joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002dffc
Capabilities:
Enumerate pe sections
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r15, rdx
mov ecx, 0x208
xor ebx, ebx
mov esi, 0x104
call fcn.180154dd8
mov rdi, rax
test rax, rax
je 0x18002e084
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, eax
test eax, eax
je 0x18002e069
cmp esi, eax
jne 0x18002e069
mov rcx, rdi
add esi, 0x104
call fcn.180154dd0
mov ecx, esi
add rcx, rcx
call fcn.180154dd8
mov rdi, rax
test rax, rax
jne 0x18002e030
test rdi, rdi
je 0x18002e084
test ebp, ebp
jne 0x18002e099
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov esi, eax
call fcn.180154dd0
jmp 0x18002e089
mov esi, 8
test esi, esi
jne 0x18002e1a7
mov rdi, qword [rsp + 0x88]
mov rdx, r15
mov rcx, r14
call fcn.18002ddf0
mov r8, rax
test rax, rax
je 0x18002e19f
movsxd r10, dword [r14 + 0x3c]
sub r8d, r14d
add r10, r14
movzx eax, word [r10 + 0x14]
lea r9, [r10 + 0x18]
movzx r11d, word [r10 + 6]
add r9, rax
cmp r8d, dword [r9 + 0xc]
jb 0x18002e0ec
mov ecx, dword [r10 + 0x3c]
lea edx, [rcx - 1]
add edx, dword [r9 + 0x10]
lea eax, [rcx - 1]
not eax
and edx, eax
add edx, dword [r9 + 0xc]
cmp r8d, edx
jb 0x18002e101
add r9, 0x28
mov eax, 0xffff
add r11w, ax
je 0x18002e19f
jmp 0x18002e0cb
mov esi, dword [r9 + 0x14]
sub esi, dword [r9 + 0xc]
add esi, r8d
je 0x18002e19f
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18002e19f
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0x18002e196
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, 4
lea rdx, [rsp + 0x88]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002e196
cmp dword [rsp + 0x80], 4
jne 0x18002e196
mov ebx, dword [rsp + 0x88]
add rbx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180154dd0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002e220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
and qword [r11 - 0x28], 0
mov r14, rcx
and dword [r11 + 0x20], 0
lea rcx, [0x1801ab938]
xor eax, eax
mov rsi, r8
mov dword [r11 + 0x24], eax
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1801abaf8]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x48], 0x40
xor r9d, r9d
and dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x38], 2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r8, rsi
lea rax, [rsp + 0x98]
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov rcx, r14
and qword [rsp + 0x20], 0
call rdi
mov ecx, eax
call rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18002ed10
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 4]
lea rdx, str.UUID
lea rcx, [rbp - 0x20]
call fcn.180006768
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x29]
lea rdx, str.SELECT__FROM_Win32_ComputerSystemProduct
lea rcx, [rbp - 0x40]
call fcn.180006768
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18002f960
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18002edfe
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18002edf9
test cl, 0x1f
je 0x18002edcc
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002eddb
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002edea
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002edf6
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18002ee64
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18002ee5f
test cl, 0x1f
je 0x18002ee32
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002ee41
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002ee50
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002ee5c
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002ee90
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 6]
lea rdx, str.Domain
lea rcx, [rbp - 0x20]
call fcn.180006768
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x23]
lea rdx, [0x1801abcb8]
lea rcx, [rbp - 0x40]
call fcn.180006768
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18002f960
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18002ef7e
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18002ef79
test cl, 0x1f
je 0x18002ef4c
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002ef5b
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002ef6a
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002ef76
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18002efe4
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18002efdf
test cl, 0x1f
je 0x18002efb2
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002efc1
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002efd0
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002efdc
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002f010
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 4]
lea rdx, [0x1801abd0c]
lea rcx, [rbp - 0x20]
call fcn.180006768
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x22]
lea rdx, [0x1801abce8]
lea rcx, [rbp - 0x40]
call fcn.180006768
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18002f960
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18002f0fe
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18002f0f9
test cl, 0x1f
je 0x18002f0cc
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f0db
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f0ea
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002f0f6
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18002f164
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18002f15f
test cl, 0x1f
je 0x18002f132
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f141
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f150
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002f15c
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002f190
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 7]
lea rdx, [0x1801abd40]
lea rcx, [rbp - 0x20]
call fcn.180006768
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x24]
lea rdx, str.SELECT__FROM_Win32_OperatingSystem
lea rcx, [rbp - 0x40]
call fcn.180006768
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18002f960
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18002f27e
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18002f279
test cl, 0x1f
je 0x18002f24c
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f25b
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f26a
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002f276
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 0x28], SafeArrayLock
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18002f2e4
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18002f2df
test cl, 0x1f
je 0x18002f2b2
call fcn.180154658
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f2c1
call fcn.180154658
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f2d0
call fcn.180154658
int3
cmp rcx, 0x27
jbe 0x18002f2dc
call fcn.180154658
int3
mov rcx, rax
call fcn.18002c160
mov qword [rbp - 8], SafeArrayLock
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180030490
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rbx
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x30], r15
mov qword [rbp - 0x40], r15
mov ebx, r15d
mov qword [rbp + 0x28], r15
call fcn.1800333d0
test eax, eax
je 0x180030665
mov qword [rsp + 0x68], rsi
lea rcx, [0x1801ae388]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_NetworkAdapterConfiguration
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12d, 1
mov rdi, rax
mov r14d, r12d
test rsi, rsi
je 0x18003055a
test rax, rax
je 0x180030551
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x180030551
mov rcx, qword [rbp + 0x30]
mov r14d, r15d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x68]
test rdi, rdi
je 0x18003056d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdi, qword [rsp + 0x60]
test r14d, r14d
mov r14, qword [rsp + 0x50]
je 0x180030655
mov rcx, qword [rbp + 0x28]
mov qword [rbp + 0x38], r15
mov dword [rbp + 0x20], r15d
test rcx, rcx
je 0x180030635
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x38]
or edx, 0xffffffff
mov r8d, r12d
call qword [rax + 0x20]
cmp dword [rbp + 0x20], r15d
je 0x180030631
mov rcx, qword [rbp + 0x38]
lea r9, [rbp - 0x38]
mov qword [rsp + 0x28], r15
lea rdx, str.MACAddress
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x180030614
movzx eax, word [rbp - 0x38]
cmp ax, r12w
je 0x180030614
test al, 8
je 0x18003060a
mov rcx, qword [rbp - 0x30]
lea rdx, str.08:00:27
call fcn.180153240
test rax, rax
cmovne ebx, r12d
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test ebx, ebx
jne 0x180030631
mov rcx, qword [rbp + 0x28]
test rcx, rcx
jne 0x1800305a0
jmp 0x180030635
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov r12, qword [rsp + 0x58]
add rsp, 0x70
pop r15
pop rbx
pop rbp
ret
mov eax, ebx
add rsp, 0x70
pop r15
pop rbx
pop rbp
ret
Function at 0x180030b70
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rbx
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], r15
mov qword [rbp - 0x40], r15
mov ebx, r15d
mov qword [rbp + 0x30], r15
call fcn.1800333d0
test eax, eax
je 0x180030d3c
mov qword [rsp + 0x68], rsi
lea rcx, [0x1801ae388]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_PnPEntity
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12d, 1
mov rdi, rax
mov r14d, r12d
test rsi, rsi
je 0x180030c3a
test rax, rax
je 0x180030c31
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x180030c31
mov rcx, qword [rbp + 0x28]
mov r14d, r15d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x68]
test rdi, rdi
je 0x180030c4d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdi, qword [rsp + 0x60]
test r14d, r14d
mov r14, qword [rsp + 0x50]
je 0x180030d2c
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0x38], r15
mov dword [rbp + 0x20], r15d
test rcx, rcx
je 0x180030d08
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x38]
or edx, 0xffffffff
mov r8d, r12d
call qword [rax + 0x20]
cmp dword [rbp + 0x20], r15d
je 0x180030d08
mov rcx, qword [rbp + 0x38]
lea r9, [rbp - 0x38]
mov qword [rsp + 0x28], r15
lea rdx, str.DeviceId
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x180030ced
cmp word [rbp - 0x38], 8
jne 0x180030ce3
mov rcx, qword [rbp - 0x30]
lea rdx, str.PCIVEN_80EEDEV_CAFE
call fcn.180153240
test rax, rax
cmovne ebx, r12d
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test ebx, ebx
jne 0x180030d08
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x180030c80
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov r12, qword [rsp + 0x58]
add rsp, 0x70
pop r15
pop rbx
pop rbp
ret
mov eax, ebx
add rsp, 0x70
pop r15
pop rbx
pop rbp
ret
Function at 0x180030d50
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x68
xor edi, edi
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp + 0x20], rdi
call fcn.1800333d0
test eax, eax
je 0x180030f5b
mov qword [rsp + 0x60], rbx
lea rcx, [0x1801ae388]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_PnPEntity
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r14d, [rdi + 1]
mov rbx, rax
test rsi, rsi
je 0x180030e0a
test rax, rax
je 0x180030e01
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 0x30]
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x180030e01
mov rcx, qword [rbp + 0x28]
mov r14d, edi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x58]
test rbx, rbx
je 0x180030e1d
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
mov r14, qword [rsp + 0x50]
je 0x180030f4d
mov rcx, qword [rbp + 0x20]
mov ebx, edi
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x18], edi
test rcx, rcx
je 0x180030f26
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x30]
or edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x18], edi
je 0x180030f22
mov rcx, qword [rbp + 0x30]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rdi
lea rdx, str.Name
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x180030f09
movzx eax, word [rbp - 0x30]
cmp ax, 1
je 0x180030f09
test al, 8
je 0x180030eff
mov rcx, qword [rbp - 0x28]
lea rdx, str.82801FB
call fcn.180153240
test rax, rax
jne 0x180030efd
mov rcx, qword [rbp - 0x28]
lea rdx, str.82441FX
call fcn.180153240
test rax, rax
jne 0x180030efd
mov rcx, qword [rbp - 0x28]
lea rdx, str.82371SB
call fcn.180153240
test rax, rax
jne 0x180030efd
mov rcx, qword [rbp - 0x28]
lea rdx, str.OpenHCD
call fcn.180153240
test rax, rax
je 0x180030eff
inc ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
jne 0x180030e50
jmp 0x180030f26
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp ebx, 3
setge dil
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
pop rdi
pop rbp
ret
mov eax, edi
add rsp, 0x68
pop rdi
pop rbp
ret
Function at 0x180030f70
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x78
xor edi, edi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp + 0x20], rdi
call fcn.1800333d0
test eax, eax
je 0x180031173
mov qword [rsp + 0x70], rbx
lea rcx, [0x1801ae388]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Bus
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15d, 1
mov rbx, rax
mov r14d, r15d
test rsi, rsi
je 0x180031034
test rax, rax
je 0x18003102b
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 0x30]
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x18003102b
mov rcx, qword [rbp + 0x28]
mov r14d, edi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x180031042
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
mov r14, qword [rsp + 0x60]
je 0x18003115b
mov rcx, qword [rbp + 0x20]
mov esi, edi
mov qword [rbp + 0x30], rdi
mov ebx, edi
mov dword [rbp + 0x18], edi
test rcx, rcx
je 0x18003113b
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x30]
or edx, 0xffffffff
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0x18], edi
je 0x18003112c
mov rcx, qword [rbp + 0x30]
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], rdi
lea rdx, str.Name
xor r8d, r8d
mov qword [rsp + 0x20], rdi
inc esi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x180031113
movzx eax, word [rbp - 0x40]
cmp ax, r15w
je 0x180031113
test al, 8
je 0x180031109
mov rcx, qword [rbp - 0x38]
lea rdx, str.ACPIBus_BUS_0
call fcn.180153240
test rax, rax
jne 0x180031107
mov rcx, qword [rbp - 0x38]
lea rdx, str.PCI_BUS_0
call fcn.180153240
test rax, rax
jne 0x180031107
mov rcx, qword [rbp - 0x38]
lea rdx, str.PNP_BUS_0
call fcn.180153240
test rax, rax
je 0x180031109
inc ebx
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
jne 0x180031070
jmp 0x180031130
mov rcx, qword [rbp + 0x20]
cmp esi, 3
jne 0x18003113b
cmp ebx, esi
cmove edi, r15d
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x68]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x58]
add rsp, 0x78
pop rdi
pop rbp
ret
mov eax, edi
add rsp, 0x78
pop rdi
pop rbp
ret