joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d220
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x6a0
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x690], rax
movzx esi, dl
mov rdi, rcx
test rcx, rcx
je 0x18000d3c4
mov rdx, rcx
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [rsp + 0x480], 0
je 0x18000d3c4
lea rdx, str..
mov qword [rsp + 0x6b8], rbx
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x18000d365
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rsp + 0x20], 0x10
je 0x18000d319
cmp word [rsp + 0x4c], 0x2e
je 0x18000d34f
lea rdx, [0x18006ce8c]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dl, 1
lea rcx, [rsp + 0x270]
call fcn.18000d220
jmp 0x18000d34f
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000d34f
mov r8b, 1
lea rcx, [rsp + 0x270]
xor edx, edx
call sym.TitanEngine.dll_HandlerCloseAllLockHandlesW
test al, al
je 0x18000d34f
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000d2a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test sil, sil
je 0x18000d3b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x180084340]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jge 0x18000d3b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18000d3b8
mov r8b, 1
mov rcx, rdi
movzx edx, r8b
call sym.TitanEngine.dll_HandlerCloseAllLockHandlesW
test al, al
je 0x18000d3b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rbx, qword [rsp + 0x6b8]
mov al, 1
jmp 0x18000d3c6
xor al, al
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.180049ad0
mov rsi, qword [rsp + 0x6c0]
add rsp, 0x6a0
pop rdi
ret
Function at 0x18000d3f0
Capabilities:
Copy file

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x438
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, r8
mov rsi, rdx
test rcx, rcx
je 0x18000d59e
test rdx, rdx
je 0x18000d59e
test rbx, rbx
je 0x18000d59e
mov rdx, rcx
mov qword [r11 + 0x20], rbp
lea rcx, [rsp + 0x20]
mov qword [r11 - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rbp, [0x1800832c0]
xor edx, edx
mov rcx, rbp
movsxd rdi, eax
mov r8d, 0x400
call fcn.18004c900
mov rcx, rdi
test edi, edi
jle 0x18000d481
nop
cmp word [rsi + rcx*2], 0x5c
je 0x18000d481
dec edi
dec rcx
test rcx, rcx
jg 0x18000d470
movsxd rax, edi
cmp word [rsi + rax*2], 0x5c
jne 0x18000d4d4
lea eax, [rdi + 1]
mov rcx, rsi
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
cmp rdi, rdx
jg 0x18000d4d7
lea rax, [rdi + rdi]
mov r8, rbp
sub r8, rax
lea rcx, [rax + rsi]
sub r8, rsi
sub rdx, rdi
inc rdx
nop dword [rax]
movzx eax, word [rcx]
mov word [r8 + rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x18000d4c0
jmp 0x18000d4d7
mov rbp, rsi
mov rdx, rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdi, qword [rsp + 0x430]
mov rbp, qword [rsp + 0x468]
cmp eax, 0x208
jl 0x18000d56c
lea rax, [rsp + 0x20]
mov ecx, 4
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x18000d511
mov rax, qword [rax]
mov qword [rbx], rax
jmp 0x18000d589
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
add eax, eax
movsxd r8, eax
call fcn.18004c130
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov al, 1
jmp 0x18000d5a0
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x438
pop rsi
pop rbx
ret
Function at 0x18000d980
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
test edx, edx
jne 0x18000d9b1
mov edi, 2
mov edx, 0x80000000
lea ebx, [rdi + 2]
jmp 0x18000d9d9
mov ebx, 2
cmp edx, 1
jne 0x18000d9c5
mov edx, 0x40000000
lea edi, [rbx + 2]
jmp 0x18000d9d9
cmp edx, 2
mov edi, 0x40
mov edx, 0xe0000000
je 0x18000d9d9
mov ebx, 0xf001f
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000daa6
xor edx, edx
mov qword [r15], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov r8d, edi
mov dword [r14], eax
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x18000da6f
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov edx, ebx
mov qword [rcx], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x18000da6f
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov al, 1
jmp 0x18000dab5
mov rax, qword [rsp + 0x88]
lea rdx, [rsp + 0x68]
xor ecx, ecx
mov qword [rax], rcx
mov rcx, rsi
mov qword [r15], rbp
mov dword [r14], ebp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18000dab3
test byte [rsp + 0x68], 2
jne 0x18000dab3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000dab3
mov rax, qword [rsp + 0x88]
xor ecx, ecx
mov qword [rax], rcx
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000dad0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
test edx, edx
jne 0x18000db01
mov edi, 2
mov edx, 0x80000000
lea ebx, [rdi + 2]
jmp 0x18000db29
mov ebx, 2
cmp edx, 1
jne 0x18000db15
mov edx, 0x40000000
lea edi, [rbx + 2]
jmp 0x18000db29
cmp edx, 2
mov edi, 0x40
mov edx, 0xe0000000
je 0x18000db29
mov ebx, 0xf001f
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000dbfd
xor edx, edx
mov qword [r15], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
add eax, dword [rsp + 0x90]
mov r8d, edi
xor edx, edx
mov dword [r14], eax
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x18000dbc6
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov edx, ebx
mov qword [rcx], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x18000dbc6
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov al, 1
jmp 0x18000dc0c
mov rax, qword [rsp + 0x88]
lea rdx, [rsp + 0x68]
xor ecx, ecx
mov qword [rax], rcx
mov rcx, rsi
mov qword [r15], rbp
mov dword [r14], ebp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18000dc0a
test byte [rsp + 0x68], 2
jne 0x18000dc0a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000dc0a
mov rax, qword [rsp + 0x88]
xor ecx, ecx
mov qword [rax], rcx
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000f390
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
cmp byte [0x180083adf], 0
mov rdi, rcx
jne 0x18000f3bf
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x180083adf], 1
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x1800909e0]
xor ebx, ebx
mov rcx, qword [0x1800909d8]
movabs rsi, 0x82fa0be82fa0be83
sub rdx, rcx
mov qword [rsp + 0x80], rbx
imul rdx, rsi
movsxd r8, edx
test edx, edx
jle 0x18000f41d
mov eax, ebx
inc rcx
cmp rdx, rax
jbe 0x18000f5ed
cmp qword [rcx], rdi
je 0x18000f442
inc ebx
inc rax
add rcx, 0x2b
cmp rax, r8
jl 0x18000f401
xor bl, bl
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x88]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
mov r9d, 0x30
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rsp + 0x54]
mov rcx, qword [0x1800909d8]
mov dword [rsp + 0x78], eax
mov rax, qword [0x1800909e0]
sub rax, rcx
movsxd rbx, ebx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f5ed
lea rax, [rsp + 0x78]
mov r9d, 0x40
imul r8, rbx, 0x2b
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [r8 + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f5ed
imul rax, rbx, 0x2b
cmp byte [rax + rcx], 1
jne 0x18000f5c0
imul rax, rbx, 0x2b
mov edx, dword [rax + rcx + 0x13]
test edx, edx
je 0x18000f4f0
cmp edx, 1
jne 0x18000f5c0
imul rax, rbx, 0x2b
lea r8, [rcx + 0x11]
lea rdx, [rsp + 0x80]
add r8, rax
mov qword [rsp + 0x20], rdx
mov rdx, rdi
mov r9, qword [rax + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000f5a6
mov rcx, qword [0x180082d08]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f5ed
imul rax, rbx, 0x2b
mov byte [rax + rcx], 2
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f5ed
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x78]
imul r8, rbx, 0x2b
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [r8 + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov bl, 1
jmp 0x18000f41f
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f5ed
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x78]
imul r8, rbx, 0x2b
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [r8 + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x18000f41d
call fcn.180005850
int3
Function at 0x18000fb80
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, qword [rsp + 0xb0]
mov edi, r9d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x18000fcee
test rdx, rdx
je 0x18000fcee
mov r8, rdx
mov rdx, rcx
call fcn.18000b550
mov rbx, rax
test rax, rax
je 0x18000fcee
cmp edi, 1
jne 0x18000fcde
xor r13d, r13d
lea rdx, [0x18006d5b8]
mov rcx, r14
mov ebp, r13d
mov edi, r13d
call fcn.1800507e0
test eax, eax
jne 0x18000fc86
mov r8, rsi
lea rdx, [0x18006d5c8]
call fcn.18000b550
mov rsi, rax
test rax, rax
je 0x18000fc86
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
add ebp, edi
mov qword [rsp + 0x20], r13
movsxd rdx, ebp
mov r9d, 0x10
add rdx, rbx
call sym.TitanEngine.dll_MemoryReadSafe
test al, al
je 0x18000fcee
movzx eax, byte [rsp + 0x30]
cmp al, 0xcc
je 0x18000fc86
cmp al, 0x90
je 0x18000fc86
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call sym.TitanEngine.dll_LengthDisassembleEx
cmp byte [rsp + 0x30], 0x48
mov edi, eax
jne 0x18000fc20
cmp byte [rsp + 0x31], 0xff
jne 0x18000fc20
cmp byte [rsp + 0x32], 0x25
jne 0x18000fc20
mov rbx, rsi
mov eax, r13d
mov edi, r13d
nop dword [rax]
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
add edi, eax
mov qword [rsp + 0x20], r13
movsxd rsi, edi
mov r9d, 0x10
lea rdx, [rsi + rbx]
call sym.TitanEngine.dll_MemoryReadSafe
test al, al
je 0x18000fcee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call sym.TitanEngine.dll_LengthDisassembleEx
movzx ecx, byte [rsp + 0x30]
cmp cl, 0xc3
je 0x18000fcdb
cmp cl, 0xc2
jne 0x18000fc90
add rbx, rsi
mov r8, r12
mov edx, r15d
mov rcx, rbx
call sym.TitanEngine.dll_SetBPX
jmp 0x18000fcf0
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000fd20
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, r8d
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x18000fe78
test rdx, rdx
je 0x18000fe78
mov r8, rdx
mov rdx, rcx
call fcn.18000b550
mov rbx, rax
test rax, rax
je 0x18000fe78
cmp edi, 1
jne 0x18000fe6e
xor r15d, r15d
lea rdx, [0x18006d5d8]
mov rcx, r14
mov ebp, r15d
mov edi, r15d
call fcn.1800507e0
test eax, eax
jne 0x18000fe17
mov r8, rsi
lea rdx, [0x18006d5e8]
call fcn.18000b550
mov rsi, rax
test rax, rax
je 0x18000fe17
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
add ebp, edi
mov qword [rsp + 0x20], r15
movsxd rdx, ebp
mov r9d, 0x10
add rdx, rbx
call sym.TitanEngine.dll_MemoryReadSafe
test al, al
je 0x18000fe78
movzx eax, byte [rsp + 0x30]
cmp al, 0xcc
je 0x18000fe17
cmp al, 0x90
je 0x18000fe17
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call sym.TitanEngine.dll_LengthDisassembleEx
cmp byte [rsp + 0x30], 0x48
mov edi, eax
jne 0x18000fdb1
cmp byte [rsp + 0x31], 0xff
jne 0x18000fdb1
cmp byte [rsp + 0x32], 0x25
jne 0x18000fdb1
mov rbx, rsi
mov eax, r15d
mov edi, r15d
nop dword [rax]
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
add edi, eax
mov qword [rsp + 0x20], r15
movsxd rsi, edi
mov r9d, 0x10
lea rdx, [rsi + rbx]
call sym.TitanEngine.dll_MemoryReadSafe
test al, al
je 0x18000fe78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call sym.TitanEngine.dll_LengthDisassembleEx
movzx ecx, byte [rsp + 0x30]
cmp cl, 0xc3
je 0x18000fe6b
cmp cl, 0xc2
jne 0x18000fe20
add rbx, rsi
mov rcx, rbx
call sym.TitanEngine.dll_DeleteBPX
jmp 0x18000fe7a
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011620
Capabilities:
Create directory
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
je 0x180011755
cmp edx, 1
jne 0x180011796
mov qword [0x180082e98], rcx
lea rcx, [0x180082660]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180082e98]
lea rdx, [0x1800830b0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800116fb
lea rbx, [0x180082ea0]
mov rcx, rbx
lea rdx, [0x1800830b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbx + rcx*2], 0x5c
je 0x1800116a8
test rcx, rcx
je 0x1800116a8
dec rcx
dec eax
cmp word [rbx + rcx*2], 0x5c
jne 0x180011697
test eax, eax
je 0x1800116f6
cdqe
add rax, rax
cmp rax, 0x208
jae 0x1800117a1
xor ecx, ecx
mov rdx, rbx
mov word [rax + rbx], cx
lea rcx, [0x180084340]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.garbage_
lea rcx, [0x180084340]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea rcx, [0x180084340]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.180009890
call fcn.18000a7d0
xor edx, edx
lea rcx, [0x180084340]
call fcn.18000d220
lea rax, [0x180084550]
xorps xmm0, xmm0
mov ecx, 2
nop dword [rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x180011720
lea eax, [rcx + 1]
add rsp, 0x20
pop rbx
ret
test r8, r8
je 0x18001175f
call fcn.1800096e0
lea rcx, [0x180084340]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp byte [0x180083adf], 0
je 0x180011796
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [0x180083adf], 0
mov eax, 1
add rsp, 0x20
pop rbx
ret
call fcn.180049f80
int3
Function at 0x180013470
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800134dd
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call fcn.18004c900
mov rcx, rdi
mov dword [rsp + 0x50], 0x10001f
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1800134dd
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
test eax, eax
jne 0x180013500
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor al, al
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rax, [rsp + 0x120]
mov ecx, 4
nop dword [rax]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x180013520
mov al, 1
jmp 0x1800134df

Function at 0x180013580
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1800135a8
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1800060b0
mov rcx, rdi
movzx ebx, al
call qword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800135d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1800135f8
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
call fcn.1800064e0
mov rcx, rdi
movzx ebx, al
call qword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180013990
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x180013a8b
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call fcn.18004c900
mov rcx, rdi
mov dword [rsp + 0x50], 0x10001f
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180013a8b
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180013a82
lea rax, [rsp + 0x120]
mov ecx, 4
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rbx, [rbx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rcx, 1
jne 0x180013a10
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x180013a82
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x180013a8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor al, al
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret
Function at 0x180014b30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
call fcn.180005920
call fcn.18000e8b0
mov rax, qword [0x180090a60]
movabs r14, 0xf0b7672a07a44c6b
mov rcx, qword [0x180090a58]
sub rax, rcx
sar rax, 4
imul rax, r14
movsxd rbp, eax
test eax, eax
jle 0x180014c11
xor ebx, ebx
xor edi, edi
nop
mov rax, qword [0x180090a60]
sub rax, rcx
sar rax, 4
imul rax, r14
cmp rax, rbx
jbe 0x180014cc6
mov rax, qword [rdi + rcx + 0x18]
test rax, rax
je 0x180014bfe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [0x180090a60]
mov rsi, qword [0x180090a58]
sub rax, rsi
sar rax, 4
imul rax, r14
cmp rax, rbx
jbe 0x180014cc6
mov rsi, qword [rdi + rsi + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180014bf7
test byte [rsp + 0x40], 2
jne 0x180014bf7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180090a58]
inc rbx
add rdi, 0x430
cmp rbx, rbp
jl 0x180014b80
mov rax, qword [0x180090a68]
xorps xmm0, xmm0
mov qword [0x180090a68], 0
movdqu xmmword [0x180090a58], xmm0
test rcx, rcx
je 0x180014c6b
sub rax, rcx
sar rax, 4
imul rax, r14
imul rdx, rax, 0x430
cmp rdx, 0x1000
jb 0x180014c66
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180014ccc
mov rcx, r8
call fcn.180049e70
cmp byte [0x180082692], 0
jne 0x180014c79
call sym.TitanEngine.dll_StopDebug
xor eax, eax
xorps xmm0, xmm0
cmp byte [0x180082abc], al
movups xmmword [0x180082d08], xmm0
mov qword [0x180082d18], rax
je 0x180014ca1
lea rcx, [0x1800826a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov byte [0x180082abc], 0
mov qword [0x180082c68], 0
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call fcn.180005850
int3
call fcn.1800503fc
int3