Function at 0x180035cd0
Capabilities:
Copy file
Get file size
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6f0
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov dword [rsp + 0x60], r9d
mov ebx, r8d
mov qword [rsp + 0x80], rdx
mov rdi, rcx
mov qword [rsp + 0xa8], rcx
mov dword [rsp + 0x48], ebx
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x4d0]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x2c0]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call fcn.18004c900
xor esi, esi
mov r15d, esi
mov dword [rsp + 0x54], esi
mov r14d, esi
mov dword [rsp + 0x50], esi
mov r13d, esi
mov dword [rsp + 0x78], esi
mov eax, dword [rsp + 0x758]
cmp eax, ebx
jae 0x180035d99
test eax, eax
je 0x180035d97
mov dword [rsp + 0x758], ebx
jmp 0x180035da0
cmp eax, ebx
cmova ebx, eax
mov dword [rsp + 0x48], ebx
cmp byte [0x180081330], sil
je 0x180035e81
lea rcx, [rsp + 0xb0]
call fcn.18000d050
test al, al
je 0x180035e81
lea r8, [rsp + 0x2c0]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.18000d3f0
test al, al
jne 0x180035e04
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x2c0]
call sym.TitanEngine.dll_FindOverlayW
test al, al
je 0x180035ea7
lea r8, [rsp + 0x4d0]
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.18000d3f0
test al, al
jne 0x180035e50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x4d0]
call fcn.18004c900
jmp 0x180035ea7
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2c0]
call sym.TitanEngine.dll_ExtractOverlayW
test al, al
je 0x180035ea7
lea rcx, [rsp + 0x2c0]
call sym.TitanEngine.dll_RemoveOverlayW
test al, al
je 0x180035ea7
mov byte [rsp + 0x40], 1
jmp 0x180035ea7
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x180036193
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r12, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18003616c
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x18003616c
mov dword [rsp + 0x78], r15d
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rdi
call fcn.180007830
test al, al
je 0x180036156
movsxd r11, dword [rsi + 0x3c]
lea rcx, [rsi + r11]
movzx eax, word [rcx + 0x18]
mov r13d, 0x10b
cmp ax, r13w
jne 0x180035f91
xor edx, edx
jmp 0x180035fa6
mov r8d, 0x20b
cmp ax, r8w
jne 0x180036156
mov edx, 1
movzx r9d, word [rcx + 0x14]
add r9, rcx
movzx r10d, word [rcx + 6]
test edx, edx
jne 0x18003608a
mov r8d, dword [rcx + 0x3c]
xor edx, edx
mov eax, ebx
div r8d
imul eax, r8d
cmp eax, ebx
jae 0x180035fd8
lea ebx, [r8 + rax]
mov dword [rsp + 0x48], ebx
jmp 0x180035fde
mov ebx, eax
mov dword [rsp + 0x48], eax
lea eax, [r10 + r10*4]
shl eax, 3
mov r13d, dword [r9 + 0x2c]
sub r13d, eax
sub r13d, r11d
sub r13d, 0xf8
mov dword [rsp + 0x98], r13d
lea eax, [r10 - 1]
lea ecx, [rax + rax*4]
shl ecx, 3
mov ecx, dword [r9 + rcx + 0x28]
xor edx, edx
mov eax, ecx
div r8d
mov r14d, ecx
sub r14d, edx
mov dword [rsp + 0x50], r14d
cmp r14d, ecx
jae 0x18003602c
add r14d, r8d
mov dword [rsp + 0x50], r14d
sub r14d, ecx
mov dword [rsp + 0x50], r14d
mov r9, rsi
mov r8, r12
mov edx, r15d
mov rcx, rdi
call fcn.18000dc30
lea r15d, [rbx + r14]
mov dword [rsp + 0x9c], r15d
jmp 0x180036193
mov r8d, dword [rcx + 0x3c]
xor edx, edx
mov eax, ebx
div r8d
imul eax, r8d
cmp eax, ebx
jae 0x1800360a7
lea ebx, [r8 + rax]
mov dword [rsp + 0x48], ebx
jmp 0x1800360ad
mov ebx, eax
mov dword [rsp + 0x48], eax
lea eax, [r10 + r10*4]
shl eax, 3
mov r13d, dword [r9 + 0x2c]
sub r13d, eax
sub r13d, r11d
sub r13d, 0x108
mov dword [rsp + 0x98], r13d
lea eax, [r10 - 1]
lea ecx, [rax + rax*4]
shl ecx, 3
mov ecx, dword [r9 + rcx + 0x28]
xor edx, edx
mov eax, ecx
div r8d
mov r14d, ecx
sub r14d, edx
mov dword [rsp + 0x50], r14d
cmp r14d, ecx
jae 0x1800360fb
add r14d, r8d
mov dword [rsp + 0x50], r14d
sub r14d, ecx
mov dword [rsp + 0x50], r14d
mov r9, rsi
mov r8, r12
mov edx, r15d
mov rcx, rdi
call fcn.18000dc30
lea r15d, [rbx + r14]
mov dword [rsp + 0x9c], r15d
jmp 0x180036193
mov r9, rsi
mov r8, r12
mov edx, r15d
mov rcx, rdi
call fcn.18000dc30
jmp 0x1800366ae
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003618e
test byte [rsp + 0x58], 2
jne 0x18003618e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, dword [rsp + 0x54]
mov r12d, 0x20b
cmp r13d, 0x28
jbe 0x1800366ae
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xe0000000
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x1800366ae
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r13d, [r15 + rax]
mov dword [rsp + 0x54], r13d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18003668c
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x18003668c
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rsi
call fcn.180007830
test al, al
je 0x18003648b
movsxd r9, dword [rdi + 0x3c]
add r9, rdi
movzx eax, word [r9 + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x1800364a1
cmp ax, r12w
jne 0x18003648b
test ebx, ebx
jne 0x1800362a0
mov ebx, dword [r9 + 0x3c]
mov dword [rsp + 0x48], ebx
mov r10d, dword [r9 + 0x38]
xor edx, edx
mov eax, ebx
div r10d
mov r12d, eax
imul r12d, r10d
mov dword [rsp + 0x70], r12d
cmp r12d, ebx
jae 0x1800362c4
add r12d, r10d
mov dword [rsp + 0x70], r12d
movzx r11d, word [r9 + 0x14]
movzx eax, word [r9 + 6]
lea ecx, [rax + 1]
mov word [r9 + 6], cx
dec eax
lea eax, [rax + rax*4]
shl eax, 3
add rax, r9
add r11, rax
mov qword [rsp + 0x68], r11
mov r8d, dword [r11 + 0x20]
mov ecx, dword [r11 + 0x24]
xor edx, edx
mov eax, r8d
div r10d
mov r15d, ecx
sub r15d, edx
add r15d, r8d
mov dword [rsp + 0x74], r15d
lea eax, [rcx + r8]
cmp r15d, eax
jae 0x180036318
add r15d, r10d
mov dword [rsp + 0x74], r15d
add dword [r11 + 0x28], r14d
lea eax, [r12 + r15]
mov dword [r9 + 0x50], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 8
jl 0x18003633e
mov eax, 8
jmp 0x18003634c
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
add rcx, 0x40
call fcn.18004c130
mov eax, 0xe0000020
mov edx, dword [rsp + 0x60]
test edx, edx
cmove edx, eax
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x48], r12d
mov dword [rcx + 0x50], ebx
mov dword [rcx + 0x4c], r15d
mov r9d, dword [rsp + 0x78]
lea eax, [r9 + r14]
mov dword [rcx + 0x54], eax
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x1800363b3
mov r8d, dword [rsp + 0x758]
lea rcx, [rdi + r9]
mov rdx, rax
call fcn.18004c130
mov r9, rdi
mov r8, qword [rsp + 0x58]
mov edx, r13d
mov rcx, rsi
call fcn.18000dc30
cmp word [rsp + 0xb0], 0
je 0x18003644f
xor r8d, r8d
mov rbx, qword [rsp + 0xa8]
mov rdx, rbx
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180036439
cmp byte [rsp + 0x40], 0
je 0x180036422
lea rdx, [rsp + 0x4d0]
mov rcx, rbx
call sym.TitanEngine.dll_AddOverlayW
test al, al
jne 0x180036422
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
xor eax, eax
jmp 0x1800366bf
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
mov eax, r15d
jmp 0x1800366bf
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
xor eax, eax
jmp 0x1800366bf
mov eax, r15d
jmp 0x1800366bf
mov r9, rdi
mov r8, r15
mov edx, r13d
mov rcx, rsi
call fcn.18000dc30
jmp 0x1800366ae
test ebx, ebx
jne 0x1800364ad
mov ebx, dword [r9 + 0x3c]
mov dword [rsp + 0x48], ebx
mov r10d, dword [r9 + 0x38]
xor edx, edx
mov eax, ebx
div r10d
mov r12d, eax
imul r12d, r10d
mov dword [rsp + 0x70], r12d
cmp r12d, ebx
jae 0x1800364d1
add r12d, r10d
mov dword [rsp + 0x70], r12d
movzx eax, word [r9 + 6]
lea ecx, [rax + 1]
mov word [r9 + 6], cx
dec eax
lea eax, [rax + rax*4]
shl eax, 3
movzx r11d, word [r9 + 0x14]
add rax, r9
add r11, rax
mov qword [rsp + 0x68], r11
mov r8d, dword [r11 + 0x20]
mov ecx, dword [r11 + 0x24]
xor edx, edx
mov eax, r8d
div r10d
mov r15d, ecx
sub r15d, edx
add r15d, r8d
mov dword [rsp + 0x74], r15d
lea eax, [rcx + r8]
cmp r15d, eax
jae 0x180036525
add r15d, r10d
mov dword [rsp + 0x74], r15d
add dword [r11 + 0x28], r14d
lea eax, [r12 + r15]
mov dword [r9 + 0x50], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 8
jl 0x18003654b
mov eax, 8
jmp 0x180036559
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
add rcx, 0x40
call fcn.18004c130
mov eax, 0xe0000020
mov edx, dword [rsp + 0x60]
test edx, edx
cmove edx, eax
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x48], r12d
mov dword [rcx + 0x50], ebx
mov dword [rcx + 0x4c], r15d
mov r9d, dword [rsp + 0x78]
lea eax, [r9 + r14]
mov dword [rcx + 0x54], eax
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x1800365c0
mov r8d, dword [rsp + 0x758]
lea rcx, [rdi + r9]
mov rdx, rax
call fcn.18004c130
mov r9, rdi
mov r8, qword [rsp + 0x58]
mov edx, r13d
mov rcx, rsi
call fcn.18000dc30
cmp word [rsp + 0xb0], 0
je 0x180036656
xor r8d, r8d
mov rbx, qword [rsp + 0xa8]
mov rdx, rbx
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180036643
cmp byte [rsp + 0x40], 0
je 0x18003662f
lea rdx, [rsp + 0x4d0]
mov rcx, rbx
call sym.TitanEngine.dll_AddOverlayW
test al, al
jne 0x18003662f
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
xor eax, eax
jmp 0x1800366bf
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
mov eax, r15d
jmp 0x1800366bf
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
xor eax, eax
jmp 0x1800366bf
mov eax, r15d
jmp 0x1800366bf
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800366ae
test byte [rsp + 0x60], 2
jne 0x1800366ae
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.18000d220
xor eax, eax
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x6f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret