Function at 0x140017540
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3e0
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r12, r8
mov qword [rsp + 0xa0], rdx
mov r14, rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x168], r8
xor esi, esi
mov dword [rsp + 0x60], esi
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x2e0]
call fcn.140033ee0
lea rcx, [rsp + 0x2e0]
call fcn.14001b260
nop
lea rdx, str.SELECT__FROM_Win32_SystemDriver_WHERE_Name_
lea rcx, [rsp + 0x2e0]
call fcn.14001e400
mov r13, rax
mov rbx, qword [r12 + 0x10]
mov rdi, r12
cmp qword [r12 + 0x18], 8
jb 0x1400175d7
mov rdi, qword [r12]
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x1f0]
call fcn.140033ee0
lea rcx, [rsp + 0x1f0]
call fcn.14001b260
nop
lea rcx, [rsp + 0x1f0]
call fcn.14001ebf0
lea r15, [rdi + rbx*2]
cmp rdi, r15
je 0x140017653
movzx ebx, word [rdi]
cmp bx, 0x22
je 0x14001762f
cmp bx, 0x27
je 0x14001762f
cmp bx, 0x5c
je 0x14001762f
lea rax, [rsp + 0x1f0]
jmp 0x14001763f
movzx edx, bx
lea rcx, [rsp + 0x1f0]
call fcn.14001e700
movzx edx, bx
mov rcx, rax
call fcn.14001e700
add rdi, 2
cmp rdi, r15
jne 0x140017610
lea rcx, [rsp + 0x1f0]
call fcn.14001ebf0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x1f8]
call fcn.14001cc30
mov dword [rsp + 0x60], 6
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x1f8]
call fcn.14001af50
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ec], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x278], rax
lea rcx, [rsp + 0x278]
call fcn.1400317dc
nop
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
mov rcx, r13
call fcn.140020e40
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x14001777f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001777a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f12
call fcn.14002ef0c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2e8]
call fcn.14001cc30
nop
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
mov qword [rsp + 0xe0], rcx
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400177d6
mov qword [rsp + 0xe8], rax
lea rax, [0x1400714f0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 3
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x100], xmm0
movaps xmm1, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x110], xmm1
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0xa0]
call fcn.140023390
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140017893
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001788e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f18
call fcn.14002ef0c
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], si
cmp byte [rsp + 0x1c0], 0
je 0x140017e4e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x60], 0x2c
mov rbx, qword [rsp + 0x1b8]
mov rax, qword [rbx]
mov r15, qword [rax + 0x20]
cmp word [rsp + 0x68], 0
je 0x140017901
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.PathName
mov rcx, rbx
mov rax, r15
call qword [0x140060458]
mov edx, eax
test eax, eax
js 0x140017f1e
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x68]
call fcn.140022df0
nop
cmp word [rsp + 0x68], 0
je 0x140017956
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], 8
setae r9b
mov r8, qword [rsp + 0x170]
cmovae rdx, r8
mov rbx, qword [rsp + 0x180]
test rbx, rbx
je 0x140017a2d
lea rcx, [rbx - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x1400179b3
cmp rcx, rdx
je 0x140017a2d
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x1400179a0
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140017a2d
inc rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rbx, rcx
jb 0x140017f52
lfence
mov rax, qword [rsp + 0x180]
sub rax, rcx
cmp rax, 0xffffffffffffffff
cmovb rdi, rax
lea rax, [rsp + 0x170]
test r9b, r9b
cmovne rax, qword [rsp + 0x170]
lea rdx, [rax + rcx*2]
mov r8, rdi
lea rcx, [rsp + 0x40]
call fcn.140002f50
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x140017aa9
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r15, [rsp + 0x170]
test r9b, r9b
cmovne r15, r8
cmp rbx, 8
jae 0x140017a61
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
mov edi, 7
jmp 0x140017a9f
mov rdi, rbx
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140003380
mov qword [rsp + 0x40], rax
lea r8, [rbx*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140034100
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp rdi, 8
jb 0x140017abf
mov rdx, qword [rsp + 0x40]
lea r8, [rdx + rbx*2]
jmp 0x140017ac8
lea r8, [rax + rbx*2]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1c8]
call fcn.140021120
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140017b18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017b13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f58
call fcn.14002ef0c
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], SafeArrayLock
mov byte [rsp + 0x190], 0
mov r8d, 7
lea rdx, str.unknown
lea rcx, [rsp + 0x190]
call fcn.140003080
nop
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x120]
call fcn.140016fb0
mov rbx, rax
lea rax, [rsp + 0x190]
cmp rax, rbx
je 0x140017c00
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x140017bd2
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017bcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f5e
call fcn.14002ef0c
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x190], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x1a0], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], 0
nop dword [rax + rax]
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x140017c44
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f5e
call fcn.14002ef0c
nop
jmp 0x140017c58
lea rbx, vtable.std::ios_base.0
lea r15, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdi, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rdx, [rsp + 0x190]
mov rcx, r14
call fcn.140002de0
nop
lea rcx, [r14 + 0x20]
lea rdx, [rsp + 0x1c8]
call fcn.140002de0
nop
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0x10
jb 0x140017cd4
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017cce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f64
call fcn.14002ef0c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x140017d17
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017d12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f6a
call fcn.14002ef0c
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1e0], SafeArrayLock
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 8
jb 0x140017d7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017f70
call fcn.14002ef0c
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], si
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x140017db2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140060458]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x140017dcd
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140060458]
nop
mov rax, qword [rsp + 0x2e0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x2e0], rdi
mov rax, qword [rsp + 0x2e0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2dc], edx
lea rcx, [rsp + 0x2e8]
call fcn.14001af50
mov rax, qword [rsp + 0x2e0]
movsxd rdx, dword [rax + 4]
mov qword [rsp + rdx + 0x2e0], r15
mov rdx, qword [rsp + 0x2e0]
movsxd r8, dword [rdx + 4]
lea r9d, [r8 - 0x10]
mov dword [rsp + r8 + 0x2dc], r9d
mov qword [rsp + 0x368], rbx
lea rcx, [rsp + 0x368]
call fcn.1400317dc
nop
jmp 0x140017ee4
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], SafeArrayLock
mov byte [r14], 0
mov r8d, 7
lea rdx, str.unknown
mov rcx, r14
call fcn.140003080
nop
lea rcx, [r14 + 0x20]
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], SafeArrayLock
mov byte [rcx], 0
mov r8d, 7
lea rdx, str.unknown
call fcn.140003080
nop
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x140017ebb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140060458]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x140017ed6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140060458]
nop
lea rcx, [rsp + 0x2e0]
call fcn.140016c40
nop
mov rcx, r12
call fcn.140002cd0
mov rax, r14
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14002ec60
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400385e8
nop
call fcn.1400385e8
nop
lfence
call fcn.140012df0
mov r8, rax
lea r9, str.Failed_to_retrieve_value
lea rcx, [rsp + 0x140]
call fcn.140012b80
lea rdx, [0x14007d108]
lea rcx, [rsp + 0x140]
call fcn.140033e04
nop
call fcn.140003440
nop
call fcn.1400385e8
nop
call fcn.1400385e8
nop
call fcn.1400385e8
nop
call fcn.1400385e8
nop
call fcn.1400385e8
int3