joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ed80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00611a29], 0
je 0x46ed8e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x46eda0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00611a29], 0
je 0x46edb5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46edc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00611a29], 0
je 0x46edf5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00612060]
aesenc xmm0, xmmword [0x00612070]
aesenc xmm0, xmmword [0x00612080]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46ee00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00611a29], 0
je 0x46ee36
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00612060]
aesenc xmm0, xmmword [0x00612070]
aesenc xmm0, xmmword [0x00612080]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4704c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00611c50]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x47055b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x470780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00611c50]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x470817
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x470be0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x470c14
mov rcx, 0x28
jmp 0x470c1f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00611c50], rcx
pop rbp
ret
Function at 0x4895c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489cff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4895ed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x489871
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x48989d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00530720]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004c7800]
lea rbx, [0x0052f150]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4898c2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4898f7
lea rdi, [0x004c7880]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4895e3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4898db
jmp 0x4898b0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x489ea0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x489eb7
inc rax
cmp rax, 4
jge 0x489ecf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x489eb4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x489ee0
inc rax
cmp rax, 4
jge 0x489eee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x489f17
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x489efb
jmp 0x489edd
Function at 0x48f900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f9ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00611c50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48f9af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004c7900]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48f99e
mov edi, 1
lea rsi, [0x004c7900]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0052f298]
lea rsi, [0x0052ea08]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x49f9a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49fa4c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00611c50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x49fa13
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x49fa26
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x49fa39
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x49fa23
mov byte [rax + rcx], dl
jmp 0x49fa23
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x100001c08
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100001c87
lea r8, [rsp + 0x58]
lea rdx, [0x1000014c8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x100001c81
mov rax, qword [rsp + 0x58]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x80010002
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
add rsp, 0x48
ret

Function at 0x10000216c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
mov rbp, rcx
mov ecx, 0x1002
mov rsi, rdx
mov eax, 2
mov r13, 0xffffffffffffffff
mul rcx
cmovo rax, r13
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
je 0x100002253
mov dword [rsp + 0x60], 0x2000
jmp 0x100002200
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x100002246
cmp dword [rsp + 0x68], 7
jne 0x100002246
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r11, rbx
mov eax, 2
shr r11, 1
add r11, 2
mul r11
cmovo rax, r13
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
je 0x100002253
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000021ba
mov ecx, dword [rsp + 0x60]
shr ecx, 1
and word [rdi + rcx*2], ax
lea eax, [rcx + 1]
mov rcx, rdi
and word [rdi + rax*2], 0
call fcn.100001de4
test rax, rax
jne 0x100002255
test rdi, rdi
je 0x100002253
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
Function at 0x100005bc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x10000a100]
xor rax, rsp
mov qword [rsp + 0x250], rax
and dword [rsp + 0x30], 0
test rdx, rdx
mov rax, qword [rsp + 0x290]
mov ebx, 2
je 0x100005c0e
mov eax, 3
jmp 0x100005cf0
cmp r9d, ebx
jl 0x100005c04
mov rcx, qword [rax]
cmp word [rcx], 0
je 0x100005c04
mov rsi, qword [rax + 8]
cmp word [rsi], 0
je 0x100005c04
mov edi, 0x104
lea r8, [rsp + 0x40]
xor r9d, r9d
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, edi
jae 0x100005cee
test eax, eax
je 0x100005cee
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100005cee
lea rcx, [0x1000019a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x100005cee
lea rdx, [0x1000019c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbp, rax
je 0x100005ce5
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, [rsp + 0x40]
mov r8, rsi
lea rcx, [rax + 0x30]
mov edx, 0xeeae
call fcn.100001b08
lea r11, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 1
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], r11
call rbp
test eax, eax
je 0x100005ce5
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0xeeb2
lea rcx, [rax + 0x30]
call fcn.100001b08
xor ebx, ebx
cmp dword [rsp + 0x30], ebx
setne bl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.100007a20
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100007744
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x10000acc8], rdi
je 0x100007792
cmp rax, rdi
jne 0x100007785
mov edi, 1
mov r12d, edi
jmp 0x100007797
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100007769
mov edi, 1
mov eax, dword [0x10000acc0]
cmp eax, edi
jne 0x1000077ad
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000780a
mov eax, dword [0x10000acc0]
test eax, eax
jne 0x100007804
mov dword [0x10000acc0], edi
lea r13, [0x100001428]
lea rsi, [0x100001410]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x1000077f6
test eax, eax
jne 0x1000077f6
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000077eb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000077d4
test eax, eax
je 0x10000780a
mov eax, 0xff
jmp 0x1000078dc
mov dword [0x10000a72c], edi
mov eax, dword [0x10000acc0]
cmp eax, edi
jne 0x100007831
lea rdx, [0x100001408]
lea rcx, [0x1000013f8]
call sub.msvcrt.dll__initterm
mov dword [0x10000acc0], 2
test r12d, r12d
jne 0x10000783f
xor eax, eax
xchg qword [0x10000acc8], rax
cmp qword [0x10000acd0], 0
je 0x100007868
lea rcx, [0x10000acd0]
call fcn.100007bf0
test eax, eax
je 0x100007868
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10000acd0]
mov r8, qword [0x10000a710]
mov rdx, qword [0x10000a718]
mov ecx, dword [0x10000a708]
call fcn.100002994
mov dword [0x10000a728], eax
cmp dword [0x10000a70c], 0
jne 0x100007898
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10000a72c], 0
jne 0x1000078ad
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10000a728]
jmp 0x1000078dc
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.1000a4000
add rsp, 0x28
jmp 0x100007744

Function at 0x100007c90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100007cda
cmp rcx, 0xffffffffffffffff
je 0x100007cda
cmp word [rcx], 0x5a4d
jne 0x100007cd2
cmp dword [rcx + 0x3c], edx
jl 0x100007cd2
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100007cd2
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100007cda
mov rax, rdx
add rsp, 0x18
ret
Function at 0x100007e97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10000a100]
jne 0x100007a3a
rol rcx, 0x10
test cx, 0xffff
jne 0x100007a36
repz ret
ror rcx, 0x10
jmp 0x100007df0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10000a7e0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rax, qword [0x10000a8d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100007e75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10000a7e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100007e97
mov rax, qword [rsp + 0x88]
mov qword [0x10000a8d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10000a878], rax
mov rax, qword [0x10000a8d8]
mov qword [0x10000a750], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10000a860], rax
mov dword [0x10000a740], 0xc0000409
mov dword [0x10000a744], 1
mov rax, qword [0x10000a100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10000a108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001450]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140df8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140df81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140df8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df806f
add dl, dl
jne 0x140df8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df80f6
xor eax, eax
add dl, dl
jne 0x140df80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df81ad
add dl, dl
jne 0x140df80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140df80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140df807e
mov eax, 1
add dl, dl
jne 0x140df8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df80fb
sub eax, ebx
mov ebx, 1
jne 0x140df814c
mov ecx, 1
add dl, dl
jne 0x140df812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140df813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140df8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140df8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df815d
cmp eax, 0x7d00
jae 0x140df819b
cmp eax, 0x500
jb 0x140df8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df807e
cmp eax, 0x7f
ja 0x140df819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140df81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140df807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140009950]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140009960]
mov dword [rax], 1
mov rax, qword [0x140009970]
mov dword [rax], 1
mov rax, qword [0x1400098d0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140009940]
mov dword [0x14000d00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140009a10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400099f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140009870]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x1400031a8
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
lea rax, section..rdata
mov rcx, rax
call sym.system
mov ecx, 0xb
call dbg.font(int)
lea rax, str._____Student_Management_Program_____
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400098b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov dword [rbp - 4], 1
jmp 0x1400032be
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x10]
jne 0x140003230
mov ecx, 0xd
call dbg.font(int)
lea rax, str.____
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
jmp 0x140003253
mov ecx, 8
call dbg.font(int)
lea rax, str.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp dword [rbp - 4], 1
je 0x140003261
cmp dword [rbp - 4], 2
je 0x14000328e
jmp 0x1400032ba
lea rax, str.__display_by_id_class
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400098b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
jmp 0x1400032ba
lea rax, str.__Display_by_average_score
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400098b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
nop
add dword [rbp - 4], 1
cmp dword [rbp - 4], 2
jle 0x140003203
nop
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400032d0
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 1
jmp 0x1400032e2
nop
mov eax, dword [rbp - 4]
mov ecx, eax
call dbg.Menu_for_display_extra(int)
call sym.getch
mov byte [rbp - 5], al
movsx eax, byte [rbp - 5]
cmp eax, 0x48
je 0x140003304
cmp eax, 0x50
je 0x140003310
jmp 0x140003320
cmp dword [rbp - 4], 1
jle 0x14000331c
sub dword [rbp - 4], 1
jmp 0x14000331c
cmp dword [rbp - 4], 1
jg 0x14000331f
add dword [rbp - 4], 1
jmp 0x14000331f
nop
jmp 0x140003320
nop
cmp byte [rbp - 5], 0xd
jne 0x1400032e2
cmp dword [rbp - 4], 1
je 0x140003334
cmp dword [rbp - 4], 2
je 0x14000334f
jmp 0x140003369
lea rax, section..rdata
mov rcx, rax
call sym.system
call dbg.Display_Data_By_Id_Class()
call sym.getch
jmp 0x140003369
lea rax, section..rdata
mov rcx, rax
call sym.system
call dbg.DisplayData_By_Average_score()
call sym.getch
nop
cmp byte [rbp - 5], 0xd
jne 0x1400032e1
nop
nop
add rsp, 0x30
pop rbp
ret