Function at 0x18001cb60
Capabilities:
Get file size
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
xor ebp, ebp
mov r13d, 1
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, r13d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18001ce6d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x88], eax
lea r8d, [rbp + 2]
mov dword [rsp + 0x20], eax
mov rcx, r12
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x90], rax
mov rbx, rax
test rax, rax
je 0x18001ce45
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
lea edx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x18001ce45
mov qword [rsp + 0x80], r14
mov r9, rax
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov rdx, r12
mov byte [rsp + 0x20], r13b
call fcn.180007830
test al, al
je 0x18001ce31
movsxd r14, dword [rsi + 0x3c]
mov ecx, 0x10b
add r14, rsi
movzx eax, word [r14 + 0x18]
cmp ax, cx
jne 0x18001cc9f
mov ecx, dword [r14 + 0x78]
mov r13d, ebp
test ecx, ecx
je 0x18001ce31
mov edx, dword [r14 + 0x34]
mov r8b, 1
add edx, ecx
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbp, rax
test rax, rax
je 0x18001ce31
mov edx, dword [rax + 0x1c]
mov r8b, 1
add edx, dword [r14 + 0x34]
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov r15, rax
test rax, rax
je 0x18001ce31
cmp qword [0x180090f18], r13
jmp 0x18001cd01
mov ecx, 0x20b
cmp ax, cx
jne 0x18001ce31
mov eax, dword [r14 + 0x88]
test eax, eax
je 0x18001ce31
mov edx, eax
movzx r8d, r13b
add rdx, qword [r14 + 0x30]
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbp, rax
test rax, rax
je 0x18001ce31
mov edx, dword [rax + 0x1c]
movzx r8d, r13b
add rdx, qword [r14 + 0x30]
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov r15, rax
test rax, rax
je 0x18001ce31
cmp qword [0x180090f18], 0
mov ebx, dword [rbp + 0x10]
je 0x18001cd0b
call sym.TitanEngine.dll_ExporterCleanup
mov r9d, 4
mov dword [0x180096bb0], ebx
mov r8d, 0x1000
mov edx, 0xc800
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov byte [0x1800915ac], 0
xor ebx, ebx
mov qword [0x1800915a0], rax
mov qword [0x180090f18], rax
mov ecx, dword [rbp + 0x20]
mov r8b, 1
test r13, r13
jne 0x18001cd63
mov edx, dword [r14 + 0x34]
add edx, ecx
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov edx, dword [rbp + 0x24]
add edx, dword [r14 + 0x34]
jmp 0x18001cd79
mov rdx, rcx
mov rcx, rsi
add rdx, qword [r14 + 0x30]
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov edx, dword [rbp + 0x24]
add rdx, qword [r14 + 0x30]
mov rdi, rax
mov r8b, 1
mov rax, rsi
mov rcx, rax
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rdi, rdi
je 0x18001cdf0
test rax, rax
je 0x18001cdf0
mov r8d, dword [rbp + 0x18]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [rax]
cmp ecx, ebx
je 0x18001cdb4
add rax, 2
inc edx
cmp edx, r8d
jbe 0x18001cda0
jmp 0x18001cdec
lea ecx, [rdx*4]
add rdi, rcx
mov rcx, rsi
test r13, r13
jne 0x18001cdce
mov edx, dword [r14 + 0x34]
add edx, dword [rdi]
jmp 0x18001cdd4
mov edx, dword [rdi]
add rdx, qword [r14 + 0x30]
mov r8b, 1
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18001cdec
mov edx, dword [r15]
mov rcx, rax
call sym.TitanEngine.dll_ExporterAddNewExport
add r15, 4
inc ebx
cmp ebx, dword [rbp + 0x18]
jbe 0x18001cd41
mov r8, qword [rsp + 0x90]
mov r9, rsi
mov edx, dword [rsp + 0x88]
mov rcx, r12
call fcn.18000dc30
mov al, 1
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, rsi
mov r8, rbx
mov edx, edi
mov rcx, r12
call fcn.18000dc30
xor al, al
jmp 0x18001ce17
lea rdx, [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18001ce6d
test byte [rsp + 0x88], 2
jne 0x18001ce6d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret