Function at 0x180019960
Capabilities:
Parse pe header
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
push rbp
push rbx
lea rbp, [rax - 0x5f]
sub rsp, 0xa8
mov qword [rax + 8], rsi
xor ebx, ebx
mov qword [rax - 0x18], rdi
xorps xmm0, xmm0
mov qword [rax - 0x20], r12
mov r12, rcx
mov qword [rax - 0x28], r13
lea rcx, [rbp + 0xf]
mov qword [rax - 0x30], r14
mov r13, rdx
mov qword [rax - 0x38], r15
xor edx, edx
mov r15, r8
mov qword [rbp - 0x11], rbx
mov dword [rbp + 0x6f], ebx
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rbx
call fcn.180014a70
xorps xmm0, xmm0
mov qword [rbp + 7], rbx
xor edx, edx
lea rcx, [rbp - 9]
movdqu xmmword [rbp - 9], xmm0
call fcn.180014a70
mov edx, 0x2000
lea rcx, [rbp + 0xf]
call fcn.180014a70
mov edx, 0x2000
lea rcx, [rbp - 9]
mov rdi, rax
call fcn.180014a70
mov rbx, rax
mov r9d, 0x1000
lea rax, [rbp - 0x11]
mov r8, rdi
mov rdx, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180019eac
movsxd rcx, dword [rdi + 0x3c]
cmp ecx, 0x500
jg 0x180019eac
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180019eac
cmp dword [rcx + rdi], 0x4550
jne 0x180019eac
movzx eax, word [rcx + rdi + 6]
lea rsi, [rax*4 + 0x21]
add rsi, rax
lea rsi, [rcx + rsi*8]
cmp rsi, 0x1000
jbe 0x180019ab9
mov rax, rsi
lea rcx, [rbp + 0xf]
and rax, 0xfffffffffffff000
add rax, 0x1000
test rsi, 0xfff
cmovne rsi, rax
mov rdx, rsi
call fcn.180014a70
mov rdx, rsi
lea rcx, [rbp - 9]
mov rdi, rax
call fcn.180014a70
mov rbx, rax
mov r9, rsi
lea rax, [rbp - 0x11]
mov r8, rdi
mov rdx, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180019eac
jmp 0x180019abe
mov esi, 0x1000
mov r9, rdi
mov byte [rsp + 0x20], 0
mov r8, r13
mov rdx, r12
call fcn.180007830
test al, al
je 0x180019eac
movsxd r14, dword [rdi + 0x3c]
mov ecx, 0x10b
add r14, rdi
movzx eax, word [r14 + 0x18]
cmp ax, cx
jne 0x180019af4
xor r8d, r8d
jmp 0x180019b08
mov ecx, 0x20b
cmp ax, cx
jne 0x180019eac
mov r8d, 1
mov r9d, dword [r14 + 0x38]
xor edx, edx
movzx eax, word [r14 + 6]
mov rcx, r15
inc eax
mov dword [rbp - 0x19], eax
mov eax, dword [r14 + 0x50]
div r9d
mov eax, dword [r14 + 0x50]
mov r10d, edx
xor edx, edx
div r9d
mov edi, eax
inc eax
test r8d, r8d
jne 0x180019cfa
test r10d, r10d
cmovne edi, eax
imul edi, r9d
sub edi, esi
call fcn.1800069b0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov rcx, r15
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x180019eac
lea rax, [rbp - 0x11]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180019e8c
test rbx, rbx
je 0x180019e8c
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
movzx r10d, word [rcx + 0x14]
add r10, 0x2c
cmp dword [rcx + 0x3c], 0x200
jbe 0x180019bd3
mov eax, dword [r14 + 0x38]
mov dword [rcx + 0x3c], eax
mov rax, qword [rbp + 0x7f]
sub eax, r13d
mov dword [rcx + 0x34], r13d
mov dword [rcx + 0x28], eax
mov eax, dword [rbp - 0x19]
cmp eax, 1
jb 0x180019c28
add r10, rcx
mov r11d, eax
nop
mov r9d, dword [r10 - 0xc]
xor edx, edx
mov eax, dword [r10 - 8]
mov ecx, r9d
mov dword [r10], eax
lea r10, [r10 + 0x28]
mov r8d, dword [r14 + 0x38]
mov eax, r9d
div r8d
sub ecx, edx
cmp ecx, r9d
lea eax, [rcx + r8]
cmovae eax, ecx
mov dword [r10 - 0x2c], eax
mov dword [r10 - 0x34], eax
sub r11, 1
jne 0x180019bf0
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r14, [r13 - 0x1000]
add r14, rsi
test edi, edi
je 0x180019ceb
xor r13d, r13d
nop dword [rax]
mov r8, rsi
xor edx, edx
mov rcx, rbx
add r14, 0x1000
call fcn.18004c900
lea rax, [rbp - 0x11]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r12
cmp edi, 0x1000
jb 0x180019ccb
mov r9d, 0x1000
call sym.TitanEngine.dll_MemoryReadSafe
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], r13
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 0xfffff000
jne 0x180019c60
mov rcx, r15
call fcn.18000d5c0
mov bl, 1
jmp 0x180019eae
mov r9d, edi
call sym.TitanEngine.dll_MemoryReadSafe
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], r13
mov r8d, edi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
call fcn.18000d5c0
mov bl, 1
jmp 0x180019eae
test r10d, r10d
cmovne edi, eax
imul edi, r9d
sub edi, esi
call fcn.1800069b0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov rcx, r15
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x180019eac
lea rax, [rbp - 0x11]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180019e8c
test rbx, rbx
je 0x180019e8c
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
movzx r10d, word [rcx + 0x14]
add r10, 0x2c
cmp dword [rcx + 0x3c], 0x200
jbe 0x180019d92
mov eax, dword [r14 + 0x38]
mov dword [rcx + 0x3c], eax
mov rax, qword [rbp + 0x7f]
sub eax, r13d
mov qword [rcx + 0x30], r13
mov dword [rcx + 0x28], eax
mov eax, dword [rbp - 0x19]
cmp eax, 1
jb 0x180019de8
add r10, rcx
mov r11d, eax
nop
mov r9d, dword [r10 - 0xc]
xor edx, edx
mov eax, dword [r10 - 8]
mov ecx, r9d
mov dword [r10], eax
lea r10, [r10 + 0x28]
mov r8d, dword [r14 + 0x38]
mov eax, r9d
div r8d
sub ecx, edx
cmp ecx, r9d
lea eax, [rcx + r8]
cmovae eax, ecx
mov dword [r10 - 0x2c], eax
mov dword [r10 - 0x34], eax
sub r11, 1
jne 0x180019db0
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
lea r14, [r13 - 0x1000]
add r14, rax
test edi, edi
je 0x180019ceb
xor r13d, r13d
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rbx
add r14, 0x1000
call fcn.18004c900
lea rax, [rbp - 0x11]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r12
cmp edi, 0x1000
jb 0x180019ccb
mov r9d, 0x1000
call sym.TitanEngine.dll_MemoryReadSafe
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], r13
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 0xfffff000
jne 0x180019e20
mov rcx, r15
call fcn.18000d5c0
mov bl, 1
jmp 0x180019eae
lea rdx, [rbp - 0x19]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180019eac
test byte [rbp - 0x19], 2
jne 0x180019eac
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rcx, qword [rbp - 9]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xc0]
test rcx, rcx
je 0x180019f24
mov rdx, qword [rbp + 7]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180019f0f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019f67
call fcn.180049e70
xorps xmm0, xmm0
mov qword [rbp + 7], 0
movdqu xmmword [rbp - 9], xmm0
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x180019f5a
mov rdx, qword [rbp + 0x1f]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180019f55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180019f67
call fcn.180049e70
movzx eax, bl
add rsp, 0xa8
pop rbx
pop rbp
ret
call fcn.1800503fc
int3