joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400086a5
Capabilities:
Enumerate disk properties

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp - 8], 0
mov r9d, 2
mov r8d, 0
mov edx, 0
lea rax, [0x1400476b0]
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0xffffffffffffffff
jne 0x1400086f0
mov eax, 0
jmp 0x140008883
mov dword [rbp - 0x40], 0x20
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x48], 0
mov dword [rbp - 4], 0
jmp 0x140008813
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x7a
jne 0x14000879b
cmp qword [rbp - 0x10], 0
je 0x140008737
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, dword [rbp - 0x48]
add eax, eax
mov eax, eax
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14000879e
mov ecx, dword [rbp - 0x48]
lea r9, [rbp - 0x44]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x18]
lea r8, [rbp - 0x48]
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
call rax
test eax, eax
je 0x140008712
jmp 0x14000879f
nop
jmp 0x14000879f
nop
cmp qword [rbp - 0x10], 0
je 0x14000880f
mov rax, qword [rbp - 0x10]
lea rdx, str.vbox
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x140008806
mov rax, qword [rbp - 0x10]
lea rdx, str.vmware
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x140008806
mov rax, qword [rbp - 0x10]
lea rdx, str.qemu
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x140008806
mov rax, qword [rbp - 0x10]
lea rdx, str.virtual
mov rcx, rax
call sym.strstr
test rax, rax
je 0x14000880f
mov dword [rbp - 8], 1
jmp 0x140008835
add dword [rbp - 4], 1
lea rcx, [rbp - 0x40]
mov edx, dword [rbp - 4]
mov rax, qword [rbp - 0x18]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
call rax
test eax, eax
jne 0x14000875a
cmp qword [rbp - 0x10], 0
je 0x14000884c
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
je 0x140008880
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x103
je 0x140008880
mov eax, 0
jmp 0x140008883
mov eax, dword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x140008a18
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x140008a75
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x14003fce0]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008a71
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x140043263]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008a80
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008a36
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008a86
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov r9d, 0
mov r8d, 0
mov edx, 0x59
mov ecx, 0x800
mov rax, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call rax
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x10], rax
mov edx, dword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r9d, edx
mov r8, rax
mov edx, 0x59
mov ecx, 0x800
mov rax, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call rax
mov dword [rbp - 0x14], eax
mov dword [rbp - 4], 0
jmp 0x140008b38
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
lea rax, [0x14003fd20]
mov rdx, qword [rdx + rax]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.stricmp
test eax, eax
jne 0x140008b34
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.puts
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x140008b4f
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008aed
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x140008b55
Capabilities:
Get keyboard layout

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 9
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x140008b91
lea rax, str.Failed_to_retrieve_keyboard_layouts._n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008bec
mov rax, qword [rbp - 0x60]
mov word [rbp - 0xa], ax
mov dword [rbp - 4], 0
jmp 0x140008be1
movzx edx, word [rbp - 0xa]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x14003fce0]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008bdd
movzx eax, word [rbp - 0xa]
mov edx, eax
lea rax, str.Language:__d_n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008bec
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008ba2
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x140008bf2
Capabilities:
Get keyboard layout

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayout]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov word [rbp - 0x12], ax
mov dword [rbp - 4], 0
jmp 0x140008c5c
movzx edx, word [rbp - 0x12]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x14003fce0]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008c58
movzx eax, word [rbp - 0x12]
mov edx, eax
lea rax, str.Language:__d_n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008c67
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008c1d
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x140008c6d
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x140008cca
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x14003fce0]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008cc6
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x140043263]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008cd5
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008c8b
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008cdb
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x140008d38
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x14003fce0]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008d34
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x140043263]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008d43
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008cf9
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008de9
Capabilities:
Check mutex on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0
mov dword [rbp - 4], 0
jmp 0x140008e6a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
lea rax, str.Frz_State
mov rax, qword [rdx + rax]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0xb7
jne 0x140008e66
mov eax, 1
jmp 0x140008e75
add dword [rbp - 4], 1
cmp dword [rbp - 4], 3
jle 0x140008e02
mov eax, 0
add rsp, 0x40
pop rbp
ret
Function at 0x140009146
Capabilities:
Get disk information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 4]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8d, 1
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call rax
mov eax, dword [rbp - 4]
cmp eax, 0xcd1a40
je 0x1400091a5
mov eax, dword [rbp - 4]
cmp eax, 0x70144646
jne 0x1400091ac
mov eax, 1
jmp 0x1400091b1
mov eax, 0
add rsp, 0x50
pop rbp
ret
Function at 0x14000953f
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x1c], 0
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0x6f
jne 0x140009659
mov eax, dword [rbp - 0x1c]
mov eax, eax
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rax
cmp qword [rbp - 8], 0
je 0x140009659
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0x22], 0
mov word [rbp - 0x1e], 0
jmp 0x140009642
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x58]
cmp eax, 6
jne 0x140009636
mov rax, qword [rbp - 8]
add rax, 0x50
mov edx, dword [rax]
mov dword [rbp - 0x22], edx
movzx eax, word [rax + 4]
mov word [rbp - 0x1e], ax
lea rax, [rbp - 0x22]
mov r8d, 3
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call sym.memcmp
test eax, eax
jne 0x140009636
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 1
jmp 0x14000965e
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400095e4
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x140009664
Capabilities:
Get mac address on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov dword [rbp - 0x18], 0x2c0
mov ecx, 0x2c0
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000969d
mov eax, 0xffffffff
jmp 0x140009770
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
cmp eax, 0x6f
jne 0x1400096e0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, dword [rbp - 0x18]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400096e0
mov eax, 1
jmp 0x140009770
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
test eax, eax
jne 0x14000976d
mov dword [rbp - 0x14], 0
jmp 0x14000971a
mov eax, dword [rbp - 0x14]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx edx, byte [rax]
mov eax, dword [rbp - 0x14]
cdqe
mov byte [rbp + rax - 0x1c], dl
add dword [rbp - 0x14], 1
cmp dword [rbp - 0x14], 3
jle 0x1400096fd
jmp 0x140009766
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x194]
cmp eax, 6
jne 0x14000975b
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 0x198]
lea rax, [rbp - 0x1c]
mov r8d, 3
mov rcx, rax
call sym.memcmp
test eax, eax
jne 0x14000975b
mov dword [rbp - 4], 1
jmp 0x14000976d
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140009722
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x140009914
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp - 8]
mov r9d, 0
mov r8, rax
mov edx, 0
lea rax, [0x14004343b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
call rax
test eax, eax
je 0x14000995f
mov rax, qword [rbp - 8]
movabs rdx, 0xf3fffffff
cmp rax, rdx
ja 0x14000995f
mov eax, 1
jmp 0x140009964
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x14000996a
Capabilities:
Check for debugger via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x1400099a7
mov eax, dword [rbp - 4]
test eax, eax
je 0x1400099a7
mov eax, 1
jmp 0x1400099ac
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x1400099b2
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 0x40], 0x40
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0x80000000
cmp rax, rdx
setb al
movzx eax, al
add rsp, 0x60
pop rbp
ret

Function at 0x140009a5c
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x140009ac3
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140009b3f
mov rax, qword [rbp - 8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x7405c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp - 0xc], 0
je 0x140009b3a
mov rax, qword [rbp - 0x18]
movabs rdx, 0xf3fffffff
cmp rax, rdx
jg 0x140009b3a
mov eax, 1
jmp 0x140009b3f
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140009da4
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 0x20], 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeEx]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009de2
mov eax, 0
jmp 0x140009f2b
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0xffffffff
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeSecurity]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009e47
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x140009f2b
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [0x140046ee0]
mov r8d, 1
mov edx, 0
mov rax, qword [0x140046ed0]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateInstance]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009e91
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x140009f2b
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.OLEAUT32.dll_SysAllocString]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov r10, qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
not eax
shr eax, 0x1f
movzx eax, al
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.OLEAUT32.dll_SysFreeString]
call rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov eax, dword [rbp - 0x14]
add rsp, 0x70
pop rbp
ret

Function at 0x14000a1b0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a1e2
mov eax, 0
jmp 0x14000a215
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_number_cores]
lea r8, str.SELECT__FROM_Win32_Processor
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a2f4
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a326
mov eax, 0
jmp 0x14000a359
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_disk_size]
lea r8, str.SELECT__FROM_Win32_LogicalDisk
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a4a6
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a4d8
mov eax, 0
jmp 0x14000a50b
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_serial_number_bios]
lea r8, str.SELECT__FROM_Win32_BIOS
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a616
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a648
mov eax, 0
jmp 0x14000a67b
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_model_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a7cd
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a7ff
mov eax, 0
jmp 0x14000a832
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_manufacturer_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a8fe
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000a930
mov eax, 0
jmp 0x14000a963
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_process_id_processor]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000aa15
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000aa47
mov eax, 0
jmp 0x14000aa7a
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_wmi_cpu_fan]
lea r8, str.SELECT__FROM_Win32_Fan
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000aa98
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000aaca
mov eax, 0
jmp 0x14000aafd
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_numRows]
lea r8, str.SELECT__FROM_Win32_CacheMemory
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ab03
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000ab35
mov eax, 0
jmp 0x14000ab68
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_numRows]
lea r8, str.SELECT__FROM_Win32_PhysicalMemory
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ab6e
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000aba0
mov eax, 0
jmp 0x14000abd3
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryDevice
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000abd9
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000ac0b
mov eax, 0
jmp 0x14000ac3e
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryArray
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ac44
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call dbg.wmi_initialize
cmp eax, 1
je 0x14000ac76
mov eax, 0
jmp 0x14000aca9
mov rax, qword [rbp - 0x10]
lea r9, [dbg.check_numRows]
lea r8, str.SELECT__FROM_Win32_VoltageProbe
lea rdx, [0x1400434e4]
mov rcx, rax
call dbg.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret