joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ee8
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140009f1a
mov eax, 0
jmp 0x140009f4d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_serial_number_bios]
lea r8, str.SELECT__FROM_Win32_BIOS
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a058
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a08a
mov eax, 0
jmp 0x14000a0bd
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_model_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a20f
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a241
mov eax, 0
jmp 0x14000a274
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_manufacturer_computer_system]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a340
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a372
mov eax, 0
jmp 0x14000a3a5
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_process_id_processor]
lea r8, str.SELECT__FROM_Win32_ComputerSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a457
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a489
mov eax, 0
jmp 0x14000a4bc
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_cpu_fan]
lea r8, str.SELECT__FROM_Win32_Fan
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a4da
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a50c
mov eax, 0
jmp 0x14000a53f
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_CacheMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a545
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a577
mov eax, 0
jmp 0x14000a5aa
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PhysicalMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a5b0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a5e2
mov eax, 0
jmp 0x14000a615
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryDevice
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a61b
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a64d
mov eax, 0
jmp 0x14000a680
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_MemoryArray
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a686
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a6b8
mov eax, 0
jmp 0x14000a6eb
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_VoltageProbe
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a6f1
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a723
mov eax, 0
jmp 0x14000a756
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PortConnector
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a75c
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a78e
mov eax, 0
jmp 0x14000a7c1
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_SMBIOSMemory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a7c7
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a7f9
mov eax, 0
jmp 0x14000a82c
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a832
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a864
mov eax, 0
jmp 0x14000a897
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Memory
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a89d
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a8cf
mov eax, 0
jmp 0x14000a902
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Sensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000a908
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a93a
mov eax, 0
jmp 0x14000a96d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_NumericSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a973
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000a9a5
mov eax, 0
jmp 0x14000a9d8
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_TemperatureSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000a9de
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000aa10
mov eax, 0
jmp 0x14000aa43
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_VoltageSensor
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000aa49
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000aa7b
mov eax, 0
jmp 0x14000aaae
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_PhysicalConnector
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000aab4
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000aae6
mov eax, 0
jmp 0x14000ab19
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_numRows]
lea r8, str.SELECT__FROM_CIM_Slot
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000aca4
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000acd6
mov eax, 0
jmp 0x14000ad09
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_network_adapter_configuration]
lea r8, str.SELECT__FROM_Win32_NetworkAdapterConfiguration
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000ae54
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000ae86
mov eax, 0
jmp 0x14000aeb9
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_pnpentity_deviceid]
lea r8, str.SELECT__FROM_Win32_PnPEntity
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000afb3
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootWMI
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000afe5
mov eax, 0
jmp 0x14000b018
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_msacpi_thermalzonetemperature]
lea r8, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000b129
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b15b
mov eax, 0
jmp 0x14000b18e
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_pointingdevice]
lea r8, str.SELECT__FROM_Win32_PointingDevice
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000b385
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b3b7
mov eax, 0
jmp 0x14000b3ea
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_diskdrive_model_name_caption]
lea r8, str.SELECT__FROM_Win32_DiskDrive
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000b62a
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000b65c
mov eax, 0
jmp 0x14000b68f
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_baseboard_serial_version]
lea r8, str.SELECT__FROM_Win32_BaseBoard
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000bae1
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000bb13
mov eax, 0
jmp 0x14000bb46
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_videocontroller_compatibility_caption_description_name]
lea r8, str.SELECT__FROM_Win32_VideoController
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000bd1c
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000bd4e
mov eax, 0
jmp 0x14000bd81
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_networkadapter_timeoflastreset]
lea r8, str.SELECT__FROM_Win32_NetworkAdapter
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000bf52
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000bf84
mov eax, 0
jmp 0x14000bfb7
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_operatingsystem_lastbootuptime]
lea r8, str.SELECT__FROM_Win32_OperatingSystem
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000c0d8
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000c10a
mov eax, 0
jmp 0x14000c13d
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_bus_name]
lea r8, str.SELECT__FROM_Win32_Bus
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14000c25e
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x14000c290
mov eax, 0
jmp 0x14000c2c3
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_csproduct_name]
lea r8, str.SELECT__FROM_Win32_ComputerSystemProduct
lea rdx, [0x140035414]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x14000cdb0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.Ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtOpenKey
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f0d0], rax
mov rax, qword [rbp - 8]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, qword [0x140037d20]
mov qword [rdx], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtEnumerateKey
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f0d8], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryValueKey
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f0e0], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14003f0e8], rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14000e15a
Capabilities:
Reference the vmware io port

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [sym.excepIN]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov qword [rbp - 8], rax
mov eax, 0x564d5868
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete cl
mov dword [0x14003f0f0], 1
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x14000e2f9
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.th_IN]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x14003f0f0]
add rsp, 0x30
pop rbp
ret

Function at 0x14000e3d0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov edx, dword [rbp - 8]
mov eax, dword [rbp - 0x10]
cmp edx, eax
jne 0x14000e421
mov edx, dword [rbp - 4]
mov eax, dword [rbp - 0xc]
cmp edx, eax
jne 0x14000e421
mov eax, 1
jmp 0x14000e426
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x14000e4c7
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edx, 0x3e8
mov ecx, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_Beep]
call rax
mov dword [rbp - 4], 0
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jne 0x14000e522
mov ecx, 2
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jne 0x14000e522
mov ecx, 4
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
je 0x14000e533
add dword [rbp - 4], 1
cmp dword [rbp - 4], 4
jne 0x14000e533
mov eax, 0
jmp 0x14000e543
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x14000e4e9
add rsp, 0x30
pop rbp
ret

Function at 0x14000e8e7
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.SampleThread]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 8], rax
lea r9, str.Test
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [0x14003f110], rax
mov rax, qword [0x14003f110]
mov edx, 0x927c0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x14003f110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x40
pop rbp
ret