Function at 0x1800386f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv
Hijack thread execution
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3540]
mov eax, 0x3640
call fcn.18005f3d0
sub rsp, rax
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rbp + 0x3530], rax
xor edi, edi
mov byte [rsp + 0x53], 1
xor sil, sil
mov byte [rsp + 0x41], 0
xor r15b, r15b
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x6c], 0
mov r14d, edi
lea ecx, [rdi + 0x50]
mov byte [rsp + 0x42], sil
mov byte [rsp + 0x40], r15b
mov r13d, edi
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x51], 1
mov byte [rsp + 0x52], 1
mov qword [rbp - 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
mov qword [rbp + 0x88], rdi
mov dword [rsp + 0x68], edi
mov qword [rbp - 0x40], rdi
call fcn.18004a114
xorps xmm0, xmm0
lea edx, [rdi + 0x10]
mov r8, rax
lea rcx, [rbp - 0x38]
mov qword [rax], rax
mov qword [rax + 8], rax
movdqa xmmword [rbp - 0x30], xmm0
movss xmm0, dword [0x18006e224]
movss dword [rbp - 0x50], xmm0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x18], 8
call fcn.18003b710
xor al, al
mov qword [0x180082ab0], rdi
cmp dword [0x7ffe0260], 0x2800
lea rcx, [0x180082b70]
movzx ebx, al
mov r8d, 0xb0
movzx eax, byte [0x180081325]
cmovae ebx, eax
mov qword [0x180082aa0], rdi
mov eax, 0x10002
mov dword [rsp + 0x54], ebx
xor edx, edx
mov dword [0x180081320], eax
mov byte [0x180082e08], sil
mov byte [0x180082e22], sil
mov byte [0x180082e3c], sil
mov byte [0x180082e56], sil
mov byte [0x180082692], sil
mov byte [0x180082c9d], sil
call fcn.18004c900
lea rdi, [0x180082ac0]
xor edx, edx
mov rcx, rdi
mov r8d, 0xb0
call fcn.18004c900
xor edx, edx
lea rcx, [rbp + 0x3130]
mov r8d, 0x400
call fcn.18004c900
call fcn.180009760
cmp byte [0x180081326], sil
lea eax, [r14 + 1]
mov byte [0x180082691], 1
je 0x1800388a0
mov edx, eax
lea rcx, [0x180082b70]
call fcn.1800097e0
nop dword [rax]
mov edx, 0x64
lea rcx, [0x180082b70]
xor r12b, r12b
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
jne 0x180038929
cmp byte [0x180082692], r12b
jne 0x18003b29c
mov rcx, qword [0x180082d08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18003b28f
mov eax, dword [0x180082d18]
lea rdx, [0x180082b80]
mov rcx, qword [0x180082d08]
mov dword [0x180082b74], eax
mov eax, dword [0x180082d1c]
mov dword [0x180082b78], eax
mov dword [0x180082b70], 5
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x180082b80]
test eax, eax
mov eax, 0xffffffff
cmove ecx, eax
mov dword [0x180082b80], ecx
test bl, bl
je 0x1800389c9
cmp dword [0x180082b70], 1
jne 0x18003895b
test r13d, r13d
je 0x1800389c9
cmp dword [0x180082b78], r13d
je 0x1800389c9
mov dword [0x180081320], 0x40010001
jmp 0x18003b22a
cmp dword [0x180082b70], 4
jne 0x1800389c9
test r13d, r13d
je 0x1800389c9
cmp dword [0x180082b78], r13d
jne 0x1800389c9
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbx]
cmp rdi, rbx
je 0x180038992
nop
mov rcx, qword [rdi + 0x14]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rdi]
cmp rdi, rbx
jne 0x180038980
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1800389bb
mov rax, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x48]
shr rax, 3
cmp rax, rcx
jbe 0x180038a23
mov rdx, qword [rbx]
lea rcx, [rbp - 0x50]
mov r8, rbx
call fcn.18003b550
xor r13d, r13d
mov ebx, dword [rsp + 0x54]
lea rdi, [0x180082ac0]
cmp byte [0x180081326], r12b
je 0x1800389e3
mov edx, 2
lea rcx, [0x180082b70]
call fcn.1800097e0
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0xc0]
test rdx, rdx
je 0x1800389ff
lea rcx, [0x180082b70]
call rdx
mov eax, dword [0x180082b70]
dec eax
cmp eax, 8
ja case.default.0x180038a21
lea rdx, sym.TitanEngine.dll_TZa2PRht_6YP5:PgFH_Ff9cCpT__.v_
mov ecx, dword [rdx + rax*4 + 0x3b450]
add rcx, rdx
jmp rcx
mov rax, qword [rbx + 8]
xor r13d, r13d
mov qword [rax], r13
mov rcx, qword [rbx]
test rcx, rcx
je 0x180038a55
nop word [rax + rax]
mov rdi, qword [rcx]
mov edx, 0x50
call fcn.180049e70
mov rcx, rdi
test rdi, rdi
jne 0x180038a40
mov rax, qword [rbp - 0x48]
mov qword [rax], rax
mov rax, qword [rbp - 0x48]
mov qword [rax + 8], rax
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
sub rcx, rdi
mov qword [rbp - 0x40], r13
add rcx, 7
shr rcx, 3
cmp rdi, qword [rbp - 0x30]
cmova rcx, r13
test rcx, rcx
je 0x1800389be
mov rax, qword [rbp - 0x48]
rep stosq qword [rdi], rax
jmp 0x1800389be
cmp byte [0x180082abe], r12b
movzx edi, byte [0x180082abc]
je 0x180038add
test dil, dil
jne 0x180038add
mov rcx, qword [0x180082c58]
test rcx, rcx
je 0x180038add
mov rax, qword [0x180082bb0]
test rax, rax
je 0x180038ad6
sub rax, qword [0x180082b98]
add rax, rcx
mov qword [0x180082bb0], rax
mov qword [0x180082b98], rcx
xor bl, bl
cmp qword [0x180082ab0], 0
jne 0x180038c5d
cmp byte [0x180082abd], bl
mov rax, qword [0x180082bb0]
mov qword [rbp + 0x90], rax
mov rax, qword [0x180082b80]
mov qword [0x180082ab0], rax
mov rax, qword [0x180082b98]
mov qword [0x180082c40], rax
je 0x180038b61
mov rax, qword [0x180082b88]
mov rcx, qword [0x180082698]
mov qword [0x180082d08], rax
mov rax, qword [0x180082b90]
mov qword [0x180082d10], rax
xor eax, eax
mov dword [0x180082d1c], eax
test rcx, rcx
je 0x180038b5f
lea r8d, [rax + 0x18]
lea rdx, [0x180082d08]
call fcn.18004c130
mov bl, 1
test dil, dil
je 0x180038b93
mov rdx, qword [0x180082c48]
test rdx, rdx
je 0x180038b93
mov rcx, qword [0x180082d08]
mov r9d, 0x2000
mov r8d, 0x1000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp byte [rsp + 0x50], r12b
je 0x180038b9f
call fcn.180005920
mov byte [rsp + 0x50], r12b
cmp byte [rsp + 0x51], r12b
je 0x180038bb0
call fcn.18000e8b0
mov eax, dword [0x180082b78]
xorps xmm0, xmm0
mov rdx, qword [0x180090a90]
xorps xmm1, xmm1
cmp rdx, qword [0x180090a98]
mov dword [rbp + 0xe8], eax
mov rax, qword [0x180082b90]
mov qword [rbp + 0xe0], rax
mov rax, qword [0x180082bb0]
mov qword [rbp + 0xec], rax
mov rax, qword [0x180082ba8]
mov qword [rbp + 0xf4], rax
mov byte [rsp + 0x51], r12b
movdqu xmmword [rbp + 0xfc], xmm0
movdqu xmmword [rbp + 0x10c], xmm1
je 0x180038c51
movups xmm0, xmmword [rbp + 0xe0]
mov eax, dword [rbp + 0x118]
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rdx + 0x10], xmm1
movsd xmm1, qword [rbp + 0x110]
movups xmmword [rdx + 0x20], xmm0
movsd qword [rdx + 0x30], xmm1
mov dword [rdx + 0x38], eax
add qword [0x180090a90], 0x3c
jmp 0x180038c5d
lea r8, [rbp + 0xe0]
call fcn.18002f9c0
mov rax, qword [0x180082b80]
mov rdx, qword [0x180090a10]
cmp rdx, qword [0x180090a18]
mov qword [rbp + 0xc0], rax
mov rax, qword [0x180082b88]
mov qword [rbp + 0xa8], rax
mov rax, qword [0x180082b90]
mov qword [rbp + 0xb4], rax
mov eax, dword [0x180082b74]
mov dword [rbp + 0xb0], eax
mov eax, dword [0x180082b78]
mov dword [rbp + 0xbc], eax
mov rax, qword [0x180082b98]
mov qword [rbp + 0xc8], rax
mov rax, qword [0x180082bb0]
mov qword [rbp + 0xd0], rax
mov rax, qword [0x180082ba8]
mov qword [rbp + 0xd8], rax
je 0x180038d10
movups xmm0, xmmword [rbp + 0xa8]
movups xmm1, xmmword [rbp + 0xb8]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0xc8]
movups xmmword [rdx + 0x10], xmm1
movsd xmm1, qword [rbp + 0xd8]
movups xmmword [rdx + 0x20], xmm0
movsd qword [rdx + 0x30], xmm1
add qword [0x180090a10], 0x38
jmp 0x180038d1c
lea r8, [rbp + 0xa8]
call fcn.18003bde0
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x78]
test rdx, rdx
je 0x180038d35
lea rcx, [0x180082b80]
call rdx
mov rdi, qword [0x180082ab0]
test rdi, rdi
je 0x180038d61
lea rdx, [rbp + 0x7c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180038d61
test byte [rbp + 0x7c], 2
jne 0x180038d61
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x180039598
call qword [0x180082c50]
mov ebx, dword [rsp + 0x54]
jmp case.default.0x180038a21
mov eax, dword [0x180082b80]
mov ecx, dword [rsp + 0x6c]
mov dword [0x180082ab8], eax
mov eax, 0x10002
mov dword [0x180081320], eax
mov eax, dword [0x180082d18]
cmp dword [0x180082b74], eax
mov eax, 1
movzx ecx, cl
cmove ecx, eax
mov rax, qword [0x180081328]
mov dword [rsp + 0x6c], ecx
mov rdx, qword [rax + 0x80]
test rdx, rdx
je case.default.0x180038a21
lea rcx, [0x180082b80]
jmp 0x18003b0c6
mov eax, dword [0x180082b78]
xorps xmm0, xmm0
mov rdx, qword [0x180090a90]
xorps xmm1, xmm1
cmp rdx, qword [0x180090a98]
mov rdi, qword [0x180082b80]
mov dword [rbp + 0x128], eax
mov rax, qword [0x180082b90]
mov qword [rbp + 0x12c], rax
mov rax, qword [0x180082b88]
mov qword [rbp + 0x134], rax
movdqu xmmword [rbp + 0x13c], xmm0
mov qword [rbp + 0x120], rdi
movdqu xmmword [rbp + 0x14c], xmm1
je 0x180038e6d
movups xmm0, xmmword [rbp + 0x120]
mov eax, dword [rbp + 0x158]
movups xmm1, xmmword [rbp + 0x130]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0x140]
movups xmmword [rdx + 0x10], xmm1
movsd xmm1, qword [rbp + 0x150]
movups xmmword [rdx + 0x20], xmm0
movsd qword [rdx + 0x30], xmm1
mov dword [rdx + 0x38], eax
add qword [0x180090a90], 0x3c
jmp 0x180038e79
lea r8, [rbp + 0x120]
call fcn.18002f9c0
xor r14d, r14d
cmp byte [0x180082e08], r12b
je 0x180038eba
mov rax, qword [0x180082df8]
lea r8d, [r14 + 0xb]
mov r9d, dword [0x180082e00]
mov rcx, rdi
mov rdx, qword [0x180082df0]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov eax, dword [0x180082e04]
mov dword [rsp + 0x20], eax
call sym.TitanEngine.dll_SetHardwareBreakPointEx
cmp byte [0x180082e22], r12b
je 0x180038efa
mov rax, qword [0x180082e12]
mov r8d, 0xc
mov r9d, dword [0x180082e1a]
mov rcx, rdi
mov rdx, qword [0x180082e0a]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov eax, dword [0x180082e1e]
mov dword [rsp + 0x20], eax
call sym.TitanEngine.dll_SetHardwareBreakPointEx
cmp byte [0x180082e3c], r12b
je 0x180038f3a
mov rax, qword [0x180082e2c]
mov r8d, 0xd
mov r9d, dword [0x180082e34]
mov rcx, rdi
mov rdx, qword [0x180082e24]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov eax, dword [0x180082e38]
mov dword [rsp + 0x20], eax
call sym.TitanEngine.dll_SetHardwareBreakPointEx
cmp byte [0x180082e56], r12b
je 0x180038f7a
mov rax, qword [0x180082e46]
mov r8d, 0xe
mov r9d, dword [0x180082e4e]
mov rcx, rdi
mov rdx, qword [0x180082e3e]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov eax, dword [0x180082e52]
mov dword [rsp + 0x20], eax
call sym.TitanEngine.dll_SetHardwareBreakPointEx
test sil, sil
je 0x180038fa4
mov rax, qword [rbp - 0x80]
mov r9d, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call sym.TitanEngine.dll_SetHardwareBreakPoint
xor al, al
mov byte [rsp + 0x42], al
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x68]
test rdx, rdx
je 0x180039598
lea rcx, [0x180082b80]
jmp 0x18003b0c6
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x180038fdd
lea rcx, [0x180082b80]
call rdx
mov rax, qword [0x180082e90]
test rax, rax
je 0x180038ffe
lea rcx, [0x180082b80]
call rax
xor r14d, r14d
mov qword [0x180082e90], r14
jmp 0x180039001
xor r14d, r14d
mov r10, qword [0x180090a90]
movabs rax, 0xeeeeeeeeeeeeeeef
mov r9, qword [0x180090a88]
mov r8, r10
sub r8, r9
mov edi, r14d
sar r8, 2
imul r8, rax
test r8, r8
je case.default.0x180038a21
mov rdx, r14
cmp r8, rdx
jbe 0x18003b41f
mov eax, dword [0x180082b78]
imul rcx, rdx, 0x3c
cmp dword [rcx + r9 + 8], eax
je 0x18003905e
inc edi
mov edx, edi
cmp r8, rdx
ja 0x18003903f
jmp case.default.0x180038a21
imul rcx, rdx, 0x3c
add rcx, r9
lea rdx, [rcx + 0x3c]
sub r10, rdx
mov r8, r10
call fcn.18004c130
sub qword [0x180090a90], 0x3c
jmp case.default.0x180038a21
cmp byte [rsp + 0x52], r12b
je 0x18003908d
call fcn.18000d860
xor edx, edx
mov byte [rsp + 0x52], r12b
mov r8d, 0x430
lea rcx, [rbp + 0x1070]
call fcn.18004c900
mov rdx, qword [0x180082b88]
lea r8, [rbp + 0x3130]
mov rcx, qword [0x180082d08]
mov r9d, 0x200
mov qword [rbp + 0x1078], rdx
call qword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
je 0x180039304
lea rcx, [rbp + 0x3130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
mov rcx, rdi
cmp word [rbp + rdi*2 + 0x3130], 0x5c
je 0x180039109
test rcx, rcx
je 0x180039109
dec rcx
dec edi
cmp word [rbp + rcx*2 + 0x3130], 0x5c
jne 0x1800390f4
cmp byte [0x180082abc], r12b
je 0x18003916e
mov rdx, qword [0x180082c20]
lea eax, [rdi + 1]
movsxd rcx, eax
lea rax, [rbp + 0x3130]
lea rcx, [rax + rcx*2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18003916e
mov rcx, qword [0x180082c30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082b88]
mov edx, 1
add rcx, qword [0x180082c60]
mov r8, qword [0x180082c70]
call sym.TitanEngine.dll_SetBPX
mov rax, qword [0x180082b88]
mov qword [0x180082c38], rax
cmp qword [0x180082aa0], 0
jne 0x1800391ad
lea eax, [rdi + 1]
movsxd rcx, eax
lea rdx, [0x18006dde8]
lea rax, [rbp + 0x3130]
lea rcx, [rax + rcx*2]
call fcn.180050580
mov rcx, qword [0x180082aa0]
test eax, eax
cmove rcx, qword [0x180082b88]
mov qword [0x180082aa0], rcx
lea eax, [rdi + 1]
movsxd rcx, eax
lea rdx, [rbp + 0x3130]
lea rdx, [rdx + rcx*2]
lea rcx, [rbp + 0x1298]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x3130]
call sym.TitanEngine.dll_TranslateNativeNameW
mov rdi, rax
test rax, rax
je 0x180039200
mov rdx, rax
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
lea rcx, [rbp + 0x3020]
mov r8d, 0x104
call fcn.18004c900
xor r14d, r14d
lea rax, [rbp + 0x3020]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x1298]
mov qword [rsp + 0x30], r14
xor edx, edx
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
lea r9d, [r14 - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [0x180090a78]
movabs rdi, 0x70913f8bcd29c245
mov rdx, qword [0x180090a70]
mov rax, rcx
sub rax, rdx
imul rax, rdi
sub eax, 1
movsxd rbx, eax
js 0x180039304
imul rsi, rbx, 0x8d
nop
sub rcx, rdx
imul rcx, rdi
cmp rcx, rbx
jbe 0x18003b425
lea rdi, [rdx + rsi]
mov rcx, rdi
lea rdx, [rbp + 0x3020]
call fcn.1800507e0
test eax, eax
jne 0x1800392da
mov eax, dword [rdi + 0x89]
dec eax
test eax, 0xfffffffd
jne 0x1800392da
lea rcx, [0x180082b80]
call qword [rdi + pe_nt_image_headers64]
cmp byte [rdi + 0x88], r12b
je 0x1800392da
mov edx, dword [rdi + 0x89]
mov rcx, rdi
call sym.TitanEngine.dll_LibrarianRemoveBreakPoint
sub rsi, 0x8d
sub rbx, 1
js 0x180039304
mov rcx, qword [0x180090a78]
movabs rdi, 0x70913f8bcd29c245
mov rdx, qword [0x180090a70]
jmp 0x180039280
mov rdx, qword [0x180090a60]
cmp rdx, qword [0x180090a68]
je 0x18003939a
lea rax, [rbp + 0x1070]
mov ecx, 8
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x180039324
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
add qword [0x180090a60], 0x430
jmp 0x1800393a6
lea r8, [rbp + 0x1070]
call fcn.18003bb30
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x1800393c2
lea rcx, [0x180082b80]
call rdx
mov rdi, qword [0x180082b80]
test rdi, rdi
je 0x180039598
lea rdx, [rbp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039598
test byte [rbp + 0x78], 2
jne 0x180039598
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x54]
jmp case.default.0x180038a21
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x90]
test rdx, rdx
je 0x18003941f
lea rcx, [0x180082b80]
call rdx
mov rcx, qword [0x180082b80]
call sym.TitanEngine.dll_LibrarianGetLibraryInfoEx
mov rdi, rax
test rax, rax
je 0x180039540
xor edx, edx
lea rcx, [rbp + 0x3020]
mov r8d, 0x104
call fcn.18004c900
xor r14d, r14d
lea rax, [rbp + 0x3020]
mov qword [rsp + 0x38], r14
lea r8, [rdi + 0x228]
mov qword [rsp + 0x30], r14
xor edx, edx
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
lea r9d, [r14 - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [0x180090a78]
movabs rdi, 0x70913f8bcd29c245
mov rdx, qword [0x180090a70]
mov rax, rcx
sub rax, rdx
imul rax, rdi
sub eax, 1
movsxd rbx, eax
js 0x180039543
imul rsi, rbx, 0x8d
nop word [rax + rax]
sub rcx, rdx
imul rcx, rdi
cmp rcx, rbx
jbe 0x18003b42b
lea rdi, [rdx + rsi]
mov rcx, rdi
lea rdx, [rbp + 0x3020]
call fcn.1800507e0
test eax, eax
jne 0x180039519
mov eax, dword [rdi + 0x89]
sub eax, 2
cmp eax, 1
ja 0x180039519
lea rcx, [0x180082b80]
call qword [rdi + pe_nt_image_headers64]
cmp byte [rdi + 0x88], r12b
je 0x180039519
mov edx, dword [rdi + 0x89]
mov rcx, rdi
call sym.TitanEngine.dll_LibrarianRemoveBreakPoint
sub rsi, 0x8d
sub rbx, 1
js 0x180039543
mov rcx, qword [0x180090a78]
movabs rdi, 0x70913f8bcd29c245
mov rdx, qword [0x180090a70]
jmp 0x1800394c0
xor r14d, r14d
mov rdx, qword [0x180090a60]
movabs rbx, 0xf0b7672a07a44c6b
mov r8, qword [0x180090a58]
mov ecx, r14d
sub rdx, r8
sar rdx, 4
imul rdx, rbx
test rdx, rdx
je 0x180039598
mov r9, qword [0x180082b80]
mov rdi, r14
cmp rdx, r14
jbe 0x18003b431
imul rax, rdi, 0x430
cmp qword [rax + r8 + 8], r9
je 0x1800395a1
inc ecx
mov edi, ecx
cmp rdx, rdi
ja 0x180039581
mov ebx, dword [rsp + 0x54]
jmp case.default.0x180038a21
imul rax, rdi, 0x430
mov rcx, qword [rax + r8 + 0x18]
test rcx, rcx
je 0x18003960d
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [0x180090a60]
mov rcx, qword [0x180090a58]
sub rax, rcx
sar rax, 4
imul rax, rbx
cmp rax, rdi
jbe 0x18003b431
imul rax, rdi, 0x430
lea rdx, [rbp + 0x74]
mov rbx, qword [rax + rcx + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039606
test byte [rbp + 0x74], 2
jne 0x180039606
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [0x180090a58]
imul rcx, rdi, 0x430
add rcx, r8
mov r8, qword [0x180090a60]
lea rdx, [rcx + 0x430]
sub r8, rdx
call fcn.18004c130
sub qword [0x180090a60], 0x430
mov ebx, dword [rsp + 0x54]
jmp case.default.0x180038a21
cmp byte [0x180081326], r12b
mov dword [0x180081320], 0x80010001
je 0x180039665
mov edx, 4
lea rcx, [0x180082b70]
call fcn.1800097e0
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x98]
jmp 0x180038faf
mov rax, qword [0x180081328]
mov dword [0x180081320], 0x80010001
mov rdx, qword [rax + 0x60]
test rdx, rdx
je 0x18003969b
lea rcx, [0x180082b80]
call rdx
cmp dword [0x180082c18], 0
mov r11d, 0x10002
jne 0x180039733
cmp byte [0x180081327], r12b
mov eax, 0x80010001
cmove eax, r11d
mov dword [0x180081320], eax
lea rax, [0x180082b70]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdi + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdi + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdi + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdi + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdi + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdi + 0x90], xmm1
movups xmmword [rdi + 0xa0], xmm0
mov eax, dword [0x180082b80]
cmp eax, 0xc000008c
ja 0x18003afb0
je 0x18003afa3
cmp eax, 0xc0000005
ja 0x18003acfe
je 0x18003a83c
cmp eax, 0x80000001
je 0x18003a3ed
cmp eax, 0x80000003
je 0x18003a005
cmp eax, 0x80000004
jne 0x18003b020
test bl, bl
je 0x180039846
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbx]
cmp rdi, rbx
je 0x1800397a2
mov rcx, qword [rdi + 0x14]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rdi]
cmp rdi, rbx
jne 0x180039790
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x18003983f
mov rax, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x48]
shr rax, 3
cmp rax, rcx
jbe 0x1800397d9
mov rdx, qword [rbx]
lea rcx, [rbp - 0x50]
mov r8, rbx
call fcn.18003b550
xor edi, edi
mov r13d, edi
jmp 0x180039848
mov rax, qword [rbx + 8]
xor r13d, r13d
mov qword [rax], r13
mov rcx, qword [rbx]
test rcx, rcx
je 0x180039805
nop dword [rax + rax]
mov rdi, qword [rcx]
mov edx, 0x50
call fcn.180049e70
mov rcx, rdi
test rdi, rdi
jne 0x1800397f0
mov rax, qword [rbp - 0x48]
mov qword [rax], rax
mov rax, qword [rbp - 0x48]
mov qword [rax + 8], rax
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
sub rcx, rdi
mov qword [rbp - 0x40], r13
add rcx, 7
shr rcx, 3
cmp rdi, qword [rbp - 0x30]
cmova rcx, r13
test rcx, rcx
je 0x18003983f
mov rax, qword [rbp - 0x48]
rep stosq qword [rdi], rax
xor edi, edi
mov r13d, edi
jmp 0x180039848
xor edi, edi
movzx eax, byte [rsp + 0x41]
cmp al, 1
je 0x180039d13
cmp sil, 1
je 0x180039d13
cmp r15b, 1
je 0x180039d13
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0x200]
or ecx, 0x100010
mov r14, rax
mov dword [rbp + 0x230], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [0x180082b90]
cmp rdx, qword [rbp + 0x248]
je 0x180039b44
movzx ecx, byte [rbp + 0x268]
test cl, 1
jne 0x180039b44
cmp rdx, qword [rbp + 0x250]
je 0x180039ad7
test cl, 2
jne 0x180039ad7
cmp rdx, qword [rbp + 0x258]
je 0x180039a67
test cl, 4
jne 0x180039a67
cmp rdx, qword [rbp + 0x260]
je 0x180039902
test cl, 8
je 0x180039bf1
cmp byte [0x180082e56], r12b
je 0x180039bf1
or dword [rbp + 0x244], 0x100
lea rdx, [rbp + 0x200]
mov eax, 0x10002
mov rcx, r14
mov dword [0x180081320], eax
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x260]
call qword [0x180082e46]
cmp byte [0x180082e56], 0
je 0x180039bc5
movups xmm0, xmmword [0x180082e3e]
mov ecx, 0x10
mov dword [rsp + 0x68], 0xe
movsd xmm1, qword [0x180082e4e]
movups xmmword [rsp + 0x78], xmm0
movsd qword [rbp - 0x78], xmm1
call sym.TitanEngine.dll_GetContextData
mov rcx, qword [0x180090a90]
mov rsi, rax
mov r9, qword [0x180090a88]
movabs rax, 0xeeeeeeeeeeeeeeef
sub rcx, r9
and rsi, 0xffffffffffffff3f
sar rcx, 2
mov ebx, edi
imul rcx, rax
test rcx, rcx
je 0x180039a44
cmp rcx, rdi
jbe 0x18003b437
xor r8d, r8d
imul rcx, rdi, 0x3c
lea edx, [r8 + 0xe]
mov rcx, qword [rcx + r9]
call sym.TitanEngine.dll_SetContextDataEx
mov rax, qword [0x180090a90]
movabs rcx, 0xeeeeeeeeeeeeeeef
mov r9, qword [0x180090a88]
sub rax, r9
sar rax, 2
imul rax, rcx
cmp rax, rdi
jbe 0x18003b437
imul rcx, rdi, 0x3c
mov r8, rsi
mov edx, 0x10
mov rcx, qword [rcx + r9]
call sym.TitanEngine.dll_SetContextDataEx
mov rcx, qword [0x180090a90]
inc ebx
mov r9, qword [0x180090a88]
movabs rax, 0xeeeeeeeeeeeeeeef
sub rcx, r9
mov edi, ebx
sar rcx, 2
imul rcx, rax
cmp rcx, rdi
ja 0x1800399bd
xor edi, edi
mov byte [0x180082e56], 0
movzx esi, r12b
mov qword [0x180082e3e], rdi
mov qword [0x180082e46], rdi
mov byte [rsp + 0x42], r12b
jmp 0x180039bfb
cmp byte [0x180082e3c], r12b
je 0x180039bf1
or dword [rbp + 0x244], 0x100
lea rdx, [rbp + 0x200]
mov eax, 0x10002
mov rcx, r14
mov dword [0x180081320], eax
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x258]
call qword [0x180082e2c]
cmp byte [0x180082e3c], 0
je 0x180039bc5
movups xmm0, xmmword [0x180082e24]
mov ecx, 0xd
mov dword [rsp + 0x68], 0xd
movsd xmm1, qword [0x180082e34]
jmp 0x180039bab
cmp byte [0x180082e22], r12b
je 0x180039bf1
or dword [rbp + 0x244], 0x100
lea rdx, [rbp + 0x200]
mov eax, 0x10002
mov rcx, r14
mov dword [0x180081320], eax
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x250]
call qword [0x180082e12]
cmp byte [0x180082e22], 0
je 0x180039bc5
movups xmm0, xmmword [0x180082e0a]
mov ecx, 0xc
mov dword [rsp + 0x68], 0xc
movsd xmm1, qword [0x180082e1a]
jmp 0x180039bab
cmp byte [0x180082e08], r12b
je 0x180039bf1
or dword [rbp + 0x244], 0x100
lea rdx, [rbp + 0x200]
mov eax, 0x10002
mov rcx, r14
mov dword [0x180081320], eax
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x248]
call qword [0x180082df8]
cmp byte [0x180082e08], 0
je 0x180039bc5
movaps xmm0, xmmword [0x180082df0]
mov ecx, 0xb
movsd xmm1, qword [0x180082e00]
mov dword [rsp + 0x68], 0xb
movsd qword [rbp - 0x78], xmm1
movups xmmword [rsp + 0x78], xmm0
call sym.TitanEngine.dll_DeleteHardwareBreakPoint
mov byte [rsp + 0x42], r12b
movzx esi, r12b
jmp 0x180039bfb
lea rdx, [rbp + 0x200]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
and dword [rbp + 0x244], 0xfffffeff
lea rdx, [rbp + 0x200]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x180039bfb
mov dword [0x180081320], 0x80010001
lea rdx, [rbp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039c1b
test byte [rbp + 0x70], 2
jne 0x180039c1b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x180039fd7
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x180039c51
xor esi, esi
mov ebx, esi
jmp 0x180039c99
xor edx, edx
lea rcx, [rbp + 0x1ee0]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rbp + 0x1ee0]
mov rcx, rdi
call fcn.1800064e0
mov rcx, rdi
test al, al
jne 0x180039c8a
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
mov ebx, esi
jmp 0x180039c99
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rbp + 0x1f60]
xor esi, esi
lea rdx, [rbp + 0x6c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039cb9
test byte [rbp + 0x6c], 2
jne 0x180039cb9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rbp + 0x3010]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rbp + 0x3010]
mov rcx, rbx
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, [0x18006de0c]
mov rcx, rax
call fcn.18004ad74
mov ecx, dword [rsp + 0x58]
test rax, rax
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x58], ecx
jmp 0x180039fd7
mov dword [0x180081320], 0x10002
cmp byte [rsp + 0x58], r12b
je 0x180039e25
mov r8d, dword [0x180082b78]
xor edx, edx
mov byte [rsp + 0x58], r12b
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x180039d5a
xor eax, eax
mov ebx, eax
jmp 0x180039da0
xor edx, edx
lea rcx, [rbp + 0x2ba0]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rbp + 0x2ba0]
mov rcx, rdi
call fcn.1800064e0
mov rcx, rdi
test al, al
jne 0x180039d93
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ebx, eax
jmp 0x180039da0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rbp + 0x2bc0]
lea rdx, [rbp + 0x84]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039dc6
test byte [rbp + 0x84], 2
jne 0x180039dc6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rbp - 0x60]
xor edi, edi
mov rdx, rbx
mov qword [rbp - 0x60], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x180082d08]
lea r9d, [rdi + 8]
and qword [rbp - 0x60], 0xfffffffffffffeff
lea r8, [rbp - 0x60]
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x180082d08]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x41]
test al, al
je 0x180039ed1
mov rbx, qword [rsp + 0x70]
mov rax, qword [rbp - 0x68]
add rax, rbx
cmp rax, qword [0x180082b90]
je 0x180039e5b
mov rcx, rbx
call sym.TitanEngine.dll_EnableBPX
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x41], r12b
call fcn.180038640
jmp 0x180039ed1
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0x1a10]
mov dword [rbp + 0x1a40], ecx
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
or dword [rbp + 0x1a54], 0x100
lea rdx, [rbp + 0x1a10]
mov rcx, rdi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180039ecf
test byte [rbp + 0x80], 2
jne 0x180039ecf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test sil, sil
je 0x180039f00
mov r9d, dword [rbp - 0x74]
xor al, al
mov r8d, dword [rbp - 0x78]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov byte [rsp + 0x42], al
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call sym.TitanEngine.dll_SetHardwareBreakPoint
call fcn.180038640
test r15b, r15b
je 0x180039fdc
xor r15b, r15b
cmp byte [0x180082abf], r15b
mov byte [rsp + 0x40], r15b
je 0x180039f8a
mov r8, qword [0x1800909e0]
xor eax, eax
mov rcx, qword [0x1800909d8]
mov edx, eax
sub r8, rcx
movabs rax, 0x82fa0be82fa0be83
imul r8, rax
test r8, r8
je 0x180039fd7
add rcx, 0x13
nop word [rax + rax]
cmp r8, rdx
jbe 0x18003b449
cmp qword [rcx - 0x12], r14
jne 0x180039f6f
mov eax, dword [rcx]
sub eax, 3
cmp eax, 3
ja 0x180039f6f
cmp byte [rcx - 0x13], 1
je 0x180039f82
inc edi
inc rdx
movsxd rax, edi
add rcx, 0x2b
cmp rax, r8
jb 0x180039f50
jmp 0x180039fd7
mov r9d, 1
jmp 0x180039fb8
mov rcx, qword [0x180082d08]
lea r8, [rbp + 0x170]
mov r9d, 0x30
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, dword [rbp + 0x194]
mov dword [rsp + 0x44], r9d
bts r9d, 8
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x44]
mov rcx, qword [0x180082d08]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call fcn.180038640
cmp dword [0x180081320], 0x80010001
jne 0x18003b062
mov rax, qword [0x180081328]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18003b02c
jmp 0x18003b017
mov rdi, qword [0x1800909e0]
xor esi, esi
mov r10, qword [0x1800909d8]
movabs rax, 0x82fa0be82fa0be83
sub rdi, r10
mov edx, esi
imul rdi, rax
movsxd r8, edi
test edi, edi
jle 0x18003a074
mov r9, qword [0x180082b90]
lea rcx, [r10 + 0x13]
nop word [rax + rax]
cmp rdi, rdx
jbe 0x18003b43d
mov rax, r9
sub rax, qword [rcx - 0xa]
inc rax
cmp qword [rcx - 0x12], rax
jne 0x18003a068
cmp dword [rcx], 1
ja 0x18003a068
cmp byte [rcx - 0x13], 1
je 0x18003a168
inc rdx
add rcx, 0x2b
cmp rdx, r8
jl 0x18003a040
cmp byte [0x180082abd], sil
jne 0x18003a3cb
cmp byte [rsp + 0x53], sil
je 0x18003a3cb
cmp byte [0x180082c9b], sil
mov byte [rsp + 0x53], sil
mov dword [0x180081320], r11d
je 0x18003a0b2
mov rcx, qword [0x180082d08]
mov r8b, 1
xor edx, edx
call fcn.18000b120
mov r8, qword [0x180082c68]
mov ebx, 1
test r8, r8
je 0x18003a0d1
mov rcx, qword [rbp + 0x90]
mov edx, ebx
call sym.TitanEngine.dll_SetBPX
cmp byte [0x180084338], sil
je 0x18003a145
mov rax, qword [0x1800909f8]
mov edi, esi
mov r9, qword [0x1800909f0]
sub rax, r9
sar rax, 3
test rax, rax
je 0x18003a132
mov rcx, rsi
cmp rax, rcx
jbe 0x18003b443
mov r8, qword [0x180084548]
mov edx, ebx
mov rcx, qword [r9 + rcx*8]
call sym.TitanEngine.dll_SetBPX
mov rax, qword [0x1800909f8]
inc edi
mov r9, qword [0x1800909f0]
sub rax, r9
mov ecx, edi
sar rax, 3
cmp rax, rcx
ja 0x18003a102
call fcn.1800059a0
mov qword [0x180084548], rsi
mov byte [0x180084338], sil
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0xa8]
test rdx, rdx
je 0x18003b020
lea rcx, [0x180082b70]
jmp 0x18003b01e
imul rcx, rdx, 0x2b
mov r9d, 0x40
movups xmm0, xmmword [rcx + r10]
movups xmmword [rbp + 0x1a0], xmm0
mov rdx, qword [rbp + 0x1a1]
movups xmm1, xmmword [rcx + r10 + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov r8, qword [rbp + 0x1a9]
movsd xmm0, qword [rcx + r10 + 0x20]
movsd qword [rbp + 0x1c0], xmm0
movzx eax, word [rcx + r10 + 0x28]
mov word [rbp + 0x1c8], ax
movzx eax, byte [rcx + r10 + 0x2a]
mov rcx, qword [0x180082d08]
mov byte [rbp + 0x1ca], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9, qword [rbp + 0x1a9]
lea rax, [rbp + 0x88]
mov rdx, qword [rbp + 0x1a1]
lea r8, [rbp + 0x1b1]
mov rcx, qword [0x180082d08]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x180082d08]
test eax, eax
je 0x18003a3a3
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, dword [0x180082b78]
xor edx, edx
mov eax, 0x10002
mov dword [0x180081320], eax
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0x1540]
mov dword [rbp + 0x1570], ecx
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp dword [rbp + 0x1b3], 1
je 0x18003a272
or dword [rbp + 0x1584], 0x100
mov r12b, 1
mov rcx, qword [rbp + 0x1a9]
lea rdx, [rbp + 0x1540]
sub qword [rbp + 0x1638], rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003a2b0
test byte [rbp + 0x50], 2
jne 0x18003a2b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0x44]
lea rax, [rsp + 0x44]
mov r8, qword [rbp + 0x1a9]
mov rdx, qword [rbp + 0x1a1]
mov rcx, qword [0x180082d08]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdi, qword [rbp + 0x1a1]
lea r8, [rbp + 0x2fe0]
mov rcx, qword [0x180082d08]
mov rdx, rdi
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rbp + 0x2fe0]
mov rcx, rdi
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, [0x18006de04]
mov rcx, rax
call fcn.18004ad74
movzx ecx, byte [rsp + 0x58]
test rax, rax
mov eax, 1
cmovne ecx, eax
mov byte [rsp + 0x58], cl
cmp dword [rbp + 0x1b3], eax
jne 0x18003a360
mov rcx, qword [rbp + 0x1a1]
call sym.TitanEngine.dll_DeleteBPX
mov rax, qword [rbp + 0x1a9]
dec rax
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x68], rax
mov byte [rsp + 0x41], sil
call qword [rbp + 0x1bf]
cmp dword [rbp + 0x1b3], 1
je 0x18003b020
mov rcx, qword [rbp + 0x1a1]
call sym.TitanEngine.dll_DisableBPX
mov rax, qword [rbp + 0x1a9]
dec rax
mov byte [rsp + 0x41], 1
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x1a1]
mov qword [rsp + 0x70], rax
jmp 0x18003b020
mov r9d, dword [rsp + 0x44]
lea rax, [rsp + 0x44]
mov r8, qword [rbp + 0x1a9]
mov rdx, qword [rbp + 0x1a1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x18003b020
mov rax, qword [0x180081328]
mov dword [0x180081320], 0x80010001
mov rdx, qword [rax]
test rdx, rdx
je 0x18003b02c
jmp 0x18003b017
mov r8, qword [0x1800909e0]
xor esi, esi
mov r10, qword [0x1800909d8]
movabs rax, 0x82fa0be82fa0be83
sub r8, r10
xor r11b, r11b
imul r8, rax
mov edi, esi
movsxd r9, r8d
test r8d, r8d
jle 0x18003a491
mov r14, qword [0x180082ba8]
lea rdx, [r10 + 0x13]
mov qword [rbp + 0x98], r14
nop dword [rax]
cmp r8, rdi
jbe 0x18003b449
mov rcx, qword [rdx - 0x12]
cmp r14, rcx
jb 0x18003a45b
add rcx, qword [rdx - 0xa]
cmp r14, rcx
jae 0x18003a45b
mov eax, dword [rdx]
sub eax, 3
cmp eax, 3
ja 0x18003a45b
cmp byte [rdx - 0x13], 1
je 0x18003a469
inc rdi
add rdx, 0x2b
cmp rdi, r9
jl 0x18003a430
jmp 0x18003a498
imul rcx, rdi, 0x2b
mov r11b, 1
movups xmm0, xmmword [rcx + r10]
movups xmm1, xmmword [rcx + r10 + 0x10]
movups xmmword [rbp - 0x10], xmm0
movsd xmm0, qword [rcx + r10 + 0x20]
movsd qword [rbp + 0x10], xmm0
movups xmmword [rbp], xmm1
jmp 0x18003a498
mov r14, qword [rbp + 0x98]
test r11b, r11b
je 0x18003a71c
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0x6d0]
mov dword [rbp + 0x700], ecx
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [rbp + 3]
mov eax, 0x10002
mov dword [0x180081320], eax
cmp ecx, 3
jne 0x18003a546
cmp dword [rbp + 0xb], 1
je 0x18003a503
mov rdx, qword [rbp - 7]
mov rcx, qword [rbp - 0xf]
call sym.TitanEngine.dll_RemoveMemoryBPX
mov rcx, r14
call qword [rbp + 0xf]
jmp 0x18003a6f8
or dword [rbp + 0x714], 0x100
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rdx, qword [rbp - 0xf]
mov rcx, r14
mov rax, qword [rbp - 7]
movzx r15d, r12b
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x40], r12b
call qword [rbp + 0xf]
jmp 0x18003a6f8
cmp ecx, 4
jne 0x18003a5bc
cmp dword [rbp + 0xb], 1
mov rdi, qword [rbp - 7]
mov rbx, qword [rbp - 0xf]
je 0x18003a57f
cmp qword [0x180082ba0], 0
jne 0x18003a6c8
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
cmp qword [0x180082ba0], 0
jmp 0x18003a6be
or dword [rbp + 0x714], 0x100
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp qword [0x180082ba0], 0
movzx r15d, r12b
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x40], r12b
jmp 0x18003a6be
cmp ecx, 5
jne 0x18003a632
cmp dword [rbp + 0xb], 1
mov rdi, qword [rbp - 7]
mov rbx, qword [rbp - 0xf]
je 0x18003a5f5
cmp qword [0x180082ba0], 1
jne 0x18003a6c8
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
cmp qword [0x180082ba0], 1
jmp 0x18003a6be
or dword [rbp + 0x714], 0x100
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp qword [0x180082ba0], 1
movzx r15d, r12b
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x40], r12b
jmp 0x18003a6be
cmp ecx, 6
jne 0x18003a6f8
cmp dword [rbp + 0xb], 1
mov rdi, qword [rbp - 7]
mov rbx, qword [rbp - 0xf]
je 0x18003a673
test qword [0x180082ba0], 0xfffffffffffffff7
jne 0x18003a6c8
mov rax, qword [0x180082ba8]
cmp qword [0x180082b90], rax
jne 0x18003a6a3
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
jmp 0x18003a6a3
or dword [rbp + 0x714], 0x100
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov qword [rsp + 0x48], rbx
movzx r15d, r12b
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x40], r12b
test qword [0x180082ba0], 0xfffffffffffffff7
jne 0x18003a6c8
mov rax, qword [0x180082ba8]
cmp qword [0x180082b90], rax
jne 0x18003a6c8
mov rcx, r14
call qword [rbp + 0xf]
jmp 0x18003a6f8
or dword [rbp + 0x714], 0x100
lea rdx, [rbp + 0x6d0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov qword [rsp + 0x48], rbx
movzx r15d, r12b
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x40], r12b
lea rdx, [rbp + 0x54]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003a718
test byte [rbp + 0x54], 2
jne 0x18003a718
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x18003a726
mov dword [0x180081320], 0x80010001
test r15b, r15b
je 0x18003a813
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x18003a75b
mov rbx, rsi
jmp 0x18003a7a0
xor edx, edx
lea rcx, [rbp + 0x2320]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rbp + 0x2320]
mov rcx, rdi
call fcn.1800064e0
mov rcx, rdi
test al, al
jne 0x18003a793
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, rsi
jmp 0x18003a7a0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rbp + 0x23a0]
lea rdx, [rbp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003a7c0
test byte [rbp + 0x58], 2
jne 0x18003a7c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rbp + 0x2ff0]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rbp + 0x2ff0]
mov rcx, rbx
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, [0x18006de14]
mov rcx, rax
call fcn.18004ad74
movzx ecx, byte [rsp + 0x58]
test rax, rax
mov eax, 1
cmovne ecx, eax
mov byte [rsp + 0x58], cl
cmp dword [0x180081320], 0x80010001
jne 0x18003b062
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x58]
test rdx, rdx
je 0x18003b02c
jmp 0x18003b017
mov r8, qword [0x1800909e0]
xor esi, esi
mov r10, qword [0x1800909d8]
movabs rax, 0x82fa0be82fa0be83
sub r8, r10
xor r15b, r15b
imul r8, rax
mov edi, esi
movsxd r9, r8d
test r8d, r8d
jle 0x18003a8ac
mov r14, qword [0x180082ba8]
lea rdx, [r10 + 0x13]
cmp r8, rdi
jbe 0x18003b449
mov rcx, qword [rdx - 0x12]
cmp r14, rcx
jb 0x18003a8a0
add rcx, qword [rdx - 0xa]
cmp r14, rcx
jae 0x18003a8a0
mov eax, dword [rdx]
sub eax, 3
cmp eax, 3
ja 0x18003a8a0
cmp byte [rdx - 0x13], 1
je 0x18003a8f8
inc rdi
add rdx, 0x2b
cmp rdi, r9
jl 0x18003a875
mov dword [0x180081320], 0x80010001
movzx r15d, byte [rsp + 0x40]
test r15b, r15b
je 0x18003acd5
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x18003ac1d
mov rbx, rsi
jmp 0x18003ac62
imul rcx, rdi, 0x2b
cmp byte [0x180082abf], sil
movups xmm0, xmmword [rcx + r10]
movzx eax, word [rcx + r10 + 0x28]
movups xmm1, xmmword [rcx + r10 + 0x10]
mov word [rbp + 0x48], ax
movzx eax, byte [rcx + r10 + 0x2a]
movups xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x4a], al
movsd xmm0, qword [rcx + r10 + 0x20]
movsd qword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x30], xmm1
je 0x18003a8ac
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0xba0]
mov dword [rbp + 0xbd0], ecx
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [rbp + 0x33]
mov eax, 0x10002
mov dword [0x180081320], eax
cmp ecx, 3
jne 0x18003a9e4
cmp dword [rbp + 0x3b], 1
je 0x18003a9a4
mov rdx, qword [rbp + 0x29]
mov rcx, qword [rbp + 0x21]
call sym.TitanEngine.dll_RemoveMemoryBPX
mov rdx, qword [rsp + 0x48]
mov r15b, 1
movzx ecx, byte [rsp + 0x40]
jmp 0x18003abc4
or dword [rbp + 0xbe4], 0x100
lea rdx, [rbp + 0xba0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rdx, qword [rbp + 0x21]
movzx ecx, r12b
mov rax, qword [rbp + 0x29]
movzx r15d, r12b
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x40], cl
jmp 0x18003abc4
cmp ecx, 4
jne 0x18003aa97
cmp dword [rbp + 0x3b], 1
mov rdi, qword [rbp + 0x29]
mov rbx, qword [rbp + 0x21]
je 0x18003aa1c
cmp qword [0x180082ba0], 0
jne 0x18003aa60
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rsp + 0x40]
jmp 0x18003aa4e
or dword [rbp + 0xbe4], 0x100
lea rdx, [rbp + 0xba0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx ecx, r12b
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x40], cl
mov rdx, rbx
mov qword [rsp + 0x60], rdi
cmp qword [0x180082ba0], 0
jne 0x18003aa60
mov r15b, 1
jmp 0x18003abc4
or dword [rbp + 0xbe4], 0x100
lea rdx, [rbp + 0xba0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rax, rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rax
mov rdx, rbx
mov byte [rsp + 0x40], r12b
jmp 0x18003abcd
cmp ecx, 5
jne 0x18003ab13
cmp dword [rbp + 0x3b], 1
mov rdi, qword [rbp + 0x29]
mov rbx, qword [rbp + 0x21]
je 0x18003aacb
cmp qword [0x180082ba0], 1
jne 0x18003aa60
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rsp + 0x40]
jmp 0x18003aafd
or dword [rbp + 0xbe4], 0x100
lea rdx, [rbp + 0xba0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx ecx, r12b
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x40], cl
mov rdx, rbx
mov qword [rsp + 0x60], rdi
cmp qword [0x180082ba0], 1
jne 0x18003aa60
mov r15b, 1
jmp 0x18003abc4
cmp ecx, 6
jne 0x18003abba
cmp dword [rbp + 0x3b], 1
mov rdi, qword [rbp + 0x29]
mov rbx, qword [rbp + 0x21]
je 0x18003ab86
test qword [0x180082ba0], 0xfffffffffffffff7
jne 0x18003ab52
mov rax, qword [0x180082ba8]
cmp qword [0x180082b90], rax
jne 0x18003ab52
mov rdx, rdi
mov rcx, rbx
call sym.TitanEngine.dll_RemoveMemoryBPX
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rsp + 0x40]
test qword [0x180082ba0], 0xfffffffffffffff7
jne 0x18003aa60
mov rax, qword [0x180082ba8]
cmp qword [0x180082b90], rax
jne 0x18003aa60
mov r15b, 1
jmp 0x18003abc4
or dword [rbp + 0xbe4], 0x100
lea rdx, [rbp + 0xba0]
mov rcx, rsi
mov r12b, 1
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx ecx, r12b
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x40], cl
mov rdx, rbx
mov qword [rsp + 0x60], rdi
jmp 0x18003ab5c
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rsp + 0x40]
test cl, cl
je 0x18003abeb
mov rax, qword [rsp + 0x60]
mov r9d, dword [rbp + 0x47]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
mov r8, rax
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test r15b, r15b
je 0x18003abf6
mov rcx, r14
call qword [rbp + 0x3f]
lea rdx, [rbp + 0x5c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003ac16
test byte [rbp + 0x5c], 2
jne 0x18003ac16
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x18003a8b6
xor edx, edx
lea rcx, [rbp + 0x2760]
mov r8d, 0x440
call fcn.18004c900
xor r8d, r8d
lea rdx, [rbp + 0x2760]
mov rcx, rdi
call fcn.1800064e0
mov rcx, rdi
test al, al
jne 0x18003ac55
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, rsi
jmp 0x18003ac62
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rbp + 0x27e0]
lea rdx, [rbp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003ac82
test byte [rbp + 0x60], 2
jne 0x18003ac82
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180082d08]
lea r8, [rbp + 0x3000]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call sym.TitanEngine.dll_MemoryReadSafe
lea rdx, [rbp + 0x3000]
mov rcx, rbx
call sym.TitanEngine.dll_StaticDisassembleEx
lea rdx, str.PUSHF
mov rcx, rax
call fcn.18004ad74
movzx ecx, byte [rsp + 0x58]
test rax, rax
mov eax, 1
cmovne ecx, eax
mov byte [rsp + 0x58], cl
cmp dword [0x180081320], 0x80010001
jne 0x18003b062
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x18003b02c
jmp 0x18003b017
cmp eax, 0xc000001d
je 0x18003ad20
cmp eax, 0xc0000025
jne 0x18003b020
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x20]
jmp 0x18003b012
mov rdx, qword [0x1800909e0]
xor esi, esi
mov r9, qword [0x1800909d8]
movabs rax, 0x82fa0be82fa0be83
sub rdx, r9
mov ecx, esi
imul rdx, rax
movsxd rdi, edx
test edx, edx
jle 0x18003ad7b
mov r8, qword [0x180082b90]
lea rax, [r9 + 0x13]
cmp rdx, rcx
jbe 0x18003b413
cmp qword [rax - 0x12], r8
jne 0x18003ad6f
cmp dword [rax], 1
ja 0x18003ad6f
cmp byte [rax - 0x13], 1
je 0x18003ad9e
inc rcx
add rax, 0x2b
cmp rcx, rdi
jl 0x18003ad55
mov dword [0x180081320], 0x80010001
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x18003b02c
jmp 0x18003b017
imul rcx, rcx, 0x2b
movups xmm0, xmmword [rcx + r9]
movups xmmword [rbp + 0x1d0], xmm0
mov rdx, qword [rbp + 0x1d1]
movups xmm1, xmmword [rcx + r9 + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov r8, qword [rbp + 0x1d9]
movsd xmm0, qword [rcx + r9 + 0x20]
movsd qword [rbp + 0x1f0], xmm0
movzx eax, word [rcx + r9 + 0x28]
mov word [rbp + 0x1f8], ax
movzx eax, byte [rcx + r9 + 0x2a]
mov r9d, 0x40
mov rcx, qword [0x180082d08]
mov byte [rbp + 0x1fa], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9, qword [rbp + 0x1d9]
lea rax, [rbp + 0x88]
mov rdx, qword [rbp + 0x1d1]
lea r8, [rbp + 0x1e1]
mov rcx, qword [0x180082d08]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x180082d08]
test eax, eax
je 0x18003af6b
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, dword [0x180082b78]
xor edx, edx
mov eax, 0x10002
mov dword [0x180081320], eax
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x180090a20]
lea rdx, [rbp + 0x1070]
mov dword [rbp + 0x10a0], ecx
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp dword [rbp + 0x1e3], 1
je 0x18003aea8
or dword [rbp + 0x10b4], 0x100
mov r12b, 1
lea rdx, [rbp + 0x1070]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
lea rdx, [rbp + 0x64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003aed8
test byte [rbp + 0x64], 2
jne 0x18003aed8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0x44]
lea rax, [rsp + 0x44]
mov r8, qword [rbp + 0x1d9]
mov rdx, qword [rbp + 0x1d1]
mov rcx, qword [0x180082d08]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [rbp + 0x1e3], 1
jne 0x18003af2f
mov rcx, qword [rbp + 0x1d1]
call sym.TitanEngine.dll_DeleteBPX
mov rax, qword [rbp + 0x1d9]
dec rax
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x68], rax
mov byte [rsp + 0x41], sil
call qword [rbp + 0x1ef]
cmp dword [rbp + 0x1e3], 1
je 0x18003af8e
mov rcx, qword [rbp + 0x1d1]
call sym.TitanEngine.dll_DisableBPX
mov rax, qword [rbp + 0x1d9]
dec rax
mov byte [rsp + 0x41], 1
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x1d1]
mov qword [rsp + 0x70], rax
jmp 0x18003af8e
mov r9d, dword [rsp + 0x44]
lea rax, [rsp + 0x44]
mov r8, qword [rbp + 0x1d9]
mov rdx, qword [rbp + 0x1d1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [0x180081320], 0x80010001
je 0x18003ad85
jmp 0x18003b062
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x28]
jmp 0x18003b012
cmp eax, 0xc000008d
je 0x18003b007
cmp eax, 0xc000008e
je 0x18003affa
cmp eax, 0xc0000094
je 0x18003afed
cmp eax, 0xc0000095
je 0x18003afe0
cmp eax, 0xc0000096
jne 0x18003b020
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x50]
jmp 0x18003b012
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x48]
jmp 0x18003b012
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x40]
jmp 0x18003b012
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x38]
jmp 0x18003b012
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x18003b020
lea rcx, [0x180082b80]
call rdx
cmp dword [0x180081320], 0x80010001
jne 0x18003b062
cmp byte [0x180081326], 0
je 0x18003b046
mov edx, 4
lea rcx, [0x180082b70]
call fcn.1800097e0
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0xb0]
test rdx, rdx
je 0x18003b062
lea rcx, [0x180082b80]
call rdx
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0xa0]
test rdx, rdx
je 0x180039598
lea rcx, [0x180082b80]
call rdx
mov ebx, dword [rsp + 0x54]
jmp case.default.0x180038a21
cmp byte [0x180081326], r12b
mov dword [0x180081320], 0x80010001
je 0x18003b0ac
mov edx, 4
lea rcx, [0x180082b70]
call fcn.1800097e0
mov rax, qword [0x180081328]
mov rdx, qword [rax + 0xb8]
test rdx, rdx
je case.default.0x180038a21
lea rcx, [0x180082b70]
call rdx
test bl, bl
je 0x18003b21e
cmp dword [0x180082b70], 4
je 0x18003b21e
mov r8d, dword [0x180082b78]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0xa0], rax
mov r15, rax
test rax, rax
je 0x18003b218
test r12b, r12b
je 0x18003b1f8
mov r14, qword [0x180090a90]
mov rbx, qword [0x180090a88]
mov r13d, dword [0x180082b78]
cmp rbx, r14
je 0x18003b1f4
mov r15d, 0xffffffff
nop
mov edi, dword [rbx + 8]
cmp r13d, edi
je 0x18003b1e0
movabs r8, 0x100000001b3
mov eax, edi
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, dil
xor rax, rcx
imul rax, r8
xor rdx, rax
mov eax, edi
imul rdx, r8
shr eax, 0x10
movzx ecx, al
mov eax, edi
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [rbp - 0x20]
imul rdx, r8
xor rdx, rax
imul rdx, r8
and rcx, rdx
mov rdx, qword [rbp - 0x38]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rbp - 0x48]
je 0x18003b1bb
mov rcx, qword [rdx + rcx*8]
cmp edi, dword [rax + 0x10]
je 0x18003b1b6
cmp rax, rcx
je 0x18003b1bb
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x18003b1a8
test rax, rax
jne 0x18003b1e0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, r15d
je 0x18003b1e0
mov r9, rbx
lea r8, [rbx + 8]
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x50]
call fcn.18003b840
add rbx, 0x3c
cmp rbx, r14
jne 0x18003b130
mov r15, qword [rbp + 0xa0]
mov ebx, dword [rsp + 0x54]
lea rdx, [rbp + 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18003b218
test byte [rbp + 0x68], 2
jne 0x18003b218
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r15d, byte [rsp + 0x40]
mov r14, qword [rsp + 0x48]
lea rdi, [0x180082ac0]
cmp byte [0x180082c9d], 0
je 0x18003b241
call sym.TitanEngine.dll_ThreaderIsAnyThreadActive
test al, al
jne 0x18003b241
call sym.TitanEngine.dll_ThreaderResumeProcess
mov r8d, dword [0x180081320]
mov edx, dword [0x180082b78]
mov ecx, dword [0x180082b74]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
test eax, eax
je 0x18003b2c4
cmp byte [0x180082692], 0
jne 0x18003b2b1
mov edx, dword [0x180082b78]
xor ecx, ecx
call sym.TitanEngine.dll_ThreaderGetThreadInfo
mov ecx, dword [0x180082b78]
test rax, rax
movzx esi, byte [rsp + 0x42]
cmove ecx, dword [0x180082d1c]
mov dword [0x180082b78], ecx
cmp byte [rsp + 0x6c], 0
je 0x1800388a0
jmp 0x18003b2c4
mov ecx, dword [0x180082d18]
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov byte [0x180082abd], r12b
jmp 0x18003b2c4
mov ecx, dword [0x180082d18]
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov byte [0x180082abd], 0
lea rax, [0x180082b70]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdi + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdi + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdi + 0x60], xmm0
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdi + 0x70], xmm1
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdi + 0x80], xmm0
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdi + 0x90], xmm1
movups xmmword [rdi + 0xa0], xmm0
call sym.TitanEngine.dll_ForceClose
cmp byte [0x180081326], 0
mov byte [0x180082691], 0
je 0x18003b359
mov edx, 3
lea rcx, [0x180082b70]
call fcn.1800097e0
cmp byte [0x180081324], 0
je 0x18003b376
xor edx, edx
lea rcx, [0x180082d20]
mov r8d, 0xc8
call fcn.18004c900
mov rcx, qword [0x1800909d8]
xorps xmm0, xmm0
mov rax, qword [0x1800909e8]
mov qword [0x1800909e8], 0
movdqu xmmword [0x1800909d8], xmm0
test rcx, rcx
je 0x18003b3da
sub rax, rcx
movabs rdx, 0x82fa0be82fa0be83
imul rax, rdx
imul rdx, rax, 0x2b
cmp rdx, 0x1000
jb 0x18003b3d5
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003b419
mov rcx, rdi
call fcn.180049e70
lea rcx, [rbp - 0x50]
call fcn.18003b480
mov rcx, qword [rbp + 0x3530]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x3640]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180005850
int3
call fcn.1800503fc
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3
call fcn.180005850
int3