joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180014ce0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rsi
sub rsp, 0x530
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov rsi, rcx
lea rcx, [0x180082660]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x180082693], 0
jne 0x180014ed5
mov r8d, dword [0x180082b78]
xor edx, edx
mov qword [rsp + 0x548], rbx
mov qword [rsp + 0x550], rdi
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180014d4f
xor edi, edi
jmp 0x180014d90
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800064e0
mov rcx, rbx
test al, al
jne 0x180014d82
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor edi, edi
jmp 0x180014d90
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0xc0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180014db2
test byte [rsp + 0x30], 2
jne 0x180014db2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x510]
mov r9d, 0x10
mov qword [rsp + 0x20], 0
mov rdx, rdi
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rsp + 0x510]
mov rcx, rdi
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, [0x18006d404]
mov rcx, rax
mov rbx, rax
call fcn.18004ad74
test rax, rax
je 0x180014e0c
mov rcx, rsi
call sym.TitanEngine.dll_StepOver
jmp 0x180014ec5
lea rdx, str.POP_SS
mov rcx, rbx
call fcn.18004ad74
test rax, rax
jne 0x180014e9c
lea rdx, str.MOV_SS
mov rcx, rbx
call fcn.18004ad74
test rax, rax
jne 0x180014e9c
mov r8d, dword [0x180082b78]
lea ecx, [rax + 0x5a]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x70], ecx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
or dword [rsp + 0x84], 0x100
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rbx
call fcn.18000d5c0
mov byte [0x180082693], 1
mov qword [0x180082aa8], rsi
mov dword [0x180082694], 0
jmp 0x180014ec5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x510]
call sym.TitanEngine.dll_LengthDisassembleEx
movsxd rcx, eax
mov r8, rsi
add rcx, rdi
mov edx, 0x10000001
call sym.TitanEngine.dll_SetBPX
mov rbx, qword [rsp + 0x548]
mov rdi, qword [rsp + 0x550]
lea rcx, [0x180082660]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x530
pop rsi
ret
Function at 0x180014f00
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4a0
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r8d, dword [0x180082b78]
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180014f4e
xor edi, edi
jmp 0x180014f8f
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800064e0
mov rcx, rbx
test al, al
jne 0x180014f81
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor edi, edi
jmp 0x180014f8f
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0xc0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180014fb1
test byte [rsp + 0x30], 2
jne 0x180014fb1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x480]
mov r9d, 0x10
mov qword [rsp + 0x20], 0
mov rdx, rdi
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rsp + 0x480]
mov rcx, rdi
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, str.CALL
mov rcx, rax
mov rbx, rax
call fcn.18004ad74
test rax, rax
jne 0x180015030
lea rdx, [0x18006ce9c]
mov rcx, rbx
call fcn.18004ad74
test rax, rax
jne 0x180015030
lea rdx, [0x18006d474]
mov rcx, rbx
call fcn.18004ad74
test rax, rax
jne 0x180015030
mov rcx, rsi
call sym.TitanEngine.dll_StepInto
jmp 0x180015059
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x480]
call sym.TitanEngine.dll_LengthDisassembleEx
movsxd rcx, eax
mov r8, rsi
add rcx, rdi
mov edx, 0x10000001
call sym.TitanEngine.dll_SetBPX
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180015080
Capabilities:
Resume thread

Disassembly:
mov qword [0x180082688], rcx
lea rcx, [0x180005a10]
mov byte [0x180082690], dl
jmp sym.TitanEngine.dll_StepOver
Function at 0x180015560
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x40
mov rdi, r8
mov qword [r11 - 0x18], 0x1000
mov rbx, rcx
mov dword [rsp + 0x68], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x20]
lea r8, [r11 - 0x18]
mov qword [r11 - 0x28], rax
mov r9d, 4
lea rdx, [r11 + 0x10]
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x18001560c
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov r8, rdi
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
js 0x18001560c
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov rcx, qword [rbx]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
setns al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x1800164c0
Capabilities:
Create process on windows
Resume thread
Terminate process
Terminate thread

Disassembly:
mov qword [0x180082c68], r9
jmp sym.TitanEngine.dll_InitDebugW

Function at 0x180016970
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x180082d18]
xor edx, edx
xor bl, bl
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1800169ac
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov r8d, dword [0x180082d1c]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800169f2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800183d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov rdx, qword [0x180082d10]
xor r9d, r9d
mov rcx, qword [0x180082d08]
xor r8d, r8d
jmp sym.TitanEngine.dll_IsJumpGoingToExecuteEx

Function at 0x1800189c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, r8
mov rcx, qword [0x180082d08]
mov edi, edx
test rcx, rcx
jne 0x1800189ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sym.TitanEngine.dll_FillEx
Function at 0x180018a10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbx
push rbp
push rdi
push r14
sub rsp, 0x78
mov ebx, r8d
mov r14, r9
mov byte [rax + 8], 0x90
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x180018ba3
mov qword [rax + 0x18], rsi
lea r8, [rax - 0x60]
mov qword [rax + 0x20], r12
mov r9d, 0x30
mov qword [rax - 0x28], r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rsp + 0x5c]
mov r9d, 0x40
mov dword [rsp + 0xa8], eax
mov r8d, ebx
lea rax, [rsp + 0xa8]
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r15d, dword [rsp + 0xc0]
sub ebx, r15d
je 0x180018b42
mov eax, ebx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
cmp byte [rsp + 0xc8], 0
je 0x180018aff
lea rax, [rsp + 0x30]
mov r9d, r15d
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rbx, [r15 + rbp]
test esi, esi
je 0x180018b5e
nop dword [rax]
lea rax, [rsp + 0x30]
mov r9d, 1
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc rbx
sub rsi, 1
jne 0x180018ad0
jmp 0x180018b5e
cmp byte [rsp + 0xd0], 0
je 0x180018b42
mov rbx, rbp
test esi, esi
je 0x180018b3d
lea rax, [rsp + 0x30]
mov r9d, 1
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc rbx
sub rsi, 1
jne 0x180018b10
mov rdx, rbx
jmp 0x180018b45
mov rdx, rbp
lea rax, [rsp + 0x30]
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0xa8]
lea rax, [rsp + 0xa8]
mov r8, r12
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r15, qword [rsp + 0x70]
mov al, 1
mov r12, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
add rsp, 0x78
pop r14
pop rdi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x78
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x18001a190
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x2060
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
xor edx, edx
mov qword [rsp + 0x48], r14
mov r8d, 0x2000
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x50]
mov rbx, r9
call fcn.18004c900
mov rcx, rbx
call fcn.1800069b0
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001a2e4
test rdi, rdi
je 0x18001a2be
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x2000
call fcn.18004c900
lea rax, [rsp + 0x48]
mov rdx, rsi
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov rcx, rbp
cmp rdi, 0x1000
jb 0x18001a29b
mov r9d, 0x1000
call sym.TitanEngine.dll_MemoryReadSafe
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, 0x1000
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsi, 0x1000
add rdi, 0xfffffffffffff000
jne 0x18001a230
jmp 0x18001a2be
mov r9, rdi
call sym.TitanEngine.dll_MemoryReadSafe
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x44]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18001a2e0
test byte [rsp + 0x44], 2
jne 0x18001a2e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18001a2e6
xor al, al
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x2060
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001a540
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x2390]
mov eax, 0x2490
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rbp + 0x2380], rax
movzx ebx, r8b
mov dword [rsp + 0x20], 0
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x2000
xor edi, edi
call fcn.18004c900
test rsi, rsi
je 0x18001a74e
lea r9, [rsp + 0x20]
mov r8d, 0x2000
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18001a74e
lea r9d, [rdi + 0x30]
xor edx, edx
lea r8, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x18001a74a
mov qword [rsp + 0x24d0], r15
lea r15d, [rdi + 0x5c]
nop word [rax + rax]
mov r8d, dword [rsp + 0x20]
xor r9b, r9b
shr r8d, 3
xor ecx, ecx
xor eax, eax
test r8d, r8d
je 0x18001a635
mov r10, qword [rsp + 0x30]
nop word [rax + rax]
mov rdx, qword [rsp + rax*8 + 0x60]
cmp rdx, r10
jne 0x18001a61f
mov r9b, 1
jmp 0x18001a624
test rdx, rdx
jne 0x18001a62b
mov ecx, 0x400
mov eax, ecx
inc ecx
inc rax
cmp ecx, r8d
jl 0x18001a610
test byte [rsp + 0x4c], 1
jne 0x18001a71d
test r9b, r9b
jne 0x18001a71d
test bl, bl
je 0x18001a666
cmp bl, 1
jne 0x18001a71d
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x60], rax
jae 0x18001a71d
xor edx, edx
lea rcx, [rbp + 0x2170]
mov r8d, 0x104
call fcn.18004c900
xor edx, edx
lea rcx, [rbp + 0x1f60]
mov r8d, 0x104
call fcn.18004c900
mov rdx, r14
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x1f5e], r15w
je 0x18001a6d2
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rbp + rcx*2 + 0x1f60], r15w
mov r9, qword [rsp + 0x40]
lea rdx, str.Dump__x__x.dmp
mov r8, qword [rsp + 0x28]
lea rcx, [rbp + 0x2170]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x2170]
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8, qword [rsp + 0x40]
lea r9, [rbp + 0x1f60]
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call sym.TitanEngine.dll_DumpMemoryW
add rdi, qword [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
mov r9d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x18001a5f0
mov r15, qword [rsp + 0x24d0]
mov al, 1
jmp 0x18001a750
xor al, al
mov rcx, qword [rbp + 0x2380]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x2490
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18001a9a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x2050
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor edi, edi
xor edx, edx
mov dword [rsp + 0x20], edi
mov r8d, 0x2000
lea rcx, [rsp + 0x40]
call fcn.18004c900
lea r9, [rsp + 0x20]
mov r8d, 0x2000
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18001aa53
mov ecx, dword [rsp + 0x20]
test ecx, 0xfffffff8
jbe 0x18001aa53
lea rbx, [rsp + 0x40]
nop dword [rax]
mov rdx, qword [rbx]
cmp rdx, rsi
jne 0x18001aa44
mov r9d, 0x18
lea r8, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
jne 0x18001aa7d
mov ecx, dword [rsp + 0x20]
mov eax, ecx
inc edi
shr eax, 3
add rbx, 8
cmp edi, eax
jl 0x18001aa20
xor al, al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8d, dword [rsp + 0x30]
mov r9, r14
movsxd rdx, edi
mov rcx, rbp
mov rdx, qword [rsp + rdx*8 + 0x40]
call sym.TitanEngine.dll_DumpMemoryW
jmp 0x18001aa55
Function at 0x18001b530
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub rsp, 0x458
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rcx, qword [0x180082e88]
test rcx, rcx
je 0x18001b67a
cmp byte [rcx], 0
mov qword [0x180082e80], rcx
je 0x18001b642
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.18004c900
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.18004c900
lea rdx, [rsp + 0x230]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jae 0x18001b60b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea r9, [rsp + 0x20]
lea rdx, str.DeleteTempGenFile
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18001b60b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x180082e80]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [0x180082e80]
test eax, eax
je 0x18001b605
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x180082e80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd rdx, eax
mov rax, qword [0x180082e80]
add rax, 2
add rdx, rax
mov qword [0x180082e80], rdx
cmp byte [rdx], 0
jne 0x18001b570
mov rcx, qword [0x180082e88]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov qword [0x180082e88], rax
mov qword [0x180082e80], rax
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x458
ret
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x458
ret

Function at 0x18001beb0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
sub rsp, 0x28
call fcn.18000c9d0
xor edx, edx
lea rcx, [0x180084340]
add rsp, 0x28
jmp fcn.18000d220
Function at 0x18001c280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp qword [0x1800915a0], 0
mov ebp, edx
mov rsi, rcx
je 0x18001c3c1
test rcx, rcx
je 0x18001c3c1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
test eax, eax
jle 0x18001c2e1
mov ecx, edi
nop dword [rax + rax]
movsx eax, byte [rcx + rsi]
inc rcx
rol ebx, 7
xor ebx, eax
cmp rcx, r8
jl 0x18001c2d0
mov edx, dword [0x1800915a8]
lea r14, [0x180095430]
mov ecx, edi
test edx, edx
je 0x18001c309
mov rax, r14
cmp dword [rax], ebx
je 0x18001c3a5
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18001c2f7
mov rax, qword [0x1800915a0]
lea rbx, sym.TitanEngine.dll_TZa2PRht_6YP5:PgFH_Ff9cCpT__.v_
mov rcx, rsi
mov dword [rbx + rdx*4 + 0x915b0], ebp
mov qword [rbx + rdx*8 + 0x934f0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
test eax, eax
jle 0x18001c351
mov rcx, rdi
nop dword [rax]
movsx eax, byte [rcx + rsi]
inc rcx
rol edi, 7
xor edi, eax
cmp rcx, rdx
jl 0x18001c340
mov ecx, dword [0x1800915a8]
mov dword [r14 + rcx*4], edi
mov word [rbx + rcx*2 + 0x963d0], cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1800915a0]
mov rdx, rsi
movsxd r8, eax
call fcn.18004c130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov rax, qword [0x1800915a0]
add rax, 2
add rcx, rax
inc dword [0x1800915a8]
mov qword [0x1800915a0], rcx
mov rdi, qword [rsp + 0x38]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbp, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop rsi
ret
Function at 0x18001c960
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [0x1800915a8]
xor bpl, bpl
mov rbx, rcx
test eax, eax
jle 0x18001caae
lea r8d, [rax + rax*2]
xor edi, edi
mov eax, dword [0x1800915a0]
xor r9d, r9d
shl r8d, 2
add eax, 0x28
sub r8d, dword [0x180090f18]
add r8d, eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sym.TitanEngine.dll_AddNewSectionExW
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0xe0000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001caae
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 0x40]
mov rcx, rbx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x18001ca8c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18001ca8c
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov r8b, 1
mov rcx, rdi
lea rdx, [r15 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test eax, eax
je 0x18001ca72
mov ecx, eax
mov rdx, rdi
call sym.TitanEngine.dll_ExporterBuildExportTable
movzx ebp, al
mov r9, rdi
mov r8, rsi
mov edx, r14d
mov rcx, rbx
call fcn.18000dc30
test bpl, bpl
je 0x18001caae
mov al, 1
jmp 0x18001cab0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18001caae
test byte [rsp + 0x70], 2
jne 0x18001caae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18001ce80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, ecx
xorps xmm0, xmm0
xor ebx, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x30], rbx
movdqu xmmword [rsp + 0x20], xmm0
call fcn.180014a70
lea edx, [rbx + 0x20]
mov dword [rsp + 0x58], ebx
lea rcx, [rsp + 0x20]
call fcn.180014a70
mov rcx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdx, rcx
cmp r8, rcx
jne 0x18001cecd
mov edx, ebx
sub r8d, ecx
lea r9, [rsp + 0x58]
mov ecx, 0x10
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, dword [rsp + 0x58]
lea rcx, [rsp + 0x20]
add rdx, 0x20
call fcn.180014a70
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x58]
sub r8, qword [rsp + 0x20]
mov rdx, rbx
mov ecx, 0x10
cmovne rdx, qword [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r8, qword [rsp + 0x20]
test eax, eax
js 0x18001cf57
cmp qword [rsp + 0x28], r8
mov rcx, rbx
cmovne rcx, r8
mov eax, dword [rcx]
lea rdx, [rcx + 8]
test eax, eax
je 0x18001cf57
mov r9d, eax
nop word [rax + rax]
movzx eax, word [rdx]
lea ecx, [rbx + 1]
cmp eax, edi
lea rdx, [rdx + 0x18]
cmovne ecx, ebx
mov ebx, ecx
sub r9, 1
jne 0x18001cf40
test r8, r8
je 0x18001cf8d
mov rdx, qword [rsp + 0x30]
mov rax, r8
sub rdx, r8
cmp rdx, 0x1000
jb 0x18001cf85
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cf9a
mov rcx, r8
call fcn.180049e70
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.1800503fc
int3
Function at 0x18001cfa0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov esi, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor ebx, ebx
xor edx, edx
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
xor bpl, bpl
call fcn.180014a70
lea edx, [rbx + 0x20]
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x20]
call fcn.180014a70
mov rcx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdx, rcx
cmp r8, rcx
jne 0x18001cffd
mov edx, ebx
sub r8d, ecx
lea r9, [rsp + 0x60]
mov ecx, 0x10
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x20]
add rdx, 0x20
call fcn.180014a70
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x60]
sub r8, qword [rsp + 0x20]
mov rdx, rbx
mov ecx, 0x10
cmovne rdx, qword [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r8, qword [rsp + 0x20]
test eax, eax
js 0x18001d083
cmp qword [rsp + 0x28], r8
mov rcx, rbx
cmovne rcx, r8
mov edx, dword [rcx]
lea rax, [rcx + 8]
test edx, edx
je 0x18001d083
movzx ecx, word [rax]
cmp ecx, esi
jne 0x18001d074
movzx ecx, word [rax + 6]
cmp rcx, rdi
je 0x18001d080
add rax, 0x18
inc ebx
cmp ebx, edx
jb 0x18001d064
jmp 0x18001d083
mov bpl, 1
test r8, r8
je 0x18001d0b9
mov rdx, qword [rsp + 0x30]
mov rax, r8
sub rdx, r8
cmp rdx, 0x1000
jb 0x18001d0b1
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001d0d2
mov rcx, r8
call fcn.180049e70
mov rbx, qword [rsp + 0x50]
movzx eax, bpl
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.1800503fc
int3