joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004df16
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], 0
je 0x14004dfda
lea rcx, [0x1403eb942]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call fcn.14004f39c
mov rcx, r14
call fcn.14004f39c
test ebp, ebp
js 0x14004dfda
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.14004b3b7
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x14004dfe9
mov qword [rdi], 2
mov rcx, rsi
call fcn.14004b2f8
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14004e7fc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, dword [0x140051140]
test esi, esi
je 0x14004e8c4
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x14004e8b7
je 0x14004e8b5
test rbx, rbx
je 0x14004e84d
mov rax, qword [rbx]
and qword [rbx], 0
test rax, rax
je 0x14004e84d
mov r14, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
jmp 0x14004e86c
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov edx, 0x10
mov rcx, rdi
call sub.bcryptprimitives.dll_ProcessPrng
mov r14, qword [rdi]
mov rbx, qword [rdi + 8]
mov ecx, 8
mov edx, 0x18
call fcn.14000eec4
test rax, rax
je 0x14004e8d7
mov rdi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov dword [rax + 0x10], esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rbx, rax
mov ecx, esi
mov rdx, rdi
call sub.kernel32.dll_TlsSetValue
test rbx, rbx
je 0x14004e8b7
mov edx, 8
mov rcx, rbx
call fcn.140007e10
jmp 0x14004e8b7
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140051128]
call fcn.14001e450
mov esi, eax
jmp 0x14004e818
mov ecx, 8
mov edx, 0x18
call fcn.140008e80
int3

Function at 0x1400500c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140050e80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140050e80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140050130
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1403f61d4]
mov rbx, rcx
test esi, esi
jle 0x140050260
mov rax, qword [0x1403f61d8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14005017b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140050205
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140050160
mov rcx, rbx
call fcn.140050ba0
mov rdi, rax
test rax, rax
je 0x140050282
mov rax, qword [0x1403f61d8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140050ce0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1403f61d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140050267
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400501fe
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140050210
add dword [0x1403f61d4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1403f61d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1400501fe
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400500c0
nop dword [rax]
xor esi, esi
jmp 0x140050188
mov rax, qword [0x1403f61d8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400500c0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400500c0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140050810
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1403f6240]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1403f6220]
test rbx, rbx
je 0x14005086c
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140050863
test eax, eax
jne 0x140050863
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140050848
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140050ba0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1403ec570]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140050bc0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140050bc8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140050bc0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140050c1d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140050c14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140050bc0
add rax, 0x28
cmp rax, r9
jne 0x140050c00
xor eax, eax
ret

Function at 0x140050c20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403ec570]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140050c3f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140050c48
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140050c3f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140050ce0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1403ec570]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140050cff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140050d08
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400047f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, edx
mov rbp, rcx
xor edx, edx
call fcn.140008ee0
movzx esi, al
test al, al
je 0x14000486e
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x1400048ee
nop dword [rax + rax]
mov edi, dword [rbx + 0xe4]
lea ecx, [rdi - 3]
cmp ecx, 1
ja 0x14000485d
mov rdx, rbx
mov rcx, rbp
call fcn.140004e80
cmp byte [rbx + 0x148], 0
jne 0x14000486b
cmp edi, 4
jne 0x14000485d
cmp byte [rbx + 0x48], 0
jne 0x14000486b
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x140004830
jmp 0x1400048ea
xor sil, sil
cmp r14d, 8
ja 0x14000487f
mov eax, 0x141
bt eax, r14d
jb 0x1400048ea
mov rbx, qword [rbp + 8]
mov ecx, r14d
mov dword [rsp + 0x30], 0x63764e5c
mov dword [rsp + 0x34], 0x74736f48
mov dword [rsp + 0x38], 0x7070632e
mov byte [rsp + 0x3c], 0
call fcn.140006640
mov qword [rsp + 0x28], rax
lea rdi, str.Failed_to_complete_transition_to__s
mov r9d, 1
mov qword [rsp + 0x20], rdi
mov r8d, 0x404
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140022460
mov ecx, r14d
call fcn.140006640
mov r8, rax
mov rdx, rdi
mov ecx, 0xc
call fcn.1400080b0
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006b950
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x1400e2104]
mov ecx, 0x1a0
call fcn.14006be84
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140004d44
mov edx, dword [rdi + 0x3a8]
lea ecx, [rdx + 1]
mov dword [rdi + 0x3a8], ecx
lea rcx, [rdi + 0x150]
lea r9, [rdi + 0x18]
lea r8, [rdi + 8]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rax
call fcn.14000bb50
mov rsi, rax
jmp 0x140004d46
xor esi, esi
test rsi, rsi
jne 0x140004dbf
mov dword [rbp - 0x20], 0x63764e5c
mov dword [rbp - 0x1c], 0x74736f48
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], sil
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004d71
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rsi, str.Failed_to_allocate_plugin_entry_for__ls
mov qword [rsp + 0x20], rsi
mov r9d, 1
mov r8d, 0xa8
lea rdx, [rbp - 0x20]
mov rcx, qword [rdi + 8]
call fcn.1400226f0
cmp qword [rbx + 0x18], 8
jb 0x140004da5
mov rbx, qword [rbx]
mov r8, rbx
mov rdx, rsi
mov ecx, 0x2a
call fcn.140008170
mov eax, 1
jmp 0x140004e5b
mov rdx, rbx
mov rcx, rsi
call fcn.14000c680
test al, al
jne 0x140004e36
mov dword [rbp - 0x20], 0x63764e5c
mov dword [rbp - 0x1c], 0x74736f48
mov dword [rbp - 0x18], 0x7070632e
mov byte [rbp - 0x14], al
cmp qword [rbx + 0x18], 8
jb 0x140004df0
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
lea rax, str.Failed_to_load_library__ls
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0xaf
lea rdx, [rbp - 0x20]
mov rcx, qword [rdi + 8]
call fcn.1400226f0
mov rcx, rsi
call fcn.14000bd30
mov edx, 0x1a0
mov rcx, rsi
call fcn.14006b8b4
mov eax, 2
jmp 0x140004e5b
cmp qword [rdi + 0x28], 0
jne 0x140004e43
mov qword [rdi + 0x28], rsi
jmp 0x140004e55
mov rax, qword [rdi + 0x30]
mov qword [rax + 0xf0], rsi
mov qword [rsi + 0xf8], rax
mov qword [rdi + 0x30], rsi
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006b950
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rdx
mov rdi, rcx
lea r9, [rcx + 8]
mov r8, rcx
mov edx, dword [rcx + 0x3a0]
lea rcx, [rsp + 0x78]
call fcn.14000f030
nop
mov ecx, dword [rsi + 0xe0]
cmp ecx, 1
jl 0x140004ff7
mov dword [rsp + 0xa0], 0x63764e5c
mov dword [rsp + 0xa4], 0x74736f48
mov dword [rsp + 0xa8], 0x7070632e
mov byte [rsp + 0xac], 0
mov rbx, qword [rdi + 8]
call fcn.140006640
lea rbp, [rsi + 0xa0]
lea rdx, str.Mandatory
lea rcx, str.Optional
cmp byte [rsi + 0x48], 0
cmovne rcx, rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
lea rax, str._s_plugin__s_is_in_state__s._Unload_it
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x228
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call fcn.140022460
mov r8, rbp
lea rdx, str.Container_is_going_to_unload_plugin__s
mov rcx, rdi
call fcn.1400051f0
mov eax, dword [rsi + 0x198]
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
cmp dword [rsi + 0xe0], 3
jl 0x140004fc1
mov rcx, rsi
call fcn.14000e330
mov rcx, qword [rdi + 0x150]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x10]
call qword [0x1400d7670]
mov r8, rbp
lea rdx, str.Container_has_stopped_plugin__s
mov rcx, rdi
call fcn.1400051f0
mov rcx, rsi
call fcn.14000e730
mov rcx, qword [rdi + 0x150]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x10]
call qword [0x1400d7670]
mov r8, rbp
lea rdx, str.Container_has_uninitialized_plugin__s
mov rcx, rdi
call fcn.1400051f0
mov rcx, rsi
call fcn.14000e8b0
nop
lea rcx, [rsp + 0x78]
call fcn.14000f170
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006b950
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x70
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x398]
test rcx, rcx
je 0x140005069
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x1400d7670]
xor ebp, ebp
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rdi + 0x398], rbp
cmp qword [rdi + 0x28], rbp
je 0x1400050e6
mov edx, dword [rdi + 0x3a0]
lea r9, [rdi + 8]
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.14000f030
mov rsi, qword [rdi + 0x30]
test rsi, rsi
je 0x1400050d4
nop dword [rax + rax]
mov rbx, rsi
mov rsi, qword [rsi + 0xf8]
mov rcx, rbx
call fcn.14000bd30
mov edx, 0x1a0
mov rcx, rbx
call fcn.14006b8b4
test rsi, rsi
jne 0x1400050b0
lea rcx, [rsp + 0x30]
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x28], rbp
call fcn.14000f170
mov rax, qword [rdi + 0x3b0]
test rax, rax
je 0x14000514b
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov r9d, 4
lea rax, str.Kill_test_time_timer__p
mov dword [rsp + 0x58], 0x63764e5c
mov dword [rsp + 0x5c], 0x74736f48
mov dword [rsp + 0x60], 0x7070632e
lea r8d, [r9 + 0x6b]
mov byte [rsp + 0x64], bpl
mov qword [rsp + 0x20], rax
call fcn.140022460
mov rcx, qword [rdi + 0x3b0]
call fcn.14001dc10
mov qword [rdi + 0x3b0], rbp
cmp qword [rdi + 0x150], rbp
je 0x1400051b2
mov rbx, qword [rdi + 0x158]
mov qword [rdi + 0x150], rbp
mov qword [rdi + 0x158], rbp
test rbx, rbx
je 0x1400051a8
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400051a8
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [0x1400d7670]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400051a8
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x1400d7670]
mov dword [rdi + 0x3a8], 0x8000
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov byte [rdi + 0x160], bpl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006b950
mov rbp, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x140005520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rsp + 0x50], 0x63764e5c
mov rcx, qword [rcx + 8]
lea rax, str.Plugins_in_state_transition__
mov r9d, 3
mov qword [rsp + 0x20], rax
mov r8d, 0x40c
mov dword [rsp + 0x54], 0x74736f48
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], 0x7070632e
mov byte [rsp + 0x5c], 0
call fcn.140022460
mov rbx, qword [rdi + 0x28]
xor esi, esi
test rbx, rbx
je 0x140005796
mov qword [rsp + 0x138], r12
lea r8, str.Uninitialized
mov qword [rsp + 0x140], r13
lea r12, str.Unverified
mov qword [rsp + 0x148], r14
lea r13, str.Done
mov qword [rsp + 0x100], r15
lea r14, [0x1400d8060]
lea r15, str.Active
lea rdx, str.Error
lea r11, str.Disabled
nop word [rax + rax]
movsxd rcx, dword [rbx + 0xe0]
mov eax, ecx
sub eax, 1
je 0x140005616
sub eax, 2
je 0x140005616
sub eax, 2
je 0x140005616
sub eax, 2
je 0x140005616
cmp eax, 2
jne 0x140005766
cmp byte [rbx + 0x48], 0
lea rax, str.Mandatory
mov r10, qword [rdi + 8]
lea r9, str.Optional
cmovne r9, rax
mov dword [rsp + 0x60], 0x63764e5c
mov dword [rsp + 0x64], 0x74736f48
lea rax, str.Initializing
mov qword [rbp - 0x58], rax
lea rax, str.Initialized
mov qword [rbp - 0x50], rax
lea rax, str.Starting
mov qword [rbp - 0x48], rax
lea rax, str.Started
mov qword [rbp - 0x40], rax
lea rax, str.Suspending
mov qword [rbp - 0x38], rax
lea rax, str.Suspended
mov qword [rbp - 0x30], rax
lea rax, str.Stopping
mov qword [rbp - 0x28], rax
lea rax, str.Stopped
mov qword [rbp - 0x20], rax
lea rax, str.Uninitializing
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x68], 0x7070632e
mov byte [rsp + 0x6c], 0
mov qword [rbp - 0x60], r8
test ecx, ecx
js 0x1400056c7
cmp ecx, 0xa
jae 0x1400056c7
lfence
mov r8, qword [rbp + rcx*8 - 0x60]
jmp 0x1400056ce
lea r8, str.Invalid
movsxd rax, dword [rbx + 0xe4]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], r11
test eax, eax
js 0x140005702
cmp eax, 6
jae 0x140005702
lfence
mov rcx, qword [rsp + rax*8 + 0x70]
jmp 0x140005709
lea rcx, str.Invalid
mov qword [rsp + 0x48], r9
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x40], r8
mov edx, esi
mov qword [rsp + 0x38], rcx
inc esi
mov qword [rsp + 0x30], rax
mov r9d, 3
mov dword [rsp + 0x28], edx
lea rax, str._____u:___20s____s___s___s
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0x41d
mov rcx, r10
call fcn.140022460
lea rdx, str.Error
lea r11, str.Disabled
lea r8, str.Uninitialized
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x1400055f0
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x140]
mov r12, qword [rsp + 0x138]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006b950
add rsp, 0x108
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rbx, qword [rcx + 0x28]
mov edi, 0x40
sub edi, dword [r9]
mov r15, r9
mov qword [rbp - 0x31], r8
mov r12d, edx
mov dword [rbp - 0x39], edi
mov r13, rcx
test rbx, rbx
je 0x140005abc
lea rsi, str.Ignore_inactive_plugin__s
cmp qword [rbx + 0x50], 0
lea rcx, str.Ignore_unloaded_plugin__s
jne 0x1400059aa
lea rax, [rbx + 0xa0]
mov dword [rbp - 0x21], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
mov r8d, 0x2d5
mov dword [rbp - 0x1d], 0x74736f48
mov dword [rbp - 0x19], 0x7070632e
mov byte [rbp - 0x15], 0
jmp 0x140005a99
mov r14d, dword [rbx + 0xe4]
lea eax, [r14 - 3]
cmp eax, 1
jbe 0x140005a5a
test r12d, r12d
je 0x140005a3e
cmp r12d, r14d
je 0x140005a3e
mov rsi, qword [r13 + 8]
mov ecx, r12d
mov dword [rbp - 0x11], 0x63764e5c
mov dword [rbp - 0xd], 0x74736f48
mov dword [rbp - 9], 0x7070632e
mov byte [rbp - 5], 0
call fcn.140006710
mov ecx, r14d
mov rdi, rax
call fcn.140006710
mov qword [rsp + 0x38], rdi
lea rcx, [rbx + 0xa0]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
lea rax, str.Skip_plugin__s._Status__s____s
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r9d, 5
mov r8d, 0x2e8
call fcn.140022460
mov edi, dword [rbp - 0x39]
lea rsi, str.Ignore_inactive_plugin__s
jmp 0x140005aa8
mov eax, dword [r15]
cmp eax, edi
jae 0x140005ade
mov ecx, eax
mov eax, dword [rbx + 0x198]
mov dword [r8 + rcx*4], eax
inc dword [r15]
jmp 0x140005aac
mov rdx, rbx
mov rcx, r13
call fcn.140004e80
lea rax, [rbx + 0xa0]
mov dword [rbp - 1], 0x63764e5c
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 1]
mov qword [rsp + 0x20], rsi
mov r8d, 0x2de
mov dword [rbp + 3], 0x74736f48
mov dword [rbp + 7], 0x7070632e
mov byte [rbp + 0xb], 0
mov rcx, qword [r13 + 8]
mov r9d, 4
call fcn.140022460
mov r8, qword [rbp - 0x31]
mov rbx, qword [rbx + 0xf0]
test rbx, rbx
jne 0x140005963
mov al, 1
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14006b950
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lfence
mov rcx, qword [r13 + 8]
lea rbx, str.Plugin_count_exceeded_maximum_allowed__u
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x31]
mov r9d, 1
mov qword [rsp + 0x20], rbx
mov r8d, 0x2f1
mov dword [rbp - 0x31], 0x63764e5c
mov dword [rbp - 0x2d], 0x74736f48
mov dword [rbp - 0x29], 0x7070632e
mov byte [rbp - 0x25], 0
call fcn.140022460
mov r8d, edi
mov rdx, rbx
mov ecx, 0x21
call fcn.1400080b0
xor al, al
jmp 0x140005abe
Function at 0x140005cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140106b98]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 0x10], rbx
lea rax, str.Container_is_initializing
mov qword [r11 + 0x18], r12
lea rdx, [rbp - 0x29]
mov qword [r11 + 0x20], r13
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 3
mov qword [r11 - 0x20], r14
mov r8d, 0x461
mov qword [r11 - 0x28], r15
mov dil, 1
mov dword [rbp - 0x29], 0x63764e5c
mov dword [rbp - 0x25], 0x74736f48
mov dword [rbp - 0x21], 0x7070632e
mov byte [rbp - 0x1d], 0
mov qword [rsp + 0x20], rax
call fcn.140022460
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x140005e44
lea r14, [0x1400d8060]
lea r15, str.Active
lea r12, str.Unverified
lea r13, str.Done
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
nop word [rax + rax]
movsxd rax, dword [rbx + 0xe4]
cmp eax, 1
je 0x140005e0b
mov r10, qword [rsi + 8]
mov dword [rbp - 0x19], 0x63764e5c
mov dword [rbp - 0x15], 0x74736f48
mov dword [rbp - 0x11], 0x7070632e
mov byte [rbp - 0xd], 0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r15
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rdx
test eax, eax
js 0x140005dd4
cmp eax, 6
jae 0x140005dd4
lfence
mov rcx, qword [rbp + rax*8 - 9]
jmp 0x140005ddb
lea rcx, str.Invalid
mov qword [rsp + 0x30], rcx
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], r8
mov r9d, 5
mov r8d, 0x468
mov rcx, r10
call fcn.140022460
jmp 0x140005e1a
mov rcx, rbx
call fcn.14000c320
movzx edi, al
test al, al
je 0x140005e56
mov rbx, qword [rbx + 0xf0]
lea rcx, str.Error
lea rdx, str.Disabled
lea r8, str.Skip_plugin__s._Status__s
test rbx, rbx
jne 0x140005d80
test dil, dil
je 0x140005e56
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 2]
call fcn.1400047f0
movzx edi, al
movzx r8d, dil
lea rdx, str.Container_is_initialized_with__d
mov rcx, rsi
call fcn.1400051f0
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test dil, dil
jne 0x140005ea7
xor edx, edx
mov byte [rsi + 0x144], 1
mov rcx, rsi
call fcn.140008a70
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14006b950
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret