Function at 0x180030e00
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800311d1
mov qword [rsp + 0x50], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
test rax, rax
je 0x1800311a9
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x1800311a9
mov qword [rsp + 0xc8], rax
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rsi
call fcn.180007830
test al, al
je 0x180031065
mov dword [0x180096e4c], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x180096e08], xmm0
mov qword [0x180096e18], rax
xorps xmm1, xmm1
movups xmmword [0x180096e20], xmm1
movups xmmword [0x180096e30], xmm1
mov qword [0x180096e40], rax
call fcn.18000ee10
lea rax, [0x180096e48]
mov qword [rsp + 0xc0], rax
movsxd rcx, dword [r14 + 0x3c]
add rcx, r14
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
cmp ax, dx
jne 0x18003107b
mov eax, dword [rcx + 0xc0]
test eax, eax
je 0x18003105f
mov byte [0x1800915ad], dil
mov dword [0x180096e4c], eax
mov edx, dword [rcx + 0x34]
add rdx, rax
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
lea r8d, [rdi + 0x18]
mov rdx, rax
lea rcx, [0x180096e08]
call fcn.18004c130
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x18003100e
mov r13d, edi
mov qword [rsp + 0x68], rdi
mov edx, eax
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
mov qword [rsp + 0x58], rax
mov rdx, qword [0x180090ac0]
cmp qword [rbx], r13
je 0x180030ff0
cmp rdx, qword [0x180090ac8]
je 0x180030fc9
mov rcx, qword [rbx]
mov qword [rdx], rcx
mov rdx, qword [0x180090ac0]
add rdx, 8
mov qword [0x180090ac0], rdx
jmp 0x180030fdf
mov r8, rbx
lea rcx, [0x180090ab8]
call fcn.1800318a0
mov rdx, qword [0x180090ac0]
add rbx, 8
mov qword [rsp + 0x58], rbx
inc edi
mov dword [rsp + 0x40], edi
jmp 0x180030fa1
mov dword [0x180096e48], edi
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.18000dc30
mov al, 1
jmp 0x1800311d3
mov dword [0x180096e48], edi
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.18000dc30
xor al, al
jmp 0x1800311d3
mov dword [0x180096e48], edi
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.18000dc30
jmp 0x1800311d1
mov edx, 0x20b
cmp ax, dx
jne 0x180031065
mov eax, dword [rcx + 0xd0]
test eax, eax
je 0x18003105f
mov byte [0x1800915ad], 1
mov dword [0x180096e4c], eax
mov edx, eax
add rdx, qword [rcx + 0x30]
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
mov r8d, 0x28
mov rdx, rax
lea rcx, [0x180096e20]
call fcn.18004c130
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x18003115e
mov r13, rdi
mov qword [rsp + 0x68], rdi
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rdx, qword [0x180090ac0]
cmp qword [rbx], r13
je 0x180031143
cmp rdx, qword [0x180090ac8]
je 0x18003111c
mov rcx, qword [rbx]
mov qword [rdx], rcx
mov rdx, qword [0x180090ac0]
add rdx, 8
mov qword [0x180090ac0], rdx
jmp 0x180031132
mov r8, rbx
lea rcx, [0x180090ab8]
call fcn.1800318a0
mov rdx, qword [0x180090ac0]
add rbx, 8
mov qword [rsp + 0x60], rbx
inc edi
mov dword [rsp + 0x40], edi
jmp 0x1800310f4
mov dword [0x180096e48], edi
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.18000dc30
mov al, 1
jmp 0x1800311d3
mov dword [0x180096e48], edi
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.18000dc30
xor al, al
jmp 0x1800311d3
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800311d1
test byte [rsp + 0xb8], 2
jne 0x1800311d1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret