Function at 0x1800372c0
Capabilities:
Copy file
Enumerate pe sections
Get file size
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
movzx r15d, r8b
mov r14d, edx
mov rdi, rcx
mov qword [rsp + 0x78], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x2b0]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xa0]
call fcn.18004c900
xor ebx, ebx
cmp byte [0x180081330], bl
je 0x18003735c
lea rcx, [rsp + 0xa0]
call fcn.18000d050
test al, al
je 0x18003735c
lea r8, [rsp + 0x2b0]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.18000d3f0
test al, al
jne 0x180037382
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xe0000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x18003790f
mov qword [rsp + 0x88], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1800378e3
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x1800378e8
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rdi
call fcn.180007830
test al, al
je 0x18003791d
xor edx, edx
lea r8d, [rdx + 0x2c]
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov ecx, r15d
test rax, rax
cmove ecx, ebx
mov dword [rsp + 0x4c], ecx
movsxd r15, dword [r12 + 0x3c]
add r15, r12
movzx eax, word [r15 + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x180037696
cmp r14d, 0xffffffff
je 0x18003791d
movzx eax, word [r15 + 6]
cmp r14d, eax
jg 0x18003791d
mov r8d, 0x2a
mov edx, r14d
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov rsi, rax
mov r8d, 0x2c
mov edx, r14d
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov r10, rax
mov qword [rsp + 0x50], rax
movzx ecx, word [r15 + 0x14]
lea rdi, [r15 + 0x18]
add rdi, rcx
mov r11d, dword [r15 + 0x3c]
mov dword [rsp + 0x44], r11d
nop word [rax + rax]
movzx eax, word [r15 + 6]
cmp ebx, eax
jge 0x1800375c9
lea eax, [r14 - 1]
cmp ebx, eax
jne 0x180037591
mov r9d, dword [rdi + 0x10]
xor edx, edx
mov eax, r9d
div r11d
mov r8d, edx
xor edx, edx
mov eax, r9d
div r11d
mov ecx, r11d
sub ecx, edx
add ecx, r9d
xor edx, edx
mov eax, r9d
div r11d
sub r9d, edx
test r8d, r8d
cmovne r9d, ecx
mov dword [rdi + 0x10], r9d
add esi, dword [rdi + 8]
mov dword [rsp + 0x40], esi
mov ecx, dword [r15 + 0x38]
mov eax, esi
xor edx, edx
div ecx
mov r8d, eax
xor edx, edx
mov eax, esi
div ecx
test edx, edx
jne 0x180037575
imul ecx, r8d
mov esi, ecx
mov dword [rsp + 0x40], ecx
mov dword [rdi + 8], ecx
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x60], r10d
jmp 0x1800375b2
lea eax, [r8 + 1]
imul eax, ecx
mov esi, eax
mov dword [rsp + 0x40], eax
mov dword [rdi + 8], eax
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x60], r10d
jmp 0x1800375b2
cmp ebx, r14d
jle 0x1800375b2
lea rcx, [rdi - 0x28]
mov r8d, 0x28
mov rdx, rdi
call fcn.18004c130
mov r10, qword [rsp + 0x50]
mov r11d, dword [rsp + 0x44]
add rdi, 0x28
mov qword [rsp + 0x90], rdi
inc ebx
mov dword [rsp + 0x64], ebx
jmp 0x1800374f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
mov eax, 0xffff
add word [r15 + 6], ax
cmp byte [rsp + 0x4c], 0
je 0x1800375ff
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call sym.TitanEngine.dll_RealignPE
mov r13d, eax
mov dword [rsp + 0x48], eax
mov r9, r12
mov r8, qword [rsp + 0x68]
mov edx, r13d
mov rcx, qword [rsp + 0x70]
call fcn.18000dc30
cmp word [rsp + 0xa0], 0
je 0x18003765b
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dl, 1
lea rcx, [rsp + 0xa0]
test eax, eax
je 0x18003764f
call fcn.18000d220
mov al, 1
jmp 0x18003793f
call fcn.18000d220
xor al, al
jmp 0x18003793f
mov al, 1
jmp 0x18003793f
mov ecx, 0x20b
cmp ax, cx
jne 0x18003791d
cmp r14d, 0xffffffff
je 0x18003791d
movzx eax, word [r15 + 6]
cmp r14d, eax
jg 0x18003791d
mov r8d, 0x29
mov edx, r14d
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov rsi, rax
mov r8d, 0x2a
mov edx, r14d
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
add esi, eax
mov r8d, dword [r15 + 0x38]
xor edx, edx
mov eax, esi
div r8d
mov r9d, edx
xor edx, edx
mov eax, esi
div r8d
mov ecx, r8d
sub ecx, edx
add ecx, esi
xor edx, edx
mov eax, esi
div r8d
sub esi, edx
test r9d, r9d
cmovne esi, ecx
mov r8d, 0x2c
mov edx, r14d
mov rcx, r12
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
mov r10, rax
mov qword [rsp + 0x50], rax
movzx ecx, word [r15 + 0x14]
lea rdi, [r15 + 0x18]
add rdi, rcx
mov r11d, dword [r15 + 0x3c]
mov dword [rsp + 0x44], r11d
nop dword [rax]
movzx eax, word [r15 + 6]
cmp ebx, eax
jge 0x180037819
lea eax, [r14 - 1]
cmp ebx, eax
jne 0x1800377e1
mov r9d, dword [rdi + 0x10]
xor edx, edx
mov eax, r9d
div r11d
mov r8d, edx
xor edx, edx
mov eax, r9d
div r11d
mov ecx, r9d
sub ecx, edx
add ecx, r11d
xor edx, edx
mov eax, r9d
div r11d
sub r9d, edx
test r8d, r8d
cmovne r9d, ecx
mov dword [rdi + 0x10], r9d
add esi, dword [rdi + 8]
mov dword [rsp + 0x40], esi
mov ecx, dword [r15 + 0x38]
mov eax, esi
xor edx, edx
div ecx
mov r8d, eax
xor edx, edx
mov eax, esi
div ecx
test edx, edx
jne 0x1800377c5
imul ecx, r8d
mov esi, ecx
mov dword [rsp + 0x40], ecx
mov dword [rdi + 8], ecx
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x60], r10d
jmp 0x180037802
lea eax, [r8 + 1]
imul eax, ecx
mov esi, eax
mov dword [rsp + 0x40], eax
mov dword [rdi + 8], eax
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x60], r10d
jmp 0x180037802
cmp ebx, r14d
jle 0x180037802
lea rcx, [rdi - 0x28]
mov r8d, 0x28
mov rdx, rdi
call fcn.18004c130
mov r10, qword [rsp + 0x50]
mov r11d, dword [rsp + 0x44]
add rdi, 0x28
mov qword [rsp + 0x90], rdi
inc ebx
mov dword [rsp + 0x64], ebx
jmp 0x180037740
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
mov eax, 0xffff
add word [r15 + 6], ax
cmp byte [rsp + 0x4c], 0
je 0x18003784f
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call sym.TitanEngine.dll_RealignPE
mov r13d, eax
mov dword [rsp + 0x48], eax
mov r9, r12
mov r8, qword [rsp + 0x68]
mov edx, r13d
mov rcx, qword [rsp + 0x70]
call fcn.18000dc30
cmp word [rsp + 0xa0], 0
je 0x1800378ab
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dl, 1
lea rcx, [rsp + 0xa0]
test eax, eax
je 0x18003789f
call fcn.18000d220
mov al, 1
jmp 0x18003793f
call fcn.18000d220
xor al, al
jmp 0x18003793f
mov al, 1
jmp 0x18003793f
mov rsi, qword [rsp + 0x58]
mov r12, rbx
lea rdx, [rsp + 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180037917
test byte [rsp + 0x44], 2
jne 0x180037917
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180037917
mov r12, rbx
mov rsi, qword [rsp + 0x58]
mov r13d, ebx
mov rdi, rbx
mov r9, r12
mov r8, rsi
mov edx, r13d
mov rcx, rdi
call fcn.18000dc30
mov dl, 1
lea rcx, [rsp + 0xa0]
call fcn.18000d220
xor al, al
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret