Function at 0x180032460
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1090
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov esi, r8d
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0
mov r14d, 0x1000
mov r8d, r14d
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.18004c900
lea rbx, [rsp + 0x80]
mov r9d, 0x30
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800324f4
mov eax, dword [rsp + 0x50]
sub eax, r15d
add eax, ecx
cmp eax, r14d
cmova eax, r14d
mov r14d, eax
test esi, esi
jne 0x180032505
mov rdx, r15
mov rcx, rdi
call sym.TitanEngine.dll_TracerDetectRedirection
mov esi, eax
cmp esi, 1
jne 0x18003259e
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180032592
mov rcx, qword [rsp + 0x81]
mov rdx, qword [rsp + 0x85]
mov rax, qword [rsp + 0x86]
cmp dl, 0x81
jne 0x18003258b
cmp al, 0x2c
jne 0x18003255d
sub ecx, dword [rsp + 0x88]
jmp 0x180032587
cmp dl, 0x81
jne 0x18003258b
cmp al, 0x34
jne 0x180032577
mov eax, dword [rsp + 0x88]
xor eax, ecx
mov ecx, eax
mov dword [rsp + 0x30], eax
jmp 0x18003258b
cmp dl, 0x81
jne 0x18003258b
cmp al, 4
jne 0x18003258b
add ecx, dword [rsp + 0x88]
mov dword [rsp + 0x30], ecx
mov eax, ecx
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 2
jne 0x18003260b
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800325ff
mov rax, qword [rsp + 0x82]
mov dword [rsp + 0x30], eax
mov edx, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800325ff
mov eax, dword [rsp + 0x30]
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 3
jne 0x180032698
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18003268c
cmp byte [rsp + 0x80], 0xff
jne 0x180032654
cmp byte [rsp + 0x81], 0x35
mov eax, dword [rsp + 0x82]
je 0x18003265b
mov eax, dword [rsp + 0x83]
mov dword [rsp + 0x30], eax
mov edx, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18003268c
mov eax, dword [rsp + 0x30]
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 4
jne 0x180032826
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18003281a
mov ecx, 0x64
mov dword [rsp + 0x40], ecx
cmp byte [rsp + 0x80], 0xeb
jne 0x180032700
mov rdx, qword [rsp + 0x81]
lea eax, [rdx - 1]
cmp al, 2
ja 0x180032700
movzx eax, dl
lea rbx, [rsp + 0x82]
add rbx, rax
mov qword [rsp + 0x48], rbx
nop
test ecx, ecx
jle 0x180032728
cmp byte [rbx], 0xff
jne 0x180032726
lea rdx, [rbx + 1]
movzx eax, byte [rdx]
sub al, 0x20
test al, 0xef
jne 0x180032726
mov rbx, rdx
mov qword [rsp + 0x48], rdx
dec ecx
mov dword [rsp + 0x40], ecx
jmp 0x180032700
test ecx, ecx
je 0x18003276c
cmp byte [rbx], 0xff
jne 0x18003276c
lea rax, [rbx + 1]
cmp byte [rax], 0x20
jne 0x18003276c
cmp byte [rbx + 2], 0x90
je 0x18003276c
mov rbx, rax
mov qword [rsp + 0x48], rax
test ecx, ecx
jle 0x18003276e
cmp byte [rbx], 0xff
jne 0x18003276c
lea rdx, [rbx + 1]
movzx eax, byte [rdx]
sub al, 0x20
test al, 0xef
jne 0x18003276c
mov rbx, rdx
mov qword [rsp + 0x48], rdx
dec ecx
mov dword [rsp + 0x40], ecx
jmp 0x180032746
test ecx, ecx
je 0x1800327ce
cmp byte [rbx], 0xff
jne 0x1800327ce
cmp byte [rbx + 1], 0x30
jne 0x1800327ce
sub rbx, 6
mov qword [rsp + 0x48], rbx
cmp byte [rbx], 0xb8
jne 0x18003279a
mov eax, dword [rbx + 1]
mov dword [rsp + 0x30], eax
cmp byte [rbx + 5], 0x40
jne 0x1800327a1
inc eax
jmp 0x18003279d
mov eax, dword [rbx + 2]
mov dword [rsp + 0x30], eax
mov edx, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18003281a
mov eax, dword [rsp + 0x30]
jmp 0x180032c6b
test ecx, ecx
je 0x18003281a
cmp byte [rbx], 0xff
jne 0x18003281a
cmp byte [rbx + 1], 0x20
jne 0x18003281a
sub rbx, 6
mov qword [rsp + 0x48], rbx
mov eax, dword [rbx + 2]
mov dword [rsp + 0x30], eax
mov edx, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18003281a
mov eax, dword [rsp + 0x30]
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 5
jne 0x1800328e1
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800328d5
mov ecx, 0x64
mov dword [rsp + 0x40], ecx
test ecx, ecx
jle 0x180032882
cmp byte [rbx], 0x50
jne 0x180032870
cmp byte [rbx + 1], 0xc3
je 0x180032880
inc rbx
mov qword [rsp + 0x48], rbx
dec ecx
mov dword [rsp + 0x40], ecx
jmp 0x180032861
test ecx, ecx
je 0x1800328d5
cmp byte [rbx], 0x50
jne 0x1800328d5
cmp byte [rbx + 1], 0xc3
jne 0x1800328d5
sub rbx, 0x16
mov qword [rsp + 0x48], rbx
mov esi, dword [rbx + 0x10]
mov edx, dword [rbx]
add edx, 0x18
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800328d5
xor esi, dword [rsp + 0x30]
mov eax, esi
mov dword [rsp + 0x30], eax
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 6
jne 0x180032923
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180032917
mov eax, dword [rsp + 0x81]
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 7
jne 0x1800329fa
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800329ee
movzx eax, byte [rsp + 0x80]
cmp al, 0xe8
jne 0x1800329b7
cmp dword [rsp + 0x95], 0x55f0
jne 0x180032984
lea rcx, [0x18006dbb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x18006dba0]
jmp 0x180032998
lea rcx, [0x18006dbd0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetCommandLineW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
mov eax, eax
jmp 0x180032c6b
cmp al, 0xc8
jne 0x1800329ee
lea rcx, [0x18006dbf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18006dbe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
mov eax, eax
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 8
jne 0x180032a3c
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180032a30
mov eax, dword [rsp + 0xb4]
jmp 0x180032c6b
jmp 0x180032c69
cmp esi, 9
jne 0x180032c69
cmp r14d, 0xc0
jbe 0x180032c69
mov r9d, r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180032c63
movzx eax, byte [rsp + 0x80]
cmp al, 0x9c
je 0x180032a8f
cmp al, 0xeb
jne 0x180032c63
xor r8d, r8d
mov edx, 0xc0
lea rcx, [rsp + 0x80]
call fcn.1800076d0
cmp eax, 0x5af7e209
jne 0x180032adc
lea rcx, [0x18006dc10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetCommandLineA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0xeb480cac
jne 0x180032b14
lea rcx, [0x18006dc30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0x86218561
jne 0x180032b4c
lea rcx, [0x18006dc58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetCurrentProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0xca9abd85
jne 0x180032b84
lea rcx, [0x18006dc78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0xf1f84a98
jne 0x180032bbc
lea rcx, [0x18006dc98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetVersionExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0x91823290
jne 0x180032bf1
lea rcx, [0x18006dcc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18006dca8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0xbee6baa0
jne 0x180032c26
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.MessageBoxA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
cmp eax, 0x79603232
jne 0x180032c5b
lea rcx, [0x18006dd08]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetModuleHandleA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rcx, rdi
call fcn.18000b8c0
mov dword [rsp + 0x30], eax
jmp 0x180032c5f
mov eax, dword [rsp + 0x30]
mov eax, eax
jmp 0x180032c6b
jmp 0x180032c69
xor eax, eax
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret