Function at 0x18002b440
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rcx, r9
mov rsi, r8
mov r12, rdx
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x18002b83e
mov qword [rsp + 0xb8], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x18002b81c
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x18002b81c
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x18002b806
mov qword [rsp + 0xa0], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x18002b7e4
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x18002b7e4
mov qword [rsp + 0x90], rax
mov rax, qword [0x180084bf8]
test rax, rax
je 0x18002b7cb
mov rcx, qword [0x180084bf0]
test rcx, rcx
je 0x18002b7cb
cmp rax, rcx
je 0x18002b7cb
jbe 0x18002b616
sub rax, rcx
mov qword [rsp + 0x68], rax
mov rcx, rax
jmp 0x18002b621
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rcx
test cl, cl
jne 0x18002b639
shr rax, 4
mov qword [rsp + 0x68], rax
inc ebx
mov dword [rsp + 0x4c], ebx
movzx ecx, al
jmp 0x18002b621
lea eax, [rbx - 1]
movsxd r15, eax
mov qword [rsp + 0x68], r15
mov rdi, r14
mov qword [rsp + 0x50], r14
mov rbx, r11
mov qword [rsp + 0x58], rbx
lea r14, [r12 + rsi]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
lea esi, [rax - 1]
mov dword [rsp + 0x40], esi
test esi, esi
jle 0x18002b769
movzx eax, byte [rdi]
cmp al, byte [rbx]
je 0x18002b74e
mov ecx, 8
mov dword [rsp + 0x4c], ecx
xor edx, edx
mov dword [rsp + 0x60], edx
mov r8, rdi
mov r9, rbx
mov r10d, esi
mov rax, qword [rsp + 0x70]
add rax, r15
cmp rdi, rax
jb 0x18002b6b6
sub rdi, r15
mov qword [rsp + 0x50], rdi
sub rbx, r15
mov qword [rsp + 0x58], rbx
add esi, r15d
mov dword [rsp + 0x40], esi
test ecx, ecx
jle 0x18002b6f4
test edx, edx
jne 0x18002b712
mov rax, qword [rbx]
cmp rax, r12
jb 0x18002b6d6
cmp rax, r14
ja 0x18002b6d6
mov edx, 1
mov dword [rsp + 0x60], edx
jmp 0x18002b6f2
inc rdi
mov qword [rsp + 0x50], rdi
inc rbx
mov qword [rsp + 0x58], rbx
dec esi
mov dword [rsp + 0x40], esi
dec ecx
mov dword [rsp + 0x4c], ecx
jmp 0x18002b6b6
test edx, edx
jne 0x18002b712
mov rdi, r8
mov qword [rsp + 0x50], r8
mov rbx, r9
mov qword [rsp + 0x58], rbx
mov esi, r10d
mov dword [rsp + 0x40], r10d
jmp 0x18002b74e
mov rdx, rbx
sub rdx, r11
add rdx, qword [rsp + 0x128]
xor r8d, r8d
mov rcx, qword [rsp + 0x100]
call sym.TitanEngine.dll_RelocaterAddNewRelocation
add rdi, 7
mov qword [rsp + 0x50], rdi
add rbx, 7
mov qword [rsp + 0x58], rbx
add esi, 0xfffffff9
mov dword [rsp + 0x40], esi
mov r11, qword [rsp + 0x78]
inc rdi
mov qword [rsp + 0x50], rdi
inc rbx
mov qword [rsp + 0x58], rbx
dec esi
mov dword [rsp + 0x40], esi
jmp 0x18002b667
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x88]
jmp 0x18002b7cb
mov r9, r11
mov r8, qword [rsp + 0xc0]
mov edx, dword [rsp + 0x44]
mov rcx, rdi
call fcn.18000dc30
jmp 0x18002b806
lea rdx, [rsp + 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002b806
test byte [rsp + 0x44], 2
jne 0x18002b806
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, r14
mov r8, r15
mov edx, dword [rsp + 0x48]
mov rcx, r13
call fcn.18000dc30
mov al, 1
jmp 0x18002b840
lea rdx, [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18002b83e
test byte [rsp + 0x48], 2
jne 0x18002b83e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret