Function at 0x180025910
Capabilities:
Get file size
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov r13, r8
mov qword [rsp + 0xd0], r8
mov dword [rsp + 0x60], edx
mov rax, rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd8], r8
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x58], r14
xor r12d, r12d
mov dword [rsp + 0x78], r12d
mov byte [rsp + 0x40], r12b
lea r8d, [r14 + 1]
mov dword [r11 - 0x60], 0x20001
lea edx, [r14 + 3]
mov dword [r11 - 0x5c], 0x40003
lea esi, [rdx + 1]
lea edi, [rdx + 2]
mov dword [r11 - 0x58], 0x60005
mov dword [r11 - 0x54], 0x80007
mov dword [r11 - 0x50], 0xa0009
mov dword [r11 - 0x4c], 0xc000b
mov dword [r11 - 0x48], 0x10000d
mov dword [r11 - 0x44], 0x120011
mov dword [r11 - 0x40], 0x140013
mov dword [r11 - 0x3c], 0x160015
mov dword [r11 - 0x38], 0x180017
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [r11 - 0x80], xmm0
mov qword [r11 - 0x70], rcx
mov word [r11 - 0x68], cx
mov byte [r11 - 0x66], cl
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0xb0], rax
cmp rax, 0xffffffffffffffff
je 0x180027d23
mov qword [rsp + 0xf0], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180027d01
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x180027d01
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf8], 0xa
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rbx
call fcn.180007830
test al, al
je 0x180027c9f
movsxd rbx, dword [rsi + 0x3c]
add rbx, rsi
mov eax, dword [rbx]
cmp eax, 0x4550
jne 0x180027c35
mov ecx, 0x10b
cmp word [rbx + 0x18], cx
jne 0x180026b69
mov r13d, dword [rbx + 0x50]
mov r9d, dword [rbx + 0x38]
xor edx, edx
mov eax, r13d
div r9d
mov r8d, edx
xor edx, edx
mov eax, r13d
div r9d
mov ecx, r13d
sub ecx, edx
add ecx, r9d
xor edx, edx
mov eax, r13d
div r9d
sub r13d, edx
test r8d, r8d
cmovne r13d, ecx
test r9d, r9d
je 0x180025b66
cmp r9d, dword [rbx + 0x3c]
jb 0x180025b66
xor cl, cl
mov byte [rsp + 0x105], cl
xor edx, edx
mov eax, dword [rbx + 0x50]
div dword [rbx + 0x38]
lea r9d, [r14 + 1]
test edx, edx
jne 0x180025b54
mov byte [rsp + 0x103], cl
jmp 0x180025b75
cmp r13d, dword [rbx + 0x28]
cmovb edi, r9d
mov byte [rsp + 0x103], dil
jmp 0x180025b75
mov cl, 6
mov byte [rsp + 0x105], cl
mov r9d, 1
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
test dword [rbx + 0x34], 0xfff
setne dl
mov byte [rsp + 0x102], dl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx ecx, byte [rbx + 0x3c]
and cl, r8b
neg cl
sbb dl, dl
and dl, 6
mov byte [rsp + 0x104], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx ecx, byte [rsp + 0xfc]
cmp word [rbx + 0x5c], 3
cmove ecx, r9d
mov byte [rsp + 0xfc], cl
mov eax, 0x2000
test word [rbx + 0x16], ax
je 0x180025f04
mov byte [rsp + 0xfb], 1
cmp dword [rbx + 0x74], r8d
jbe 0x180025de9
mov edx, dword [rbx + 0x78]
test edx, edx
je 0x180025de9
cmp edx, r13d
ja 0x180025dc7
mov ecx, dword [rbx + 0x7c]
add ecx, edx
cmp ecx, r13d
ja 0x180025dc7
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180025dc7
mov edx, dword [rbx + 0x7c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180025dc7
mov edx, dword [rdi + 0x1c]
cmp edx, r13d
ja 0x180025dc7
mov eax, dword [rdi + 0x14]
lea ecx, [rdx + rax*4]
cmp ecx, r13d
ja 0x180025dc7
mov ecx, dword [rdi + 0x24]
cmp ecx, r13d
ja 0x180025dc7
mov eax, dword [rdi + 0x18]
lea r8d, [rax*4]
lea eax, [r8 + rcx]
cmp eax, r13d
ja 0x180025dc7
mov eax, dword [rdi + 0x20]
cmp eax, r13d
ja 0x180025dc7
add eax, r8d
cmp eax, r13d
ja 0x180025dc7
cmp dword [rdi + 0xc], r13d
ja 0x180025dc7
cmp dword [rsp + 0x60], 1
jne 0x180025dcf
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180025d48
xor edx, edx
mov dword [rsp + 0x50], edx
cmp edx, dword [rdi + 0x14]
jae 0x180025d50
mov ecx, dword [r8]
mov dword [rsp + 0x58], ecx
mov eax, r13d
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
cmp r14, rax
ja 0x180025d35
mov eax, dword [rbx + 0x38]
cmp r14, rax
jb 0x180025d35
add r8, 4
mov qword [rsp + 0x48], r8
jmp 0x180025d44
mov byte [rsp + 0x106], 1
mov edx, dword [rdi + 0x14]
mov dword [rsp + 0x50], edx
inc edx
jmp 0x180025d00
mov byte [rsp + 0x106], 1
mov r9d, dword [rdi + 0x20]
add r9d, dword [rbx + 0x34]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180025dc7
xor edx, edx
mov dword [rsp + 0x50], edx
cmp edx, dword [rdi + 0x18]
jae 0x180025dcf
mov ecx, dword [r8]
mov dword [rsp + 0x58], ecx
mov eax, r13d
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
cmp r14, rax
ja 0x180025db4
mov eax, dword [rbx + 0x38]
cmp r14, rax
jb 0x180025db4
add r8, 4
mov qword [rsp + 0x48], r8
jmp 0x180025dc3
mov byte [rsp + 0x106], 1
mov edx, dword [rdi + 0x18]
mov dword [rsp + 0x50], edx
inc edx
jmp 0x180025d7f
mov byte [rsp + 0x106], 1
mov r8b, 1
movzx edx, byte [rsp + 0x106]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180025df1
mov byte [rsp + 0x106], 7
cmp dword [rbx + 0x74], 5
jbe 0x180025ef7
mov edx, dword [rbx + 0xa0]
test edx, edx
je 0x180025ef7
cmp edx, r13d
ja 0x180025ed6
mov ecx, dword [rbx + 0xa4]
add ecx, edx
cmp ecx, r13d
ja 0x180025ed6
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180025ed2
mov edx, dword [rbx + 0xa4]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180025ed2
mov ecx, dword [rdi]
mov dword [rsp + 0x58], ecx
mov eax, dword [rdi + 4]
mov edx, 0xcfff
movzx ecx, byte [rsp + 0x107]
mov r8d, 3
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
test r14, r14
je 0x180025edf
add eax, 0xfffffff8
mov dword [rsp + 0x70], eax
add rdi, 8
mov qword [rsp + 0x48], rdi
test eax, eax
je 0x180025ec7
movzx ecx, cl
cmp word [rdi], dx
cmova ecx, r8d
mov byte [rsp + 0x107], cl
add rdi, 2
mov qword [rsp + 0x48], rdi
add eax, 0xfffffffe
mov dword [rsp + 0x70], eax
jmp 0x180025ea0
mov eax, dword [rdi]
mov dword [rsp + 0x58], eax
mov eax, dword [rdi + 4]
jmp 0x180025e81
mov cl, 3
jmp 0x180025ed8
mov cl, 1
mov byte [rsp + 0x107], cl
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026086
mov byte [rsp + 0x107], 8
jmp 0x180026086
cmp dword [rbx + 0x74], r8d
jbe 0x180025fe2
mov edx, dword [rbx + 0x78]
test edx, edx
je 0x180025fe2
cmp edx, r13d
ja 0x180025fc7
mov ecx, dword [rbx + 0x7c]
add ecx, edx
cmp ecx, r13d
ja 0x180025fc7
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180025fad
mov edx, dword [rbx + 0x8c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180025fc7
mov ecx, dword [rdi + 0x1c]
cmp ecx, r13d
ja 0x180025fc7
mov eax, dword [rdi + 0x14]
lea ecx, [rcx + rax*4]
cmp ecx, r13d
ja 0x180025fc7
mov ecx, dword [rdi + 0x24]
cmp ecx, r13d
ja 0x180025fc7
mov eax, dword [rdi + 0x18]
lea edx, [rax*4]
lea eax, [rdx + rcx]
cmp eax, r13d
ja 0x180025fc7
mov eax, dword [rdi + 0x20]
cmp eax, r13d
ja 0x180025fc7
add eax, edx
cmp eax, r13d
ja 0x180025fc7
cmp dword [rdi + 0xc], r13d
ja 0x180025fc7
movzx edx, byte [rsp + 0x106]
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180025fea
mov dl, 2
mov byte [rsp + 0x106], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180025fea
mov byte [rsp + 0x106], 7
cmp dword [rbx + 0x74], 5
jbe 0x18002607e
mov edx, dword [rbx + 0xa0]
test edx, edx
je 0x18002607e
cmp edx, r13d
ja 0x180026063
mov ecx, dword [rbx + 0xa4]
add ecx, edx
cmp ecx, r13d
ja 0x180026063
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002605f
sub rax, rsi
cmp rax, r15
ja 0x18002605f
movzx edx, byte [rsp + 0x107]
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026086
mov dl, 5
jmp 0x180026065
mov dl, 1
mov byte [rsp + 0x107], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026086
mov byte [rsp + 0x107], 7
cmp dword [rbx + 0x74], 1
jbe 0x1800263fb
mov ecx, dword [rbx + 0x80]
test ecx, ecx
je 0x1800263fb
cmp ecx, r13d
ja 0x1800263af
mov r9d, dword [rbx + 0x34]
add r9d, ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800263af
sub rax, rsi
cmp rax, r15
ja 0x1800263af
mov edx, dword [rbx + 0x80]
add edx, dword [rbx + 0x34]
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
cmp eax, 0x7fffffff
jge 0x1800263af
mov r8d, 0x2d
mov edx, eax
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0xa0000060
mov eax, 0
mov ecx, 6
cmove eax, ecx
mov byte [rsp + 0x109], al
cmp dword [rsp + 0x60], 1
jne 0x1800263b7
mov eax, dword [rbx + 0x80]
test eax, eax
je 0x1800263b7
mov r8d, dword [rbx + 0x34]
lea r9d, [r8 + rax]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r12, rax
mov qword [rsp + 0x98], rax
nop word [rax + rax]
cmp byte [rsp + 0x10a], 0
jne 0x18002639e
cmp dword [r12 + 0x10], 0
je 0x18002639e
xor r15d, r15d
mov qword [rsp + 0x80], r15
mov r8d, dword [rbx + 0x34]
mov r9d, dword [r12 + 0xc]
add r9, r8
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r15b
mov r14d, dword [rsp + 0x54]
mov edx, r14d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
test rax, rax
je 0x18002622e
mov rcx, rax
call fcn.180006e50
test al, al
jne 0x1800261e3
mov byte [rsp + 0xfd], 1
xor cl, cl
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], cl
jmp 0x180026236
xor al, al
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x180026236
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
call fcn.180007c70
mov r15, rax
mov qword [rsp + 0x80], rax
mov al, 1
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], al
jmp 0x180026236
mov byte [rsp + 0x10a], 1
mov eax, dword [r12]
mov r8d, dword [rbx + 0x34]
mov byte [rsp + 0x28], 1
mov edx, r14d
mov rcx, rsi
mov byte [rsp + 0x20], 0
test eax, eax
je 0x180026269
lea r9, [r8 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0xb8], rax
mov r14d, dword [r12]
jmp 0x180026283
mov r9d, dword [r12 + 0x10]
add r9, r8
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0xb8], rax
mov r14d, dword [r12 + 0x10]
mov qword [rsp + 0x88], r14
mov rdi, rax
test rax, rax
je 0x18002636d
nop word [rax + rax]
cmp byte [rsp + 0x10a], 0
jne 0x180026375
mov eax, dword [rdi]
test eax, eax
je 0x180026375
jns 0x1800262d4
xor eax, 0x80000000
cmp eax, 0x10000
jl 0x180026350
mov byte [rsp + 0x10a], 1
jmp 0x180026350
mov r8d, dword [rbx + 0x34]
lea r9, [r8 + 2]
add r9, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, dword [rsp + 0x54]
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rsi, rax
test rax, rax
je 0x180026343
mov edx, 8
mov rcx, rax
call fcn.180007700
test al, al
je 0x180026343
test r15, r15
je 0x18002634b
mov rdx, rsi
mov rcx, r15
call fcn.1800082b0
test rax, rax
jne 0x18002634b
mov byte [rsp + 0xfe], 1
movzx eax, byte [rsp + 0xf8]
sub al, 0xa
cmp al, 1
ja 0x18002634b
mov byte [rsp + 0xf8], 0xb
jmp 0x18002634b
mov byte [rsp + 0x10a], 1
mov rsi, qword [rsp + 0x68]
add r14, 4
mov qword [rsp + 0x88], r14
add rdi, 4
mov qword [rsp + 0xb8], rdi
jmp 0x1800262a0
mov byte [rsp + 0x10a], 1
cmp byte [rsp + 0x40], 0
je 0x18002638d
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add r12, 0x14
mov qword [rsp + 0x98], r12
jmp 0x180026170
mov r14, qword [rsp + 0x70]
mov r15d, dword [rsp + 0x54]
mov r12d, dword [rsp + 0x78]
jmp 0x1800263b7
mov byte [rsp + 0x108], 1
mov r8b, 1
movzx edx, byte [rsp + 0x108]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x10a]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x109]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026403
mov byte [rsp + 0x108], 7
cmp dword [rbx + 0x74], 9
jbe 0x180026566
mov edx, dword [rbx + 0xc0]
test edx, edx
je 0x180026566
cmp edx, r13d
ja 0x180026544
mov ecx, dword [rbx + 0xc4]
add ecx, edx
cmp ecx, r13d
ja 0x180026544
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180026544
mov rdx, rax
sub rdx, rsi
mov ecx, r15d
cmp rdx, rcx
ja 0x180026544
mov ecx, dword [rax]
test ecx, ecx
je 0x18002648b
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800264cd
add eax, r13d
cmp ecx, eax
ja 0x1800264cd
mov ecx, dword [r8 + 4]
test ecx, ecx
je 0x1800264a1
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800264cd
add eax, r13d
cmp ecx, eax
ja 0x1800264cd
mov ecx, dword [r8 + 8]
test ecx, ecx
je 0x1800264b7
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800264cd
add eax, r13d
cmp ecx, eax
ja 0x1800264cd
mov ecx, dword [r8 + 0xc]
test ecx, ecx
je 0x1800264d5
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800264cd
add eax, r13d
cmp ecx, eax
jbe 0x1800264d5
mov byte [rsp + 0x10c], 6
mov ecx, dword [r8 + 0xc]
test ecx, ecx
je 0x18002654c
cmp dword [rsp + 0x60], 1
jne 0x18002654c
mov r9d, dword [rbx + 0x34]
add r9d, ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002654c
test r14, r14
je 0x18002654c
mov ecx, dword [rdx]
mov dword [rsp + 0x58], ecx
mov eax, dword [rbx + 0x34]
mov r14, qword [rsp + 0x58]
cmp r14, rax
jb 0x180026531
lea ecx, [rax + r13]
cmp r14, rcx
jbe 0x180026539
mov byte [rsp + 0x10c], 6
add rdx, 4
mov qword [rsp + 0x48], rdx
jmp 0x180026510
mov byte [rsp + 0x10c], 6
xor r8d, r8d
movzx edx, byte [rsp + 0x10c]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002656e
mov byte [rsp + 0x10c], 7
cmp dword [rbx + 0x74], 0xa
jbe 0x1800265d2
mov edx, dword [rbx + 0xc8]
test edx, edx
je 0x1800265d2
cmp edx, r13d
ja 0x1800265ce
mov ecx, dword [rbx + 0xcc]
add ecx, edx
cmp ecx, r13d
ja 0x1800265ce
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800265ce
sub rax, rsi
mov ecx, r15d
cmp rax, rcx
ja 0x1800265ce
movzx edx, byte [rsp + 0x10d]
jmp 0x1800265db
mov dl, 6
jmp 0x1800265d4
mov dl, 7
mov byte [rsp + 0x10d], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x74], 0xb
jbe 0x18002671e
mov edx, dword [rbx + 0xd0]
test edx, edx
je 0x18002671e
cmp edx, r13d
ja 0x180026713
mov ecx, dword [rbx + 0xd4]
add ecx, edx
cmp ecx, r13d
ja 0x180026713
mov esi, edx
mov r14, qword [rsp + 0x68]
add rsi, r14
mov qword [rsp + 0x48], rsi
je 0x180026695
mov rcx, rsi
sub rcx, r14
mov eax, r15d
cmp rcx, rax
ja 0x180026695
mov rdi, rsi
mov qword [rsp + 0xa0], rsi
movzx ecx, byte [rsp + 0x10e]
nop
cmp dword [rdi], 0
je 0x18002669e
movzx eax, word [rdi + 4]
cmp eax, dword [rbx + 0xd4]
jbe 0x180026665
mov cl, 6
jmp 0x180026680
lea rcx, [rsi + rax]
call fcn.180006b00
movzx ecx, byte [rsp + 0x10e]
test al, al
mov eax, 6
cmove ecx, eax
mov byte [rsp + 0x10e], cl
add rdi, 8
mov qword [rsp + 0xa0], rdi
jmp 0x180026650
mov cl, 6
mov byte [rsp + 0x10e], cl
mov rsi, qword [rsp + 0x68]
xor r8d, r8d
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x74], 0xc
jbe 0x180026730
mov edx, dword [rbx + 0xd8]
test edx, edx
je 0x180026730
cmp edx, r13d
ja 0x18002672c
mov ecx, dword [rbx + 0xdc]
add ecx, edx
cmp ecx, r13d
ja 0x18002672c
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002672c
sub rax, rsi
mov ecx, r15d
cmp rax, rcx
ja 0x18002672c
movzx edx, byte [rsp + 0x10b]
jmp 0x180026739
mov cl, 6
mov byte [rsp + 0x10e], cl
jmp 0x1800266a3
mov cl, 7
mov byte [rsp + 0x10e], cl
jmp 0x1800266a3
mov dl, 5
jmp 0x180026732
mov dl, 7
mov byte [rsp + 0x10b], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x74], 0xe
jbe 0x1800267aa
mov edx, dword [rbx + 0xe8]
test edx, edx
je 0x1800267aa
cmp edx, r13d
ja 0x1800267a6
mov ecx, dword [rbx + 0xec]
add ecx, edx
cmp ecx, r13d
ja 0x1800267a6
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800267a6
sub rax, rsi
mov ecx, r15d
cmp rax, rcx
ja 0x1800267a6
movzx edx, byte [rsp + 0x10f]
jmp 0x1800267b3
mov dl, 5
jmp 0x1800267ac
mov dl, 7
mov byte [rsp + 0x10f], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x74], 2
jbe 0x1800268f8
mov edx, dword [rbx + 0x88]
test edx, edx
je 0x1800268f8
cmp edx, r13d
ja 0x1800268d6
mov ecx, dword [rbx + 0x8c]
add ecx, edx
cmp ecx, r13d
ja 0x1800268d6
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002683a
mov r8d, r15d
mov rcx, rax
sub rcx, rsi
cmp rcx, r8
ja 0x18002683a
mov edx, dword [rbx + 0x8c]
sub rdx, rsi
add rdx, rax
cmp rdx, r8
jbe 0x180026842
mov byte [rsp + 0x110], 4
cmp dword [rsp + 0x60], 1
jne 0x1800268b8
mov rcx, qword [rsp + 0xc8]
call fcn.180007980
mov rsi, rax
test rax, rax
je 0x1800268b3
xor edi, edi
mov dword [rsp + 0x50], edi
cmp edi, 0x16
jae 0x1800268a2
cmp byte [rsp + 0x111], 0
jne 0x180026895
movzx edx, word [rsp + rdi*2 + 0x118]
lea r9, [rsp + 0x111]
lea r8, [0x180007790]
mov rcx, rsi
call 0x1802d2642
int3
mov edi, 0x16
mov dword [rsp + 0x50], edi
inc edi
jmp 0x180026860
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x68]
cmp byte [rsp + 0x110], 4
jne 0x1800268de
cmp byte [rsp + 0x111], 0
jne 0x1800268de
mov byte [rsp + 0x110], 0
jmp 0x1800268de
mov byte [rsp + 0x110], 5
mov r8b, 1
movzx edx, byte [rsp + 0x110]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026900
mov byte [rsp + 0x110], 7
movzx eax, word [rbx + 0x14]
lea rcx, [rbx + 0x18]
add rcx, rax
mov qword [rsp + 0xa8], rcx
movzx r8d, word [rbx + 6]
mov dword [rsp + 0x7c], r8d
movzx edi, byte [rsp + 0x112]
test r8d, r8d
je 0x180026988
mov r10d, dword [rcx + 0xc]
mov r12d, dword [rcx + 8]
lea r9d, [r12 + r10]
mov r11d, dword [rbx + 0x38]
xor edx, edx
mov eax, r12d
div r11d
test edx, edx
jne 0x18002694b
mov r12d, r9d
jmp 0x180026954
sub r12d, edx
add r12d, r10d
add r12d, r11d
cmp r8d, 1
jbe 0x18002697e
add rcx, 0x28
mov qword [rsp + 0xa8], rcx
mov eax, dword [rcx + 0xc]
cmp r9d, eax
ja 0x180026973
cmp r12d, eax
jbe 0x18002697e
mov dil, 6
mov byte [rsp + 0x112], dil
dec r8d
mov dword [rsp + 0x7c], r8d
jmp 0x180026925
mov edx, dword [rcx + 0x10]
mov ecx, dword [rcx + 0x14]
add ecx, edx
cmp ecx, r15d
jbe 0x1800269ac
movzx eax, dil
test edx, edx
mov edi, 1
cmovne eax, edi
mov byte [rsp + 0x112], al
jmp 0x1800269b1
mov edi, 1
add r12d, 0xf000
movzx eax, byte [rsp + 0x103]
cmp dword [rbx + 0x50], r12d
mov ecx, 6
cmova eax, ecx
mov byte [rsp + 0x103], al
mov r8b, 1
movzx edx, al
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x112]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
mov edx, dword [rbx + 0x34]
add edx, dword [rbx + 0x28]
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
cmp eax, 0xffffffff
je 0x180026a37
mov r8d, 0x2d
mov edx, eax
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0x20000020
mov eax, 0
mov ecx, 2
cmove eax, ecx
mov byte [rsp + 0x101], al
mov r9d, dword [rbx + 0x34]
add r9d, dword [rbx + 0x28]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rcx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x180026a68
mov cl, 1
jmp 0x180026a82
mov qword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
cmp eax, dword [rcx]
movzx ecx, byte [rsp + 0x101]
cmove ecx, edi
mov byte [rsp + 0x101], cl
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
mov r13, qword [rsp + 0xd0]
test r13, r13
je 0x180026ade
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
movsd xmm1, qword [rsp + 0x108]
movsd qword [r13 + 0x10], xmm1
movzx eax, word [rsp + 0x110]
mov word [r13 + 0x18], ax
movzx eax, byte [rsp + 0x112]
mov byte [r13 + 0x1a], al
mov r9, rsi
mov r8, qword [rsp + 0x90]
mov edx, r15d
mov rcx, qword [rsp + 0xb0]
call fcn.18000dc30
cmp byte [rsp + 0xf8], 0xa
jne 0x180026b0a
mov al, 1
jmp 0x180027d5f
jmp 0x180027d23
cmp eax, 0x4550
jne 0x180027c35
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x180027c35
mov byte [rsp + 0xfa], 1
mov r13d, dword [rbx + 0x50]
mov r9d, dword [rbx + 0x38]
xor edx, edx
mov eax, r13d
div r9d
mov r8d, edx
xor edx, edx
mov eax, r13d
div r9d
mov ecx, r13d
sub ecx, edx
add ecx, r9d
xor edx, edx
mov eax, r13d
div r9d
sub r13d, edx
test r8d, r8d
cmovne r13d, ecx
test r9d, r9d
je 0x180026c01
cmp r9d, dword [rbx + 0x3c]
jb 0x180026c01
xor cl, cl
mov byte [rsp + 0x105], cl
xor edx, edx
mov eax, dword [rbx + 0x50]
div dword [rbx + 0x38]
mov r9d, 1
test edx, edx
jne 0x180026bef
mov byte [rsp + 0x103], cl
jmp 0x180026c10
cmp r13d, dword [rbx + 0x28]
cmovb edi, r9d
mov byte [rsp + 0x103], dil
jmp 0x180026c10
mov cl, 6
mov byte [rsp + 0x105], cl
mov r9d, 1
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
mov eax, dword [rbx + 0x30]
test rax, 0xfff
setne dl
mov byte [rsp + 0x102], dl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx ecx, byte [rbx + 0x3c]
and cl, r8b
neg cl
sbb dl, dl
and dl, 6
mov byte [rsp + 0x104], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx ecx, byte [rsp + 0xfc]
cmp word [rbx + 0x5c], 3
cmove ecx, r9d
mov byte [rsp + 0xfc], cl
mov eax, 0x2000
test word [rbx + 0x16], ax
je 0x180026fb4
mov byte [rsp + 0xfb], 1
cmp dword [rbx + 0x84], r8d
jbe 0x180026e92
mov edx, dword [rbx + 0x88]
test edx, edx
je 0x180026e92
cmp edx, r13d
ja 0x180026e70
mov ecx, dword [rbx + 0x8c]
add ecx, edx
cmp ecx, r13d
ja 0x180026e70
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180026e70
mov edx, dword [rbx + 0x8c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180026e70
mov edx, dword [rdi + 0x1c]
cmp edx, r13d
ja 0x180026e70
mov eax, dword [rdi + 0x14]
lea ecx, [rdx + rax*4]
cmp ecx, r13d
ja 0x180026e70
mov ecx, dword [rdi + 0x24]
cmp ecx, r13d
ja 0x180026e70
mov eax, dword [rdi + 0x18]
lea r8d, [rax*4]
lea eax, [r8 + rcx]
cmp eax, r13d
ja 0x180026e70
mov eax, dword [rdi + 0x20]
cmp eax, r13d
ja 0x180026e70
add eax, r8d
cmp eax, r13d
ja 0x180026e70
cmp dword [rdi + 0xc], r13d
ja 0x180026e70
cmp dword [rsp + 0x60], 1
jne 0x180026e78
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180026df1
xor edx, edx
mov dword [rsp + 0x50], edx
cmp edx, dword [rdi + 0x14]
jae 0x180026df9
mov ecx, dword [r8]
mov dword [rsp + 0x58], ecx
mov eax, r13d
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
cmp r14, rax
ja 0x180026dde
mov eax, dword [rbx + 0x38]
cmp r14, rax
jb 0x180026dde
add r8, 4
mov qword [rsp + 0x48], r8
jmp 0x180026ded
mov byte [rsp + 0x106], 1
mov edx, dword [rdi + 0x14]
mov dword [rsp + 0x50], edx
inc edx
jmp 0x180026da9
mov byte [rsp + 0x106], 1
mov r9d, dword [rdi + 0x20]
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180026e70
xor edx, edx
mov dword [rsp + 0x50], edx
cmp edx, dword [rdi + 0x18]
jae 0x180026e78
mov ecx, dword [r8]
mov dword [rsp + 0x58], ecx
mov eax, r13d
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
cmp r14, rax
ja 0x180026e5d
mov eax, dword [rbx + 0x38]
cmp r14, rax
jb 0x180026e5d
add r8, 4
mov qword [rsp + 0x48], r8
jmp 0x180026e6c
mov byte [rsp + 0x106], 1
mov edx, dword [rdi + 0x18]
mov dword [rsp + 0x50], edx
inc edx
jmp 0x180026e28
mov byte [rsp + 0x106], 1
mov r8b, 1
movzx edx, byte [rsp + 0x106]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x180026e9a
mov byte [rsp + 0x106], 7
cmp dword [rbx + 0x84], 5
jbe 0x180026fa7
mov edx, dword [rbx + 0xb0]
test edx, edx
je 0x180026fa7
cmp edx, r13d
ja 0x180026f86
mov ecx, dword [rbx + 0xb4]
add ecx, edx
cmp ecx, r13d
ja 0x180026f86
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180026f82
mov edx, dword [rbx + 0xb4]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180026f82
mov ecx, dword [rdi]
mov dword [rsp + 0x58], ecx
mov eax, dword [rdi + 4]
mov edx, 0xcfff
movzx ecx, byte [rsp + 0x107]
mov r8d, 3
nop dword [rax]
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x70], r14
test r14, r14
je 0x180026f8f
add eax, 0xfffffff8
mov dword [rsp + 0x70], eax
add rdi, 8
mov qword [rsp + 0x48], rdi
nop
test eax, eax
je 0x180026f77
movzx ecx, cl
cmp word [rdi], dx
cmova ecx, r8d
mov byte [rsp + 0x107], cl
add rdi, 2
mov qword [rsp + 0x48], rdi
add eax, 0xfffffffe
mov dword [rsp + 0x70], eax
jmp 0x180026f50
mov eax, dword [rdi]
mov dword [rsp + 0x58], eax
mov eax, dword [rdi + 4]
jmp 0x180026f30
mov cl, 3
jmp 0x180026f88
mov cl, 1
mov byte [rsp + 0x107], cl
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002713e
mov byte [rsp + 0x107], 8
jmp 0x18002713e
cmp dword [rbx + 0x84], r8d
jbe 0x18002709b
mov edx, dword [rbx + 0x88]
test edx, edx
je 0x18002709b
cmp edx, r13d
ja 0x180027080
mov ecx, dword [rbx + 0x8c]
add ecx, edx
cmp ecx, r13d
ja 0x180027080
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180027066
mov edx, dword [rbx + 0x8c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180027080
mov ecx, dword [rdi + 0x1c]
cmp ecx, r13d
ja 0x180027080
mov eax, dword [rdi + 0x14]
lea ecx, [rcx + rax*4]
cmp ecx, r13d
ja 0x180027080
mov ecx, dword [rdi + 0x24]
cmp ecx, r13d
ja 0x180027080
mov eax, dword [rdi + 0x18]
lea edx, [rax*4]
lea eax, [rdx + rcx]
cmp eax, r13d
ja 0x180027080
mov eax, dword [rdi + 0x20]
cmp eax, r13d
ja 0x180027080
add eax, edx
cmp eax, r13d
ja 0x180027080
cmp dword [rdi + 0xc], r13d
ja 0x180027080
movzx edx, byte [rsp + 0x106]
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x1800270a3
mov dl, 2
mov byte [rsp + 0x106], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x1800270a3
mov byte [rsp + 0x106], 7
cmp dword [rbx + 0x84], 5
jbe 0x180027136
mov edx, dword [rbx + 0xb0]
test edx, edx
je 0x180027136
cmp edx, r13d
ja 0x18002711b
mov ecx, dword [rbx + 0xb4]
add ecx, edx
cmp ecx, r13d
ja 0x18002711b
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180027117
sub rax, rsi
cmp rax, r15
ja 0x180027117
movzx edx, byte [rsp + 0x107]
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002713e
mov dl, 5
jmp 0x18002711d
mov dl, 1
mov byte [rsp + 0x107], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002713e
mov byte [rsp + 0x107], 7
cmp dword [rbx + 0x84], 1
jbe 0x1800274ab
mov eax, dword [rbx + 0x90]
test eax, eax
je 0x1800274ab
cmp eax, r13d
ja 0x18002745f
mov r9d, eax
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002745f
sub rax, rsi
cmp rax, r15
ja 0x18002745f
mov edx, dword [rbx + 0x90]
add rdx, qword [rbx + 0x30]
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
test eax, eax
js 0x18002745f
mov r8d, 0x2d
mov edx, eax
mov rcx, rsi
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0xa0000060
mov eax, 0
mov ecx, 6
cmove eax, ecx
mov byte [rsp + 0x109], al
cmp dword [rsp + 0x60], 1
jne 0x180027467
mov eax, dword [rbx + 0x90]
test eax, eax
je 0x180027467
mov r8, qword [rbx + 0x30]
lea r9, [r8 + rax]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r12, rax
mov qword [rsp + 0x98], rax
mov rsi, qword [rsp + 0xc0]
nop word [rax + rax]
cmp byte [rsp + 0x10a], 0
jne 0x180027449
cmp dword [r12 + 0x10], 0
je 0x180027449
xor r15d, r15d
mov qword [rsp + 0x80], r15
mov r8, qword [rbx + 0x30]
mov r9d, dword [r12 + 0xc]
add r9, r8
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r15b
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x68]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
test rax, rax
je 0x1800272ef
mov rcx, rax
call fcn.180006e50
xor r14b, r14b
test al, al
jne 0x1800272a4
mov byte [rsp + 0xfd], 1
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x41], r14b
jmp 0x1800272f7
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x41], r14b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x1800272f7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
call fcn.180007c70
mov r15, rax
mov qword [rsp + 0x80], rax
mov al, 1
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], al
jmp 0x1800272f7
mov byte [rsp + 0x10a], 1
mov eax, dword [r12]
mov byte [rsp + 0x28], 1
mov edx, dword [rsp + 0x54]
mov rdi, qword [rsp + 0x68]
mov byte [rsp + 0x20], 0
mov rcx, rdi
test eax, eax
je 0x180027333
mov r8, qword [rbx + 0x30]
lea r9, [r8 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rsi, rax
mov qword [rsp + 0xc0], rax
mov r14d, dword [r12]
jmp 0x180027349
mov r8d, dword [rbx + 0x34]
mov r9d, dword [r12 + 0x10]
add r9, r8
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r14d, dword [r12 + 0x10]
mov qword [rsp + 0x88], r14
test rsi, rsi
je 0x180027418
nop word [rax + rax]
cmp byte [rsp + 0x10a], 0
jne 0x180027420
mov rax, qword [rsi]
test rax, rax
je 0x180027420
jns 0x1800273aa
cmp eax, 0x10000
jl 0x18002738b
mov byte [rsp + 0x10a], 1
add r14, 8
mov qword [rsp + 0x88], r14
add rsi, 8
mov qword [rsp + 0xc0], rsi
mov rdi, qword [rsp + 0x68]
jmp 0x180027360
mov r8, qword [rbx + 0x30]
lea r9, [r8 + 2]
add r9, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
test rax, rax
je 0x180027383
mov edx, 8
mov rcx, rax
call fcn.180007700
test al, al
je 0x180027383
test r15, r15
je 0x18002738b
mov rdx, rdi
mov rcx, r15
call fcn.1800082b0
test rax, rax
jne 0x18002738b
mov byte [rsp + 0xfe], 1
mov r8b, 1
mov dl, 6
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002738b
mov byte [rsp + 0x10a], 1
cmp byte [rsp + 0x40], 0
je 0x180027438
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add r12, 0x14
mov qword [rsp + 0x98], r12
jmp 0x180027230
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r15d, dword [rsp + 0x54]
mov r12d, dword [rsp + 0x78]
jmp 0x180027467
mov byte [rsp + 0x108], 1
mov r8b, 1
movzx edx, byte [rsp + 0x108]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x10a]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x109]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x1800274b3
mov byte [rsp + 0x108], 7
cmp dword [rbx + 0x84], 9
jbe 0x180027632
mov edx, dword [rbx + 0xd0]
test edx, edx
je 0x180027632
cmp edx, r13d
ja 0x180027610
mov ecx, dword [rbx + 0xd4]
add ecx, edx
cmp ecx, r13d
ja 0x180027610
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180027610
mov rdx, rax
sub rdx, rsi
mov ecx, r15d
cmp rdx, rcx
ja 0x180027610
mov rcx, qword [rax]
test rcx, rcx
je 0x180027546
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x18002759d
mov eax, r13d
add rax, rdx
cmp rcx, rax
ja 0x18002759d
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x180027563
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x18002759d
mov eax, r13d
add rax, rdx
cmp rcx, rax
ja 0x18002759d
mov rcx, qword [r8 + 0x10]
test rcx, rcx
je 0x180027580
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x18002759d
mov eax, r13d
add rax, rdx
cmp rcx, rax
ja 0x18002759d
mov rcx, qword [r8 + 0x18]
test rcx, rcx
je 0x1800275a5
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x18002759d
mov eax, r13d
add rax, rdx
cmp rcx, rax
jbe 0x1800275a5
mov byte [rsp + 0x10c], 6
mov rcx, qword [r8 + 0x18]
test rcx, rcx
je 0x180027618
cmp dword [rsp + 0x60], 1
jne 0x180027618
mov r9, qword [rbx + 0x30]
add r9, rcx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rcx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180027618
test r14, r14
je 0x180027618
mov r14, qword [rcx]
mov rdx, qword [rbx + 0x30]
cmp r14, rdx
jb 0x1800275fd
mov eax, r13d
add rax, rdx
cmp r14, rax
jbe 0x180027605
mov byte [rsp + 0x10c], 6
add rcx, 8
mov qword [rsp + 0x48], rcx
jmp 0x1800275e1
mov byte [rsp + 0x10c], 6
xor r8d, r8d
movzx edx, byte [rsp + 0x10c]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x18002763a
mov byte [rsp + 0x10c], 7
cmp dword [rbx + 0x84], 0xa
jbe 0x1800276a1
mov edx, dword [rbx + 0xd8]
test edx, edx
je 0x1800276a1
cmp edx, r13d
ja 0x18002769d
mov ecx, dword [rbx + 0xdc]
add ecx, edx
cmp ecx, r13d
ja 0x18002769d
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002769d
sub rax, rsi
mov ecx, r15d
cmp rax, rcx
ja 0x18002769d
movzx edx, byte [rsp + 0x10d]
jmp 0x1800276aa
mov dl, 6
jmp 0x1800276a3
mov dl, 7
mov byte [rsp + 0x10d], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x84], 0xb
jbe 0x180027775
mov edx, dword [rbx + 0xe0]
test edx, edx
je 0x180027775
cmp edx, r13d
ja 0x180027771
mov ecx, dword [rbx + 0xe4]
add ecx, edx
cmp ecx, r13d
ja 0x180027771
mov esi, edx
mov r14, qword [rsp + 0x68]
add rsi, r14
mov qword [rsp + 0x48], rsi
je 0x180027766
mov rcx, rsi
sub rcx, r14
mov eax, r15d
cmp rcx, rax
ja 0x180027766
mov rdi, rsi
mov qword [rsp + 0xa0], rsi
movzx ecx, byte [rsp + 0x10e]
cmp dword [rdi], 0
je 0x180027783
movzx eax, word [rdi + 4]
cmp eax, dword [rbx + 0xe4]
jbe 0x180027736
mov cl, 6
jmp 0x180027751
lea rcx, [rsi + rax]
call fcn.180006b00
movzx ecx, byte [rsp + 0x10e]
test al, al
mov eax, 6
cmove ecx, eax
mov byte [rsp + 0x10e], cl
add rdi, 8
mov qword [rsp + 0xa0], rdi
jmp 0x180027721
mov cl, 6
mov byte [rsp + 0x10e], cl
jmp 0x180027783
mov cl, 6
jmp 0x180027777
mov cl, 7
mov byte [rsp + 0x10e], cl
mov r14, qword [rsp + 0x68]
xor r8d, r8d
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x84], 0xc
jbe 0x1800277fa
mov edx, dword [rbx + 0xe8]
test edx, edx
je 0x1800277fa
cmp edx, r13d
ja 0x1800277f6
mov ecx, dword [rbx + 0xec]
add ecx, edx
cmp ecx, r13d
ja 0x1800277f6
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800277f6
sub rax, r14
mov ecx, r15d
cmp rax, rcx
ja 0x1800277f6
movzx edx, byte [rsp + 0x10b]
jmp 0x180027803
mov dl, 5
jmp 0x1800277fc
mov dl, 7
mov byte [rsp + 0x10b], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x84], 0xe
jbe 0x180027877
mov edx, dword [rbx + 0xf8]
test edx, edx
je 0x180027877
cmp edx, r13d
ja 0x180027873
mov ecx, dword [rbx + 0xfc]
add ecx, edx
cmp ecx, r13d
ja 0x180027873
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180027873
sub rax, r14
mov ecx, r15d
cmp rax, rcx
ja 0x180027873
movzx edx, byte [rsp + 0x10f]
jmp 0x180027880
mov dl, 5
jmp 0x180027879
mov dl, 7
mov byte [rsp + 0x10f], dl
xor r8d, r8d
lea rcx, [rsp + 0xf8]
call fcn.18000e880
cmp dword [rbx + 0x84], 2
jbe 0x1800279c3
mov edx, dword [rbx + 0x98]
test edx, edx
je 0x1800279c3
cmp edx, r13d
ja 0x1800279a1
mov ecx, dword [rbx + 0x9c]
add ecx, edx
cmp ecx, r13d
ja 0x1800279a1
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r8b
mov edx, r15d
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002790a
mov edx, r15d
mov rcx, rax
sub rcx, r14
cmp rcx, rdx
ja 0x18002790a
mov ecx, dword [rbx + 0x9c]
sub rcx, r14
add rcx, rax
cmp rcx, rdx
jbe 0x180027912
mov byte [rsp + 0x110], 4
cmp dword [rsp + 0x60], 1
jne 0x180027983
mov rcx, qword [rsp + 0xc8]
call fcn.180007980
mov rsi, rax
test rax, rax
je 0x180027983
xor edi, edi
mov dword [rsp + 0x50], edi
cmp edi, 0x16
jae 0x180027972
cmp byte [rsp + 0x111], 0
jne 0x180027965
movzx edx, word [rsp + rdi*2 + 0x118]
lea r9, [rsp + 0x111]
lea r8, [0x180007790]
mov rcx, rsi
call 0x18031ee2d
int3
mov edi, 0x16
mov dword [rsp + 0x50], edi
inc edi
jmp 0x180027930
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp byte [rsp + 0x110], 4
jne 0x1800279a9
cmp byte [rsp + 0x111], 0
jne 0x1800279a9
mov byte [rsp + 0x110], 0
jmp 0x1800279a9
mov byte [rsp + 0x110], 5
mov r8b, 1
movzx edx, byte [rsp + 0x110]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
jmp 0x1800279cb
mov byte [rsp + 0x110], 7
movzx eax, word [rbx + 0x14]
lea rcx, [rbx + 0x18]
add rcx, rax
mov qword [rsp + 0xa8], rcx
movzx r8d, word [rbx + 6]
mov dword [rsp + 0x7c], r8d
movzx edi, byte [rsp + 0x112]
test r8d, r8d
je 0x180027a53
mov r11d, dword [rcx + 0xc]
mov r9d, dword [rcx + 8]
lea r10d, [r11 + r9]
mov r12d, dword [rbx + 0x38]
xor edx, edx
mov eax, r9d
div r12d
test edx, edx
jne 0x180027a16
mov r12d, r10d
jmp 0x180027a1f
sub r12d, edx
add r12d, r11d
add r12d, r9d
cmp r8d, 1
jbe 0x180027a49
add rcx, 0x28
mov qword [rsp + 0xa8], rcx
mov eax, dword [rcx + 0xc]
cmp r10d, eax
ja 0x180027a3e
cmp r12d, eax
jbe 0x180027a49
mov dil, 6
mov byte [rsp + 0x112], dil
dec r8d
mov dword [rsp + 0x7c], r8d
jmp 0x1800279f0
mov edx, dword [rcx + 0x10]
mov ecx, dword [rcx + 0x14]
add ecx, edx
cmp ecx, r15d
jbe 0x180027a77
movzx eax, dil
test edx, edx
mov edi, 1
cmovne eax, edi
mov byte [rsp + 0x112], al
jmp 0x180027a7c
mov edi, 1
add r12d, 0xf000
movzx eax, byte [rsp + 0x103]
cmp dword [rbx + 0x50], r12d
mov ecx, 6
cmova eax, ecx
mov byte [rsp + 0x103], al
mov r8b, 1
movzx edx, al
lea rcx, [rsp + 0xf8]
call fcn.18000e880
movzx edx, byte [rsp + 0x112]
lea rcx, [rsp + 0xf8]
call fcn.18000e880
mov edx, dword [rbx + 0x28]
add rdx, qword [rbx + 0x30]
mov rcx, r14
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
cmp eax, 0xffffffff
je 0x180027b03
mov r8d, 0x2d
mov edx, eax
mov rcx, r14
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0x20000020
mov eax, 0
mov ecx, 2
cmove eax, ecx
mov byte [rsp + 0x101], al
mov r9d, dword [rbx + 0x28]
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rcx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x180027b34
mov cl, 1
jmp 0x180027b4e
mov qword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
cmp eax, dword [rcx]
movzx ecx, byte [rsp + 0x101]
cmove ecx, edi
mov byte [rsp + 0x101], cl
mov r8b, 1
movzx edx, cl
lea rcx, [rsp + 0xf8]
call fcn.18000e880
mov r13, qword [rsp + 0xd0]
test r13, r13
je 0x180027baa
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
movsd xmm1, qword [rsp + 0x108]
movsd qword [r13 + 0x10], xmm1
movzx eax, word [rsp + 0x110]
mov word [r13 + 0x18], ax
movzx eax, byte [rsp + 0x112]
mov byte [r13 + 0x1a], al
mov r9, r14
mov r8, qword [rsp + 0x90]
mov edx, r15d
mov rcx, qword [rsp + 0xb0]
call fcn.18000dc30
cmp byte [rsp + 0xf8], 0xa
jne 0x180027bd6
mov al, 1
jmp 0x180027d5f
jmp 0x180027d23
mov byte [rsp + 0xf8], 0xd
mov byte [rsp + 0x100], 1
test r13, r13
je 0x180027c7f
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
movsd xmm1, qword [rsp + 0x108]
movsd qword [r13 + 0x10], xmm1
movzx eax, word [rsp + 0x110]
mov word [r13 + 0x18], ax
movzx eax, byte [rsp + 0x112]
mov byte [r13 + 0x1a], al
mov r9, rsi
mov r8, qword [rsp + 0x90]
mov edx, r15d
mov rcx, qword [rsp + 0xb0]
call fcn.18000dc30
jmp 0x180027d5d
mov byte [rsp + 0xf8], 0xd
mov byte [rsp + 0xff], 1
test r13, r13
je 0x180027ce9
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
movsd xmm1, qword [rsp + 0x108]
movsd qword [r13 + 0x10], xmm1
movzx eax, word [rsp + 0x110]
mov word [r13 + 0x18], ax
movzx eax, byte [rsp + 0x112]
mov byte [r13 + 0x1a], al
mov r9, rsi
mov r8, qword [rsp + 0x90]
mov edx, r15d
mov rcx, rbx
call fcn.18000dc30
jmp 0x180027d5d
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180027d23
test byte [rsp + 0x78], 2
jne 0x180027d23
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x180027d5d
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
movsd xmm1, qword [rsp + 0x108]
movsd qword [r13 + 0x10], xmm1
movzx eax, word [rsp + 0x110]
mov word [r13 + 0x18], ax
movzx eax, byte [rsp + 0x112]
mov byte [r13 + 0x1a], al
xor al, al
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret