joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007f8c
Capabilities:
Enumerate disk properties

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp - 8], 0
mov r9d, 2
mov r8d, 0
mov edx, 0
lea rax, [0x1400380a0]
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0xffffffffffffffff
jne 0x140007fd7
mov eax, 0
jmp 0x14000816a
mov dword [rbp - 0x40], 0x20
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x48], 0
mov dword [rbp - 4], 0
jmp 0x1400080fa
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x7a
jne 0x140008082
cmp qword [rbp - 0x10], 0
je 0x14000801e
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, dword [rbp - 0x48]
add eax, eax
mov eax, eax
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140008085
mov ecx, dword [rbp - 0x48]
lea r9, [rbp - 0x44]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x18]
lea r8, [rbp - 0x48]
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
call rax
test eax, eax
je 0x140007ff9
jmp 0x140008086
nop
jmp 0x140008086
nop
cmp qword [rbp - 0x10], 0
je 0x1400080f6
mov rax, qword [rbp - 0x10]
lea rdx, str.vbox
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x1400080ed
mov rax, qword [rbp - 0x10]
lea rdx, str.vmware
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x1400080ed
mov rax, qword [rbp - 0x10]
lea rdx, str.qemu
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x1400080ed
mov rax, qword [rbp - 0x10]
lea rdx, str.virtual
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400080f6
mov dword [rbp - 8], 1
jmp 0x14000811c
add dword [rbp - 4], 1
lea rcx, [rbp - 0x40]
mov edx, dword [rbp - 4]
mov rax, qword [rbp - 0x18]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
call rax
test eax, eax
jne 0x140008041
cmp qword [rbp - 0x10], 0
je 0x140008133
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
je 0x140008167
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x103
je 0x140008167
mov eax, 0
jmp 0x14000816a
mov eax, dword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x1400082ff
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x14000835c
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x140032c60]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x140008358
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x1400350e2]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x140008367
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x14000831d
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x14000836d
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov r9d, 0
mov r8d, 0
mov edx, 0x59
mov ecx, 0x800
mov rax, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call rax
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x10], rax
mov edx, dword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r9d, edx
mov r8, rax
mov edx, 0x59
mov ecx, 0x800
mov rax, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call rax
mov dword [rbp - 0x14], eax
mov dword [rbp - 4], 0
jmp 0x14000841f
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
lea rax, [0x140032ca0]
mov rdx, qword [rdx + rax]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.stricmp
test eax, eax
jne 0x14000841b
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.puts
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x140008436
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x1400083d4
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x14000843c
Capabilities:
Get keyboard layout

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 9
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x140008478
lea rax, str.Failed_to_retrieve_keyboard_layouts._n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x1400084d3
mov rax, qword [rbp - 0x60]
mov word [rbp - 0xa], ax
mov dword [rbp - 4], 0
jmp 0x1400084c8
movzx edx, word [rbp - 0xa]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x140032c60]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x1400084c4
movzx eax, word [rbp - 0xa]
mov edx, eax
lea rax, str.Language:__d_n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x1400084d3
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008489
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x1400084d9
Capabilities:
Get keyboard layout

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayout]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov word [rbp - 0x12], ax
mov dword [rbp - 4], 0
jmp 0x140008543
movzx edx, word [rbp - 0x12]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x140032c60]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x14000853f
movzx eax, word [rbp - 0x12]
mov edx, eax
lea rax, str.Language:__d_n
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x14000854e
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008504
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x140008554
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x1400085b1
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x140032c60]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x1400085ad
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x1400350e2]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x1400085bc
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x140008572
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x1400085c2
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
call rax
mov word [rbp - 6], ax
mov dword [rbp - 4], 0
jmp 0x14000861f
movzx edx, word [rbp - 6]
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
lea rax, [0x140032c60]
mov eax, dword [rcx + rax]
cmp edx, eax
jne 0x14000861b
movzx eax, word [rbp - 6]
mov edx, eax
lea rax, [0x1400350e2]
mov rcx, rax
call sym.printf_7
mov eax, 1
jmp 0x14000862a
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0xf
jle 0x1400085e0
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x1400086b0
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x1c], 0
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0x6f
jne 0x1400087ca
mov eax, dword [rbp - 0x1c]
mov eax, eax
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rax
cmp qword [rbp - 8], 0
je 0x1400087ca
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0x22], 0
mov word [rbp - 0x1e], 0
jmp 0x1400087b3
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x58]
cmp eax, 6
jne 0x1400087a7
mov rax, qword [rbp - 8]
add rax, 0x50
mov edx, dword [rax]
mov dword [rbp - 0x22], edx
movzx eax, word [rax + 4]
mov word [rbp - 0x1e], ax
lea rax, [rbp - 0x22]
mov r8d, 3
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call sym.memcmp
test eax, eax
jne 0x1400087a7
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 1
jmp 0x1400087cf
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140008755
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x1400087d5
Capabilities:
Get mac address on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov dword [rbp - 0x18], 0x2c0
mov ecx, 0x2c0
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000880e
mov eax, 0xffffffff
jmp 0x1400088e1
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
cmp eax, 0x6f
jne 0x140008851
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, dword [rbp - 0x18]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140008851
mov eax, 1
jmp 0x1400088e1
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
test eax, eax
jne 0x1400088de
mov dword [rbp - 0x14], 0
jmp 0x14000888b
mov eax, dword [rbp - 0x14]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx edx, byte [rax]
mov eax, dword [rbp - 0x14]
cdqe
mov byte [rbp + rax - 0x1c], dl
add dword [rbp - 0x14], 1
cmp dword [rbp - 0x14], 3
jle 0x14000886e
jmp 0x1400088d7
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x194]
cmp eax, 6
jne 0x1400088cc
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 0x198]
lea rax, [rbp - 0x1c]
mov r8d, 3
mov rcx, rax
call sym.memcmp
test eax, eax
jne 0x1400088cc
mov dword [rbp - 4], 1
jmp 0x1400088de
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140008893
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x140008a85
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp - 8]
mov r9d, 0
mov r8, rax
mov edx, 0
lea rax, [0x140035138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
call rax
test eax, eax
je 0x140008ad0
mov rax, qword [rbp - 8]
movabs rdx, 0xf3fffffff
cmp rax, rdx
ja 0x140008ad0
mov eax, 1
jmp 0x140008ad5
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008adb
Capabilities:
Check for debugger via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x140008b18
mov eax, dword [rbp - 4]
test eax, eax
je 0x140008b18
mov eax, 1
jmp 0x140008b1d
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008b23
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 0x40], 0x40
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0x80000000
cmp rax, rdx
setb al
movzx eax, al
add rsp, 0x60
pop rbp
ret

Function at 0x140008bcd
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x140008c34
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140008cb0
mov rax, qword [rbp - 8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x7405c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp - 0xc], 0
je 0x140008cab
mov rax, qword [rbp - 0x18]
movabs rdx, 0xf3fffffff
cmp rax, rdx
jg 0x140008cab
mov eax, 1
jmp 0x140008cb0
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140008f66
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 0x20], 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeEx]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140008fa4
mov eax, 0
jmp 0x1400090ed
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0xffffffff
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeSecurity]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009009
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x1400090ed
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1400378e0]
mov r8d, 1
mov edx, 0
mov rax, qword [0x1400378d0]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateInstance]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009053
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x1400090ed
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.OLEAUT32.dll_SysAllocString]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov r10, qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
not eax
shr eax, 0x1f
movzx eax, al
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.OLEAUT32.dll_SysFreeString]
call rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov eax, dword [rbp - 0x14]
add rsp, 0x70
pop rbp
ret

Function at 0x140009372
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x1400093a4
mov eax, 0
jmp 0x1400093d7
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_number_cores]
lea r8, str.SELECT__FROM_Win32_Processor
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400094b6
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x1400094e8
mov eax, 0
jmp 0x14000951b
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_disk_size]
lea r8, str.SELECT__FROM_Win32_LogicalDisk
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x140009668
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000969a
mov eax, 0
jmp 0x1400096cd
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_serial_number_bios]
lea r8, str.SELECT__FROM_Win32_BIOS
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400097d8
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000980a
mov eax, 0
jmp 0x14000983d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_model_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000998f
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x1400099c1
mov eax, 0
jmp 0x1400099f4
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_manufacturer_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009ac0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009af2
mov eax, 0
jmp 0x140009b25
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_process_id_processor]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009bd7
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009c09
mov eax, 0
jmp 0x140009c3c
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_cpu_fan]
lea r8, str.SELECT__FROM_Win32_Fan
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x140009c5a
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009c8c
mov eax, 0
jmp 0x140009cbf
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_CacheMemory
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009cc5
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009cf7
mov eax, 0
jmp 0x140009d2a
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PhysicalMemory
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009d30
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009d62
mov eax, 0
jmp 0x140009d95
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryDevice
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009d9b
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009dcd
mov eax, 0
jmp 0x140009e00
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryArray
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009e06
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009e38
mov eax, 0
jmp 0x140009e6b
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_VoltageProbe
lea rdx, [0x1400351d4]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret