fcn.1400041d4
lea r9, [rsp + 0x1e0]
lea r8, str.PNPDeviceID
mov rdx, qword [rsp + 0x38]
call fcn.140054810
test al, al
je 0x1400530c7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400532c0
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
jne 0x140053097
mov r8d, edi
jmp 0x1400530ab
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400530a0
lea rcx, [rsp + 0x218]
call fcn.140002b2c
nop
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x1e0]
lea r8, str.Drive
mov rdx, qword [rsp + 0x38]
call fcn.140054810
test al, al
je 0x140053177
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400532c8
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
jne 0x140053145
mov r8d, edi
jmp 0x14005315b
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140053150
lea rcx, [rsp + 0x220]
call fcn.140002b2c
nop
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x1e0]
lea r8, str.MediaType
mov rdx, qword [rsp + 0x38]
call fcn.140054810
test al, al
je 0x14005321b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x1400532d0
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
je 0x1400531fc
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400531f0
mov edi, ebx
mov r8d, edi
lea rcx, [rsp + 0x210]
call fcn.140002b2c
nop
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
je 0x14005323c
lea rdx, [rsp + 0x200]
mov rcx, rax
call fcn.14002a1d0
add qword [r14 + 8], 0x28
jmp 0x14005324f
lea r8, [rsp + 0x200]
mov rdx, rax
mov rcx, r14
call fcn.140056400
mov sil, 1
mov byte [rsp + 0x30], sil
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x200]
call fcn.140029820
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
jmp 0x140053292
movzx eax, sil
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.140220e50
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
call fcn.14022a144
nop
mov ecx, eax
call fcn.140002dfc
nop
mov ecx, eax
call fcn.140002dfc
nop
mov ecx, eax
call fcn.140002dfc
int3