joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], 0
lea rsi, [rcx + 8]
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140006002
mov rax, qword [rdx]
mov qword [rsp + 0x28], rax
lea rax, str.Load_plugins_from__ls
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x131
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.1400226f0
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x1400d7670]
test al, al
je 0x1400060e4
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006052
mov rcx, qword [rbx]
call fcn.14001e2f0
test al, al
jne 0x1400060cf
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], al
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006084
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rdi, str.File__ls_is_not_supported
mov qword [rsp + 0x20], rdi
mov r9d, 1
mov r8d, 0x137
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.1400226f0
cmp qword [rbx + 0x18], 8
jb 0x1400060b8
mov rbx, qword [rbx]
mov r8, rbx
mov rdx, rdi
mov ecx, 0x2c
call fcn.140008170
xor al, al
jmp 0x140006192
mov rdx, rbx
mov rcx, rdi
call fcn.140004cd0
test eax, eax
sete al
jmp 0x140006192
mov r14d, 1
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x1400d7670]
mov ecx, 0x11
test al, al
cmovne r14d, ecx
cmp qword [rbx + 0x18], 8
jb 0x140006110
mov rbx, qword [rbx]
mov r9d, r14d
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14002ac40
lea rax, vtable.nvc::HostDirectoryEnumerator.0
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x168], rdi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14002acb0
movzx esi, al
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x14000618e
mov edi, 0xffffffff
mov ecx, edi
lock xadd dword [rbx + 8], ecx
cmp ecx, 1
jne 0x14000618e
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx]
call qword [0x1400d7670]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14000618e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x1400d7670]
movzx eax, sil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14006b950
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400067b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rdi, rcx
call fcn.140008ee0
test al, al
je 0x140006818
nop
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140006805
cmp byte [rax + 0x148], 0
jne 0x1400068b5
cmp dword [rax + 0xe4], 4
jne 0x140006805
cmp byte [rax + 0x48], 0
jne 0x140006839
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140008ee0
test al, al
jne 0x1400067e0
cmp byte [rdi + 0x144], 0
sete al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006b950
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x68], rbx
mov r9d, 1
lea rbx, [rax + 0xa0]
mov qword [rsp + 0x70], rsi
lea rsi, str.Base_host:_mandatory_plugin__s_has_failed._Exit
mov qword [rsp + 0x28], rbx
mov r8d, 0x20c
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x20], 0x63764e5c
mov dword [rbp - 0x1c], 0x74736f48
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.140022460
mov r8, rbx
mov rdx, rsi
mov ecx, 0x29
call fcn.1400080b0
mov rsi, qword [rsp + 0x70]
xor al, al
mov rbx, qword [rsp + 0x68]
mov byte [rdi + 0x144], 1
jmp 0x140006822
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
add rax, 0xa0
mov dword [rbp - 0x20], 0x63764e5c
mov qword [rsp + 0x28], rax
mov r9d, 2
lea rax, str.Base_host:_plugin__s_has_requested_restart._Exit
mov dword [rbp - 0x1c], 0x74736f48
mov r8d, 0x202
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], 0
call fcn.140022460
xor al, al
mov byte [rdi + 0x144], 1
jmp 0x140006822
Function at 0x140007630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xc8
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov dword [rbp - 0x39], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Container_is_resuming
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x4e6
mov dword [rbp - 0x35], 0x74736f48
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x31], 0x7070632e
mov byte [rbp - 0x2d], 0
call fcn.140022460
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400d7670]
test al, al
je 0x1400076ed
mov rcx, qword [rdi + 8]
lea rax, str.Force_terminate_container_as_it_is_resuming_is_safe_mode
mov r9d, 1
mov qword [rsp + 0x20], rax
mov r8d, 0x4ea
mov dword [rbp - 0x29], 0x63764e5c
lea rdx, [rbp - 0x29]
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
call fcn.140022460
mov byte [rdi + 0x144], 1
jmp 0x140007882
mov qword [rsp + 0xe8], rbx
mov rbx, qword [rdi + 0x28]
mov qword [rsp + 0xf0], rsi
mov sil, 1
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
test rbx, rbx
je 0x14000782d
lea r14, [0x1400d8060]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x1400077eb
mov r10, qword [rdi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x1400077b4
cmp eax, 6
jae 0x1400077b4
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x1400077bb
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4f6
mov rcx, r10
call fcn.140022460
jmp 0x1400077fa
mov rcx, rbx
call fcn.14000d610
movzx esi, al
test al, al
je 0x140007824
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x140007760
test sil, sil
jne 0x14000782d
mov byte [rdi + 0x144], 1
jmp 0x14000783f
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 4]
call fcn.1400047f0
movzx esi, al
movzx r8d, sil
lea rdx, str.Container_is_resumed_with__d
mov rcx, rdi
call fcn.1400051f0
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14006b950
add rsp, 0xc8
pop rdi
pop rbp
ret
Function at 0x140007b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, qword [rcx + 0x148]
mov rbp, rcx
test rsi, rsi
je 0x140007d07
cmp dword [rsi], 0
ja 0x140007bd7
cmp dword [rsi + 4], 0
ja 0x140007bd7
cmp dword [rsi + 8], 0
jbe 0x140007d07
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, 1
jne 0x140007d07
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0xb0], rdi
call fcn.14001e1f0
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
mov rdi, rax
mov rcx, qword [rbp + 8]
movabs rax, 0xcccccccccccccccd
mul rbx
movdqu xmmword [rsp + 0x70], xmm0
mov eax, dword [rsi + 8]
mov r9d, 3
shr rdx, 3
mov r8d, 0x9e
sub edi, edx
mov dword [rsp + 0x80], 0x2e726570
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
lea rax, str.NvcLoadStats___LibraryLoadTime___u_us__InitializeTime___u_us__StartTime___u_us__TotalLoadTime___u_us
mov qword [rsp + 0x20], rax
mov word [rsp + 0x84], 0x68
call fcn.140022460
mov r8d, dword [rsi + 8]
mov r9d, edi
mov edx, dword [rsi + 4]
mov ecx, dword [rsi]
call fcn.140029730
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp + 8]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xa6
lea rax, str.NvcLoadStats_returned__u
mov dword [rsp + 0x80], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x84], 0x68
call fcn.140022460
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14006b950
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rsi
ret
Function at 0x140008310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test rdx, rdx
je 0x1400080a6
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp dword [rdx + 0xc], 0
mov rdi, rdx
mov rsi, rcx
ja 0x140007f02
cmp dword [rdx + 0x10], 0
ja 0x140007f02
cmp dword [rdx + 0x14], 0
jbe 0x140008090
mov qword [rsp + 0x100], rbx
call fcn.14001e1f0
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov rbx, rax
mov eax, dword [rdi + 0x14]
mov r9d, 3
sub ebx, dword [rdi + 0x20]
mov r8d, 0xbf
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0xc]
mov dword [rsp + 0x28], eax
lea rax, str.NvcUnloadStats___StopTime___u_us__UninitializeTime___u_us__DestroyPluginsTime___u_us__TotalUnloadTime___u_us
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.140022460
mov r8d, dword [rdi + 0x14]
mov r9d, ebx
mov edx, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
call fcn.1400298e0
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xc7
lea rax, str.NvcUnloadStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.140022460
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rbp - 0x19]
mov rcx, rax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov rbx, qword [rsp + 0x100]
cmp eax, 1
jne 0x140008090
mov rcx, qword [rbp + 0x27]
lea rdx, [rbp - 0x39]
mov rax, qword [rbp - 0x11]
mov r9d, 3
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
mov r8d, 0xd8
shr rcx, 0x14
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi]
shr rax, 0x14
mov qword [rsp + 0x28], rax
lea rax, str.NvcMemoryStats___PeakWorkingSetSize___u_MB__PeakPagefileUsage___u_MB
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x2e726570
mov word [rbp - 0x25], 0x68
call fcn.140022460
mov rdx, qword [rbp + 0x27]
mov rcx, qword [rbp - 0x11]
call fcn.140029770
movdqa xmm0, xmmword [str.NvcTelemetryHelP]
lea rdx, [rbp - 0x39]
mov rcx, qword [rsi]
mov r9d, 3
mov dword [rsp + 0x28], eax
mov r8d, 0xde
lea rax, str.NvcMemoryStats_returned__u
mov dword [rbp - 0x29], 0x2e726570
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x25], 0x68
call fcn.140022460
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14006b950
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rcx + 0x148]
add rcx, 8
jmp 0x140007ec0
Function at 0x140008320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_starting
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x4ad
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.140022460
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x1400084ab
lea r14, [0x1400d8060]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x14000846b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x140008434
cmp eax, 6
jae 0x140008434
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x14000843b
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x4b4
mov rcx, r10
call fcn.140022460
jmp 0x140008481
mov rdx, qword [rsi + 0x138]
mov rcx, rbx
call fcn.14000dd30
movzx edi, al
test al, al
je 0x1400084bd
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x1400083e0
test dil, dil
je 0x1400084bd
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 4]
call fcn.1400047f0
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_started_with__d
mov rcx, rsi
call fcn.1400051f0
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x14000850e
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.140008530
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14006b950
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x40], 0x63764e5c
mov dword [rbp - 0x3c], 0x74736f48
mov dword [rbp - 0x38], 0x7070632e
mov byte [rbp - 0x34], 0
lea rax, str.Update_plugins
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x14a
lea rdx, [rbp - 0x40]
mov rcx, qword [rcx + 8]
call fcn.140022460
mov byte [rdi + 0x5c0], 1
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400d7670]
test al, al
je 0x140008d16
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x140008d07
nop dword [rax]
mov ecx, dword [rax + 0xe4]
cmp ecx, 5
je 0x140008cfb
mov dword [rax + 0xe8], ecx
mov dword [rax + 0xe4], 2
mov rax, qword [rax + 0xf0]
test rax, rax
jne 0x140008ce0
lea rdx, str.Container_marked_plugins_as_unverified
mov rcx, rdi
call fcn.1400051f0
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
mov rax, qword [rax + 0x68]
call qword [0x1400d7670]
nop
mov rdx, rax
mov rcx, rdi
call fcn.140005fa0
movzx esi, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140008d7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ece
call fcn.14006b8b4
test sil, sil
je 0x140008ea2
mov edx, 2
mov rcx, rdi
call fcn.140008530
mov edx, 2
mov rcx, rdi
call fcn.140008a70
lea r9, [rdi + 8]
mov r8, rdi
mov edx, dword [rdi + 0x3a0]
lea rcx, [rbp - 0x30]
call fcn.14000f030
nop
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x140008ddd
nop dword [rax]
cmp dword [rbx + 0xe4], 2
jne 0x140008dd1
mov rcx, rbx
call fcn.14000c180
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x140008dc0
lea rdx, str.Container_processed_disabled_plugins
mov rcx, rdi
call fcn.1400051f0
nop
lea rcx, [rbp - 0x30]
call fcn.14000f170
cmp byte [rdi + 0x161], 0
je 0x140008e88
mov dword [rbp - 0x40], 0x63764e5c
mov dword [rbp - 0x3c], 0x74736f48
mov dword [rbp - 0x38], 0x7070632e
mov byte [rbp - 0x34], 0
lea rax, str.Container_is_in_suspended_state._Skipping_plugin_initialization_and_start
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x184
lea rdx, [rbp - 0x40]
mov rcx, qword [rdi + 8]
call fcn.140022460
mov byte [rdi + 0x162], 1
mov dword [rbp - 0x40], 0x63764e5c
mov dword [rbp - 0x3c], 0x74736f48
mov dword [rbp - 0x38], 0x7070632e
mov byte [rbp - 0x34], 0
lea rax, str.Directory_change_event_is_queued_to_update_plugins_after_resuming_from_suspend
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x186
lea rdx, [rbp - 0x40]
mov rcx, qword [rdi + 8]
call fcn.140022460
jmp 0x140008ea2
mov rcx, rdi
call fcn.140005cc0
movzx esi, al
test al, al
je 0x140008ea2
mov rcx, rdi
call fcn.140008320
movzx esi, al
mov byte [rdi + 0x5c0], 0
movzx eax, sil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006b950
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14007ce08
int3
Function at 0x14000b4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r12
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r8d, dword [0x140109ec0]
mov r14, rcx
mov rax, qword gs:[0x58]
mov r12d, 0x14
mov r15, qword [rax + r8*8]
mov ecx, dword [r12 + r15]
test ecx, ecx
je 0x14000b6b7
movdqa xmm0, xmmword [str.VectoredExceptikernel32]
lea eax, [rcx - 5]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x6f4c6e6f
mov r9d, 2
mov dword [rbp + 0xb], 0x72656767
mov r8d, 0xbd
mov dword [rbp + 0xf], 0x7070632e
mov byte [rbp + 0x13], 0
mov qword [rsp + 0x80], rsi
xor esi, esi
cmp ecx, 5
mov rcx, qword [rdx]
lea rdx, [rbp - 9]
cmovae esi, eax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx]
mov rcx, qword [r14 + 0x10]
mov dword [rsp + 0x28], eax
lea rax, [0x1400d9740]
mov qword [rsp + 0x20], rax
call fcn.140022460
cmp esi, dword [r12 + r15]
jae 0x14000b6a7
mov qword [rsp + 0xc0], rbx
lea r9, str.Exception:_0x_x_at_Address_0x_p._Stack_Backtrace:
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r13
lea r13, str.0x_p
mov r8d, 0x20
nop dword [rax + rax]
movdqa xmm0, xmmword [str.VectoredExceptikernel32]
mov eax, 0xcccccccd
mul esi
movdqu xmmword [rbp - 9], xmm0
mov ecx, esi
mov dword [rbp + 7], 0x6f4c6e6f
shr edx, 2
mov dword [rbp + 0xb], 0x72656767
mov dword [rbp + 0xf], 0x7070632e
mov byte [rbp + 0x13], 0
lea eax, [rdx + rdx*4]
sub ecx, eax
lea rdx, [rbp - 9]
mov eax, ecx
mov rcx, qword [r14 + 0x10]
imul rbx, rax, 0xb0
add rbx, r8
mov r8d, 0xc2
add rbx, r15
mov rax, qword [rbx + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, 2
call fcn.140022460
xor edi, edi
add rbx, 0x10
nop dword [rax]
mov rax, qword [rbx]
test rax, rax
je 0x14000b67c
movdqa xmm0, xmmword [str.VectoredExceptikernel32]
lea rdx, [rbp - 9]
mov rcx, qword [r14 + 0x10]
mov r9d, 2
mov qword [rsp + 0x28], rax
mov r8d, 0xc7
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x6f4c6e6f
mov dword [rbp + 0xb], 0x72656767
mov dword [rbp + 0xf], 0x7070632e
mov byte [rbp + 0x13], 0
mov qword [rsp + 0x20], r13
call fcn.140022460
inc edi
add rbx, 8
cmp edi, 0x14
jb 0x14000b620
inc esi
mov r8d, 0x20
lea r9, str.Exception:_0x_x_at_Address_0x_p._Stack_Backtrace:
cmp esi, dword [r12 + r15]
jb 0x14000b5a0
mov r13, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x80]
mov dword [r12 + r15], 0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14006b950
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbp
ret
Function at 0x14000f7c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, r8
mov rdi, rcx
mov qword [rbp - 0x30], rcx
call fcn.140009fd0
nop
lea rax, vtable.nvc::ServiceHost.0
mov qword [rdi], rax
xor r15d, r15d
mov qword [rdi + 0x600], r15
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea rdx, [rdi + 0x608]
mov rax, qword [rax + 0x70]
call qword [0x1400d7670]
nop
mov qword [rdi + 0x628], r15
mov qword [rdi + 0x630], r15
movdqa xmm0, xmmword [str.NvcServiceHost..]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x707063
lea rax, str.Service_host
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 4]
lea r8d, [r15 + 0x28]
lea rdx, [rbp - 0x28]
mov rcx, qword [rdi + 8]
call fcn.140022460
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 0x5e0], xmm0
mov qword [rdi + 0x5f0], rax
mov dword [rdi + 0x5f8], eax
mov dword [rdi + 0x5e0], 0x10
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x628], rax
mov qword [0x140109208], rdi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140011320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000f941
movdqa xmm0, xmmword [str.NvcServiceHost..]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x707063
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r14, str.Service_host:_failed_to_create_ServiceThread._Error__u
mov qword [rsp + 0x20], r14
lea r9d, [r15 + 1]
lea r8d, [r15 + 0x38]
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140022460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r14
lea ecx, [r15 + 0x11]
call fcn.1400080b0
lea rax, [rdi + 0x608]
cmp qword [rdi + 0x620], 8
jb 0x14000f934
mov rax, qword [rdi + 0x608]
mov qword [rdi + 0x618], r15
mov word [rax], r15w
jmp 0x14000f94a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x628]
test rcx, rcx
je 0x14000f99e
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movdqa xmm0, xmmword [str.NvcServiceHost..]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x707063
mov dword [rsp + 0x28], eax
lea rax, str.Service_host:_wait_completed_with__u
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8d, [r9 + 0x4a]
lea rdx, [rbp - 0x28]
mov rcx, qword [rdi + 8]
call fcn.140022460
jmp 0x14000f9e2
movdqa xmm0, xmmword [str.NvcServiceHost..]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x707063
lea rbx, str.Service_host_failed
mov qword [rsp + 0x20], rbx
mov r9d, 1
lea r8d, [r9 + 0x52]
lea rdx, [rbp - 0x28]
mov rcx, qword [rdi + 8]
call fcn.140022460
mov rdx, rbx
mov ecx, 0x12
call fcn.1400080b0
mov rcx, rdi
call fcn.140011360
nop
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006b950
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret