joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff72e2c5450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rsp + 0x50], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Plugins_in_state_transition__
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x40c
mov dword [rsp + 0x54], 0x74736f48
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], 0x7070632e
mov byte [rsp + 0x5c], 0
call fcn.7ff72e2d6af0
mov rbx, qword [rdi + 0x28]
xor esi, esi
test rbx, rbx
je 0x7ff72e2c56c6
mov qword [rsp + 0x138], r12
lea r8, [0x7ff72e395f78]
mov qword [rsp + 0x140], r13
lea r12, str.Unverified
mov qword [rsp + 0x148], r14
lea r13, str.Done
mov qword [rsp + 0x100], r15
lea r14, [0x7ff72e396010]
lea r15, str.Active
lea rdx, str.Error
lea r11, str.Disabled
nop word [rax + rax]
movsxd rcx, dword [rbx + 0xe0]
mov eax, ecx
sub eax, 1
je 0x7ff72e2c5546
sub eax, 2
je 0x7ff72e2c5546
sub eax, 2
je 0x7ff72e2c5546
sub eax, 2
je 0x7ff72e2c5546
cmp eax, 2
jne 0x7ff72e2c5696
cmp byte [rbx + 0x48], 0
lea rax, str.Mandatory
mov r10, qword [rdi + 8]
lea r9, str.Optional
cmovne r9, rax
mov dword [rsp + 0x60], 0x63764e5c
mov dword [rsp + 0x64], 0x74736f48
lea rax, [0x7ff72e395f88]
mov qword [rbp - 0x58], rax
lea rax, [0x7ff72e395f98]
mov qword [rbp - 0x50], rax
lea rax, [0x7ff72e395fa8]
mov qword [rbp - 0x48], rax
lea rax, [0x7ff72e395fb8]
mov qword [rbp - 0x40], rax
lea rax, [0x7ff72e395fc0]
mov qword [rbp - 0x38], rax
lea rax, [0x7ff72e395fd0]
mov qword [rbp - 0x30], rax
lea rax, [0x7ff72e395fe0]
mov qword [rbp - 0x28], rax
lea rax, [0x7ff72e395ff0]
mov qword [rbp - 0x20], rax
lea rax, [0x7ff72e395ff8]
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x68], 0x7070632e
mov byte [rsp + 0x6c], 0
mov qword [rbp - 0x60], r8
test ecx, ecx
js 0x7ff72e2c55f7
cmp ecx, 0xa
jae 0x7ff72e2c55f7
lfence
mov r8, qword [rbp + rcx*8 - 0x60]
jmp 0x7ff72e2c55fe
lea r8, str.Invalid
movsxd rax, dword [rbx + 0xe4]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], r11
test eax, eax
js 0x7ff72e2c5632
cmp eax, 6
jae 0x7ff72e2c5632
lfence
mov rcx, qword [rsp + rax*8 + 0x70]
jmp 0x7ff72e2c5639
lea rcx, str.Invalid
mov qword [rsp + 0x48], r9
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x40], r8
mov edx, esi
mov qword [rsp + 0x38], rcx
inc esi
mov qword [rsp + 0x30], rax
mov r9d, 3
mov dword [rsp + 0x28], edx
lea rax, str._____u:___20s____s___s___s
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0x41d
mov rcx, r10
call fcn.7ff72e2d6af0
lea rdx, str.Error
lea r11, str.Disabled
lea r8, [0x7ff72e395f78]
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x7ff72e2c5520
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x140]
mov r12, qword [rsp + 0x138]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0x108
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x7ff72e2c5840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rbx, qword [rcx + 0x28]
mov edi, 0x40
sub edi, dword [r9]
mov r15, r9
mov qword [rbp - 0x31], r8
mov r12d, edx
mov dword [rbp - 0x39], edi
mov r13, rcx
test rbx, rbx
je 0x7ff72e2c59ec
lea rsi, str.Ignore_inactive_plugin__s
cmp qword [rbx + 0x50], 0
lea rcx, str.Ignore_unloaded_plugin__s
jne 0x7ff72e2c58da
lea rax, [rbx + 0xa0]
mov dword [rbp - 0x21], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r8d, 0x2d5
mov dword [rbp - 0x1d], 0x74736f48
mov dword [rbp - 0x19], 0x7070632e
mov byte [rbp - 0x15], 0
jmp 0x7ff72e2c59c9
mov r14d, dword [rbx + 0xe4]
lea eax, [r14 - 3]
cmp eax, 1
jbe 0x7ff72e2c598a
test r12d, r12d
je 0x7ff72e2c596e
cmp r12d, r14d
je 0x7ff72e2c596e
mov rsi, qword [r13 + 8]
mov ecx, r12d
mov dword [rbp - 0x11], 0x63764e5c
mov dword [rbp - 0xd], 0x74736f48
mov dword [rbp - 9], 0x7070632e
mov byte [rbp - 5], 0
call fcn.7ff72e2c6640
mov ecx, r14d
mov rdi, rax
call fcn.7ff72e2c6640
mov qword [rsp + 0x38], rdi
lea rcx, [rbx + 0xa0]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
lea rax, str.Skip_plugin__s._Status__s____s
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r9d, 5
mov r8d, 0x2e8
call fcn.7ff72e2d6af0
mov edi, dword [rbp - 0x39]
lea rsi, str.Ignore_inactive_plugin__s
jmp 0x7ff72e2c59d8
mov eax, dword [r15]
cmp eax, edi
jae 0x7ff72e2c5a0e
mov ecx, eax
mov eax, dword [rbx + 0x198]
mov dword [r8 + rcx*4], eax
inc dword [r15]
jmp 0x7ff72e2c59dc
mov rdx, rbx
mov rcx, r13
call fcn.7ff72e2c4db0
lea rax, [rbx + 0xa0]
mov dword [rbp - 1], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rsi
mov r8d, 0x2de
mov dword [rbp + 3], 0x74736f48
mov dword [rbp + 7], 0x7070632e
mov byte [rbp + 0xb], 0
mov rcx, qword [r13 + 8]
mov r9d, 4
call fcn.7ff72e2d6af0
mov r8, qword [rbp - 0x31]
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x7ff72e2c5893
mov al, 1
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lfence
mov rcx, qword [r13 + 8]
lea rbx, str.Plugin_count_exceeded_maximum_allowed__u
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x31]
mov r9d, 1
mov qword [rsp + 0x20], rbx
mov r8d, 0x2f1
mov dword [rbp - 0x31], 0x63764e5c
mov dword [rbp - 0x2d], 0x74736f48
mov dword [rbp - 0x29], 0x7070632e
mov byte [rbp - 0x25], 0
call fcn.7ff72e2d6af0
mov r8d, edi
mov rdx, rbx
mov ecx, 0x21
call fcn.7ff72e2c7fe0
xor al, al
jmp 0x7ff72e2c59ee
Function at 0x7ff72e2c5bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_initializing
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x461
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.7ff72e2d6af0
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x7ff72e2c5d74
lea r14, [0x7ff72e396010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x7ff72e2c5d3b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x7ff72e2c5d04
cmp eax, 6
jae 0x7ff72e2c5d04
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x7ff72e2c5d0b
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x468
mov rcx, r10
call fcn.7ff72e2d6af0
jmp 0x7ff72e2c5d4a
mov rcx, rbx
call fcn.7ff72e2cc250
movzx edi, al
test al, al
je 0x7ff72e2c5d86
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x7ff72e2c5cb0
test dil, dil
je 0x7ff72e2c5d86
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.7ff72e2c4720
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_initialized_with__d
mov rcx, rsi
call fcn.7ff72e2c5120
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x7ff72e2c5dd7
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.7ff72e2c89a0
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff72e2c5ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], 0
lea rsi, [rcx + 8]
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x7ff72e2c5f32
mov rax, qword [rdx]
mov qword [rsp + 0x28], rax
lea rax, str.Load_plugins_from__ls
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x131
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.7ff72e2d6d80
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x7ff72e395670]
test al, al
je 0x7ff72e2c6014
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x7ff72e2c5f82
mov rcx, qword [rbx]
call fcn.7ff72e2d2860
test al, al
jne 0x7ff72e2c5fff
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], al
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x7ff72e2c5fb4
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rdi, str.File__ls_is_not_supported
mov qword [rsp + 0x20], rdi
mov r9d, 1
mov r8d, 0x137
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.7ff72e2d6d80
cmp qword [rbx + 0x18], 8
jb 0x7ff72e2c5fe8
mov rbx, qword [rbx]
mov r8, rbx
mov rdx, rdi
mov ecx, 0x2c
call fcn.7ff72e2c80a0
xor al, al
jmp 0x7ff72e2c60c2
mov rdx, rbx
mov rcx, rdi
call fcn.7ff72e2c4c00
test eax, eax
sete al
jmp 0x7ff72e2c60c2
mov r14d, 1
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x7ff72e395670]
mov ecx, 0x11
test al, al
cmovne r14d, ecx
cmp qword [rbx + 0x18], 8
jb 0x7ff72e2c6040
mov rbx, qword [rbx]
mov r9d, r14d
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.7ff72e2df460
lea rax, [0x7ff72e3964c8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x168], rdi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.7ff72e2df4d0
movzx esi, al
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x7ff72e2c60be
mov edi, 0xffffffff
mov ecx, edi
lock xadd dword [rbx + 8], ecx
cmp ecx, 1
jne 0x7ff72e2c60be
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx]
call qword [0x7ff72e395670]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x7ff72e2c60be
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x7ff72e395670]
movzx eax, sil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.7ff72e329d50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff72e2c66e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rdi, rcx
call fcn.7ff72e2c8e10
test al, al
je 0x7ff72e2c6748
nop
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x7ff72e2c6735
cmp byte [rax + 0x148], 0
jne 0x7ff72e2c67e5
cmp dword [rax + 0xe4], 4
jne 0x7ff72e2c6735
cmp byte [rax + 0x48], 0
jne 0x7ff72e2c6769
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.7ff72e2c8e10
test al, al
jne 0x7ff72e2c6710
cmp byte [rdi + 0x144], 0
sete al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7ff72e329d50
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x68], rbx
mov r9d, 1
lea rbx, [rax + 0xa0]
mov qword [rsp + 0x70], rsi
lea rsi, str.Base_host:_mandatory_plugin__s_has_failed._Exit
mov qword [rsp + 0x28], rbx
mov r8d, 0x20c
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x20], 0x63764e5c
mov dword [rbp - 0x1c], 0x74736f48
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.7ff72e2d6af0
mov r8, rbx
mov rdx, rsi
mov ecx, 0x29
call fcn.7ff72e2c7fe0
mov rsi, qword [rsp + 0x70]
xor al, al
mov rbx, qword [rsp + 0x68]
mov byte [rdi + 0x144], 1
jmp 0x7ff72e2c6752
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
add rax, 0xa0
mov dword [rbp - 0x20], 0x63764e5c
mov qword [rsp + 0x28], rax
mov r9d, 2
lea rax, str.Base_host:_plugin__s_has_requested_restart._Exit
mov dword [rbp - 0x1c], 0x74736f48
mov r8d, 0x202
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.7ff72e2d6af0
xor al, al
mov byte [rdi + 0x144], 1
jmp 0x7ff72e2c6752
Function at 0x7ff72e2c7560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xc8
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov dword [rbp - 0x39], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Container_is_resuming
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x4e6
mov dword [rbp - 0x35], 0x74736f48
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x31], 0x7070632e
mov byte [rbp - 0x2d], 0
call fcn.7ff72e2d6af0
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff72e395670]
test al, al
je 0x7ff72e2c761d
mov rcx, qword [rdi + 8]
lea rax, str.Force_terminate_container_as_it_is_resuming_is_safe_mode
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x4ea
mov dword [rbp - 0x29], 0x63764e5c
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
call fcn.7ff72e2d6af0
mov byte [rdi + 0x144], 1
jmp 0x7ff72e2c77b2
mov qword [rsp + 0xe8], rbx
mov rbx, qword [rdi + 0x28]
mov qword [rsp + 0xf0], rsi
mov sil, 1
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
test rbx, rbx
je 0x7ff72e2c775d
lea r14, [0x7ff72e396010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x7ff72e2c771b
mov r10, qword [rdi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x7ff72e2c76e4
cmp eax, 6
jae 0x7ff72e2c76e4
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x7ff72e2c76eb
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4f6
mov rcx, r10
call fcn.7ff72e2d6af0
jmp 0x7ff72e2c772a
mov rcx, rbx
call fcn.7ff72e2cd540
movzx esi, al
test al, al
je 0x7ff72e2c7754
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x7ff72e2c7690
test sil, sil
jne 0x7ff72e2c775d
mov byte [rdi + 0x144], 1
jmp 0x7ff72e2c776f
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 4]
call fcn.7ff72e2c4720
movzx esi, al
movzx r8d, sil
lea rdx, str.Container_is_resumed_with__d
mov rcx, rdi
call fcn.7ff72e2c5120
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0xc8
pop rdi
pop rbp
ret
Function at 0x7ff72e2c7ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, qword [rcx + 0x148]
mov rbp, rcx
test rsi, rsi
je 0x7ff72e2c7c37
cmp dword [rsi], 0
ja 0x7ff72e2c7b07
cmp dword [rsi + 4], 0
ja 0x7ff72e2c7b07
cmp dword [rsi + 8], 0
jbe 0x7ff72e2c7c37
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, 1
jne 0x7ff72e2c7c37
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0xb0], rdi
call fcn.7ff72e2d2760
movdqa xmm0, xmmword [str.NvcTelemetryHel]
mov rdi, rax
mov rcx, qword [rbp + 8]
movabs rax, 0xcccccccccccccccd
mul rbx
movdqu xmmword [rsp + 0x70], xmm0
mov eax, dword [rsi + 8]
mov r9d, 3
shr rdx, 3
mov r8d, 0x9e
sub edi, edx
mov dword [rsp + 0x80], 0x2e726570
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
lea rax, str.NvcLoadStats___LibraryLoadTime___u_us__InitializeTime___u_us__StartTime___u_us__TotalLoadTime___u_us
mov qword [rsp + 0x20], rax
mov word [rsp + 0x84], 0x68
call fcn.7ff72e2d6af0
mov r8d, dword [rsi + 8]
mov r9d, edi
mov edx, dword [rsi + 4]
mov ecx, dword [rsi]
call fcn.7ff72e2ddf50
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp + 8]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xa6
lea rax, str.NvcLoadStats_returned__u
mov dword [rsp + 0x80], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x84], 0x68
call fcn.7ff72e2d6af0
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.7ff72e329d50
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rsi
ret
Function at 0x7ff72e2c8240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test rdx, rdx
je 0x7ff72e2c7fd6
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp dword [rdx + 0xc], 0
mov rdi, rdx
mov rsi, rcx
ja 0x7ff72e2c7e32
cmp dword [rdx + 0x10], 0
ja 0x7ff72e2c7e32
cmp dword [rdx + 0x14], 0
jbe 0x7ff72e2c7fc0
mov qword [rsp + 0x100], rbx
call fcn.7ff72e2d2760
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov rbx, rax
mov eax, dword [rdi + 0x14]
mov r9d, 3
sub ebx, dword [rdi + 0x20]
mov r8d, 0xbf
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0xc]
mov dword [rsp + 0x28], eax
lea rax, str.NvcUnloadStats___StopTime___u_us__UninitializeTime___u_us__DestroyPluginsTime___u_us__TotalUnloadTime___u_us
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.7ff72e2d6af0
mov r8d, dword [rdi + 0x14]
mov r9d, ebx
mov edx, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
call fcn.7ff72e2de100
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xc7
lea rax, str.NvcUnloadStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.7ff72e2d6af0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rbp - 0x19]
mov rcx, rax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov rbx, qword [rsp + 0x100]
cmp eax, 1
jne 0x7ff72e2c7fc0
mov rcx, qword [rbp + 0x27]
lea rdx, [rbp - 0x39]
mov rax, qword [rbp - 0x11]
mov r9d, 3
movdqa xmm0, xmmword [str.NvcTelemetryHel]
mov r8d, 0xd8
shr rcx, 0x14
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi]
shr rax, 0x14
mov qword [rsp + 0x28], rax
lea rax, str.NvcMemoryStats___PeakWorkingSetSize___u_MB__PeakPagefileUsage___u_MB
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.7ff72e2d6af0
mov rdx, qword [rbp + 0x27]
mov rcx, qword [rbp - 0x11]
call fcn.7ff72e2ddf90
movdqa xmm0, xmmword [str.NvcTelemetryHel]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xde
lea rax, str.NvcMemoryStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.7ff72e2d6af0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rcx + 0x148]
add rcx, 8
jmp 0x7ff72e2c7df0
Function at 0x7ff72e2c8250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x7ff72e3c3a28]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_starting
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x4ad
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.7ff72e2d6af0
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x7ff72e2c83db
lea r14, [0x7ff72e396010]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x7ff72e2c839b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x7ff72e2c8364
cmp eax, 6
jae 0x7ff72e2c8364
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x7ff72e2c836b
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4b4
mov rcx, r10
call fcn.7ff72e2d6af0
jmp 0x7ff72e2c83b1
mov rdx, qword [rsi + 0x138]
mov rcx, rbx
call fcn.7ff72e2cdc60
movzx edi, al
test al, al
je 0x7ff72e2c83ed
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x7ff72e2c8310
test dil, dil
je 0x7ff72e2c83ed
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 4]
call fcn.7ff72e2c4720
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_started_with__d
mov rcx, rsi
call fcn.7ff72e2c5120
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x7ff72e2c843e
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.7ff72e2c8460
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.7ff72e329d50
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret