Function at 0x18001ae10
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rbp + 0x770], rax
xor r13d, r13d
mov byte [rsp + 0x40], r8b
movzx r14d, r8b
mov qword [rsp + 0x30], r13
mov r15, rdx
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov qword [rsp + 0x50], rcx
lea r8d, [r13 + 1]
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18001b4bd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rsp + 0x44], eax
lea r8d, [r13 + 2]
mov dword [rsp + 0x20], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x60], rax
mov rsi, rax
test rax, rax
je 0x18001b49b
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
lea edx, [r13 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18001b49b
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x8d0], rbx
cmp eax, 0xf94
jge 0x18001b485
lea rbx, [rdi + rax]
mov ecx, 0x10b
movzx eax, word [rbx + 0x18]
cmp ax, cx
jne 0x18001af16
mov esi, r13d
jmp 0x18001af29
mov ecx, 0x20b
cmp ax, cx
jne 0x18001b485
mov esi, 1
test r14b, r14b
je 0x18001af6d
mov rcx, qword [0x180082e88]
test rcx, rcx
je 0x18001af48
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
mov edx, 0x5000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180082e88], rax
mov qword [0x180082e80], rax
mov r8b, 1
mov rcx, rdi
test esi, esi
jne 0x18001b1dc
mov r14d, dword [rbx + 0x34]
mov edx, dword [rbx + 0x80]
add rdx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18001b445
lea rsi, [rax + 0x10]
mov r13d, 0x5c
cmp dword [rsi], 0
je 0x18001b445
mov edx, dword [rsi - 4]
mov r8b, 1
add rdx, r14
mov rcx, rdi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
test rax, rax
je 0x18001b1ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rbp + 0x370]
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rcx
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov r8, r15
call fcn.180007000
test al, al
jne 0x18001b1c6
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x400
call fcn.18004c900
mov rdx, r15
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x6e], r13w
je 0x18001b05a
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rsp + rcx*2 + 0x70], r13w
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp byte [rsp + 0x40], 0
je 0x18001b0b9
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x180082e80]
lea rdx, [rsp + 0x70]
add eax, eax
movsxd r8, eax
call fcn.18004c130
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd rcx, eax
mov rax, qword [0x180082e80]
add rax, 2
add rcx, rax
mov qword [0x180082e80], rcx
lea rdx, [rsp + 0x70]
lea rcx, str.MODULEx86
call fcn.180006d50
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 1]
call sym.TitanEngine.dll_GetPE32DataW
cmp qword [0x180090f18], 0
je 0x18001b0e9
call sym.TitanEngine.dll_ExporterCleanup
xor ecx, ecx
mov dword [0x180096bb0], 0
mov edx, 0x5000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rbx
mov qword [0x180090f18], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x180090f18]
mov rdx, rbx
movsxd r8, eax
call fcn.18004c130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov rax, qword [0x180090f18]
add rax, 2
mov byte [0x1800915ac], 1
add rcx, rax
mov eax, dword [rsi - 0x10]
mov qword [0x1800915a0], rcx
mov rcx, rdi
test eax, eax
jne 0x18001b160
mov eax, dword [rsi]
mov edx, eax
mov r8b, 1
add rdx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
test rax, rax
je 0x18001b1b5
mov ecx, dword [rbx]
test ecx, ecx
je 0x18001b1b5
jns 0x18001b18d
btc ecx, 0x1f
mov edx, 0x1000
call sym.TitanEngine.dll_ExporterAddNewOrdinalExport
jmp 0x18001b1af
lea rdx, [r14 + rcx]
mov r8b, 1
mov rcx, rdi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
add rax, 2
je 0x18001b1af
mov edx, 0x1000
mov rcx, rax
call sym.TitanEngine.dll_ExporterAddNewExport
add rbx, 4
jne 0x18001b175
lea rdx, [0x18006d748]
lea rcx, [rsp + 0x70]
call sym.TitanEngine.dll_ExporterBuildExportTableExW
add rsi, 0x14
lea rax, [rsi - 0x10]
test rax, rax
jne 0x18001afa0
jmp 0x18001b445
mov r14, qword [rbx + 0x30]
mov edx, dword [rbx + 0x90]
add rdx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18001b445
movzx r12d, byte [rsp + 0x40]
lea rsi, [rax + 0x10]
mov r13d, 0x5c
cmp dword [rsi], 0
je 0x18001b440
mov edx, dword [rsi - 4]
mov r8b, 1
add rdx, r14
mov rcx, rdi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
test rax, rax
je 0x18001b433
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rbp + 0x370]
mov dword [rsp + 0x28], 0x200
mov qword [rsp + 0x20], rcx
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x370]
mov r8, r15
call fcn.180007000
test al, al
jne 0x18001b42f
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x400
call fcn.18004c900
mov rdx, r15
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x6e], r13w
je 0x18001b2c1
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rsp + rcx*2 + 0x70], r13w
lea rdx, [rbp + 0x370]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test r12b, r12b
je 0x18001b31e
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x180082e80]
lea rdx, [rsp + 0x70]
add eax, eax
movsxd r8, eax
call fcn.18004c130
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd rcx, eax
mov rax, qword [0x180082e80]
add rax, 2
add rcx, rax
mov qword [0x180082e80], rcx
lea rdx, [rsp + 0x70]
lea rcx, str.MODULEx64
call fcn.180006d50
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 1]
call sym.TitanEngine.dll_GetPE32DataW
cmp qword [0x180090f18], 0
je 0x18001b34e
call sym.TitanEngine.dll_ExporterCleanup
xor ecx, ecx
mov dword [0x180096bb0], 0
mov edx, 0x5000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rbx
mov qword [0x180090f18], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x180090f18]
mov rdx, rbx
movsxd r8, eax
call fcn.18004c130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov rax, qword [0x180090f18]
add rax, 2
mov byte [0x1800915ac], 1
add rcx, rax
mov eax, dword [rsi - 0x10]
mov qword [0x1800915a0], rcx
mov rcx, rdi
test eax, eax
jne 0x18001b3c5
mov eax, dword [rsi]
mov edx, eax
mov r8b, 1
add rdx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rbx, rax
test rax, rax
je 0x18001b41e
nop word [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001b41e
jns 0x18001b3f6
mov edx, 0x1000
call sym.TitanEngine.dll_ExporterAddNewOrdinalExport
jmp 0x18001b418
lea rdx, [rcx + r14]
mov r8b, 1
mov rcx, rdi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
add rax, 2
je 0x18001b418
mov edx, 0x1000
mov rcx, rax
call sym.TitanEngine.dll_ExporterAddNewExport
add rbx, 8
jne 0x18001b3e0
lea rdx, str..export
lea rcx, [rsp + 0x70]
call sym.TitanEngine.dll_ExporterBuildExportTableExW
add rsi, 0x14
lea rax, [rsi - 0x10]
test rax, rax
jne 0x18001b207
mov r12, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, rdi
mov edx, dword [rsp + 0x44]
mov rcx, r12
call fcn.18000dc30
mov al, 1
mov rbx, qword [rsp + 0x8d0]
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x880
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [rsp + 0x44]
mov r9, rdi
mov r8, rsi
mov rcx, r12
call fcn.18000dc30
xor al, al
jmp 0x18001b45b
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x18001b4bd
test byte [rsp + 0x48], 2
jne 0x18001b4bd
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x18001b463