Function at 0x14004b420
Capabilities:
Connect to wmi namespace via wbemlocator
Reference sql statements
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
test cl, cl
jne 0x1400094de
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r15 + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Device_Scanner__Retrieving_mices_VID_and_PID..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r15 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14000950a
lfence
mov edx, eax
lea rcx, str.COM_Initialization
call fcn.1400092a0
jmp 0x14000970b
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140009557
cmp eax, 0x80010119
je 0x140009557
lea rcx, str.COM_Security_Initialization
jmp 0x1400096b7
lea rax, [0x14007d230]
mov qword [rsp + 0x20], rax
lea r9, [0x140058550]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140058560]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax]
test eax, eax
jns 0x140009590
lea rcx, str.WbemLocator_Creation
jmp 0x1400096b7
mov rax, qword [0x14007d230]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov ecx, 0x18
call fcn.140050f68
mov rbx, rax
mov qword [rbp - 0x41], rax
test rax, rax
je 0x1400095da
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140009c71
jmp 0x1400095dd
mov rbx, r15
mov qword [rbp - 0x41], rbx
test rbx, rbx
je 0x140009c7c
lea rax, [0x14007d220]
mov qword ss:[rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x14007d230]
mov rax, rdi
call qword [0x140057e20]
mov edi, eax
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140009668
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009649
nop
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000965b
call fcn.140050f60
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.140050f60
test edi, edi
jns 0x140009677
mov edx, edi
lea rcx, str.WMI_Connection
jmp 0x1400096b9
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [0x14007d220]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140009734
lea rcx, str.Proxy_Blanket_Configuration
mov edx, eax
lfence
call fcn.1400092a0
mov rcx, qword [0x14007d220]
test rcx, rcx
je 0x1400096e5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140057e20]
mov qword [0x14007d220], r15
mov rcx, qword [0x14007d230]
test rcx, rcx
je 0x140009705
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140057e20]
mov qword [0x14007d230], r15
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140050f40
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rbp - 0x31], r15
mov rax, qword [0x14007d220]
mov rcx, qword [rax]
mov r14, qword [rcx + 0xa0]
mov ecx, 0x18
call fcn.140050f68
mov rbx, rax
mov qword [rbp - 0x39], rax
test rax, rax
je 0x14000977b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_PnPEntity_WHERE_Caption_LIKE__Mouse_
call fcn.140050d00
mov qword [rbx], rax
jmp 0x14000977e
mov rbx, r15
mov qword [rbp - 0x11], rbx
test rbx, rbx
je 0x140009c7c
mov rsi, qword [rbx]
mov ecx, 0x18
call fcn.140050f68
mov rdi, rax
mov qword [rbp - 0x39], rax
test rax, rax
je 0x1400097c2
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x140058a78]
call fcn.140050d00
mov qword ds:[rdi], rax
jmp 0x1400097c5
mov rdi, r15
mov qword [rbp - 9], rdi
test rdi, rdi
je 0x140009c87
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x30
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, qword [0x14007d220]
mov rax, r14
call qword [0x140057e20]
mov esi, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14000983e
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000981e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r15
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009830
call fcn.140050f60
mov qword [rdi + 8], r15
mov edx, 0x18
mov rcx, rdi
call fcn.140050f60
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000987d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000985e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009870
call fcn.140050f60
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.140050f60
nop dword [rax]
test esi, esi
js 0x14000970b
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x49], r15d
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140009c24
nop dword [rax]
mov rax, qword ds:[rcx]
lea rdx, [rbp - 0x49]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x41]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
mov rax, qword [rax + 0x20]
call qword [0x140057e20]
cmp dword [rbp - 0x49], 0
je 0x140009c20
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword ds:[rbp - 0x41]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.DeviceID
mov rax, qword [rax + 0x20]
call qword [0x140057e20]
test eax, eax
js 0x140009be5
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x37], r15
mov rdx, qword [rbp - 0x21]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140009930
lea rcx, ds:[rbp + 0x1f]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rcx, qword [rbp + 0x1f]
mov qword [rsp + 0x20], 4
lea r9, str.VID_
xor r8d, r8d
mov rdx, qword [rbp + 0x2f]
call fcn.1400087c0
mov rdi, rax
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rcx, qword [rbp + 0x1f]
mov qword [rsp + 0x20], 4
lea r9, str.PID_
xor r8d, r8d
mov rdx, qword [rbp + 0x2f]
call fcn.1400087c0
mov rbx, rax
cmp rdi, 0xffffffffffffffff
je 0x140009b93
cmp rax, 0xffffffffffffffff
je 0x140009b93
lea rdx, str.___VID_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
mov rsi, rax
lea rdx, [rdi + 4]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
cmp qword [rbp + 0x2f], rdx
jb 0x140009c6b
lfence
mov rcx, qword [rbp + 0x2f]
sub rcx, rdx
mov r8d, 4
cmp rcx, r8
cmovb r8, rcx
lea rax, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rax, qword [rbp + 0x1f]
lea rdx, [rax + rdx*2]
lea rcx, [rbp - 1]
call fcn.1400066a0
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rsi
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140009a8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c0b
call fcn.140050f60
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea rdx, str.___PID_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
mov rdi, rax
lea rdx, [rbx + 4]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
cmp qword [rbp + 0x2f], rdx
jb 0x140009c92
lfence
mov rcx, qword [rbp + 0x2f]
sub rcx, rdx
mov r8d, 4
cmp rcx, r8
cmovb r8, rcx
lea rax, [rbp + 0x1f]
cmp qword [rbp + 0x37], 7
cmova rax, qword [rbp + 0x1f]
lea rdx, [rax + rdx*2]
lea rcx, [rbp - 1]
call fcn.1400066a0
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rdi
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140009b7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c12
call fcn.140050f60
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
inc dword [0x14007d228]
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 7
jbe 0x140009be5
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c19
nop
call fcn.140050f60
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140057e20]
mov rcx, qword ds:[rbp - 0x31]
test rcx, rcx
jne 0x1400098a0
jmp 0x140009c24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140057e20]
cmp dword [0x14007d228], 2
jl 0x1400096c5
lea rdx, str.____Check_in_the_Windows_configuation___Bluetooth__Devices_if_more_than_two_mices_are_plugged._If_so__ban_the_user.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400096c5
call fcn.140007f60
nop
mov ecx, 0x8007000e
call fcn.140050cf0
nop
mov ecx, 0x8007000e
call fcn.140050cf0
nop
mov ecx, 0x8007000e
call fcn.140050cf0
nop
call fcn.140007f60
int3
movzx ecx, dl
jmp 0x140009460