joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1da0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1edf
push rbp
mov rbp, rsp
sub rsp, 0x60
lea ecx, [rbx - 0x30]
cmp cl, 9
jbe 0x4c1dcd
lea ecx, [rbx - 0x61]
nop dword [rax]
cmp cl, 5
jbe 0x4c1dcd
lea ecx, [rbx - 0x41]
cmp cl, 5
ja 0x4c1dfa
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c1de8
mov rcx, qword [rax]
nop dword [rax + rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateInStringEscU12
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c1e10
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005197ff]
mov r11d, 0x22
xor eax, eax
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c1e99
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c1ed0
nop dword [rax]
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateInStringEscU1
Function at 0x4c1f00
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c203f
push rbp
mov rbp, rsp
sub rsp, 0x60
lea ecx, [rbx - 0x30]
cmp cl, 9
jbe 0x4c1f2d
lea ecx, [rbx - 0x61]
nop dword [rax]
cmp cl, 5
jbe 0x4c1f2d
lea ecx, [rbx - 0x41]
cmp cl, 5
ja 0x4c1f5a
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c1f48
mov rcx, qword [rax]
nop dword [rax + rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateInStringEscU123
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c1f70
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005197ff]
mov r11d, 0x22
xor eax, eax
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c1ff9
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2030
nop dword [rax]
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateInStringEscU12
Function at 0x4c2060
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c219f
push rbp
mov rbp, rsp
sub rsp, 0x60
lea ecx, [rbx - 0x30]
cmp cl, 9
jbe 0x4c208d
lea ecx, [rbx - 0x61]
nop dword [rax]
cmp cl, 5
jbe 0x4c208d
lea ecx, [rbx - 0x41]
cmp cl, 5
ja 0x4c20ba
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c20a8
mov rcx, qword [rax]
nop dword [rax + rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateInString
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c20d0
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005197ff]
mov r11d, 0x22
xor eax, eax
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2159
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2190
nop dword [rax]
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateInStringEscU123
Function at 0x4c26c0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c27e9
push rbp
mov rbp, rsp
sub rsp, 0x60
lea ecx, [rbx - 0x30]
cmp cl, 9
ja 0x4c2702
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c26f0
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateE0
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2718
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518281]
mov r11d, 0x1e
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c27a6
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c27da
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateESign
Function at 0x4c2880
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c29a9
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x72
jne 0x4c28bf
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c28ad
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateTr
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c28d5
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005188ba]
mov r11d, 0x1f
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2966
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c299a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateT
Function at 0x4c29e0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2b09
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x75
jne 0x4c2a1f
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2a0d
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateTru
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2a35
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005188d9]
mov r11d, 0x1f
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2ac6
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2afa
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateTr
Function at 0x4c2b40
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2c69
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x65
jne 0x4c2b7f
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2b6d
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateEndValue
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2b95
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x005188f8]
mov r11d, 0x1f
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2c26
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2c5a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateTru
Function at 0x4c2ca0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2dc9
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x61
jne 0x4c2cdf
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2ccd
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateFa
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2cf5
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518d55]
mov r11d, 0x20
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2d86
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2dba
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateF
Function at 0x4c2e00
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2f29
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x6c
jne 0x4c2e3f
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2e2d
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateFal
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2e55
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518d75]
mov r11d, 0x20
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c2ee6
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c2f1a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateFa
Function at 0x4c2f60
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c3089
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x73
jne 0x4c2f9f
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2f8d
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateFals
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c2fb5
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518d95]
mov r11d, 0x20
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c3046
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c307a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateFal
Function at 0x4c30c0
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c31e9
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x65
jne 0x4c30ff
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c30ed
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateEndValue
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c3115
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518db5]
mov r11d, 0x20
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c31a6
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c31da
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateFals
Function at 0x4c3220
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c3349
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x75
jne 0x4c325f
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c324d
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateNu
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c3275
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518917]
mov r11d, 0x1f
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c3306
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c333a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateN
Function at 0x4c3380
Capabilities:
Reference wmi statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c34a9
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp bl, 0x6c
jne 0x4c33bf
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c33ad
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
lea rcx, sym.encoding_json.stateNul
mov qword [rax], rcx
xor eax, eax
add rsp, 0x60
pop rbp
ret
test byte [rax], al
cmp dword [0x00682e70], 0
je 0x4c33d5
mov rcx, qword [rax]
call sym.runtime.gcWriteBarrier1
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, sym.encoding_json.stateError
mov qword [rax], rcx
mov eax, ebx
call sym.encoding_json.quoteChar
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x004fc2e0]
nop dword [rax]
call sym.runtime.newobject
mov qword [rsp + 0x50], rax
lea rbx, [0x0051356d]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00541130]
mov r9d, 1
lea r10, [0x00518936]
mov r11d, 0x1f
xor eax, eax
nop dword [rax]
call sym.runtime.concatstring4
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rbx
cmp dword [0x00682e70], 0
je 0x4c3466
call sym.runtime.gcWriteBarrier2
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx + 0x38]
mov qword [rcx + 0x10], rbx
lea rbx, [0x00541db8]
mov qword [rdx + 0x28], rbx
cmp dword [0x00682e70], 0
je 0x4c349a
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rbx, qword [rdx + 0x30]
mov qword [r11 + 8], rbx
mov qword [rdx + 0x30], rcx
mov eax, 0xb
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp sym.encoding_json.stateNu