Function at 0x18000c9d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x5b0
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
xor r14d, r14d
mov ebx, r14d
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x180]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x390]
call fcn.18004c900
nop
mov rax, qword [0x1800832b8]
test rax, rax
jne 0x18000ca58
lea ecx, [rax + 0x23]
call sym.TitanEngine.dll_GetContextData
mov qword [0x1800832b8], rax
cmp byte [0x180083ade], 0
je 0x18000ca80
mov r8, rax
lea rdx, str._x__Entry_Point_at:__08X
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x70]
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
cmp byte [0x180083ac3], 0
je 0x18000cc0c
mov rdi, qword [0x180082c38]
mov qword [rsp + 0x48], rdi
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180084130]
call sym.TitanEngine.dll_GetPE32DataW
mov rdx, rax
mov r8, rdi
mov ecx, 0x19000
call sym.TitanEngine.dll_RelocaterInit
mov edx, r14d
mov dword [rsp + 0x44], edx
movabs r10, 0x34f72c234f72c235
mov r9, qword [0x180090a48]
mov r8, qword [0x180090a40]
nop word [rax + rax]
mov rax, r9
sub rax, r8
imul rax, r10
cmp edx, eax
jge 0x18000cb0a
movsxd rax, edx
imul rcx, rax, 0x1d
cmp dword [rcx + r8 + 0x18], 1
cmove ebx, edx
mov dword [rsp + 0x68], ebx
inc edx
mov dword [rsp + 0x44], edx
jmp 0x18000cae0
cmp word [0x180083ae0], 0
jne 0x18000cbb5
lea rdx, [rsp + 0x180]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jae 0x18000cbae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rax + 0x12d]
lea r9, [rsp + 0x390]
lea rdx, [0x18006d1f8]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18000cbae
lea rdx, [rsp + 0x390]
lea rsi, [0x180083ae0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movsxd rax, ebx
imul rcx, rax, 0x1d
mov rax, qword [0x180090a40]
mov r8, qword [rcx + rax + 0x10]
mov rdx, qword [rcx + rax + 8]
add rdx, rdi
mov rax, qword [0x1800830a8]
mov r9, rsi
mov rcx, qword [rax]
call sym.TitanEngine.dll_DumpMemoryW
mov r8, qword [0x180090a40]
jmp 0x18000cbbc
mov r8, qword [0x180090a40]
lea rsi, [0x180083ae0]
movsxd rax, ebx
imul rax, rax, 0x1d
mov rbx, qword [rax + r8 + 8]
add rbx, rdi
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [0x180084130]
call sym.TitanEngine.dll_GetPE32DataW
mov r8, rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x180083d10]
mov rdx, rdi
mov rcx, qword [0x1800830a8]
mov rcx, qword [rcx]
call sym.TitanEngine.dll_RelocaterCompareTwoSnapshotsW
mov byte [0x180082c9f], 1
jmp 0x18000cc18
mov rdi, qword [0x180082c40]
mov qword [rsp + 0x48], rdi
lea r8, [0x180084130]
mov rdx, rdi
mov rcx, qword [0x1800830a8]
mov rcx, qword [rcx]
call sym.TitanEngine.dll_PastePEHeaderW
test al, al
je 0x18000cc4a
cmp byte [0x180083ade], 0
je 0x18000cc4a
lea rcx, str._x__Paste_PE_header
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
mov r9, qword [0x1800832b8]
lea r8, [0x180083f20]
mov rdx, rdi
mov rcx, qword [0x1800830a8]
mov rcx, qword [rcx]
call sym.TitanEngine.dll_DumpProcessW
cmp byte [0x180083ade], 0
je 0x18000cc7f
lea rcx, str._x__Process_dumped_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
call sym.TitanEngine.dll_scylla_estimatedIATSize
lea r8d, [rax + 0xc8]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [0x18006cf34]
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_AddNewSectionExW
lea esi, [rdi + rax]
cmp byte [0x180082c9f], 0
je 0x18000ccf9
cmp byte [0x180083ac3], 0
je 0x18000ccf9
mov r8d, dword [0x180084c00]
sub r8d, dword [0x180096bd8]
add r8d, 0xd0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str..TEv2
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_AddNewSectionExW
mov ebx, eax
jmp 0x18000ccfd
mov ebx, dword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_StaticFileLoadW
test al, al
je 0x18000ced1
movsxd rdx, esi
mov r8b, 1
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov r14, qword [rsp + 0x58]
mov r8, r14
mov rdx, rsi
mov rcx, rax
call sym.TitanEngine.dll_scylla_fixMappedDump
test eax, eax
jne 0x18000cd79
cmp byte [0x180083ade], al
je 0x18000cd79
lea rcx, str._x__IAT_has_been_fixed_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
cmp byte [0x180082c9f], 0
je 0x18000cdbe
cmp byte [0x180083ac3], 0
je 0x18000cdbe
movsxd rdx, ebx
add rdx, rdi
mov r8b, 1
mov rcx, rsi
call sym.TitanEngine.dll_ConvertVAtoFileOffset
mov rcx, rax
mov r8, rsi
mov edx, ebx
call sym.TitanEngine.dll_RelocaterExportRelocation
cmp byte [0x180083ade], 0
je 0x18000cdbe
lea rcx, str._x__Exporting_relocations_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
cmp byte [0x180083adc], 0
je 0x18000cdf6
mov r8d, 2
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call sym.TitanEngine.dll_RealignPE
mov ebx, eax
mov dword [rsp + 0x40], eax
cmp byte [0x180083ade], 0
je 0x18000cdfa
lea rcx, str._x__Realigning_file_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
jmp 0x18000cdfa
mov ebx, dword [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_StaticFileUnloadW
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_MakeAllSectionsRWEW
cmp byte [0x180083ac3], 0
je 0x18000ce6c
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180084130]
call sym.TitanEngine.dll_GetPE32DataW
mov rdx, rax
lea rcx, [0x180083f20]
call sym.TitanEngine.dll_RelocaterChangeFileBaseW
test al, al
je 0x18000ce6c
cmp byte [0x180083ade], 0
je 0x18000ce6c
lea rcx, str._x__Rebase_file_image_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
cmp byte [0x180083adb], 0
je 0x18000ceb7
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x48]
lea rcx, [0x180084130]
call sym.TitanEngine.dll_FindOverlayW
test al, al
je 0x18000ceb7
lea rdx, [0x180083f20]
lea rcx, [0x180084130]
call sym.TitanEngine.dll_CopyOverlayW
cmp byte [0x180083ade], 0
je 0x18000ceb7
lea rcx, str._x__Moving_overlay_to_unpacked_file_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
call sym.TitanEngine.dll_StopDebug
cmp byte [0x180083ade], 0
je 0x18000ced1
lea rcx, str._Success__File_has_been_unpacked_
call sym.TitanEngine.dll_EngineAddUnpackerWindowLogMessage
jmp 0x18000cf85
cmp byte [0x180083ade], 0
je 0x18000cfdc
lea r9, str.___Unpack_ended...
xor r8d, r8d
mov edx, 0x180
mov rcx, qword [0x180084128]
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
mov rcx, qword [0x180084128]
call qword [sym.imp.USER32.dll_SendMessageA]
dec eax
movsxd r8, eax
xor r9d, r9d
mov edx, 0x186
mov rcx, qword [0x180084128]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret