Function at 0x180030260
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r13, rcx
mov edi, ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800307b6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [rbx + 2]
mov rcx, rbp
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
test rax, rax
je 0x18003078e
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x18003078e
mov r9, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rbp
call fcn.180007830
test al, al
je 0x18003077b
movsxd rcx, dword [r14 + 0x3c]
mov r8d, 0x10b
add rcx, r14
mov esi, ebx
mov edx, 0x20b
movzx eax, word [rcx + 0x18]
cmp ax, r8w
jne 0x1800303b3
mov eax, dword [rcx + 0xc0]
test eax, eax
je 0x18003077b
mov edx, dword [rcx + 0x34]
mov r8b, 1
add rdx, rax
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18003077b
mov eax, dword [rax + 0xc]
test eax, eax
je 0x18003077b
mov edx, eax
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18003077b
cmp qword [rax], rbx
je 0x18003042a
test rdi, rdi
je 0x1800303a6
mov rcx, qword [rax]
mov qword [rdi], rcx
add rdi, 8
add rax, 8
inc esi
cmp qword [rax], rbx
jne 0x180030397
jmp 0x18003042a
cmp ax, dx
jne 0x18003077b
mov eax, dword [rcx + 0xd0]
test eax, eax
je 0x18003077b
mov edx, eax
mov r8b, 1
add rdx, qword [rcx + 0x30]
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18003077b
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x18003077b
mov r8b, 1
mov rcx, r14
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x18003077b
cmp qword [rax], rbx
je 0x18003042a
nop word [rax + rax]
test rdi, rdi
je 0x18003041f
mov rcx, qword [rax]
mov qword [rdi], rcx
add rdi, 8
add rax, 8
inc esi
cmp qword [rax], rbx
jne 0x180030410
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rbp
call fcn.18000dc30
xorps xmm0, xmm0
mov edx, esi
shl rdx, 3
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
call fcn.180014a70
mov rax, qword [rsp + 0x48]
mov rdi, rbx
cmp rax, qword [rsp + 0x40]
mov edx, 0x80000000
mov qword [rsp + 0x30], rbx
mov rcx, r13
cmovne rdi, qword [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180030741
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, r14
mov r12d, eax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
test rax, rax
je 0x180030719
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x180030719
mov r9, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
mov rdx, r14
call fcn.180007830
test al, al
je 0x180030706
movsxd rcx, dword [rbp + 0x3c]
mov edx, 0x10b
add rcx, rbp
mov esi, ebx
movzx eax, word [rcx + 0x18]
cmp ax, dx
jne 0x18003059c
mov eax, dword [rcx + 0xc0]
test eax, eax
je 0x180030706
mov edx, dword [rcx + 0x34]
mov r8b, 1
add rdx, rax
mov rcx, rbp
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x180030706
mov eax, dword [rax + 0xc]
test eax, eax
je 0x180030706
mov edx, eax
mov r8b, 1
mov rcx, rbp
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x180030706
cmp qword [rax], rbx
je 0x180030612
test rdi, rdi
je 0x18003058f
mov rcx, qword [rax]
mov qword [rdi], rcx
add rdi, 8
add rax, 8
inc esi
cmp qword [rax], rbx
jne 0x180030580
jmp 0x180030612
mov edx, 0x20b
cmp ax, dx
jne 0x180030706
mov eax, dword [rcx + 0xd0]
test eax, eax
je 0x180030706
mov edx, eax
mov r8b, 1
add rdx, qword [rcx + 0x30]
mov rcx, rbp
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x180030706
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x180030706
mov r8b, 1
mov rcx, rbp
call sym.TitanEngine.dll_ConvertVAtoFileOffset
test rax, rax
je 0x180030706
cmp qword [rax], rbx
je 0x180030612
test rdi, rdi
je 0x180030607
mov rcx, qword [rax]
mov qword [rdi], rcx
add rdi, 8
add rax, 8
inc esi
cmp qword [rax], rbx
jne 0x1800305f8
mov r9, rbp
mov r8, r15
mov edx, r12d
mov rcx, r14
call fcn.18000dc30
mov rcx, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rcx
cmovne rbx, rcx
test esi, esi
je 0x1800306c5
lea edx, [rsi*8]
mov rcx, rbx
call fcn.180007700
test al, al
je 0x1800306c0
mov rbp, qword [rsp + 0xa8]
test rbp, rbp
je 0x1800306c0
call fcn.1800059a0
test esi, esi
je 0x1800306a9
mov edi, esi
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [0x1800909f8]
cmp rdx, qword [0x180090a00]
je 0x180030690
mov rax, qword [rbx]
mov qword [rdx], rax
add qword [0x1800909f8], 8
jmp 0x18003069f
mov r8, rbx
lea rcx, [0x1800909f0]
call fcn.1800318a0
add rbx, 8
sub rdi, 1
jne 0x180030670
mov rcx, qword [rsp + 0x40]
mov bl, 1
mov qword [0x180084548], rbp
mov byte [0x180084338], 1
jmp 0x1800306c7
mov rcx, qword [rsp + 0x40]
xor bl, bl
test rcx, rcx
je 0x1800306fe
mov rdx, qword [rsp + 0x50]
mov r8, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800306f9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1800307d0
call fcn.180049e70
movzx eax, bl
jmp 0x1800307b8
mov r9, rbp
mov r8, r15
mov edx, r12d
mov rcx, r14
call fcn.18000dc30
jmp 0x180030741
lea rdx, [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180030741
test byte [rsp + 0xb0], 2
jne 0x180030741
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800307b6
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180030774
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800307d0
call fcn.180049e70
jmp 0x1800307b6
mov r9, r14
mov r8, r15
mov edx, r12d
mov rcx, rbp
call fcn.18000dc30
jmp 0x1800307b6
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800307b6
test byte [rsp + 0xb0], 2
jne 0x1800307b6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800503fc
int3