joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008e7f
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp - 8]
mov r9d, 0
mov r8, rax
mov edx, 0
lea rax, [0x14003536c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
call rax
test eax, eax
je 0x140008eca
mov rax, qword [rbp - 8]
movabs rdx, 0xf3fffffff
cmp rax, rdx
ja 0x140008eca
mov eax, 1
jmp 0x140008ecf
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008ed5
Capabilities:
Check for debugger via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x140008f12
mov eax, dword [rbp - 4]
test eax, eax
je 0x140008f12
mov eax, 1
jmp 0x140008f17
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140008f1d
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 0x40], 0x40
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0x80000000
cmp rax, rdx
setb al
movzx eax, al
add rsp, 0x60
pop rbp
ret

Function at 0x140008fc7
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x14000902e
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x1400090aa
mov rax, qword [rbp - 8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x7405c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp - 0xc], 0
je 0x1400090a5
mov rax, qword [rbp - 0x18]
movabs rdx, 0xf3fffffff
cmp rax, rdx
jg 0x1400090a5
mov eax, 1
jmp 0x1400090aa
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140009386
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 0x20], 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeEx]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x1400093c4
mov eax, 0
jmp 0x14000950d
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0xffffffff
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeSecurity]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009429
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x14000950d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [0x140037b20]
mov r8d, 1
mov edx, 0
mov rax, qword [0x140037b10]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateInstance]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x140009473
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x14000950d
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.OLEAUT32.dll_SysAllocString]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov r10, qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
not eax
shr eax, 0x1f
movzx eax, al
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.OLEAUT32.dll_SysFreeString]
call rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov eax, dword [rbp - 0x14]
add rsp, 0x70
pop rbp
ret

Function at 0x140009792
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x1400097c4
mov eax, 0
jmp 0x1400097f7
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_number_cores]
lea r8, str.SELECT__FROM_Win32_Processor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400098d6
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009908
mov eax, 0
jmp 0x14000993b
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_disk_size]
lea r8, str.SELECT__FROM_Win32_LogicalDisk
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x140009a88
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009aba
mov eax, 0
jmp 0x140009aed
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_serial_number_bios]
lea r8, str.SELECT__FROM_Win32_BIOS
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009bf8
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009c2a
mov eax, 0
jmp 0x140009c5d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_model_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009daf
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009de1
mov eax, 0
jmp 0x140009e14
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_manufacturer_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009ee0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009f12
mov eax, 0
jmp 0x140009f45
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_process_id_processor]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140009ff7
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a029
mov eax, 0
jmp 0x14000a05c
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_cpu_fan]
lea r8, str.SELECT__FROM_Win32_Fan
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a07a
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a0ac
mov eax, 0
jmp 0x14000a0df
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_CacheMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a0e5
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a117
mov eax, 0
jmp 0x14000a14a
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PhysicalMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a150
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a182
mov eax, 0
jmp 0x14000a1b5
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryDevice
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a1bb
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a1ed
mov eax, 0
jmp 0x14000a220
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryArray
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a226
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a258
mov eax, 0
jmp 0x14000a28b
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_VoltageProbe
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a291
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a2c3
mov eax, 0
jmp 0x14000a2f6
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PortConnector
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a2fc
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a32e
mov eax, 0
jmp 0x14000a361
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_SMBIOSMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a367
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a399
mov eax, 0
jmp 0x14000a3cc
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a3d2
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a404
mov eax, 0
jmp 0x14000a437
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Memory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a43d
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a46f
mov eax, 0
jmp 0x14000a4a2
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Sensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a4a8
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a4da
mov eax, 0
jmp 0x14000a50d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_NumericSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a513
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a545
mov eax, 0
jmp 0x14000a578
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_TemperatureSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a57e
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a5b0
mov eax, 0
jmp 0x14000a5e3
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_VoltageSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a5e9
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a61b
mov eax, 0
jmp 0x14000a64e
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_PhysicalConnector
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a654
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a686
mov eax, 0
jmp 0x14000a6b9
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Slot
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a844
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a876
mov eax, 0
jmp 0x14000a8a9
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_network_adapter_configuration]
lea r8, str.SELECT__FROM_Win32_NetworkAdapterConfiguration
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a9f4
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000aa26
mov eax, 0
jmp 0x14000aa59
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_pnpentity_deviceid]
lea r8, str.SELECT__FROM_Win32_PnPEntity
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ab53
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000ab85
mov eax, 0
jmp 0x14000abb8
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_msacpi_thermalzonetemperature]
lea r8, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000acc9
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000acfb
mov eax, 0
jmp 0x14000ad2e
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_pointingdevice]
lea r8, str.SELECT__FROM_Win32_PointingDevice
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000af25
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000af57
mov eax, 0
jmp 0x14000af8a
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_diskdrive_model_name_caption]
lea r8, str.SELECT__FROM_Win32_DiskDrive
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000b1ca
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b1fc
mov eax, 0
jmp 0x14000b22f
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_baseboard_serial_version]
lea r8, str.SELECT__FROM_Win32_BaseBoard
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000b681
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b6b3
mov eax, 0
jmp 0x14000b6e6
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_videocontroller_compatibility_caption_description_name]
lea r8, str.SELECT__FROM_Win32_VideoController
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000b8bc
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b8ee
mov eax, 0
jmp 0x14000b921
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_networkadapter_timeoflastreset]
lea r8, str.SELECT__FROM_Win32_NetworkAdapter
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000baf2
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000bb24
mov eax, 0
jmp 0x14000bb57
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_operatingsystem_lastbootuptime]
lea r8, str.SELECT__FROM_Win32_OperatingSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000bc78
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000bcaa
mov eax, 0
jmp 0x14000bcdd
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_bus_name]
lea r8, str.SELECT__FROM_Win32_Bus
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret