Function at 0x140043440
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x300
mov rax, qword [0x1400fe3f8]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov r14, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
call fcn.1400448b0
mov byte [r14 + 8], al
mov rcx, qword [r14]
call fcn.140044520
movzx ebx, al
mov ecx, 0x108
call fcn.14009c500
mov rsi, rax
mov qword [rsp + 0x48], rax
xor r15d, r15d
test rax, rax
je 0x14004354f
movzx ecx, byte [r14 + 9]
lea rdx, [r14 + 0x20]
mov edi, dword [rdx]
lea rax, vtable.pesieve::ProcessScanReport.0
mov qword [rsi], rax
mov qword [rsi + 8], r15
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], 0xf
mov byte [rsi + 8], r15b
mov qword [rsi + 0x28], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x40], r15
mov dword [rsi + 0x48], edi
mov byte [rsi + 0x4c], bl
mov byte [rsi + 0x4d], r15b
mov byte [rsi + 0x4e], cl
mov qword [rsi + 0x50], rdx
mov qword [rsi + 0x58], r15
lea rbx, [rsi + 0x60]
mov qword [rsp + 0x40], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x30]
call fcn.14009c500
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rbx + 0x10], edi
lea rcx, [rsi + 0x78]
lea rax, [fcn.14000b4b0]
mov qword [rsp + 0x20], rax
lea r9, [0x140040850]
lea edx, [r15 + 0x10]
lea r8d, [r15 + 9]
call fcn.14009cf20
nop
jmp 0x140043552
mov rsi, r15
mov qword [rsp + 0x30], rsi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x1e0]
call fcn.14009f630
mov r8d, 0x104
lea rdx, [rsp + 0x1e0]
mov rcx, qword [r14]
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
lea rax, [rsp + 0x1e0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400435b5
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x1a0]
call fcn.140012bb0
nop
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1c0]
call fcn.14003f540
mov rdi, rax
lea rbx, [rsi + 8]
cmp rbx, rax
je 0x14004365c
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140043630
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14004362b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140043a61
mov rcx, r8
call fcn.14006b0f0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x14004369f
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004369a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043a61
call fcn.14006b0f0
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x1d8], 0xf
mov byte [rsp + 0x1c0], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x1400436fe
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400436f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043a67
call fcn.14006b0f0
mov edx, 1
lea rcx, [rsp + 0xa0]
call fcn.140005c90
nop
mov rdx, rsi
mov rcx, r14
call fcn.140041df0
mov qword [rsp + 0x58], rax
jmp 0x140043730
mov rdx, rsi
mov rcx, r14
call fcn.140043d80
mov qword [rsp + 0x40], rax
jmp 0x14004374f
mov qword [rsp + 0x50], r15
cmp dword [r14 + 0x44], 0
je 0x14004377a
mov rdx, rsi
mov rcx, r14
call fcn.140042d60
mov qword [rsp + 0x50], rax
jmp 0x14004377a
mov rax, r15
cmp byte [r14 + 0x40], 0
je 0x1400437a2
mov rdx, rsi
mov rcx, r14
call fcn.140043ab0
nop
jmp 0x1400437a2
cmp qword [rsp + 0x58], 0
jne 0x1400437c3
cmp qword [rsp + 0x50], 0
jne 0x1400437c3
cmp qword [rsp + 0x40], 0
jne 0x1400437c3
test rax, rax
je 0x140043a6d
mov qword [rsp + 0x48], rsi
lea rdx, [rsi + 0x98]
lea rcx, [rsp + 0x48]
call fcn.140058710
cmp byte [rsi + 0x4d], 0
je 0x140043a28
mov edx, dword [r14 + 0x24]
test edx, edx
je 0x140043a28
cmp edx, 1
je 0x1400437fd
cmp edx, 4
jne 0x14004388d
mov rcx, qword [rsi + 0x78]
mov rax, qword [rcx]
cmp rax, rcx
je 0x14004388d
nop dword [rax]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140043829
cmp byte [rcx + 0x18], 0
je 0x140043829
cmp dword [rcx + 0x50], 1
jne 0x140043829
mov dword [rcx + 0x50], r15d
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x140043858
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x140043853
nop dword [rax]
cmp rax, qword [rcx + 0x10]
jne 0x140043853
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x140043840
mov rax, rcx
jmp 0x14004387f
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], 0
jne 0x14004387f
nop dword [rax]
nop dword [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x140043870
cmp rax, qword [rsi + 0x78]
jne 0x140043810
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x24]
cmp edx, 3
je 0x14004389b
cmp edx, 4
jne 0x140043920
mov rcx, qword [rsi + 0x98]
mov rax, qword [rcx]
cmp rax, rcx
je 0x140043920
nop word [rax + rax]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1400438c3
cmp dword [rcx + 0x50], 1
jne 0x1400438c3
mov dword [rcx + 0x50], r15d
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x1400438ef
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x1400438ea
cmp rax, qword [rcx + 0x10]
jne 0x1400438ea
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x1400438d7
mov rax, rcx
jmp 0x14004390f
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], 0
jne 0x14004390f
nop dword [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x140043900
cmp rax, qword [rsi + 0x98]
jne 0x1400438b0
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x24]
lea eax, [rdx - 2]
test eax, 0xfffffffd
jne 0x140043a28
mov rcx, qword [rsi + 0xa8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1400439a8
nop dword [rax]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140043953
cmp dword [rcx + 0x50], 1
jne 0x140043953
mov dword [rcx + 0x50], r15d
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14004397f
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x14004397a
cmp rax, qword [rcx + 0x10]
jne 0x14004397a
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x140043967
mov rax, rcx
jmp 0x14004399f
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], 0
jne 0x14004399f
nop dword [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x140043990
cmp rax, qword [rsi + 0xa8]
jne 0x140043940
mov rcx, qword [rsi + 0xf8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x140043a28
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1400439ca
cmp dword [rcx + 0x50], 1
jne 0x1400439ca
mov dword [rcx + 0x50], r15d
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x1400439f8
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x1400439f3
nop
cmp rax, qword [rcx + 0x10]
jne 0x1400439f3
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x1400439e0
mov rax, rcx
jmp 0x140043a1f
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], 0
jne 0x140043a1f
nop dword [rax]
nop dword [rax + rax]
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], 0
je 0x140043a10
cmp rax, qword [rsi + 0xf8]
jne 0x1400439b7
lea rcx, [rsp + 0xa0]
call fcn.14000c2f0
mov rax, rsi
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14009c8a0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.1400a3548
nop
call fcn.1400a3548
nop
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0xa0]
call fcn.14001bcc0
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140040b50
lea rdx, [0x1400fc268]
lea rcx, [rsp + 0x88]
call fcn.14009d9c0
int3