joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x48
mov rdx, qword [0x140143798]
xor r9d, r9d
mov r8, rcx
mov eax, 0xcff20a67
test rdx, rdx
jne 0x1400627f9
mov r8, qword [0x1401436b0]
mov edx, r9d
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test r8, r8
je 0x1400627a0
mov rbx, qword [0x1401436a8]
nop dword [rax]
cmp dword [rbx + 0x20], 0x2fb2e854
je 0x140062826
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x140062780
mov eax, 0xcff20a67
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov rdx, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov r8, qword [rsp + 0x50]
xor rdx, rax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [0x140143798], rdx
xor rdx, rax
jne 0x140062931
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
jmp 0x140062934
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x1400628a7
nop dword [rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14006286a
inc rax
cmp byte [rax + r8], r9b
jne 0x140062861
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x1400628a1
mov rcx, r9
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x140062880
cmp edx, 0xe040e233
je 0x1400628bb
inc edi
cmp edi, ebp
jb 0x140062850
mov dword [0x140143468], 0x13
mov eax, 0xcff20a67
jmp 0x1400627aa
cmp di, 0xffff
je 0x1400628a7
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x1400628f6
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp rdx, rax
jbe 0x1400628a7
cmp rdx, rsi
jb 0x1400628a7
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x1400628a7
test rdx, rdx
je 0x1400628a7
mov rcx, qword [rbx + 0x18]
mov eax, 0xcff20a67
add rcx, rsi
cmp rdx, rcx
jbe 0x1400627c2
mov dword [0x140143468], 0x15
jmp 0x1400627aa
mov r9, rdx
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
add rsp, 0x48
jmp r9
Function at 0x140062950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x48
mov rdx, qword [0x1401437a8]
xor r9d, r9d
mov r8, rcx
mov eax, 0xb83816b6
test rdx, rdx
jne 0x140062a29
mov r8, qword [0x1401436b0]
mov edx, r9d
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test r8, r8
je 0x1400629d0
mov rbx, qword [0x1401436a8]
nop dword [rax]
cmp dword [rbx + 0x20], 0x2fb2e854
je 0x140062a56
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x1400629b0
mov eax, 0xb83816b6
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov rdx, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov r8, qword [rsp + 0x50]
xor rdx, rax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [0x1401437a8], rdx
xor rdx, rax
jne 0x140062b61
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
jmp 0x140062b64
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x140062ad7
nop dword [rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x140062a9a
inc rax
cmp byte [rax + r8], r9b
jne 0x140062a91
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x140062ad1
mov rcx, r9
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x140062ab0
cmp edx, 0x978afee2
je 0x140062aeb
inc edi
cmp edi, ebp
jb 0x140062a80
mov dword [0x140143468], 0x13
mov eax, 0xb83816b6
jmp 0x1400629da
cmp di, 0xffff
je 0x140062ad7
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x140062b26
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp rdx, rax
jbe 0x140062ad7
cmp rdx, rsi
jb 0x140062ad7
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x140062ad7
test rdx, rdx
je 0x140062ad7
mov rcx, qword [rbx + 0x18]
mov eax, 0xb83816b6
add rcx, rsi
cmp rdx, rcx
jbe 0x1400629f2
mov dword [0x140143468], 0x15
jmp 0x1400629da
mov r9, rdx
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
add rsp, 0x48
jmp r9
Function at 0x140066670
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x260
mov rbx, rdx
mov dword [rsp + 0x290], 0x104
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.1400a5760
xor ebp, ebp
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x40], rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400666ec
lea rax, [rsp + 0x298]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400666f9
cmp eax, 2
jne 0x140066807
mov al, 1
add rsp, 0x260
pop rsi
pop rbp
pop rbx
ret
mov rax, rbp
mov qword [rsp + 0x280], rdi
cmp word [rbx], ax
je 0x140066719
nop dword [rax]
inc rax
cmp word [rbx + rax*2], bp
jne 0x140066710
cmp word [rbx + rax*2 - 2], 0x5c
lea rdi, [rbx + rax*2]
je 0x140066734
mov eax, 0x5c
mov word [rdi], ax
add rdi, 2
mov word [rdi], bp
mov rcx, qword [rsp + 0x298]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x290]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400667d9
nop
lea r8, [rsp + 0x50]
mov word [rdi], bp
mov edx, 0x208
mov rcx, rbx
call fcn.1400a82f8
mov rdx, rbx
mov rcx, rsi
call fcn.140066670
test al, al
je 0x1400667d9
mov rcx, qword [rsp + 0x298]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x290]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x290], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140066770
mov rcx, qword [rsp + 0x298]
mov word [rdi - 2], bp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdi, qword [rsp + 0x280]
test eax, eax
je 0x1400666ec
xor al, al
add rsp, 0x260
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006e130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x40
xor r10d, r10d
mov r12, rcx
mov qword [rcx + 0x48], r10
mov rdx, qword [0x140143880]
test rdx, rdx
jne 0x14006e1fe
mov r8, qword [0x1401436b0]
mov edx, r10d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
test r8, r8
je 0x14006e1ab
mov rbx, qword [0x1401436a8]
nop word [rax + rax]
cmp dword [rbx + 0x20], 0x2489d460
je 0x14006e22f
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x14006e190
mov dword [0x140143468], 0x12
mov byte [0x140143245], r10b
mov rdx, r10
mov qword [0x140143470], r10
mov qword [0x140143478], r10
mov r15, qword [rsp + 0x20]
xor rdx, 0x23e55482
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143880], rdx
xor rdx, 0x23e55482
jne 0x14006e33c
mov dword [0x140143468], 0x14
mov byte [0x140143245], r10b
mov qword [0x140143470], r10
mov qword [0x140143478], r10
jmp 0x14006e33f
mov rsi, qword [rbx + 0x10]
mov edi, r10d
movsxd r15, dword [rsi + 0x3c]
add r15, rsi
mov r13d, dword [r15 + 0x88]
add r13, rsi
mov r14d, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14006e2b7
nop word [rax + rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r10
add r8, rsi
cmp byte [r8], al
je 0x14006e27a
inc rax
cmp byte [rax + r8], r10b
jne 0x14006e271
mov r11d, r10d
mov r9d, r10d
test rax, rax
je 0x14006e2b1
mov rcx, r10
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r9d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r9d
mov r11d, edx
cmp rcx, rax
jb 0x14006e290
cmp edx, 0x76c80e2
je 0x14006e2c6
inc edi
cmp edi, ebp
jb 0x14006e260
mov dword [0x140143468], 0x13
jmp 0x14006e1b5
cmp di, 0xffff
je 0x14006e2b7
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x14006e307
mov eax, dword [r15 + 0x8c]
mov ecx, dword [r15 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x14006e2b7
cmp rdx, rsi
jb 0x14006e2b7
mov eax, dword [r15 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14006e2b7
test rdx, rdx
je 0x14006e2b7
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp rdx, rcx
jbe 0x14006e1cd
mov dword [0x140143468], 0x15
jmp 0x14006e1b5
mov r10, rdx
mov rcx, qword [r12 + 8]
mov r9, 0xffffffffffff0000
xor r8d, r8d
mov edx, 0x1101
add rsp, 0x40
pop r12
jmp r10
Function at 0x140070d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x48
mov rdx, qword [0x140143988]
xor r8d, r8d
mov rax, rcx
mov ecx, 0xa6bb2bfc
test rdx, rdx
jne 0x140070de4
mov r9, qword [0x1401436b0]
mov edx, r8d
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test r9, r9
je 0x140070d8b
mov rbx, qword [0x1401436a8]
nop dword [rax]
cmp dword [rbx + 0x20], 0x1a6c9752
je 0x140070e1d
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r9
jb 0x140070d70
mov dword [0x140143468], 0x12
mov byte [0x140143245], r8b
mov rdx, r8
mov qword [0x140143470], r8
mov qword [0x140143478], r8
mov rax, qword [rsp + 0x50]
xor rdx, rcx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [0x140143988], rdx
xor rdx, rcx
jne 0x140070f31
mov rcx, rax
mov dword [0x140143468], 0x14
mov byte [0x140143245], r8b
mov qword [0x140143470], r8
mov qword [0x140143478], r8
call r8
cmp eax, 0xffffffff
setne al
add rsp, 0x48
ret
mov rsi, qword [rbx + 0x10]
mov edi, r8d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x140070eac
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
movsxd r9, dword [r14 + rax*4]
mov rax, r8
add r9, rsi
cmp byte [r9], al
je 0x140070e6a
inc rax
cmp byte [rax + r9], r8b
jne 0x140070e61
mov r11d, r8d
mov r10d, r8d
test rax, rax
je 0x140070ea1
mov rcx, r8
nop dword [rax + rax]
movsx edx, byte [rcx + r9]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x140070e80
cmp edx, 0xbcd7bcae
je 0x140070ebb
inc edi
cmp edi, ebp
jb 0x140070e50
mov ecx, 0xa6bb2bfc
mov dword [0x140143468], 0x13
jmp 0x140070d95
cmp di, 0xffff
je 0x140070ea7
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x140070ef6
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp rdx, rax
jbe 0x140070ea7
cmp rdx, rsi
jb 0x140070ea7
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x140070ea7
test rdx, rdx
je 0x140070ea7
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp rdx, rcx
mov ecx, 0xa6bb2bfc
jbe 0x140070dad
mov dword [0x140143468], 0x15
jmp 0x140070d95
mov r8, rdx
mov rcx, rax
call r8
cmp eax, 0xffffffff
setne al
add rsp, 0x48
ret
Function at 0x140070fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r14
sub rsp, 0x38
xor r9d, r9d
mov rbp, rdx
cmp word [0x1401434a0], r9w
mov r14, rcx
je 0x14007102a
mov eax, 0x104
lea rcx, [0x1401434a0]
cmp rdx, rax
mov r8d, r9d
cmova rbp, rax
cmp r8, rbp
jae 0x14007122a
movzx eax, word [rcx + r8*2]
inc r9d
mov word [r14 + r8*2], ax
mov r8d, r9d
cmp word [rcx + r9*2], 0
jne 0x140071001
add rsp, 0x38
pop r14
pop rbp
ret
mov rdx, qword [0x140143978]
mov eax, 0x96f9e8bc
test rdx, rdx
jne 0x1400710dd
mov rdx, qword [0x1401436b0]
mov ecx, r9d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
test rdx, rdx
je 0x140071093
mov rbx, qword [0x1401436a8]
cmp dword [rbx + 0x20], 0x1a6c9752
je 0x14007110a
inc ecx
add rbx, 0x28
movsxd rax, ecx
cmp rax, rdx
jb 0x140071073
mov eax, 0x96f9e8bc
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov rdx, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov r15, qword [rsp + 0x20]
xor rdx, rax
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143978], rdx
xor rdx, rax
jne 0x14007121c
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
jmp 0x14007121f
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov eax, dword [r13 + 0x88]
mov r12d, dword [rax + rsi + 0x20]
mov r15d, dword [rax + rsi + 0x18]
add r12, rsi
test r15d, r15d
je 0x140071188
mov eax, edi
movsxd r8, dword [r12 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14007114b
inc rax
cmp byte [rax + r8], r9b
jne 0x140071142
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x140071181
mov rcx, r9
nop dword [rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x140071160
cmp edx, 0x8c957fee
je 0x14007119c
inc edi
cmp edi, r15d
jb 0x140071131
mov dword [0x140143468], 0x13
mov eax, 0x96f9e8bc
jmp 0x14007109d
cmp di, 0xffff
je 0x140071188
mov r10d, dword [r13 + 0x88]
mov eax, dword [r10 + rsi + 0x24]
lea r8, [r10 + rsi]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r8
jb 0x1400711e2
mov eax, dword [r13 + 0x8c]
add rax, r10
add rax, rsi
cmp rdx, rax
jbe 0x140071188
cmp rdx, rsi
jb 0x140071188
mov eax, dword [r13 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x140071188
test rdx, rdx
je 0x140071188
mov rcx, qword [rbx + 0x18]
mov eax, 0x96f9e8bc
add rcx, rsi
cmp rdx, rcx
jbe 0x1400710b5
mov dword [0x140143468], 0x15
jmp 0x14007109d
mov r9, rdx
mov r8d, ebp
mov rdx, r14
xor ecx, ecx
call r9
add rsp, 0x38
pop r14
pop rbp
ret
Function at 0x140072fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x40
mov rdx, qword [0x140143880]
xor r10d, r10d
mov r12, rcx
test rdx, rdx
jne 0x14007306f
mov r8, qword [0x1401436b0]
mov edx, r10d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
test r8, r8
je 0x14007301c
mov rbx, qword [0x1401436a8]
cmp dword [rbx + 0x20], 0x2489d460
je 0x1400730a0
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x140073001
mov dword [0x140143468], 0x12
mov byte [0x140143245], r10b
mov rdx, r10
mov qword [0x140143470], r10
mov qword [0x140143478], r10
mov r15, qword [rsp + 0x20]
xor rdx, 0x23e55482
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143880], rdx
xor rdx, 0x23e55482
jne 0x1400731ac
mov dword [0x140143468], 0x14
mov byte [0x140143245], r10b
mov qword [0x140143470], r10
mov qword [0x140143478], r10
jmp 0x1400731af
mov rsi, qword [rbx + 0x10]
mov edi, r10d
movsxd r15, dword [rsi + 0x3c]
add r15, rsi
mov r13d, dword [r15 + 0x88]
add r13, rsi
mov r14d, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x140073127
nop word [rax + rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r10
add r8, rsi
cmp byte [r8], al
je 0x1400730ea
inc rax
cmp byte [rax + r8], r10b
jne 0x1400730e1
mov r11d, r10d
mov r9d, r10d
test rax, rax
je 0x140073121
mov rcx, r10
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r9d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r9d
mov r11d, edx
cmp rcx, rax
jb 0x140073100
cmp edx, 0x76c80e2
je 0x140073136
inc edi
cmp edi, ebp
jb 0x1400730d0
mov dword [0x140143468], 0x13
jmp 0x140073026
cmp di, 0xffff
je 0x140073127
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x140073177
mov eax, dword [r15 + 0x8c]
mov ecx, dword [r15 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x140073127
cmp rdx, rsi
jb 0x140073127
mov eax, dword [r15 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x140073127
test rdx, rdx
je 0x140073127
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp rdx, rcx
jbe 0x14007303e
mov dword [0x140143468], 0x15
jmp 0x140073026
mov r10, rdx
mov rcx, qword [r12 + 8]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call r10
lea rdx, [r12 + 0x48]
mov r8, rax
mov rcx, r12
add rsp, 0x40
pop r12
jmp fcn.140070f50
Function at 0x1400731e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
sub rsp, 0x58
mov r9, qword [0x140143800]
xor r10d, r10d
mov rax, r8
test r9, r9
jne 0x1400732c3
mov qword [r11 + 0x20], rbx
mov r9d, r10d
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r11, qword [0x1401436b0]
test r11, r11
je 0x14007325c
mov rbx, qword [0x1401436a8]
nop
cmp dword [rbx + 0x20], 0x2489d460
je 0x1400732fd
inc r9d
add rbx, 0x28
movsxd rax, r9d
cmp rax, r11
jb 0x140073240
mov dword [0x140143468], 0x12
mov byte [0x140143245], r10b
mov r9, r10
mov qword [0x140143470], r10
mov qword [0x140143478], r10
mov rax, qword [rsp + 0x70]
xor r9, 0x2b1549ee
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov qword [0x140143800], r9
xor r9, 0x2b1549ee
jne 0x140073408
mov dword [0x140143468], 0x14
mov r8d, eax
mov byte [0x140143245], r10b
mov qword [0x140143470], r10
mov qword [0x140143478], r10
mov rcx, qword [rcx + 8]
add rsp, 0x58
jmp r10
mov rsi, qword [rbx + 0x10]
mov edi, r10d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x140073387
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r10
add r8, rsi
cmp byte [r8], al
je 0x14007334a
inc rax
cmp byte [rax + r8], r10b
jne 0x140073341
mov r11d, r10d
mov r9d, r10d
test rax, rax
je 0x140073381
mov rcx, r10
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r9d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r9d
mov r11d, edx
cmp rcx, rax
jb 0x140073360
cmp edx, 0xf9c9d8e
je 0x140073396
inc edi
cmp edi, ebp
jb 0x140073330
mov dword [0x140143468], 0x13
jmp 0x140073266
cmp di, 0xffff
je 0x140073387
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov r9d, dword [rcx + rdx*4]
add r9, rsi
cmp r9, r13
jb 0x1400733d2
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp r9, rax
jbe 0x140073387
cmp r9, rsi
jb 0x140073387
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp r9, rax
ja 0x140073387
test r9, r9
je 0x140073387
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp r9, rcx
jbe 0x14007327e
mov dword [0x140143468], 0x15
jmp 0x140073266
mov rcx, qword [rcx + 8]
mov r10, r9
mov r8d, eax
add rsp, 0x58
jmp r10
Function at 0x140079310
Capabilities:
Access peb ldr_data
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using speck
Get ntdll base address
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
lea rcx, [0x1400c2630]
jmp 0x1406f7b1c