joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d4b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov ebp, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor ebx, ebx
xor edx, edx
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov esi, r8d
call fcn.180014a70
lea edx, [rbx + 0x20]
mov dword [rsp + 0x68], ebx
lea rcx, [rsp + 0x20]
call fcn.180014a70
mov rcx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdx, rcx
cmp r8, rcx
jne 0x18001d50d
mov edx, ebx
sub r8d, ecx
lea r9, [rsp + 0x68]
mov ecx, 0x10
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, dword [rsp + 0x68]
lea rcx, [rsp + 0x20]
add rdx, 0x20
call fcn.180014a70
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x68]
sub r8, qword [rsp + 0x20]
mov rdx, rbx
mov ecx, 0x10
cmovne rdx, qword [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r8, qword [rsp + 0x20]
test eax, eax
js 0x18001d592
cmp qword [rsp + 0x28], r8
mov rcx, rbx
cmovne rcx, r8
mov edx, dword [rcx]
add rcx, 4
test edx, edx
je 0x18001d592
cmp dword [rcx], ebp
jne 0x18001d589
cmp ebx, esi
jae 0x18001d589
movzx eax, word [rcx + 6]
mov qword [rdi], rax
add rdi, 8
inc ebx
add rcx, 0x14
add edx, 0xffffffff
jne 0x18001d574
test r8, r8
je 0x18001d5c8
mov rdx, qword [rsp + 0x30]
mov rax, r8
sub rdx, r8
cmp rdx, 0x1000
jb 0x18001d5c0
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001d5df
mov rcx, r8
call fcn.180049e70
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1800503fc
int3
Function at 0x180020280
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
je 0x180020391
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180020391
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 2]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x180020369
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180020369
mov r9, r15
mov r8, r12
mov rdx, r14
mov rcx, rax
call sym.TitanEngine.dll_HooksInsertNewIATRedirectionEx
mov r9, rdi
mov r8, rsi
mov edx, ebp
mov rcx, rbx
test al, al
je 0x180020362
call fcn.18000dc30
mov al, 1
jmp 0x180020393
call fcn.18000dc30
jmp 0x180020391
lea rdx, [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180020391
test byte [rsp + 0x88], 2
jne 0x180020391
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180020700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rsi, qword [0x180090aa8]
movabs rax, 0x4ec4ec4ec4ec4ec5
sub rsi, qword [0x180090aa0]
movzx r15d, r8b
sar rsi, 3
mov rdi, rdx
imul rsi, rax
mov dword [rsp + 0x48], 2
dec esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
mov rbp, rax
test rdi, rdi
je 0x180020781
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
test eax, eax
jle 0x180020781
mov ecx, ebx
nop word [rax + rax]
movsx eax, byte [rcx + rdi]
inc rcx
rol ebx, 7
xor ebx, eax
cmp rcx, rdx
jl 0x180020770
test rbp, rbp
je 0x180020866
test esi, esi
je 0x180020866
mov eax, esi
mov qword [rsp + 0x40], r14
imul r14, rax, 0x68
nop dword [rax]
mov rax, qword [0x180090aa0]
cmp qword [r14 + rax + 0x32], rbp
jne 0x1800207b4
cmp r15b, 1
je 0x1800207ca
cmp dword [r14 + rax + 0x3a], ebx
jne 0x180020854
cmp byte [r14 + rax], 1
jne 0x180020854
mov rcx, qword [r14 + rax + 6]
lea r9, [rsp + 0x48]
mov edx, 0xe
lea r8d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180020854
mov rdx, qword [0x180090aa0]
mov r8d, dword [r14 + rdx + 2]
lea rcx, [r14 + rdx]
mov rcx, qword [r14 + rdx + 6]
add rdx, 0x24
mov eax, esi
imul rdi, rax, 0x68
add rdx, rdi
call fcn.18004c130
mov rcx, qword [0x180090aa0]
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov edx, 0xe
mov rcx, qword [r14 + rcx + 6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180090aa0]
mov r8, qword [0x180090aa8]
add rcx, rdi
lea rdx, [rcx + 0x68]
sub r8, rdx
call fcn.18004c130
sub qword [0x180090aa8], 0x68
sub r14, 0x68
add esi, 0xffffffff
jne 0x1800207a0
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
xor al, al
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x180020bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, qword [0x180090aa8]
movabs rax, 0x4ec4ec4ec4ec4ec5
sub rdi, qword [0x180090aa0]
movzx r14d, r8b
sar rdi, 3
mov rsi, rdx
imul rdi, rax
mov dword [rsp + 0x48], 2
dec edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
mov rbp, rax
test rsi, rsi
je 0x180020c31
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
test eax, eax
jle 0x180020c31
mov ecx, ebx
nop word [rax + rax]
movsx eax, byte [rcx + rsi]
inc rcx
rol ebx, 7
xor ebx, eax
cmp rcx, rdx
jl 0x180020c20
test rbp, rbp
je 0x180020cf5
test edi, edi
je 0x180020cf5
mov eax, edi
imul rsi, rax, 0x68
nop dword [rax + rax]
mov rax, qword [0x180090aa0]
cmp qword [rsi + rax + 0x32], rbp
jne 0x180020c64
cmp r14b, 1
je 0x180020c70
cmp dword [rsi + rax + 0x3a], ebx
jne 0x180020ce8
cmp byte [rsi + rax], 1
jne 0x180020ce8
cmp byte [rsi + rax + 0x3e], 0
je 0x180020ce8
mov rcx, qword [rsi + rax + 6]
lea r9, [rsp + 0x48]
mov edx, 0xe
lea r8d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180020ce8
mov rdx, qword [0x180090aa0]
mov r8d, dword [rsi + rdx + 2]
lea rcx, [rsi + rdx]
mov rcx, qword [rsi + rdx + 6]
add rdx, 0x24
mov eax, edi
imul rax, rax, 0x68
add rdx, rax
call fcn.18004c130
mov rcx, qword [0x180090aa0]
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov edx, 0xe
mov rcx, qword [rsi + rcx + 6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x180090aa0]
mov byte [rsi + rax + 0x3e], 0
sub rsi, 0x68
add edi, 0xffffffff
jne 0x180020c50
mov rbx, qword [rsp + 0x40]
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180021040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, qword [0x180090aa8]
movabs rax, 0x4ec4ec4ec4ec4ec5
sub rdi, qword [0x180090aa0]
movzx r14d, r8b
sar rdi, 3
mov rsi, rdx
imul rdi, rax
mov dword [rsp + 0x48], 2
dec edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
mov rbp, rax
test rsi, rsi
je 0x1800210c1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
test eax, eax
jle 0x1800210c1
mov ecx, ebx
nop word [rax + rax]
movsx eax, byte [rcx + rsi]
inc rcx
rol ebx, 7
xor ebx, eax
cmp rcx, rdx
jl 0x1800210b0
test rbp, rbp
je 0x180021185
test edi, edi
je 0x180021185
mov eax, edi
imul rsi, rax, 0x68
nop dword [rax + rax]
mov rax, qword [0x180090aa0]
cmp qword [rsi + rax + 0x32], rbp
jne 0x1800210f4
cmp r14b, 1
je 0x180021100
cmp dword [rsi + rax + 0x3a], ebx
jne 0x180021178
cmp byte [rsi + rax], 1
jne 0x180021178
cmp byte [rsi + rax + 0x3e], 0
jne 0x180021178
mov rcx, qword [rsi + rax + 6]
lea r9, [rsp + 0x48]
mov edx, 0xe
lea r8d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180021178
mov rdx, qword [0x180090aa0]
mov r8d, dword [rsi + rdx + 2]
lea rcx, [rsi + rdx]
mov rcx, qword [rsi + rdx + 6]
add rdx, 0x16
mov eax, edi
imul rax, rax, 0x68
add rdx, rax
call fcn.18004c130
mov rcx, qword [0x180090aa0]
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov edx, 0xe
mov rcx, qword [rsi + rcx + 6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x180090aa0]
mov byte [rsi + rax + 0x3e], 1
sub rsi, 0x68
add edi, 0xffffffff
jne 0x1800210e0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180021930
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x2040
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x2000
call fcn.18004c900
mov rax, qword [0x180090aa0]
mov qword [0x180090aa8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1800219e4
mov eax, dword [rsp + 0x20]
and eax, 0xfffffff8
mov qword [rsp + 0x2058], rbx
mov ebx, 1
cmp eax, 8
jbe 0x1800219dc
nop dword [rax + rax]
mov ecx, ebx
mov rdx, rdi
mov rcx, qword [rsp + rcx*8 + 0x30]
call sym.TitanEngine.dll_HooksScanModuleMemory
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x1800219c0
mov rbx, qword [rsp + 0x2058]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x2040
pop rdi
ret

Function at 0x180021a00
Capabilities:
Enumerate process modules

Disassembly:
lea rcx, [0x18001f460]
jmp sym.TitanEngine.dll_HooksScanEntireProcessMemory
Function at 0x180022c10
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14, qword [rsp + 0x4c0]
mov rbp, r8
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov rsi, r9
call fcn.18004c900
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call fcn.18004c900
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jae 0x180022d2c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, [rsp + 0x40]
lea rdx, str.DumpTemp
lea rcx, [rsp + 0x250]
lea r8d, [rax + 0x66]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180022d2c
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, rbx
call sym.TitanEngine.dll_DumpProcessW
xor eax, eax
lea r8, [rsp + 0x30]
mov r9, rbp
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x30], eax
mov ecx, edi
mov byte [rsp + 0x20], al
call sym.TitanEngine.dll_scylla_searchIAT
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180022d16
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x180022d16
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call sym.TitanEngine.dll_scylla_getImports
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsi], rbx
mov qword [r14], rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180023c70
Capabilities:
Allocate or change rwx memory
Create thread
Inject dll
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
lea rdi, [0x18000d730]
mov esi, edx
lea r14, [0x18000d710]
mov rbx, rcx
sub rdi, r14
test rcx, rcx
je 0x180023eaf
lea rcx, [0x18006da78]
mov qword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
lea rcx, [0x18006da98]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
lea rcx, [0x18006dac0]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18006daa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
lea rcx, [0x18006dae0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetProcAddress
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
lea rcx, [0x18006db00]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
lea rcx, [0x18006db20]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18006db10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rbx
call fcn.18000b8c0
mov r9d, 0x1000
mov qword [rsp + 0x68], rax
mov r8d, r9d
mov dword [rsp + 0x78], esi
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8, rdi
xor edx, edx
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rdi
mov r8, r14
mov rsi, rax
mov rcx, rbx
lea rax, [rsp + 0xb0]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
test eax, eax
je 0x180023e88
lea rax, [rsp + 0xb0]
mov r9d, 0x3c
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0xa0]
mov r9, rsi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x180023eb1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180024c60
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180024dab
mov byte [rsp + 0x20], 1
mov r9, rcx
xor r8d, r8d
xor edx, edx
call fcn.180007830
test al, al
je 0x180024dab
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x180024d26
mov eax, dword [rcx + 0x34]
sub rbx, rax
movzx eax, word [rcx + 0x14]
lea r8, [rcx + 0x18]
add r8, rax
mov qword [rsp + 0x40], r8
movzx r11d, word [rcx + 6]
mov edx, r11d
mov dword [rsp + 0x34], edx
mov r9d, 0xffffffff
mov dword [rsp + 0x30], r9d
test edx, edx
je 0x180024d14
mov r10d, dword [r8 + 0xc]
cmp r10, rbx
ja 0x180024d03
mov ecx, dword [r8 + 8]
cmp ecx, dword [r8 + 0x10]
cmovbe ecx, dword [r8 + 0x10]
lea eax, [r10 + rcx]
cmp rbx, rax
jae 0x180024d03
mov r9d, r11d
sub r9d, edx
mov dword [rsp + 0x30], r9d
add r8, 0x28
mov qword [rsp + 0x40], r8
dec edx
mov dword [rsp + 0x34], edx
jmp 0x180024cd5
mov eax, r9d
jmp 0x180024db0
mov edx, 0x20b
cmp ax, dx
jne 0x180024dab
sub rbx, qword [rcx + 0x30]
movzx eax, word [rcx + 0x14]
lea r8, [rcx + 0x18]
add r8, rax
mov qword [rsp + 0x48], r8
movzx r11d, word [rcx + 6]
mov edx, r11d
mov dword [rsp + 0x3c], edx
mov r9d, 0xffffffff
mov dword [rsp + 0x38], r9d
nop dword [rax + rax]
test edx, edx
je 0x180024d9f
mov r10d, dword [r8 + 0xc]
cmp r10, rbx
ja 0x180024d8e
mov ecx, dword [r8 + 8]
cmp ecx, dword [r8 + 0x10]
cmovbe ecx, dword [r8 + 0x10]
lea eax, [r10 + rcx]
cmp rbx, rax
jae 0x180024d8e
mov r9d, r11d
sub r9d, edx
mov dword [rsp + 0x38], r9d
add r8, 0x28
mov qword [rsp + 0x48], r8
dec edx
mov dword [rsp + 0x3c], edx
jmp 0x180024d60
mov eax, r9d
jmp 0x180024db0
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180024f70
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov rbx, r9
mov rdi, r8
mov r14d, edx
mov rsi, rcx
test rcx, rcx
je 0x18002519d
mov byte [rsp + 0x20], 1
mov r9, rcx
xor r8d, r8d
xor edx, edx
call fcn.180007830
test al, al
je 0x18002519d
movsxd rcx, dword [rsi + 0x3c]
add rcx, rsi
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x180024fd1
xor r8d, r8d
mov eax, r8d
jmp 0x180024fe7
mov edx, 0x20b
cmp ax, dx
jne 0x18002519d
mov eax, 1
xor r8d, r8d
test eax, eax
jne 0x1800250cd
cmp byte [rsp + 0x80], al
jne 0x180025004
test rdi, rdi
jne 0x180025002
sub ebx, dword [rcx + 0x34]
jmp 0x180025004
sub ebx, edi
mov r11d, ebx
mov eax, dword [rcx + 0x38]
mov edx, ebx
cmp r11, rax
cmovae rdx, r8
movzx eax, word [rcx + 0x14]
lea r8, [rcx + 0x18]
add r8, rax
movzx r9d, word [rcx + 6]
test r9d, r9d
je 0x180025073
mov r10d, dword [r8 + 0xc]
cmp r10, r11
ja 0x180025060
mov eax, dword [r8 + 8]
mov ebx, dword [r8 + 0x10]
cmp eax, ebx
cmovbe eax, ebx
add eax, r10d
cmp r11, rax
jae 0x180025060
mov rcx, r11
sub rcx, r10
cmp rcx, rbx
ja 0x180025060
mov edx, dword [r8 + 0x14]
sub rdx, r10
add rdx, r11
mov qword [rsp + 0x38], rdx
add r8, 0x28
mov qword [rsp + 0x40], r8
dec r9d
mov dword [rsp + 0x30], r9d
jmp 0x180025023
movzx eax, byte [rsp + 0x88]
test al, al
je 0x1800250ad
test rdx, rdx
je 0x18002508c
add rdx, rsi
mov qword [rsp + 0x38], rdx
test al, al
je 0x1800250ad
cmp rdx, rsi
jb 0x1800250a6
lea rcx, [rsi + r14]
cmp rdx, rcx
ja 0x1800250a6
mov rax, rdx
jmp 0x18002519f
xor eax, eax
jmp 0x18002519f
test rdx, rdx
je 0x1800250bf
cmp rdx, r14
ja 0x1800250bf
mov rax, rdx
jmp 0x18002519f
xor eax, eax
jmp 0x18002519f
cmp byte [rsp + 0x80], 0
jne 0x1800250e3
test rdi, rdi
jne 0x1800250e1
sub ebx, dword [rcx + 0x30]
jmp 0x1800250e3
sub ebx, edi
mov r11d, ebx
mov eax, dword [rcx + 0x38]
mov edx, ebx
cmp r11, rax
cmovae rdx, r8
movzx eax, word [rcx + 0x14]
lea r8, [rcx + 0x18]
add r8, rax
movzx r9d, word [rcx + 6]
test r9d, r9d
je 0x180025152
mov r10d, dword [r8 + 0xc]
cmp r10, r11
ja 0x18002513f
mov eax, dword [r8 + 8]
mov ebx, dword [r8 + 0x10]
cmp eax, ebx
cmovbe eax, ebx
add eax, r10d
cmp r11, rax
jae 0x18002513f
mov rcx, r11
sub rcx, r10
cmp rcx, rbx
ja 0x18002513f
mov edx, dword [r8 + 0x14]
sub rdx, r10
add rdx, r11
mov qword [rsp + 0x38], rdx
add r8, 0x28
mov qword [rsp + 0x40], r8
dec r9d
mov dword [rsp + 0x30], r9d
jmp 0x180025102
movzx eax, byte [rsp + 0x88]
test al, al
je 0x180025186
test rdx, rdx
je 0x18002516b
add rdx, rsi
mov qword [rsp + 0x38], rdx
test al, al
je 0x180025186
cmp rdx, rsi
jb 0x180025182
lea rcx, [rsi + r14]
cmp rdx, rcx
ja 0x180025182
mov rax, rdx
jmp 0x18002519f
xor eax, eax
jmp 0x18002519f
test rdx, rdx
je 0x180025195
cmp rdx, r14
ja 0x180025195
mov rax, rdx
jmp 0x18002519f
xor eax, eax
jmp 0x18002519f
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x180029bf0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1840
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x1830], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call fcn.18004c900
xor edx, edx
lea rcx, [rsp + 0x1030]
mov r8d, 0x800
call fcn.18004c900
xor esi, esi
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x180029d93
test dword [rsp + 0x20], 0xfffffffc
jbe 0x180029d93
lea r14, [rsp + 0x30]
nop dword [rax]
mov r8d, dword [r14]
test r8d, r8d
je 0x180029d7e
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180029d7e
mov r8d, 0x400
lea rdx, [rsp + 0x1030]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x180029d5c
lea rcx, [rsp + 0x1030]
call sym.TitanEngine.dll_TranslateNativeNameW
mov rdx, rax
lea rcx, [rsp + 0x1030]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, [rsp + 0x24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180029d18
test byte [rsp + 0x24], 2
jne 0x180029d18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbp
lea rcx, [rsp + 0x1030]
call fcn.180050580
test eax, eax
je 0x180029d53
mov edx, 0x5c
lea rcx, [rsp + 0x1030]
call fcn.18004acc4
test rax, rax
je 0x180029d7e
lea rcx, [rax + 2]
mov rdx, rbp
call fcn.180050580
test eax, eax
jne 0x180029d7e
movsxd rax, esi
mov eax, dword [rsp + rax*4 + 0x30]
jmp 0x180029d95
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180029d7e
test byte [rsp + 0x28], 2
jne 0x180029d7e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
inc esi
shr eax, 2
add r14, 4
cmp esi, eax
jl 0x180029c80
xor eax, eax
mov rcx, qword [rsp + 0x1830]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x1840]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180029dc0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x3450
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x3440], rax
mov r15, rdx
mov r12, rcx
xor edx, edx
mov r8d, 0x2000
lea rcx, [rsp + 0x1040]
call fcn.18004c900
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x40]
call fcn.18004c900
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x3040]
call fcn.18004c900
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
test r15, r15
je 0x180029f7f
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x180029f7f
xor esi, esi
nop word [rax + rax]
mov eax, dword [rsp + 0x20]
shr eax, 2
cmp esi, eax
jge 0x180029f7f
movsxd rax, esi
mov r8d, dword [rsp + rax*4 + 0x40]
test r8d, r8d
je 0x180029f78
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180029f78
xor edx, edx
mov r8d, 0x2000
lea rcx, [rsp + 0x1040]
call fcn.18004c900
lea r9, [rsp + 0x24]
mov r8d, 0x2000
lea rdx, [rsp + 0x1040]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x180029f56
xor ebx, ebx
mov eax, dword [rsp + 0x24]
shr eax, 3
cmp ebx, eax
jge 0x180029f56
movsxd rax, ebx
lea rdi, [rsp + 0x1040]
lea rdi, [rdi + rax*8]
mov rdx, qword [rdi]
test rdx, rdx
je 0x180029f52
mov r9d, 0x400
lea r8, [rsp + 0x3040]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
test eax, eax
je 0x180029f52
mov rdx, r12
lea rcx, [rsp + 0x3040]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180029f52
movsxd rax, esi
mov rdx, qword [rdi]
mov ecx, dword [rsp + rax*4 + 0x40]
call r15
jmp 0x180029f52
inc ebx
jmp 0x180029ee5
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180029f78
test byte [rsp + 0x28], 2
jne 0x180029f78
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
jmp 0x180029e70
mov rcx, qword [rsp + 0x3440]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x3490]
add rsp, 0x3450
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret