Function at 0x18000b990
Capabilities:
Get file size
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x2b8
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x68], rdx
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x18000b9d1
mov rbx, qword [0x180082d08]
test rbx, rbx
jne 0x18000b9d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov qword [rsp + 0x2e0], rbp
mov rdx, rdi
mov qword [rsp + 0x2b0], rsi
mov rcx, rbx
mov qword [rsp + 0x2a8], r12
mov qword [rsp + 0x2a0], r13
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x290], r15
call fcn.18000b5f0
mov qword [rsp + 0x60], rax
mov rdi, rax
test rax, rax
je 0x18000bc98
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.18004c900
mov r9d, 0x104
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x18000bc98
xor ebx, ebx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18000bc98
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x48], eax
lea r8d, [rbx + 2]
mov dword [rsp + 0x20], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000bc76
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x18000bc76
mov r9, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
call fcn.180007830
test al, al
je 0x18000bc28
movsxd rcx, dword [rsi + 0x3c]
mov eax, 0x10b
cmp word [rcx + rsi + 0x18], ax
jne 0x18000bb21
mov edi, dword [rcx + rsi + 0x7c]
mov r13d, dword [rcx + rsi + 0x34]
mov eax, dword [rcx + rsi + 0x78]
mov dword [rsp + 0x44], edi
jmp 0x18000bb38
mov eax, dword [rcx + rsi + 0x8c]
mov r13, qword [rcx + rsi + 0x30]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + rsi + 0x88]
mov r12d, eax
mov r8b, 1
mov rcx, rsi
lea rdx, [r12 + r13]
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov r14, rax
test rax, rax
je 0x18000bc28
mov edx, dword [rax + 0x1c]
mov r8b, 1
add rdx, r13
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov edx, dword [r14 + 0x20]
mov r8b, 1
add rdx, r13
mov qword [rsp + 0x50], rax
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov edx, dword [r14 + 0x24]
mov r8b, 1
add rdx, r13
mov rcx, rsi
mov rbp, rax
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rdi, rax
cmp qword [rsp + 0x50], rbx
je 0x18000bc28
test rbp, rbp
je 0x18000bc28
test rax, rax
je 0x18000bc28
mov eax, dword [r14 + 0x18]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x18000bc28
mov r14, qword [rsp + 0x60]
mov edx, dword [rbp]
mov r8b, 1
add rdx, r13
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rdx, rax
test rax, rax
je 0x18000bc18
movsx rcx, word [rdi]
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + rcx*4]
cmp rax, r12
jb 0x18000bbf6
mov ecx, dword [rsp + 0x44]
add rcx, r12
cmp rax, rcx
jb 0x18000bc18
add rax, r14
cmp rax, qword [rsp + 0x68]
jne 0x18000bc18
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x18000bc07
cmp rax, 0x1388
jb 0x18000bc3e
inc ebx
add rbp, 4
add rdi, 2
cmp ebx, dword [rsp + 0x40]
jb 0x18000bbc0
mov r8, qword [rsp + 0x58]
mov r9, rsi
mov edx, dword [rsp + 0x48]
mov rcx, r15
call fcn.18000dc30
jmp 0x18000bc98
lea rcx, [0x180096ec0]
sub rcx, rdx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18000bc50
mov r8, qword [rsp + 0x58]
mov r9, rsi
mov edx, dword [rsp + 0x48]
mov rcx, r15
call fcn.18000dc30
mov al, 1
jmp 0x18000bc9a
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18000bc98
test byte [rsp + 0x40], 2
jne 0x18000bc98
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
mov rbp, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x2b8
pop rdi
pop rbx
ret