Function at 0x180027e30
Capabilities:
Get file size
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x48], rdx
mov rbx, rcx
test r8, r8
je 0x180029b32
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0xc8], r8
mov byte [rsp + 0x42], r14b
mov r12b, 1
mov dword [rsp + 0x70], r12d
lea r15d, [r14 + 1]
test rdx, rdx
jne 0x180027ea9
lea rdi, [r11 - 0x60]
mov qword [rsp + 0x48], rdi
lea r8, [r11 - 0x60]
mov edx, r15d
call sym.TitanEngine.dll_IsPE32FileValidExW
movzx eax, byte [rsi + 2]
test al, al
jne 0x180029858
cmp byte [rdi], 0xb
jne 0x180029850
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0xe0000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x180029b32
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x180029b10
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x180029b10
mov qword [rsp + 0xd0], rax
mov byte [rsi], 0xc
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rbx
call fcn.180007830
test al, al
je 0x180029839
movsxd rbx, dword [r13 + 0x3c]
add rbx, r13
mov ecx, dword [rbx]
cmp ecx, 0x4550
jne 0x180027fd4
mov eax, 0x10b
cmp word [rbx + 0x18], ax
jne 0x180027fb6
mov r15d, r14d
jmp 0x180027fc9
cmp ecx, 0x4550
jne 0x180027fd4
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x180027fd4
mov r10, qword [rsp + 0x48]
cmp byte [r10 + 7], r14b
je 0x180027fed
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
jmp 0x180029b32
cmp byte [r10 + 8], r14b
jne 0x180027fd4
cmp byte [r10 + 0xd], r14b
jne 0x180027fd4
cmp byte [r10 + 0xc], r14b
jne 0x180027fd4
cmp byte [r10 + 0x10], r14b
jne 0x180027fd4
cmp byte [r10 + 0x12], r14b
jne 0x180027fd4
test r15d, r15d
jne 0x180028c0a
mov r15d, dword [rbx + 0x50]
mov r8d, dword [rbx + 0x38]
xor edx, edx
mov eax, r15d
div r8d
mov r9d, edx
xor edx, edx
mov eax, r15d
div r8d
mov ecx, r8d
sub ecx, edx
add ecx, r15d
xor edx, edx
mov eax, r15d
div r8d
sub r15d, edx
test r9d, r9d
cmovne r15d, ecx
mov dword [rsp + 0x64], r15d
cmp byte [r10 + 6], 0
je 0x180028351
mov r9d, dword [rbx + 0x80]
add r9d, dword [rbx + 0x34]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
mov edx, dword [rbx + 0x80]
add edx, dword [rbx + 0x34]
mov rcx, r13
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
test eax, eax
js 0x180028351
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0xa0000060
jne 0x1800280e5
mov r9d, 0xe0000020
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_SetPE32DataForMappedFile
test al, al
jne 0x1800280e5
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
xor al, al
jmp 0x180029b34
mov eax, dword [rbx + 0x80]
test eax, eax
je 0x180028351
mov r8d, dword [rbx + 0x34]
lea r9d, [r8 + rax]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r15, rax
mov qword [rsp + 0x90], rax
nop word [rax + rax]
cmp dword [r15 + 0x10], 0
je 0x180028347
mov r12, r14
mov qword [rsp + 0x98], r14
mov r8d, dword [rbx + 0x34]
mov r9d, dword [r15 + 0xc]
add r9, r8
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r12b
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
test rax, rax
je 0x1800281be
mov rcx, rax
call fcn.180006e50
test al, al
jne 0x180028175
xor cl, cl
mov byte [rsp + 0x42], cl
mov byte [rsp + 0x50], cl
jmp 0x1800281be
xor al, al
mov byte [rsp + 0x42], al
mov byte [rsp + 0x50], al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x1800281be
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
call fcn.180007c70
mov r12, rax
mov qword [rsp + 0x98], rax
mov al, 1
mov byte [rsp + 0x42], al
mov byte [rsp + 0x50], al
mov eax, dword [r15]
mov r8d, dword [rbx + 0x34]
mov byte [rsp + 0x28], 1
mov edx, dword [rsp + 0x44]
mov rcx, r13
mov byte [rsp + 0x20], 0
test eax, eax
je 0x1800281f0
lea r9, [r8 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0xb8], rax
mov r13d, dword [r15]
jmp 0x180028208
mov r9d, dword [r15 + 0x10]
add r9, r8
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0xb8], rax
mov r13d, dword [r15 + 0x10]
mov qword [rsp + 0xa0], r13
mov rdi, rax
test rax, rax
je 0x180028312
nop dword [rax]
mov eax, dword [rdi]
test eax, eax
je 0x18002830a
jns 0x18002825c
xor eax, 0x80000000
cmp eax, 0x10000
jl 0x180028242
xor al, al
mov byte [rsp + 0x41], al
mov dword [rsp + 0x70], eax
add r13, 4
mov qword [rsp + 0xa0], r13
add rdi, 4
mov qword [rsp + 0xb8], rdi
jmp 0x180028220
mov r8d, dword [rbx + 0x34]
lea r9, [r8 + 2]
add r9, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0xa8]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r15, rax
test rax, rax
je 0x180028242
mov edx, 8
mov rcx, rax
call fcn.180007700
test al, al
je 0x180028242
test r12, r12
je 0x180028242
mov rdx, r15
mov rcx, r12
call fcn.1800082b0
test rax, rax
jne 0x180028242
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x84], r14d
lea r8, [rsp + 0x84]
lea rdx, [rsp + 0x80]
mov rcx, r12
call fcn.1800083a0
test al, al
je 0x180028242
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x180028238
cmp dword [rsp + 0x84], 0
je 0x180028238
inc eax
btc eax, 0x1f
mov dword [rdi], eax
jmp 0x180028242
mov r15, qword [rsp + 0x90]
cmp byte [rsp + 0x42], 0
je 0x18002832a
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add r15, 0x14
mov qword [rsp + 0x90], r15
mov r13, qword [rsp + 0xa8]
mov edi, dword [rsp + 0x44]
jmp 0x180028120
mov r12d, dword [rsp + 0x70]
mov r15d, dword [rsp + 0x64]
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 0xe]
cmp al, 8
jne 0x18002836b
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x180028449
cmp byte [rsi + 0xe], 0
jne 0x180028449
test al, al
je 0x180028449
cmp al, 7
je 0x180028449
cmp dword [rbx + 0x74], 0
jbe 0x180028449
mov edx, dword [rbx + 0x78]
test edx, edx
je 0x180028449
cmp edx, r15d
ja 0x18002848a
mov ecx, dword [rbx + 0x7c]
add ecx, edx
cmp ecx, r15d
ja 0x18002848a
mov byte [rsp + 0x40], 1
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180028445
mov edx, dword [rbx + 0x7c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180028474
mov ecx, dword [rdi + 0x1c]
cmp ecx, r15d
ja 0x18002846f
mov eax, dword [rdi + 0x14]
lea ecx, [rcx + rax*4]
cmp ecx, r15d
ja 0x18002846f
mov ecx, dword [rdi + 0x24]
cmp ecx, r15d
ja 0x18002846f
mov eax, dword [rdi + 0x18]
lea edx, [rax*4]
lea eax, [rdx + rcx]
cmp eax, r15d
ja 0x18002846f
mov eax, dword [rdi + 0x20]
cmp eax, r15d
ja 0x18002846f
add eax, edx
cmp eax, r15d
ja 0x18002846f
movzx eax, byte [rsp + 0x40]
cmp dword [rdi + 0xc], r15d
cmova eax, r14d
mov byte [rsp + 0x40], al
test al, al
je 0x180028474
mov edi, dword [rsp + 0x44]
mov rax, qword [rsp + 0x48]
movzx r8d, byte [rax + 3]
cmp r8b, 1
jne 0x1800284a0
cmp byte [rax + 0xf], r8b
jne 0x1800284a0
xor r12b, r12b
mov byte [rsp + 0x41], r12b
mov rdx, rax
jmp 0x1800285cb
mov byte [rsp + 0x40], 0
mov byte [rsi + 0xd], 1
mov eax, dword [rbx + 0x78]
mov dword [rsi + 0xf], eax
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x13], eax
mov qword [rbx + 0x78], r14
jmp 0x180028445
mov byte [rsi + 0xd], 1
mov eax, dword [rbx + 0x78]
mov dword [rsi + 0xf], eax
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x13], eax
mov qword [rbx + 0x78], r14
jmp 0x180028449
cmp byte [rsi + 4], 0
jne 0x18002869c
cmp byte [rax + 0xf], 0
je 0x18002869c
mov edx, dword [rbx + 0xa0]
cmp edx, r15d
ja 0x180028597
mov ecx, dword [rbx + 0xa4]
add ecx, edx
cmp ecx, r15d
ja 0x180028597
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180028563
mov edx, dword [rbx + 0xa4]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180028563
mov eax, dword [rdi]
mov dword [rsp + 0x60], eax
mov edx, dword [rdi + 4]
mov ecx, 0xcfff
nop
test eax, eax
je 0x1800285c6
lea eax, [rdx - 8]
mov dword [rsp + 0x60], eax
add rdi, 8
mov qword [rsp + 0x58], rdi
test eax, eax
je 0x180028558
cmp word [rdi], cx
jbe 0x180028546
xor edx, edx
mov word [rdi], dx
add rdi, 2
mov qword [rsp + 0x58], rdi
add eax, 0xfffffffe
mov dword [rsp + 0x60], eax
jmp 0x180028538
mov eax, dword [rdi]
mov dword [rsp + 0x60], eax
mov edx, dword [rdi + 4]
jmp 0x180028520
mov rdx, qword [rsp + 0x48]
cmp byte [rdx + 3], 0
je 0x180028578
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x1800285cb
mov byte [rsi + 3], 1
mov eax, dword [rbx + 0xa0]
mov dword [rsi + 5], eax
mov eax, dword [rbx + 0xa4]
mov dword [rsi + 9], eax
mov qword [rbx + 0xa0], r14
jmp 0x1800285cb
test r8b, r8b
je 0x1800285a9
xor r12b, r12b
mov byte [rsp + 0x41], r12b
mov rdx, rax
jmp 0x1800285cb
mov byte [rsi + 3], 1
mov eax, dword [rbx + 0xa0]
mov dword [rsi + 5], eax
mov eax, dword [rbx + 0xa4]
mov dword [rsi + 9], eax
mov qword [rbx + 0xa0], r14
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rsi + 0x18]
test cl, cl
jne 0x1800286d2
movzx eax, byte [rdx + 0x19]
test al, al
je 0x1800285e7
cmp al, 7
jne 0x1800286b5
test cl, cl
jne 0x1800286d2
movzx eax, byte [rdx + 0x18]
test al, al
je 0x1800286d2
cmp al, 7
je 0x1800286d2
cmp dword [rbx + 0x74], 2
jbe 0x1800286d2
mov edx, dword [rbx + 0x88]
test edx, edx
je 0x1800286d2
cmp edx, r15d
ja 0x1800286b5
mov ecx, dword [rbx + 0x8c]
add ecx, edx
cmp ecx, r15d
ja 0x1800286b5
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edi, dword [rsp + 0x44]
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002867d
mov rcx, rax
sub rcx, r13
cmp rcx, rdi
ja 0x18002867d
mov ecx, dword [rbx + 0x8c]
sub rcx, r13
add rcx, rax
cmp rcx, rdi
jbe 0x1800286d6
mov byte [rsi + 0x17], 1
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x19], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsi + 0x1d], eax
mov qword [rbx + 0x88], r14
jmp 0x1800286d6
movzx r12d, r12b
cmp byte [rax + 0xf], 0
cmovne r12d, r14d
mov byte [rsp + 0x41], r12b
mov rdx, rax
jmp 0x1800285cb
mov byte [rsi + 0x17], 1
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x19], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsi + 0x1d], eax
mov qword [rbx + 0x88], r14
mov edi, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x22], 0
jne 0x1800287e9
movzx eax, byte [rdx + 0x14]
test al, al
je 0x1800287e9
cmp al, 7
je 0x1800287e9
cmp dword [rbx + 0x74], 9
jbe 0x1800287e9
mov edx, dword [rbx + 0xc0]
test edx, edx
je 0x1800287e4
cmp edx, r15d
ja 0x1800287c7
mov ecx, dword [rbx + 0xc4]
add ecx, edx
cmp ecx, r15d
ja 0x1800287c7
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800287c7
mov rdx, rax
sub rdx, r13
mov ecx, edi
cmp rdx, rcx
ja 0x1800287c7
mov byte [rsp + 0x40], 1
mov ecx, dword [rax]
test ecx, ecx
je 0x18002877c
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800287c2
add eax, r15d
cmp ecx, eax
ja 0x1800287c2
mov ecx, dword [r8 + 4]
test ecx, ecx
je 0x180028792
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800287c2
add eax, r15d
cmp ecx, eax
ja 0x1800287c2
mov ecx, dword [r8 + 8]
test ecx, ecx
je 0x1800287a8
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800287c2
add eax, r15d
cmp ecx, eax
ja 0x1800287c2
mov ecx, dword [r8 + 0xc]
test ecx, ecx
je 0x1800287e4
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jb 0x1800287c2
add eax, r15d
cmp ecx, eax
jbe 0x180028a6d
mov byte [rsp + 0x40], 0
mov byte [rsi + 0x21], 1
mov eax, dword [rbx + 0xc0]
mov dword [rsi + 0x23], eax
mov eax, dword [rbx + 0xc4]
mov dword [rsi + 0x27], eax
mov qword [rbx + 0xc0], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x2c], 0
jne 0x18002886c
movzx eax, byte [rdx + 0x15]
test al, al
je 0x18002886c
cmp al, 7
je 0x18002886c
cmp dword [rbx + 0x74], 0xa
jbe 0x18002886c
mov edx, dword [rbx + 0xc8]
test edx, edx
je 0x18002886c
cmp edx, r15d
ja 0x18002884f
mov ecx, dword [rbx + 0xcc]
add ecx, edx
cmp ecx, r15d
ja 0x18002884f
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002884f
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x18002886c
mov byte [rsi + 0x2b], 1
mov eax, dword [rbx + 0xc8]
mov dword [rsi + 0x2d], eax
mov eax, dword [rbx + 0xcc]
mov dword [rsi + 0x31], eax
mov qword [rbx + 0xc8], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x36], 0
jne 0x1800288fd
movzx eax, byte [rdx + 0x16]
test al, al
je 0x1800288fd
cmp al, 7
je 0x1800288fd
cmp dword [rbx + 0x74], 0xb
jbe 0x1800288fd
mov edx, dword [rbx + 0xd0]
test edx, edx
je 0x1800288f8
cmp edx, r15d
ja 0x1800288db
mov ecx, dword [rbx + 0xd4]
add ecx, edx
cmp ecx, r15d
ja 0x1800288db
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800288db
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x1800288f8
mov byte [rsi + 0x35], 1
mov eax, dword [rbx + 0xd0]
mov dword [rsi + 0x37], eax
mov eax, dword [rbx + 0xd4]
mov dword [rsi + 0x3b], eax
mov qword [rbx + 0xd0], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x40], 0
jne 0x180028980
movzx eax, byte [rdx + 0x13]
test al, al
je 0x180028980
cmp al, 7
je 0x180028980
cmp dword [rbx + 0x74], 0xc
jbe 0x180028980
mov edx, dword [rbx + 0xd8]
test edx, edx
je 0x180028980
cmp edx, r15d
ja 0x180028963
mov ecx, dword [rbx + 0xdc]
add ecx, edx
cmp ecx, r15d
ja 0x180028963
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180028963
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x180028980
mov byte [rsi + 0x3f], 1
mov eax, dword [rbx + 0xd8]
mov dword [rsi + 0x41], eax
mov eax, dword [rbx + 0xdc]
mov dword [rsi + 0x45], eax
mov qword [rbx + 0xd0], r14
cmp byte [rsi + 0x4a], 0
jne 0x180028a0c
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 0x17]
test al, al
je 0x180028a0c
cmp al, 7
je 0x180028a0c
cmp dword [rbx + 0x74], 0xe
jbe 0x180028a0c
mov edx, dword [rbx + 0xe8]
test edx, edx
je 0x180028a0c
cmp edx, r15d
ja 0x1800289ef
mov ecx, dword [rbx + 0xec]
add ecx, edx
cmp ecx, r15d
ja 0x1800289ef
mov r9d, dword [rbx + 0x34]
add r9d, edx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800289ef
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x180028a0c
mov byte [rsi + 0x49], 1
mov eax, dword [rbx + 0xe8]
mov dword [rsi + 0x4b], eax
mov eax, dword [rbx + 0xec]
mov dword [rsi + 0x4f], eax
mov qword [rbx + 0xe8], r14
mov r15, qword [rsp + 0x48]
cmp byte [r15 + 0x1a], 0
jne 0x180028a23
cmp byte [r15 + 0xb], 0
je 0x180028b44
movzx eax, word [rbx + 0x14]
lea r8, [rbx + 0x18]
add r8, rax
mov qword [rsp + 0xb0], r8
movzx r9d, word [rbx + 6]
mov dword [rsp + 0x88], r9d
mov ecx, r14d
test r9d, r9d
je 0x180028b0c
mov r11d, dword [r8 + 0xc]
mov ecx, dword [r8 + 8]
lea r10d, [rcx + r11]
mov edi, dword [rbx + 0x38]
xor edx, edx
mov eax, ecx
div edi
test edx, edx
jne 0x180028acf
mov r14d, r10d
jmp 0x180028ad8
test ecx, ecx
je 0x1800287e4
mov r9d, dword [rbx + 0x34]
add r9d, ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rcx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800287e4
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800287e4
mov edx, dword [rcx]
mov eax, dword [rbx + 0x34]
cmp edx, eax
jb 0x180028ac0
add eax, r15d
cmp edx, eax
jbe 0x180028ac4
xor eax, eax
mov dword [rcx], eax
add rcx, 4
mov qword [rsp + 0x58], rcx
jmp 0x180028aa8
sub ecx, edx
lea r14d, [r11 + rcx]
add r14d, edi
cmp r9d, 1
jbe 0x180028afc
add r8, 0x28
mov qword [rsp + 0xb0], r8
mov eax, dword [r8 + 0xc]
cmp r10d, eax
ja 0x180028af8
cmp r14d, eax
jbe 0x180028afc
mov dword [r8 + 8], r14d
dec r9d
mov dword [rsp + 0x88], r9d
jmp 0x180028a43
mov r9d, dword [r8 + 0x14]
mov edx, dword [r8 + 0x10]
lea eax, [rdx + r9]
mov edi, dword [rsp + 0x44]
cmp eax, edi
jbe 0x180028b2d
test edx, edx
je 0x180028b2d
mov eax, edi
sub eax, r9d
mov dword [r8 + 0x10], eax
cmp byte [r15 + 0xb], 0
je 0x180028b44
add r14d, 0xf000
cmp dword [rbx + 0x50], r14d
jbe 0x180028b44
mov dword [rbx + 0x50], ecx
cmp byte [r15 + 9], 0
je 0x180028baf
mov edx, dword [rbx + 0x34]
mov eax, dword [rbx + 0x28]
add rdx, rax
mov rcx, r13
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
mov ebx, eax
cmp eax, 0xffffffff
je 0x180028baf
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0x20000020
jne 0x180028baf
mov r9d, 0xe0000020
mov r8d, 0x2d
mov edx, ebx
mov rcx, r13
call sym.TitanEngine.dll_SetPE32DataForMappedFile
test al, al
jne 0x180028baf
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
xor al, al
jmp 0x180029b34
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
test r12b, r12b
je 0x180028bcf
mov byte [rsi], 0xa
mov byte [rsi + 2], r12b
mov al, 1
jmp 0x180029b34
mov r15d, dword [rbx + 0x50]
mov r8d, dword [rbx + 0x38]
xor edx, edx
mov eax, r15d
div r8d
mov r9d, edx
xor edx, edx
mov eax, r15d
div r8d
mov ecx, r15d
sub ecx, edx
add ecx, r8d
xor edx, edx
mov eax, r15d
div r8d
sub r15d, edx
test r9d, r9d
cmovne r15d, ecx
mov dword [rsp + 0x64], r15d
cmp byte [r10 + 6], 0
je 0x180028f5b
mov r9d, dword [rbx + 0x90]
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
mov edx, dword [rbx + 0x90]
add rdx, qword [rbx + 0x30]
mov rcx, r13
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
test eax, eax
js 0x180028f5b
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0xa0000060
jne 0x180028cdc
mov r9d, 0xe0000020
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_SetPE32DataForMappedFile
test al, al
jne 0x180028cdc
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
xor al, al
jmp 0x180029b34
mov eax, dword [rbx + 0x90]
test eax, eax
je 0x180028f5b
mov r8, qword [rbx + 0x30]
lea r9, [r8 + rax]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r15, rax
mov qword [rsp + 0x90], rax
mov rdi, qword [rsp + 0xc0]
nop dword [rax]
cmp dword [r15 + 0x10], 0
je 0x180028f4d
mov r12, r14
mov qword [rsp + 0x98], r14
mov r8, qword [rbx + 0x30]
mov r9d, dword [r15 + 0xc]
add r9, r8
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], r12b
mov edx, dword [rsp + 0x44]
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r15, rax
test rax, rax
je 0x180028dc0
mov rcx, rax
call fcn.180006e50
test al, al
jne 0x180028d77
xor cl, cl
mov byte [rsp + 0x42], cl
mov byte [rsp + 0x50], cl
jmp 0x180028dc0
xor al, al
mov byte [rsp + 0x42], al
mov byte [rsp + 0x50], al
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x180028dc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, r15
call fcn.180007c70
mov r12, rax
mov qword [rsp + 0x98], rax
mov al, 1
mov byte [rsp + 0x42], al
mov byte [rsp + 0x50], al
mov r15, qword [rsp + 0x90]
mov eax, dword [r15]
mov byte [rsp + 0x28], 1
mov edx, dword [rsp + 0x44]
mov rcx, r13
mov byte [rsp + 0x20], 0
test eax, eax
je 0x180028dfd
mov r8, qword [rbx + 0x30]
lea r9, [r8 + rax]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0xc0], rax
mov r13d, dword [r15]
jmp 0x180028e11
mov r8d, dword [rbx + 0x34]
mov r9d, dword [r15 + 0x10]
add r9, r8
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r13d, dword [r15 + 0x10]
mov qword [rsp + 0xa0], r13
test rdi, rdi
je 0x180028f1c
mov rax, qword [rdi]
test rax, rax
je 0x180028f14
jns 0x180028e5b
cmp eax, 0x10000
jl 0x180028e41
xor al, al
mov byte [rsp + 0x41], al
mov dword [rsp + 0x70], eax
add r13, 8
mov qword [rsp + 0xa0], r13
add rdi, 8
mov qword [rsp + 0xc0], rdi
jmp 0x180028e22
mov r8, qword [rbx + 0x30]
lea r9, [r8 + 2]
add r9, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0xa8]
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r15, rax
test rax, rax
je 0x180028e41
mov edx, 8
mov rcx, rax
call fcn.180007700
test al, al
je 0x180028e41
test r12, r12
je 0x180028e41
mov rdx, r15
mov rcx, r12
call fcn.1800082b0
test rax, rax
jne 0x180028e41
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x84], r14d
lea r8, [rsp + 0x84]
lea rdx, [rsp + 0x80]
mov rcx, r12
call fcn.1800083a0
test al, al
je 0x180028e41
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x180028e37
cmp dword [rsp + 0x84], 0
je 0x180028e37
lea ecx, [rax + 1]
movabs rax, 0x8000000000000000
xor rcx, rax
mov qword [rdi], rcx
jmp 0x180028e41
mov r15, qword [rsp + 0x90]
cmp byte [rsp + 0x42], 0
je 0x180028f34
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add r15, 0x14
mov qword [rsp + 0x90], r15
mov r13, qword [rsp + 0xa8]
jmp 0x180028d20
mov r12d, dword [rsp + 0x70]
mov r15d, dword [rsp + 0x64]
mov edi, dword [rsp + 0x44]
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 0xe]
cmp al, 8
jne 0x180028f75
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x18002907f
cmp byte [rsi + 0xe], 0
jne 0x18002907f
test al, al
je 0x18002907f
cmp al, 7
je 0x18002907f
cmp dword [rbx + 0x84], 0
jbe 0x18002907f
mov edx, dword [rbx + 0x88]
test edx, edx
je 0x18002907f
cmp edx, r15d
ja 0x180029062
mov ecx, dword [rbx + 0x8c]
add ecx, edx
cmp ecx, r15d
ja 0x180029062
mov byte [rsp + 0x40], 1
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002907f
mov edx, dword [rbx + 0x8c]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180029062
mov ecx, dword [rdi + 0x1c]
cmp ecx, r15d
ja 0x18002905d
mov eax, dword [rdi + 0x14]
lea ecx, [rcx + rax*4]
cmp ecx, r15d
ja 0x18002905d
mov ecx, dword [rdi + 0x24]
cmp ecx, r15d
ja 0x18002905d
mov eax, dword [rdi + 0x18]
lea edx, [rax*4]
lea eax, [rdx + rcx]
cmp eax, r15d
ja 0x18002905d
mov eax, dword [rdi + 0x20]
cmp eax, r15d
ja 0x18002905d
add eax, edx
cmp eax, r15d
ja 0x18002905d
movzx eax, byte [rsp + 0x40]
cmp dword [rdi + 0xc], r15d
cmova eax, r14d
mov byte [rsp + 0x40], al
test al, al
jne 0x18002907f
jmp 0x180029062
mov byte [rsp + 0x40], 0
mov byte [rsi + 0xd], 1
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0xf], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsi + 0x13], eax
mov qword [rbx + 0x88], r14
mov rdi, qword [rsp + 0x48]
movzx r8d, byte [rdi + 3]
cmp r8b, 1
jne 0x1800290a2
cmp byte [rdi + 0xf], r8b
jne 0x1800290a2
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x1800291ce
cmp byte [rsi + 4], 0
jne 0x1800291b3
cmp byte [rdi + 0xf], 0
je 0x1800291b3
mov edx, dword [rbx + 0xb0]
cmp edx, r15d
ja 0x180029185
mov ecx, dword [rbx + 0xb4]
add ecx, edx
cmp ecx, r15d
ja 0x180029185
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, dword [rsp + 0x44]
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180029170
mov edx, dword [rbx + 0xb4]
mov rcx, rax
call fcn.180007700
test al, al
je 0x180029170
mov eax, dword [rdi]
mov dword [rsp + 0x60], eax
mov edx, dword [rdi + 4]
mov ecx, 0xcfff
test eax, eax
je 0x1800291c9
lea eax, [rdx - 8]
mov dword [rsp + 0x60], eax
add rdi, 8
mov qword [rsp + 0x58], rdi
nop dword [rax + rax]
test eax, eax
je 0x180029160
cmp word [rdi], cx
jbe 0x18002914e
xor edx, edx
mov word [rdi], dx
add rdi, 2
mov qword [rsp + 0x58], rdi
add eax, 0xfffffffe
mov dword [rsp + 0x60], eax
jmp 0x180029140
mov r8d, dword [rdi]
mov dword [rsp + 0x60], r8d
mov eax, r8d
mov edx, dword [rdi + 4]
jmp 0x180029123
mov rdi, qword [rsp + 0x48]
cmp byte [rdi + 3], 0
je 0x180029194
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x1800291ce
test r8b, r8b
je 0x180029194
xor r12b, r12b
mov byte [rsp + 0x41], r12b
jmp 0x1800291ce
mov byte [rsi + 3], 1
mov eax, dword [rbx + 0xb0]
mov dword [rsi + 5], eax
mov eax, dword [rbx + 0xb4]
mov dword [rsi + 9], eax
mov qword [rbx + 0xb0], r14
jmp 0x1800291ce
movzx eax, r12b
cmp byte [rdi + 0xf], 0
cmovne eax, r14d
movzx r12d, al
mov byte [rsp + 0x41], al
jmp 0x1800291ce
mov rdi, qword [rsp + 0x48]
movzx ecx, byte [rsi + 0x18]
test cl, cl
jne 0x1800292b7
movzx eax, byte [rdi + 0x19]
test al, al
je 0x1800291ea
cmp al, 7
jne 0x18002929a
test cl, cl
jne 0x1800292b7
movzx eax, byte [rdi + 0x18]
test al, al
je 0x1800292b7
cmp al, 7
je 0x1800292b7
cmp dword [rbx + 0x84], 2
jbe 0x1800292b7
mov edx, dword [rbx + 0x98]
test edx, edx
je 0x1800292b7
cmp edx, r15d
ja 0x18002929a
mov ecx, dword [rbx + 0x9c]
add ecx, edx
cmp ecx, r15d
ja 0x18002929a
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edi, dword [rsp + 0x44]
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002927b
mov rcx, rax
sub rcx, r13
cmp rcx, rdi
ja 0x18002927b
mov ecx, dword [rbx + 0x9c]
sub rcx, r13
add rcx, rax
cmp rcx, rdi
jbe 0x1800292bb
mov byte [rsi + 0x17], 1
mov eax, dword [rbx + 0x98]
mov dword [rsi + 0x19], eax
mov eax, dword [rbx + 0x9c]
mov dword [rsi + 0x1d], eax
mov qword [rbx + 0x98], r14
jmp 0x1800292bb
mov byte [rsi + 0x17], 1
mov eax, dword [rbx + 0x98]
mov dword [rsi + 0x19], eax
mov eax, dword [rbx + 0x9c]
mov dword [rsi + 0x1d], eax
mov qword [rbx + 0x98], r14
mov edi, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x22], 0
jne 0x1800293f6
movzx eax, byte [rdx + 0x14]
test al, al
je 0x1800293f6
cmp al, 7
je 0x1800293f6
cmp dword [rbx + 0x84], 9
jbe 0x1800293f6
mov edx, dword [rbx + 0xd0]
test edx, edx
je 0x1800293f1
cmp edx, r15d
ja 0x1800293d4
mov ecx, dword [rbx + 0xd4]
add ecx, edx
cmp ecx, r15d
ja 0x1800293d4
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov r8, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800293d4
mov rdx, rax
sub rdx, r13
mov ecx, edi
cmp rdx, rcx
ja 0x1800293d4
mov byte [rsp + 0x40], 1
mov rcx, qword [rax]
test rcx, rcx
je 0x180029374
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x1800293cf
mov eax, r15d
add rax, rdx
cmp rcx, rax
ja 0x1800293cf
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x180029391
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x1800293cf
mov eax, r15d
add rax, rdx
cmp rcx, rax
ja 0x1800293cf
mov rcx, qword [r8 + 0x10]
test rcx, rcx
je 0x1800293ae
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x1800293cf
mov eax, r15d
add rax, rdx
cmp rcx, rax
ja 0x1800293cf
mov rcx, qword [r8 + 0x18]
test rcx, rcx
je 0x1800293f1
mov rdx, qword [rbx + 0x30]
cmp rcx, rdx
jb 0x1800293cf
mov eax, r15d
add rax, rdx
cmp rcx, rax
jbe 0x18002968e
mov byte [rsp + 0x40], 0
mov byte [rsi + 0x21], 1
mov eax, dword [rbx + 0xd0]
mov dword [rsi + 0x23], eax
mov eax, dword [rbx + 0xd4]
mov dword [rsi + 0x27], eax
mov qword [rbx + 0xd0], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x2c], 0
jne 0x180029480
movzx eax, byte [rdx + 0x15]
test al, al
je 0x180029480
cmp al, 7
je 0x180029480
cmp dword [rbx + 0x84], 0xa
jbe 0x180029480
mov edx, dword [rbx + 0xd8]
test edx, edx
je 0x180029480
cmp edx, r15d
ja 0x180029463
mov ecx, dword [rbx + 0xdc]
add ecx, edx
cmp ecx, r15d
ja 0x180029463
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180029463
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x180029480
mov byte [rsi + 0x2b], 1
mov eax, dword [rbx + 0xd8]
mov dword [rsi + 0x2d], eax
mov eax, dword [rbx + 0xdc]
mov dword [rsi + 0x31], eax
mov qword [rbx + 0xd8], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x36], 0
jne 0x180029514
movzx eax, byte [rdx + 0x16]
test al, al
je 0x180029514
cmp al, 7
je 0x180029514
cmp dword [rbx + 0x84], 0xb
jbe 0x180029514
mov edx, dword [rbx + 0xe0]
test edx, edx
je 0x18002950f
cmp edx, r15d
ja 0x1800294f2
mov ecx, dword [rbx + 0xe4]
add ecx, edx
cmp ecx, r15d
ja 0x1800294f2
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800294f2
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x18002950f
mov byte [rsi + 0x35], 1
mov eax, dword [rbx + 0xe0]
mov dword [rsi + 0x37], eax
mov eax, dword [rbx + 0xe4]
mov dword [rsi + 0x3b], eax
mov qword [rbx + 0xe0], r14
mov rdx, qword [rsp + 0x48]
cmp byte [rsi + 0x40], 0
jne 0x18002959e
movzx eax, byte [rdx + 0x13]
test al, al
je 0x18002959e
cmp al, 7
je 0x18002959e
cmp dword [rbx + 0x84], 0xc
jbe 0x18002959e
mov edx, dword [rbx + 0xe8]
test edx, edx
je 0x18002959e
cmp edx, r15d
ja 0x180029581
mov ecx, dword [rbx + 0xec]
add ecx, edx
cmp ecx, r15d
ja 0x180029581
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180029581
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x18002959e
mov byte [rsi + 0x3f], 1
mov eax, dword [rbx + 0xe8]
mov dword [rsi + 0x41], eax
mov eax, dword [rbx + 0xec]
mov dword [rsi + 0x45], eax
mov qword [rbx + 0xe0], r14
cmp byte [rsi + 0x4a], 0
jne 0x18002962d
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 0x17]
test al, al
je 0x18002962d
cmp al, 7
je 0x18002962d
cmp dword [rbx + 0x84], 0xe
jbe 0x18002962d
mov edx, dword [rbx + 0xf8]
test edx, edx
je 0x18002962d
cmp edx, r15d
ja 0x180029610
mov ecx, dword [rbx + 0xfc]
add ecx, edx
cmp ecx, r15d
ja 0x180029610
mov r9d, edx
add r9, qword [rbx + 0x30]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180029610
sub rax, r13
mov ecx, edi
cmp rax, rcx
jbe 0x18002962d
mov byte [rsi + 0x49], 1
mov eax, dword [rbx + 0xf8]
mov dword [rsi + 0x4b], eax
mov eax, dword [rbx + 0xfc]
mov dword [rsi + 0x4f], eax
mov qword [rbx + 0xf8], r14
mov r15, qword [rsp + 0x48]
cmp byte [r15 + 0x1a], 0
jne 0x180029644
cmp byte [r15 + 0xb], 0
je 0x180029775
movzx eax, word [rbx + 0x14]
lea r8, [rbx + 0x18]
add r8, rax
mov qword [rsp + 0xb0], r8
movzx r9d, word [rbx + 6]
mov dword [rsp + 0x88], r9d
mov ecx, r14d
test r9d, r9d
je 0x18002973d
mov r11d, dword [r8 + 0xc]
mov ecx, dword [r8 + 8]
lea r10d, [rcx + r11]
mov edi, dword [rbx + 0x38]
xor edx, edx
mov eax, ecx
div edi
test edx, edx
jne 0x180029700
mov r14d, r10d
jmp 0x180029709
test rcx, rcx
je 0x1800293f1
mov r9, qword [rbx + 0x30]
add r9, rcx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
mov rcx, r13
call sym.TitanEngine.dll_ConvertVAtoFileOffsetEx
mov rcx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800293f1
mov r9d, dword [rsp + 0x60]
nop dword [rax + rax]
test r9d, r9d
je 0x1800293f1
mov rdx, qword [rcx]
mov r8, qword [rbx + 0x30]
cmp rdx, r8
jb 0x1800296f0
mov eax, r15d
add rax, r8
cmp rdx, rax
jbe 0x1800296f5
xor eax, eax
mov qword [rcx], rax
add rcx, 8
mov qword [rsp + 0x58], rcx
jmp 0x1800296d0
sub ecx, edx
lea r14d, [rdi + rcx]
add r14d, r11d
cmp r9d, 1
jbe 0x18002972d
add r8, 0x28
mov qword [rsp + 0xb0], r8
mov eax, dword [r8 + 0xc]
cmp r10d, eax
ja 0x180029729
cmp r14d, eax
jbe 0x18002972d
mov dword [r8 + 8], r14d
dec r9d
mov dword [rsp + 0x88], r9d
jmp 0x180029664
mov r9d, dword [r8 + 0x14]
mov edx, dword [r8 + 0x10]
lea eax, [rdx + r9]
mov edi, dword [rsp + 0x44]
cmp eax, edi
jbe 0x18002975e
test edx, edx
je 0x18002975e
mov eax, edi
sub eax, r9d
mov dword [r8 + 0x10], eax
cmp byte [r15 + 0xb], 0
je 0x180029775
add r14d, 0xf000
cmp dword [rbx + 0x50], r14d
jbe 0x180029775
mov dword [rbx + 0x50], ecx
cmp byte [r15 + 9], 0
je 0x1800297de
mov edx, dword [rbx + 0x28]
add rdx, qword [rbx + 0x30]
mov rcx, r13
call sym.TitanEngine.dll_GetPE32SectionNumberFromVA
mov ebx, eax
cmp eax, 0xffffffff
je 0x1800297de
mov r8d, 0x2d
mov edx, eax
mov rcx, r13
call sym.TitanEngine.dll_GetPE32DataFromMappedFile
test eax, 0x20000020
jne 0x1800297de
mov r9d, 0xe0000020
mov r8d, 0x2d
mov edx, ebx
mov rcx, r13
call sym.TitanEngine.dll_SetPE32DataForMappedFile
test al, al
jne 0x1800297de
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
xor al, al
jmp 0x180029b34
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call fcn.18000dc30
test r12b, r12b
je 0x1800297fe
mov byte [rsi], 0xa
mov byte [rsi + 2], r12b
mov al, 1
jmp 0x180029b34
mov r9, r13
mov r8, qword [rsp + 0x68]
mov edx, edi
mov rcx, rbx
call fcn.18000dc30
jmp 0x180029b32
test al, al
je 0x180029b32
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0xe0000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180029b32
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r12, rax
test rax, rax
je 0x180029b10
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180029b10
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rbx
call fcn.180007830
test al, al
je 0x180029b32
movsxd rcx, dword [rdi + 0x3c]
mov edx, dword [rcx + rdi]
cmp edx, 0x4550
jne 0x180029afd
mov eax, 0x10b
cmp word [rcx + rdi + 0x18], ax
je 0x18002993c
cmp edx, edx
jne 0x180029afd
mov eax, 0x20b
cmp word [rcx + rdi + 0x18], ax
jne 0x180029afd
mov r14d, r15d
movzx eax, byte [rsi + 3]
test r14d, r14d
jne 0x180029a1a
test al, al
je 0x180029961
mov eax, dword [rsi + 5]
mov dword [rcx + rdi + 0xa0], eax
mov eax, dword [rsi + 9]
mov dword [rcx + rdi + 0xa4], eax
cmp byte [rsi + 0xd], 0
je 0x180029975
mov eax, dword [rsi + 0xf]
mov dword [rcx + rdi + 0x78], eax
mov eax, dword [rsi + 0x13]
mov dword [rcx + rdi + 0x7c], eax
cmp byte [rsi + 0x17], 0
je 0x18002998f
mov eax, dword [rsi + 0x19]
mov dword [rcx + rdi + 0x88], eax
mov eax, dword [rsi + 0x1d]
mov dword [rcx + rdi + 0x8c], eax
cmp byte [rsi + 0x21], 0
je 0x1800299a9
mov eax, dword [rsi + 0x23]
mov dword [rcx + rdi + 0xc0], eax
mov eax, dword [rsi + 0x27]
mov dword [rcx + rdi + 0xc4], eax
cmp byte [rsi + 0x2b], 0
je 0x1800299c3
mov eax, dword [rsi + 0x2d]
mov dword [rcx + rdi + 0xc8], eax
mov eax, dword [rsi + 0x31]
mov dword [rcx + rdi + 0xcc], eax
cmp byte [rsi + 0x35], 0
je 0x1800299dd
mov eax, dword [rsi + 0x37]
mov dword [rcx + rdi + 0xd0], eax
mov eax, dword [rsi + 0x3b]
mov dword [rcx + rdi + 0xd4], eax
cmp byte [rsi + 0x3f], 0
je 0x1800299f7
mov eax, dword [rsi + 0x41]
mov dword [rcx + rdi + 0xd8], eax
mov eax, dword [rsi + 0x45]
mov dword [rcx + rdi + 0xdc], eax
cmp byte [rsi + 0x49], 0
je 0x180029ae8
mov eax, dword [rsi + 0x4b]
mov dword [rcx + rdi + 0xe8], eax
mov eax, dword [rsi + 0x4f]
mov dword [rcx + rdi + 0xec], eax
jmp 0x180029ae8
test al, al
je 0x180029a32
mov eax, dword [rsi + 5]
mov dword [rcx + rdi + 0xb0], eax
mov eax, dword [rsi + 9]
mov dword [rcx + rdi + 0xb4], eax
cmp byte [rsi + 0xd], 0
je 0x180029a4c
mov eax, dword [rsi + 0xf]
mov dword [rcx + rdi + 0x88], eax
mov eax, dword [rsi + 0x13]
mov dword [rcx + rdi + 0x8c], eax
cmp byte [rsi + 0x17], 0
je 0x180029a66
mov eax, dword [rsi + 0x19]
mov dword [rcx + rdi + 0x98], eax
mov eax, dword [rsi + 0x1d]
mov dword [rcx + rdi + 0x9c], eax
cmp byte [rsi + 0x21], 0
je 0x180029a80
mov eax, dword [rsi + 0x23]
mov dword [rcx + rdi + 0xd0], eax
mov eax, dword [rsi + 0x27]
mov dword [rcx + rdi + 0xd4], eax
cmp byte [rsi + 0x2b], 0
je 0x180029a9a
mov eax, dword [rsi + 0x2d]
mov dword [rcx + rdi + 0xd8], eax
mov eax, dword [rsi + 0x31]
mov dword [rcx + rdi + 0xdc], eax
cmp byte [rsi + 0x35], 0
je 0x180029ab4
mov eax, dword [rsi + 0x37]
mov dword [rcx + rdi + 0xe0], eax
mov eax, dword [rsi + 0x3b]
mov dword [rcx + rdi + 0xe4], eax
cmp byte [rsi + 0x3f], 0
je 0x180029ace
mov eax, dword [rsi + 0x41]
mov dword [rcx + rdi + 0xe8], eax
mov eax, dword [rsi + 0x45]
mov dword [rcx + rdi + 0xec], eax
cmp byte [rsi + 0x49], 0
je 0x180029ae8
mov eax, dword [rsi + 0x4b]
mov dword [rcx + rdi + 0xf8], eax
mov eax, dword [rsi + 0x4f]
mov dword [rcx + rdi + 0xfc], eax
mov r9, rdi
mov r8, r12
mov edx, r13d
mov rcx, rbx
call fcn.18000dc30
mov al, 1
jmp 0x180029b34
mov r9, rdi
mov r8, r12
mov edx, r13d
mov rcx, rbx
call fcn.18000dc30
jmp 0x180029b32
lea rdx, [rsp + 0x64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180029b32
test byte [rsp + 0x64], 2
jne 0x180029b32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret