joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002a060
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x48
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r15, rcx
xor bl, bl
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002a16f
mov qword [rsp + 0x70], rbp
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rsi + 2]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x18002a143
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x18002a143
lea r9, [rsp + 0x78]
mov edx, ebp
lea r8, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.imagehlp.dll_CheckSumMappedFile]
test rax, rax
je 0x18002a131
mov r9d, dword [rsp + 0x78]
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 0x13]
call sym.TitanEngine.dll_SetPE32DataW
movzx ebx, al
mov r9, rsi
mov r8, r14
mov edx, ebp
mov rcx, rdi
call fcn.18000dc30
jmp 0x18002a165
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002a165
test byte [rsp + 0x78], 2
jne 0x18002a165
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
movzx eax, bl
add rsp, 0x48
pop r15
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002ae60
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r8d, dword [0x180084c00]
xor bpl, bpl
sub r8d, dword [0x180096bd8]
mov rbx, rcx
add r8d, 8
test r8d, r8d
jle 0x18002afa3
xor edi, edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sym.TitanEngine.dll_AddNewSectionExW
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0xe0000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002afa3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 0x40]
mov rcx, rbx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x18002af81
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18002af81
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov r8b, 1
mov rcx, rdi
lea rdx, [r15 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test eax, eax
je 0x18002af67
mov ecx, eax
mov r8, rdi
mov edx, r15d
call sym.TitanEngine.dll_RelocaterExportRelocation
movzx ebp, al
mov r9, rdi
mov r8, rsi
mov edx, r14d
mov rcx, rbx
call fcn.18000dc30
test bpl, bpl
je 0x18002afa3
mov al, 1
jmp 0x18002afa5
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002afa3
test byte [rsp + 0x70], 2
jne 0x18002afa3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x18002afc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
cmp qword [0x180096bd8], 0
mov rdi, rdx
mov ebx, r8d
mov rsi, rcx
mov qword [rsp + 0x30], 0
je 0x18002b081
mov r9d, 0x30
lea r8, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rsp + 0x5c]
mov r9d, 0x40
mov dword [rsp + 0x98], eax
mov r8d, ebx
lea rax, [rsp + 0x98]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8, qword [0x180096bd8]
lea rax, [rsp + 0x30]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18002b081
mov rcx, qword [0x180096bd8]
mov al, 1
add rcx, rbx
mov qword [0x180084c08], 0xffffffffffffffff
mov qword [0x180084c00], rcx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea r11, [rsp + 0x70]
xor al, al
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18002b0a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
mov qword [rax + 8], rbp
xorps xmm0, xmm0
mov qword [rax + 0x10], rsi
mov rbp, rcx
mov qword [rax + 0x18], rdi
lea rcx, [rax - 0x68]
mov qword [rax - 0x10], r14
mov esi, r9d
mov r14, rdx
mov qword [rax - 0x70], 0
xor edx, edx
mov qword [rax - 0x58], 0
mov rdi, r8
movdqu xmmword [rax - 0x68], xmm0
call fcn.180014a70
cmp qword [0x180096bd8], 0
je 0x18002b1e8
mov r9d, 0x30
mov qword [rsp + 0x90], r15
lea r8, [rsp + 0x58]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rsp + 0x7c]
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
mov r9d, 0x30
mov rcx, rbp
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rax, qword [rsp + 0x70]
cmp rax, rdi
jb 0x18002b147
test rdi, rdi
jne 0x18002b14a
mov rdi, rax
lea rax, [rsp + 0x30]
mov r9d, 0x40
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180014a70
mov rbx, rax
mov r15, rax
lea rax, [rsp + 0x38]
mov r8, rbx
mov r9, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18002b1dc
mov ecx, dword [rbx]
mov eax, dword [rbx + 4]
cmp ecx, 0
je 0x18002b1be
cmp ecx, esi
jae 0x18002b1be
cmp eax, 0x2000
jae 0x18002b1be
add rbx, rax
mov ecx, dword [rbx]
mov eax, dword [rbx + 4]
cmp ecx, 0
jne 0x18002b1a6
sub ebx, r15d
mov rdx, r14
mov r8d, ebx
mov rcx, rbp
call sym.TitanEngine.dll_RelocaterGrabRelocationTable
mov r15, qword [rsp + 0x90]
movzx ebx, al
jmp 0x18002b1ea
mov r15, qword [rsp + 0x90]
xor bl, bl
jmp 0x18002b1ea
xor bl, bl
mov rcx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
test rcx, rcx
je 0x18002b242
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18002b23d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002b24e
call fcn.180049e70
movzx eax, bl
add rsp, 0xa0
pop rbx
ret
call fcn.1800503fc
int3

Function at 0x18002b300
Capabilities:
Write file on windows

Disassembly:
mov rax, r9
mov r10, r8
mov r9, rdx
mov r8, rax
mov rdx, r10
jmp sym.TitanEngine.dll_DumpMemoryW
Function at 0x18002bf60
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r15, rcx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002c119
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rbx + 2]
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
je 0x18002c0f7
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x18002c0f7
mov r9, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rdi
call fcn.180007830
test al, al
je 0x18002c119
movsxd rbx, dword [rsi + 0x3c]
mov ecx, 0x10b
add rbx, rsi
movzx eax, word [rbx + 0x18]
cmp ax, cx
je 0x18002c095
mov ecx, 0x20b
cmp ax, cx
jne 0x18002c07f
cmp dword [rbx + 0xb0], 0
je 0x18002c119
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 0x15]
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
xor edx, edx
xor rax, 1
mov r9, rax
mov rcx, rsi
lea r8d, [rdx + 0x15]
call sym.TitanEngine.dll_SetPE32DataForMappedFile
mov edx, dword [rbx + 0xb0]
add rdx, qword [rbx + 0x30]
jmp 0x18002c0cd
mov r9, rsi
mov r8, rbp
mov edx, r14d
mov rcx, rdi
call fcn.18000dc30
jmp 0x18002c119
cmp dword [rbx + 0xa0], 0
je 0x18002c119
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 0x15]
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
xor edx, edx
xor rax, 1
mov r9, rax
mov rcx, rsi
lea r8d, [rdx + 0x15]
call sym.TitanEngine.dll_SetPE32DataForMappedFile
mov edx, dword [rbx + 0x34]
mov eax, dword [rbx + 0xa0]
add rdx, rax
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
mov r9, rsi
mov r8, rbp
mov edx, r14d
mov rcx, rdi
mov ebx, eax
call fcn.18000dc30
mov r8b, 1
mov edx, ebx
mov rcx, r15
call sym.TitanEngine.dll_WipeSectionW
jmp 0x18002c11b
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002c119
test byte [rsp + 0x68], 2
jne 0x18002c119
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18002c200
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, r8
mov rdi, r9
mov r8, rdx
mov rsi, rcx
mov rdx, rax
push rsi
call 0x180198bc4
mov rbp, rax
test rax, rax
je 0x18002c3df
mov rdx, rax
mov rcx, rsi
push rcx
call 0x1800f1e06
mov rbx, rax
test rax, rax
je 0x18002c3db
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rbx, eax
mov rcx, rbx
cmp byte [rbx + rdi], 0x5c
je 0x18002c298
test rcx, rcx
je 0x18002c298
dec rcx
dec ebx
cmp byte [rcx + rdi], 0x5c
jne 0x18002c288
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x18002c365
movsxd rax, ebx
inc rax
cmp rax, 0x104
jae 0x18002c3ff
lea rdx, [0x18006cc94]
mov byte [rsp + rax + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x104
movsxd rbx, eax
call fcn.18004c900
mov rsi, rbx
cmp rbx, 3
jle 0x18002c365
xor ebx, ebx
cmp byte [rsp + rbx + 0x53], 0x5c
jne 0x18002c359
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rbx + 3]
cmp rax, 0x104
jae 0x18002c3ff
xor edx, edx
mov byte [rsp + rbx + 0x163], 0
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc rbx
lea rax, [rbx + 3]
cmp rax, rsi
jl 0x18002c317
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002c3df
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002c3db
test byte [rsp + 0x40], 2
jne 0x18002c3db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18002c3e1
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.180049f80
int3
Function at 0x18002c690
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor ebp, ebp
mov rbx, r9
mov qword [rax - 0x48], rbp
mov r15d, r8d
mov r12, rdx
mov dword [rax - 0x50], 0x80
xor r9d, r9d
mov dword [rax - 0x58], 3
lea r8d, [rbp + 1]
mov edx, 0xe0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002c7c1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rbp + 0x40]
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x18002c79f
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
lea edx, [rbp + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x18002c79f
mov rcx, qword [rsp + 0xb8]
mov r9d, r15d
mov qword [rsp + 0x40], rcx
mov r8, r12
mov rcx, qword [rsp + 0xb0]
mov edx, r14d
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0xa0]
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call sym.TitanEngine.dll_ResourcerFindResourceEx
mov r9, rbp
mov r8, rsi
mov edx, r14d
mov rcx, rdi
movzx ebx, al
call fcn.18000dc30
test bl, bl
je 0x18002c7c1
mov al, 1
jmp 0x18002c7c3
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002c7c1
test byte [rsp + 0x50], 2
jne 0x18002c7c1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18002cae0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
xor edi, edi
mov r14, rdx
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002cbc6
mov qword [rsp + 0x60], rbp
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 2]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x18002cb9a
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18002cb9a
mov r8, r14
mov edx, ebp
mov rcx, rax
call sym.TitanEngine.dll_ResourcerEnumerateResourceEx
mov r9, rdi
mov r8, rsi
mov edx, ebp
mov rcx, rbx
call fcn.18000dc30
jmp 0x18002cbbc
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002cbbc
test byte [rsp + 0x70], 2
jne 0x18002cbbc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
Function at 0x18002d330
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
mov rbx, r8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rbx, 0xffffffffffffffff
je 0x18002d383
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rdi], eax
mov al, 1
jmp 0x18002d389
xor al, al
jmp 0x18002d389
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18002d3a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov rsi, rcx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18002d40d
mov ebx, dword [rsp + 0x70]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002d40d
cmp dword [rsp + 0x30], ebx
jne 0x18002d400
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.18004c900
mov rbx, qword [rsp + 0x50]
xor al, al
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18002d800
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1068
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r15, qword [rsp + 0x10d8]
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov r13d, 0x1000
lea rcx, [rsp + 0x50]
mov r8d, r13d
xor edx, edx
mov edi, r9d
call fcn.18004c900
test r14, r14
je 0x18002da1a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], r12d
mov r8, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x18002da1a
cmp byte [rsp + 0x10d0], r12b
je 0x18002d8bc
xor edx, edx
lea r8d, [r12 + 1]
mov rcx, r14
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
add rax, rsi
jmp 0x18002d8bf
mov rax, rsi
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rcx, qword [rsp + 0x48]
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18002d9f3
mov rcx, r15
call fcn.1800069b0
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov rcx, r15
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002d9f3
test edi, edi
jle 0x18002d9dd
cmp edi, r13d
mov ebx, edi
cmovae ebx, r13d
nop word [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x40]
test eax, eax
je 0x18002d9c5
cmp r8d, ebx
jne 0x18002d9c5
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, r13d
jbe 0x18002d995
add edi, 0xfffff000
test edi, edi
jg 0x18002d940
jmp 0x18002d9dd
cmp ebx, edi
je 0x18002d9dd
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x40]
test eax, eax
je 0x18002d9c5
cmp r8d, ebx
jne 0x18002d9c5
mov r8d, edi
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call fcn.18000d5c0
mov rcx, rsi
call fcn.18000d5c0
mov al, 1
jmp 0x18002da1c
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002da1a
test byte [rsp + 0x44], 2
jne 0x18002da1a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x1068
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002dae0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf68]
mov eax, 0x1068
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov ebx, r8d
mov r15d, edx
mov r14, rcx
mov r13d, 0x1000
mov r8d, r13d
lea rcx, [rsp + 0x50]
xor edx, edx
mov rsi, r9
call fcn.18004c900
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], r12d
mov r8, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x18002dcf3
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18002dccc
mov rcx, rsi
call fcn.1800069b0
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002dccc
test ebx, ebx
jle 0x18002dc7f
cmp ebx, r13d
mov edi, ebx
cmovae edi, r13d
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x40]
test eax, eax
je 0x18002dc67
cmp r8d, edi
jne 0x18002dc67
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, edi
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, r13d
jbe 0x18002dc37
add ebx, 0xfffff000
test ebx, ebx
jg 0x18002dbe2
jmp 0x18002dc7f
cmp edi, ebx
je 0x18002dc7f
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x40]
test eax, eax
je 0x18002dc67
cmp r8d, edi
jne 0x18002dc67
mov r8d, ebx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002dca6
test byte [rsp + 0x44], 2
jne 0x18002dca6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002dcc8
test byte [rsp + 0x44], 2
jne 0x18002dcc8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18002dcf5
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002dcf3
test byte [rsp + 0x44], 2
jne 0x18002dcf3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x1068
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret