Function at 0x1400e9848
Capabilities:
Get process image filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor r12d, r12d
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x208
mov ebx, r12d
call sub.msvcrt.dll_memset
test rdi, rdi
jne 0x1400e98cd
lea rdx, [0x1404587e8]
lea rcx, [0x14043480c]
call fcn.1400f39cc
mov edi, 0xc004e001
lea rdx, [0x140457c40]
lea rcx, [0x140441058]
mov r15d, edi
call fcn.1400f4710
mov ecx, edi
jmp 0x1400e9932
mov rax, qword [rdi]
cmp dword [rax], 0x50
je 0x1400e990c
lea rdx, [0x140457f30]
lea rcx, [0x14042a9a8]
call fcn.1400f3670
mov edi, 0xc004e001
mov ecx, edi
mov r15d, edi
call fcn.14007ac40
lea rdx, [0x14045c098]
lea rcx, [0x14042e048]
call fcn.1400f4080
jmp 0x1400e9937
mov rcx, rdi
call fcn.140052110
lea rdx, [0x1404586e0]
mov r15d, eax
lea rcx, [0x14042b0b8]
call fcn.1400f50fc
test r15d, r15d
jns 0x1400e9937
mov ecx, r15d
call fcn.14007ac40
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
mov r14d, eax
test eax, eax
jne 0x1400e9a2e
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov r14d, eax
test eax, eax
jne 0x1400e9a2e
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400e99a1
lea rdx, [0x140454c6c]
lea rcx, [0x14043ab58]
call fcn.1400f4dac
mov r14d, dword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
jmp 0x1400e9a3e
lea rdx, [0x140457848]
lea rcx, [0x14042a264]
call fcn.1400f39cc
lea rdx, [0x140452008]
lea rcx, [0x140433948]
call fcn.1400f3d28
mov rcx, rdi
mov rbx, rdi
test rdi, rdi
je 0x1400e998f
mov r8d, 0x104
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
jne 0x1400e998f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140458380]
mov ebx, eax
lea rcx, [0x14042ad78]
call fcn.1400f43c8
movzx r14d, bx
lea rdx, [0x14045a5a4]
or r14d, 0x80070000
lea rcx, [0x14042ce70]
test ebx, ebx
cmovle r14d, ebx
mov rbx, rdi
call fcn.1400f4a68
jmp 0x1400e9994
test r14d, r14d
js 0x1400e9a3e
movzx r14d, r14w
or r14d, 0x80010000
cmp dword [0x140451890], 5
jbe 0x1400e9ad0
movabs rax, 0x400000000000
test qword [0x1404518a0], rax
je 0x1400e9ad0
mov rdi, qword [0x1404518a8]
lea rdx, [0x140452c98]
lea rcx, [0x14042fe78]
and rdi, rax
call fcn.1400f3318
cmp rdi, qword [0x1404518a8]
jne 0x1400e9ad0
lea rax, [rsp + 0x60]
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x30], rax
lea rdx, [0x14044603c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140001758
mov ecx, r15d
call fcn.14007ace8
test rbx, rbx
je 0x1400e9ae6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140388a50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret