Function at 0x180022eb0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r13, qword [rsp + 0x4f0]
xor eax, eax
mov r12, qword [rsp + 0x510]
mov r14d, ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], eax
movzx esi, r9b
mov r15, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x2e
lea rcx, [rsp + 0x50]
call fcn.18004acc4
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
movzx ebx, word [rax]
xor eax, eax
mov word [rdi], ax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str._scy
mov word [rdi], bx
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test sil, sil
je 0x180022fa6
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, qword [rsp + 0x4e8]
mov r8, rbp
mov rcx, rax
mov rdx, r13
call sym.TitanEngine.dll_DumpProcessW
test al, al
jne 0x180022fa6
xor eax, eax
jmp 0x1800230e7
mov r9, qword [rsp + 0x4f8]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x20], 0
mov ecx, r14d
call sym.TitanEngine.dll_scylla_searchIAT
test eax, eax
je 0x180022fe4
cmp eax, 0xff
jne 0x180022fda
mov eax, 0x401
jmp 0x1800230e7
add eax, 0xffffff04
cmp eax, 1
jbe 0x180023001
mov edx, dword [rsp + 0x40]
mov r9, r12
mov rcx, qword [rsp + 0x48]
mov r8d, r14d
call sym.TitanEngine.dll_scylla_getImports
call sym.TitanEngine.dll_scylla_importsValid
test al, al
jne 0x18002300b
mov eax, 0x405
jmp 0x1800230e7
mov r8, r15
lea rdx, [rsp + 0x260]
mov rcx, rbp
call sym.TitanEngine.dll_scylla_fixDump
cmp eax, 0xfe
jne 0x18002302f
mov eax, 0x407
jmp 0x1800230e7
cmp byte [rsp + 0x4e0], 0
je 0x1800230e2
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0xe0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180023134
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 0x40]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x180023112
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180023112
xor r8d, r8d
mov edx, ebp
mov rcx, rax
call sym.TitanEngine.dll_RealignPE
mov r9, rdi
mov r8, rsi
mov edx, eax
mov rcx, rbx
call fcn.18000dc30
mov eax, 0x400
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180023134
test byte [rsp + 0x40], 2
jne 0x180023134
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x406
jmp 0x1800230e7