Function at 0x18002b280
Capabilities:
Create thread
Get file size
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [0x180000000]
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [rdx + 0x42fec]
lea rcx, [rsp + 0x88]
xor r12d, r12d
mov dword [rcx], eax
movzx eax, word [rdx + 0x42ff0]
mov qword [rsp + 0x58], r9
mov word [rcx + 4], ax
movzx eax, byte [rdx + 0x42ff2]
lea rdx, str.Restoring_session._n
mov byte [rcx + 6], al
mov rcx, rsi
mov qword [rsp + 0x50], r8
mov rdi, r12
call fcn.180016c70
mov qword [rsp + 0x30], r12
mov r15d, 1
lea rcx, [rsi + 0x11943]
xor r9d, r9d
mov edx, 0x80000000
mov r8d, r15d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b343
lea rdx, str._tFailed_to_open_session_file._n
mov rcx, rsi
call fcn.180016c70
xor eax, eax
jmp 0x18002ba90
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xd8], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x18002b3f0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 4]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rbx
mov rbp, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18002b3f0
mov rcx, rsi
call sym.PRDLL.dll_Undelete_Done
mov rcx, rsi
call fcn.18001a540
test eax, eax
jne 0x18002b3f7
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, str.Undelete_RestoreSession:_Files_list_or_strings_storage_is_NOT_allocated._n
mov rcx, rsi
call fcn.180016b80
mov rcx, rsi
call sym.PRDLL.dll_Undelete_Done
test rsi, rsi
je 0x18002b3f0
mov dword [rsi], 0x20000008
xor eax, eax
jmp 0x18002ba88
lea rdx, [rsp + 0x88]
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r14
call fcn.18002df10
test eax, eax
je 0x18002b429
mov r15d, r12d
jmp 0x18002b62f
mov eax, dword [rbp + 6]
mov edi, 0xe
mov r8d, 0x1000
mov dword [rsi + 0x248], eax
movzx ecx, word [rbp + 0xa]
lea r9d, [rdi - 0xa]
mov rdx, rcx
mov word [rsi + 0x2ad], cx
movzx eax, word [rbp + 0xc]
imul rdx, rdx, 0x126
xor ecx, ecx
mov word [rsi + 0x2af], ax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsi + 0x2b5], rax
test rax, rax
jne 0x18002b49c
mov rcx, rsi
call sym.PRDLL.dll_Undelete_Done
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, str.Undelete_RestoreSession:_Files_list_or_strings_storage_is_NOT_allocated._n
mov rcx, rsi
call fcn.180016b80
xor eax, eax
jmp 0x18002ba78
mov r14d, r12d
cmp r12w, word [rsi + 0x2ad]
jae 0x18002b62f
mov rbx, r12
movzx eax, byte [rdi + rbp + 0x11]
mov r12, qword [rsi + 0x2b5]
lea r13, [rdi + rbp]
shr eax, 7
add rdi, 0x111
xor eax, dword [rbx + r12 + 4]
and eax, 0xffffff
xor dword [rbx + r12 + 4], eax
movzx ecx, byte [r13 + 0x11]
shr ecx, 7
test ecx, ecx
je 0x18002b5a5
cmp ecx, r15d
jne 0x18002b612
movzx eax, byte [r13 + 0x10]
lea rdx, [r13 + 0x12]
lea rcx, [rbx + r12 + 0x27]
mov byte [rbx + r12 + 0x26], al
mov rax, qword [r13]
mov qword [rbx + r12 + 0x14], rax
mov rax, qword [r13 + 8]
mov qword [rbx + r12 + 0x1c], rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx r11d, byte [r13 + 0x11]
and r11b, 0x7f
je 0x18002b532
movzx eax, r11b
mov word [rbx + r12 + 0x24], ax
lea r12, [rbx + r12 + 0xc]
test r12, r12
je 0x18002b576
mov rcx, r12
call fcn.180001a60
test eax, eax
je 0x18002b576
movzx edx, byte [r13 + 0x10]
mov rcx, qword [r12]
xor r8d, r8d
call fcn.180002620
test eax, eax
je 0x18002b576
mov r8, qword [r13 + 8]
mov rdx, qword [r13]
mov rcx, qword [r12]
call fcn.180002590
test eax, eax
jne 0x18002b612
mov rcx, rsi
call sym.PRDLL.dll_Undelete_Done
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Corrupted_session_file_
mov rcx, rsi
mov dword [rsi], eax
call fcn.180016c70
xor eax, eax
jmp 0x18002ba78
movzx eax, byte [r13 + 0x11]
lea rcx, [rbx + r12 + 0xc]
and eax, 0x7f
sub eax, 0x41
xor eax, dword [rbx + r12]
and eax, 0xffffff
xor dword [rbx + r12], eax
movzx eax, byte [r13 + 0x11]
mov byte [rbx + r12 + 0x28], 0x3a
and al, 0x7f
mov byte [rbx + r12 + 0x29], 0
mov byte [rbx + r12 + 0x27], al
movzx eax, al
mov word [rbx + r12 + 0x24], ax
test rcx, rcx
je 0x18002b576
call fcn.180001a60
test eax, eax
je 0x18002b576
mov rcx, qword [rsi + 0x2b5]
xor r8d, r8d
movzx edx, byte [rcx + rbx + 0x27]
mov rcx, qword [rcx + rbx + 0xc]
call fcn.180002220
test eax, eax
je 0x18002b576
movzx eax, word [rsi + 0x2ad]
inc r14d
add rbx, 0x126
cmp r14d, eax
jb 0x18002b4b0
xor r12d, r12d
mov rax, qword [rdi + rbp]
add rdi, 8
mov r14d, r12d
mov qword [rsi + 0x284], rax
cmp r12w, word [rsi + 0x2ad]
jae 0x18002b76d
mov r13, r12
nop word [rax + rax]
mov r9d, dword [rdi + rbp]
mov rax, qword [rsi + 0x2b5]
add rdi, 4
mov r12, qword [rax + r13 + 0xc]
test r9d, r9d
je 0x18002b693
lea r8, [rdi + rbp]
lea rdx, [r9*8]
mov rcx, r12
mov rbx, r9
call fcn.180003060
add rdi, rbx
mov eax, dword [rdi + rbp]
add rdi, 4
test eax, eax
je 0x18002b747
mov rbx, rax
lea rsi, [0x180000000]
nop dword [rax]
mov eax, dword [rdi + rbp]
add rdi, 4
lea r8, [rdi + rbp]
add rdi, rax
mov eax, dword [r8]
cmp eax, 6
ja case.default.0x18002b6d0
mov ecx, dword [rsi + rax*4 + 0x2bab0]
add rcx, rsi
jmp rcx
mov edx, 4
mov rcx, r12
call fcn.180001ca0
xor r15d, r15d
test eax, eax
setne r15b
jmp case.default.0x18002b6d0
mov rdx, r8
mov rcx, r12
call fcn.18000a420
mov r15d, eax
jmp case.default.0x18002b6d0
mov rdx, r8
mov rcx, r12
call fcn.180016810
mov r15d, eax
jmp case.default.0x18002b6d0
mov edx, 0xb64
mov rcx, r12
call fcn.180001ca0
xor r15d, r15d
test eax, eax
setne r15b
jmp case.default.0x18002b6d0
mov edx, 0x28
mov rcx, r12
call fcn.180001ca0
xor r15d, r15d
test eax, eax
setne r15b
sub rbx, 1
jne 0x18002b6b0
mov rsi, qword [rsp + 0x40]
test r15d, r15d
je 0x18002b8a9
movzx eax, word [rsi + 0x2ad]
inc r14d
add r13, 0x126
cmp r14d, eax
jb 0x18002b660
xor r12d, r12d
cmp qword [rsi + 0x284], 0
je 0x18002b7eb
mov rax, qword [rdi + rbp]
lea rcx, [rsi + 0x88]
lea rdx, [rdi + rbp + 0x28]
mov qword [rsi + 0x70], rax
mov rax, qword [rdi + rbp + 8]
mov r8d, 0x160
mov qword [rsi + 0x78], rax
mov rax, qword [rdi + rbp + 0x10]
mov qword [rsi + 0x80], rax
mov rax, qword [rdi + rbp + 0x18]
mov qword [rsi + 0x1e8], rax
mov rax, qword [rdi + rbp + 0x20]
mov qword [rsi + 0x1f8], rax
call fcn.18002dae0
mov rax, qword [rdi + rbp + 0x188]
mov qword [rsi + 0x60], rax
mov rax, qword [rdi + rbp + 0x190]
add rdi, 0x1a0
mov qword [rsi + 0x68], rax
mov rax, qword [rdi + rbp - 8]
mov qword [rsi + 0x58], rax
mov rbx, qword [rdi + rbp]
add rdi, 8
test rbx, rbx
je 0x18002b815
lea r8d, [rbx + rbx]
lea rdx, [rdi + rbp]
lea rcx, [rsi + 0x3c]
lea r9, [rsp + 0x80]
call fcn.180017020
lea rdi, [rdi + rbx*2]
mov r14, qword [rdi + rbp]
add rdi, 8
mov r13d, r12d
mov qword [rsi + 0x218], r12
test r14, r14
je 0x18002b914
lea r12, [rdi + rbp]
lea rcx, [rsi + 0x3c]
xor r8d, r8d
mov rdx, r12
add rdi, 0x93
call fcn.1800172e0
test eax, eax
je 0x18002b902
mov rcx, qword [rsi + 0x210]
mov rax, qword [rsi + 0x44]
imul rcx, rcx, 0x93
test byte [r12 + 0x78], 1
lea rdx, [rcx + rax - 0x93]
jne 0x18002b87b
inc qword [rsi + 0x218]
movzx ecx, word [rdx + 0x85]
shr ecx, 0xc
and ecx, 7
je 0x18002b8f9
sub ecx, 1
je 0x18002b8ee
sub ecx, 1
je 0x18002b8e3
sub ecx, 1
je 0x18002b8d8
cmp ecx, 1
jne 0x18002b902
lea rcx, [rsi + 0x3c]
call fcn.18002cec0
jmp 0x18002b902
mov rcx, rsi
call sym.PRDLL.dll_Undelete_Done
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Undelete_RestoreSession:_Unable_to_add_file_system._n
mov rcx, rsi
mov dword [rsi], eax
call fcn.180016b80
xor eax, eax
jmp 0x18002ba78
lea rcx, [rsi + 0x3c]
call fcn.18002cec0
jmp 0x18002b902
lea rcx, [rsi + 0x3c]
call fcn.1800121e0
jmp 0x18002b902
lea rcx, [rsi + 0x3c]
call fcn.18002cec0
jmp 0x18002b902
lea rcx, [rsi + 0x3c]
call fcn.18002cec0
inc r13d
mov eax, r13d
cmp rax, r14
jb 0x18002b830
xor r12d, r12d
mov r14d, dword [rdi + rbp]
mov r13d, r12d
test r14, r14
je 0x18002b9f0
lea rbx, [rdi + rbp + 8]
lea r12, [rsi + 0x3c]
movabs rdi, 0x8000000000000000
movabs rsi, 0x7fffffffffffffff
movabs rbp, 0xffffffffffff
nop dword [rax + rax]
mov rax, qword [rbx]
lea rcx, [rsp + 0x68]
add rbx, 0x18
mov qword [rcx], rax
mov rax, qword [rbx - 0x10]
mov qword [rcx + 8], rax
mov rax, qword [rbx - 8]
mov qword [rcx + 0x10], rax
mov rax, qword [r12]
test rax, rax
je 0x18002b999
lea rcx, [rsp + 0x68]
test rcx, rcx
je 0x18002b999
mov r8, qword [rsp + 0x68]
test rdi, r8
je 0x18002b99e
and r8, rsi
add r8, rax
mov qword [rsp + 0x68], r8
jmp 0x18002b99e
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], r9
mov rcx, rdx
mov rax, rdx
shr rcx, 0x3e
mov dword [rsp + 0x28], r9d
shr rax, 0x30
and ecx, 1
and rdx, rbp
movzx r9d, al
mov dword [rsp + 0x20], ecx
mov rcx, r12
call fcn.1800174c0
inc r13d
mov eax, r13d
cmp rax, r14
jb 0x18002b950
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor r12d, r12d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rsi + 0x2b5]
movzx ecx, word [rsi + 0x2af]
imul rcx, rcx, 0x126
mov rcx, qword [rcx + rax + 0xc]
mov rax, qword [rsp + 0x50]
lea rdx, str._tSession_restored._n
mov qword [rsi + 0x26c], rax
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x34], rcx
mov rcx, rsi
mov qword [rsi + 0x254], rax
call fcn.180016c70
or dword [rsi + 0x317], 0x4000000
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r8, [0x18002a750]
mov r9, rsi
mov edx, 0x800000
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x2e1], rax
mov eax, r15d
mov r13, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18002d590
add rsp, 0xa0
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret