joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rsp + 0x50], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Plugins_in_state_transition__
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x40c
mov dword [rsp + 0x54], 0x74736f48
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], 0x7070632e
mov byte [rsp + 0x5c], 0
call fcn.140016af0
mov rbx, qword [rdi + 0x28]
xor esi, esi
test rbx, rbx
je 0x1400056c6
mov qword [rsp + 0x138], r12
lea r8, str.Uninitialized
mov qword [rsp + 0x140], r13
lea r12, str.Unverified
mov qword [rsp + 0x148], r14
lea r13, str.Done
mov qword [rsp + 0x100], r15
lea r14, [0x1400d6010]
lea r15, str.Active
lea rdx, str.Error
lea r11, str.Disabled
nop word [rax + rax]
movsxd rcx, dword [rbx + 0xe0]
mov eax, ecx
sub eax, 1
je 0x140005546
sub eax, 2
je 0x140005546
sub eax, 2
je 0x140005546
sub eax, 2
je 0x140005546
cmp eax, 2
jne 0x140005696
cmp byte [rbx + 0x48], 0
lea rax, str.Mandatory
mov r10, qword [rdi + 8]
lea r9, str.Optional
cmovne r9, rax
mov dword [rsp + 0x60], 0x63764e5c
mov dword [rsp + 0x64], 0x74736f48
lea rax, str.Initializing
mov qword [rbp - 0x58], rax
lea rax, str.Initialized
mov qword [rbp - 0x50], rax
lea rax, str.Starting
mov qword [rbp - 0x48], rax
lea rax, str.Started
mov qword [rbp - 0x40], rax
lea rax, str.Suspending
mov qword [rbp - 0x38], rax
lea rax, str.Suspended
mov qword [rbp - 0x30], rax
lea rax, str.Stopping
mov qword [rbp - 0x28], rax
lea rax, str.Stopped
mov qword [rbp - 0x20], rax
lea rax, str.Uninitializing
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x68], 0x7070632e
mov byte [rsp + 0x6c], 0
mov qword [rbp - 0x60], r8
test ecx, ecx
js 0x1400055f7
cmp ecx, 0xa
jae 0x1400055f7
lfence
mov r8, qword [rbp + rcx*8 - 0x60]
jmp 0x1400055fe
lea r8, str.Invalid
movsxd rax, dword [rbx + 0xe4]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], r11
test eax, eax
js 0x140005632
cmp eax, 6
jae 0x140005632
lfence
mov rcx, qword [rsp + rax*8 + 0x70]
jmp 0x140005639
lea rcx, str.Invalid
mov qword [rsp + 0x48], r9
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x40], r8
mov edx, esi
mov qword [rsp + 0x38], rcx
inc esi
mov qword [rsp + 0x30], rax
mov r9d, 3
mov dword [rsp + 0x28], edx
lea rax, str._____u:___20s____s___s___s
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0x41d
mov rcx, r10
call fcn.140016af0
lea rdx, str.Error
lea r11, str.Disabled
lea r8, str.Uninitialized
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x140005520
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x140]
mov r12, qword [rsp + 0x138]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x108
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rbx, qword [rcx + 0x28]
mov edi, 0x40
sub edi, dword [r9]
mov r15, r9
mov qword [rbp - 0x31], r8
mov r12d, edx
mov dword [rbp - 0x39], edi
mov r13, rcx
test rbx, rbx
je 0x1400059ec
lea rsi, str.Ignore_inactive_plugin__s
cmp qword [rbx + 0x50], 0
lea rcx, str.Ignore_unloaded_plugin__s
jne 0x1400058da
lea rax, [rbx + 0xa0]
mov dword [rbp - 0x21], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r8d, 0x2d5
mov dword [rbp - 0x1d], 0x74736f48
mov dword [rbp - 0x19], 0x7070632e
mov byte [rbp - 0x15], 0
jmp 0x1400059c9
mov r14d, dword [rbx + 0xe4]
lea eax, [r14 - 3]
cmp eax, 1
jbe 0x14000598a
test r12d, r12d
je 0x14000596e
cmp r12d, r14d
je 0x14000596e
mov rsi, qword [r13 + 8]
mov ecx, r12d
mov dword [rbp - 0x11], 0x63764e5c
mov dword [rbp - 0xd], 0x74736f48
mov dword [rbp - 9], 0x7070632e
mov byte [rbp - 5], 0
call fcn.140006640
mov ecx, r14d
mov rdi, rax
call fcn.140006640
mov qword [rsp + 0x38], rdi
lea rcx, [rbx + 0xa0]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
lea rax, str.Skip_plugin__s._Status__s____s
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r9d, 5
mov r8d, 0x2e8
call fcn.140016af0
mov edi, dword [rbp - 0x39]
lea rsi, str.Ignore_inactive_plugin__s
jmp 0x1400059d8
mov eax, dword [r15]
cmp eax, edi
jae 0x140005a0e
mov ecx, eax
mov eax, dword [rbx + 0x198]
mov dword [r8 + rcx*4], eax
inc dword [r15]
jmp 0x1400059dc
mov rdx, rbx
mov rcx, r13
call fcn.140004db0
lea rax, [rbx + 0xa0]
mov dword [rbp - 1], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rsi
mov r8d, 0x2de
mov dword [rbp + 3], 0x74736f48
mov dword [rbp + 7], 0x7070632e
mov byte [rbp + 0xb], 0
mov rcx, qword [r13 + 8]
mov r9d, 4
call fcn.140016af0
mov r8, qword [rbp - 0x31]
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x140005893
mov al, 1
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lfence
mov rcx, qword [r13 + 8]
lea rbx, str.Plugin_count_exceeded_maximum_allowed__u
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x31]
mov r9d, 1
mov qword [rsp + 0x20], rbx
mov r8d, 0x2f1
mov dword [rbp - 0x31], 0x63764e5c
mov dword [rbp - 0x2d], 0x74736f48
mov dword [rbp - 0x29], 0x7070632e
mov byte [rbp - 0x25], 0
call fcn.140016af0
mov r8d, edi
mov rdx, rbx
mov ecx, 0x21
call fcn.140007fe0
xor al, al
jmp 0x1400059ee
Function at 0x140005bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_initializing
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x461
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.140016af0
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x140005d74
lea r14, [0x1400d6010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x140005d3b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x140005d04
cmp eax, 6
jae 0x140005d04
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x140005d0b
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x468
mov rcx, r10
call fcn.140016af0
jmp 0x140005d4a
mov rcx, rbx
call fcn.14000c250
movzx edi, al
test al, al
je 0x140005d86
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x140005cb0
test dil, dil
je 0x140005d86
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.140004720
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_initialized_with__d
mov rcx, rsi
call fcn.140005120
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x140005dd7
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.1400089a0
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140069d50
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], 0
lea rsi, [rcx + 8]
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140005f32
mov rax, qword [rdx]
mov qword [rsp + 0x28], rax
lea rax, str.Load_plugins_from__ls
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x131
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.140016d80
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x1400d5670]
test al, al
je 0x140006014
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140005f82
mov rcx, qword [rbx]
call fcn.140012860
test al, al
jne 0x140005fff
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], al
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140005fb4
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rdi, str.File__ls_is_not_supported
mov qword [rsp + 0x20], rdi
mov r9d, 1
mov r8d, 0x137
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.140016d80
cmp qword [rbx + 0x18], 8
jb 0x140005fe8
mov rbx, qword [rbx]
mov r8, rbx
mov rdx, rdi
mov ecx, 0x2c
call fcn.1400080a0
xor al, al
jmp 0x1400060c2
mov rdx, rbx
mov rcx, rdi
call fcn.140004c00
test eax, eax
sete al
jmp 0x1400060c2
mov r14d, 1
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x1400d5670]
mov ecx, 0x11
test al, al
cmovne r14d, ecx
cmp qword [rbx + 0x18], 8
jb 0x140006040
mov rbx, qword [rbx]
mov r9d, r14d
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14001f460
lea rax, vtable.nvc::HostDirectoryEnumerator.0
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x168], rdi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14001f4d0
movzx esi, al
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x1400060be
mov edi, 0xffffffff
mov ecx, edi
lock xadd dword [rbx + 8], ecx
cmp ecx, 1
jne 0x1400060be
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx]
call qword [0x1400d5670]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400060be
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x1400d5670]
movzx eax, sil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140069d50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400066e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rdi, rcx
call fcn.140008e10
test al, al
je 0x140006748
nop
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140006735
cmp byte [rax + 0x148], 0
jne 0x1400067e5
cmp dword [rax + 0xe4], 4
jne 0x140006735
cmp byte [rax + 0x48], 0
jne 0x140006769
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140008e10
test al, al
jne 0x140006710
cmp byte [rdi + 0x144], 0
sete al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140069d50
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x68], rbx
mov r9d, 1
lea rbx, [rax + 0xa0]
mov qword [rsp + 0x70], rsi
lea rsi, str.Base_host:_mandatory_plugin__s_has_failed._Exit
mov qword [rsp + 0x28], rbx
mov r8d, 0x20c
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x20], 0x63764e5c
mov dword [rbp - 0x1c], 0x74736f48
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.140016af0
mov r8, rbx
mov rdx, rsi
mov ecx, 0x29
call fcn.140007fe0
mov rsi, qword [rsp + 0x70]
xor al, al
mov rbx, qword [rsp + 0x68]
mov byte [rdi + 0x144], 1
jmp 0x140006752
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
add rax, 0xa0
mov dword [rbp - 0x20], 0x63764e5c
mov qword [rsp + 0x28], rax
mov r9d, 2
lea rax, str.Base_host:_plugin__s_has_requested_restart._Exit
mov dword [rbp - 0x1c], 0x74736f48
mov r8d, 0x202
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.140016af0
xor al, al
mov byte [rdi + 0x144], 1
jmp 0x140006752
Function at 0x140007560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xc8
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov dword [rbp - 0x39], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Container_is_resuming
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x4e6
mov dword [rbp - 0x35], 0x74736f48
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x31], 0x7070632e
mov byte [rbp - 0x2d], 0
call fcn.140016af0
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400d5670]
test al, al
je 0x14000761d
mov rcx, qword [rdi + 8]
lea rax, str.Force_terminate_container_as_it_is_resuming_is_safe_mode
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x4ea
mov dword [rbp - 0x29], 0x63764e5c
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
call fcn.140016af0
mov byte [rdi + 0x144], 1
jmp 0x1400077b2
mov qword [rsp + 0xe8], rbx
mov rbx, qword [rdi + 0x28]
mov qword [rsp + 0xf0], rsi
mov sil, 1
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
test rbx, rbx
je 0x14000775d
lea r14, [0x1400d6010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x14000771b
mov r10, qword [rdi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x1400076e4
cmp eax, 6
jae 0x1400076e4
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x1400076eb
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4f6
mov rcx, r10
call fcn.140016af0
jmp 0x14000772a
mov rcx, rbx
call fcn.14000d540
movzx esi, al
test al, al
je 0x140007754
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x140007690
test sil, sil
jne 0x14000775d
mov byte [rdi + 0x144], 1
jmp 0x14000776f
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 4]
call fcn.140004720
movzx esi, al
movzx r8d, sil
lea rdx, str.Container_is_resumed_with__d
mov rcx, rdi
call fcn.140005120
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140069d50
add rsp, 0xc8
pop rdi
pop rbp
ret
Function at 0x140007ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, qword [rcx + 0x148]
mov rbp, rcx
test rsi, rsi
je 0x140007c37
cmp dword [rsi], 0
ja 0x140007b07
cmp dword [rsi + 4], 0
ja 0x140007b07
cmp dword [rsi + 8], 0
jbe 0x140007c37
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, 1
jne 0x140007c37
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0xb0], rdi
call fcn.140012760
movdqa xmm0, xmmword [str.NvcTelemetryHel]
mov rdi, rax
mov rcx, qword [rbp + 8]
movabs rax, 0xcccccccccccccccd
mul rbx
movdqu xmmword [rsp + 0x70], xmm0
mov eax, dword [rsi + 8]
mov r9d, 3
shr rdx, 3
mov r8d, 0x9e
sub edi, edx
mov dword [rsp + 0x80], 0x2e726570
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
lea rax, str.NvcLoadStats___LibraryLoadTime___u_us__InitializeTime___u_us__StartTime___u_us__TotalLoadTime___u_us
mov qword [rsp + 0x20], rax
mov word [rsp + 0x84], 0x68
call fcn.140016af0
mov r8d, dword [rsi + 8]
mov r9d, edi
mov edx, dword [rsi + 4]
mov ecx, dword [rsi]
call fcn.14001df50
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp + 8]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xa6
lea rax, str.NvcLoadStats_returned__u
mov dword [rsp + 0x80], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x84], 0x68
call fcn.140016af0
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140069d50
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rsi
ret
Function at 0x140008240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test rdx, rdx
je 0x140007fd6
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp dword [rdx + 0xc], 0
mov rdi, rdx
mov rsi, rcx
ja 0x140007e32
cmp dword [rdx + 0x10], 0
ja 0x140007e32
cmp dword [rdx + 0x14], 0
jbe 0x140007fc0
mov qword [rsp + 0x100], rbx
call fcn.140012760
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov rbx, rax
mov eax, dword [rdi + 0x14]
mov r9d, 3
sub ebx, dword [rdi + 0x20]
mov r8d, 0xbf
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0xc]
mov dword [rsp + 0x28], eax
lea rax, str.NvcUnloadStats___StopTime___u_us__UninitializeTime___u_us__DestroyPluginsTime___u_us__TotalUnloadTime___u_us
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.140016af0
mov r8d, dword [rdi + 0x14]
mov r9d, ebx
mov edx, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
call fcn.14001e100
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xc7
lea rax, str.NvcUnloadStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.140016af0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rbp - 0x19]
mov rcx, rax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov rbx, qword [rsp + 0x100]
cmp eax, 1
jne 0x140007fc0
mov rcx, qword [rbp + 0x27]
lea rdx, [rbp - 0x39]
mov rax, qword [rbp - 0x11]
mov r9d, 3
movdqa xmm0, xmmword [str.NvcTelemetryHel]
mov r8d, 0xd8
shr rcx, 0x14
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi]
shr rax, 0x14
mov qword [rsp + 0x28], rax
lea rax, str.NvcMemoryStats___PeakWorkingSetSize___u_MB__PeakPagefileUsage___u_MB
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.140016af0
mov rdx, qword [rbp + 0x27]
mov rcx, qword [rbp - 0x11]
call fcn.14001df90
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xde
lea rax, str.NvcMemoryStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.140016af0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140069d50
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rcx + 0x148]
add rcx, 8
jmp 0x140007df0
Function at 0x140008250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_starting
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x4ad
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.140016af0
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x1400083db
lea r14, [0x1400d6010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x14000839b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x140008364
cmp eax, 6
jae 0x140008364
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x14000836b
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4b4
mov rcx, r10
call fcn.140016af0
jmp 0x1400083b1
mov rdx, qword [rsi + 0x138]
mov rcx, rbx
call fcn.14000dc60
movzx edi, al
test al, al
je 0x1400083ed
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x140008310
test dil, dil
je 0x1400083ed
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 4]
call fcn.140004720
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_started_with__d
mov rcx, rsi
call fcn.140005120
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x14000843e
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.140008460
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140069d50
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret