Function at 0x140009740
Capabilities:
Get process image filename

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14008d558]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
movzx esi, dl
lea rcx, [0x14008e5e8]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rbx, qword [0x14008e608]
mov qword [rsp + 0x50], 0
test rbx, rbx
je 0x140009aa5
mov rax, qword [0x14008fbf8]
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x98], r14
call qword [0x14006d610]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x54], eax
lea rdx, [0x140002c40]
mov rax, qword [0x14008fc00]
mov rcx, rdi
call qword [0x14006d610]
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140009872
cmp dword [0x14008d0b0], 4
jl 0x14000980b
test dword [0x14008d12c], 0x10000
je 0x14000980b
lea edx, [rax + 4]
mov ecx, 0x10000
lea edi, [rax + 1]
call fcn.14000b080
mov edx, eax
jmp 0x140009826
mov edx, 4
mov ecx, 0x10000
call fcn.14000b080
xor edi, edi
mov edx, eax
test eax, eax
je 0x140009a9d
mov eax, dword [rsp + 0x54]
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
mov dword [rsp + 0x40], eax
mov r9d, 4
lea rax, str.Unable_to_get_handle_to_process__lu_n
mov r8d, 0x10000
mov qword [rsp + 0x38], rax
mov ecx, edi
mov dword [rsp + 0x30], 0x30f
lea rax, str.proc_det_get_name_from_window
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.14000b530
jmp 0x140009a9d
mov r8d, 0x410
mov rdx, rbx
mov rcx, rdi
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140009a9d
mov rcx, qword [0x14008e610]
mov r8, qword [0x14008e608]
test sil, sil
jne 0x1400098d0
mov r10, rcx
mov rax, r8
sub r10, r8
movzx r9d, byte [rax]
movzx edx, byte [rax + r10]
sub r9d, edx
jne 0x1400098c7
inc rax
test edx, edx
jne 0x1400098b2
test r9d, r9d
je 0x140009a9d
mov edx, 0x410
mov r9, 0xffffffffffffffff
call fcn.140025d24
mov rcx, qword [0x14008e610]
cmp byte [rcx], 0
je 0x140009a9d
mov edx, 0x5c
call fcn.140015a40
mov rbx, rax
test rax, rax
je 0x140009a9d
mov esi, dword [0x14008e610]
lea r14, str.C:jenkinsworkspacedptfSrcESIFProductsESIF_UFSourceswinesif_assist.c
inc rbx
mov qword [rsp + 0x88], rbp
sub esi, ebx
mov qword [rsp + 0x90], r12
add esi, 0x410
lea r12, str.proc_det_send_proc_change_event
cmp dword [0x14008d0b0], 4
mov edi, 1
jl 0x140009961
test dword [0x14008d12c], 0x10000
je 0x140009961
lea edx, [rdi + 3]
mov ecx, 0x10000
mov ebp, edi
call fcn.14000b080
jmp 0x140009976
mov edx, 4
mov ecx, 0x10000
call fcn.14000b080
xor ebp, ebp
test eax, eax
je 0x1400099ae
mov qword [rsp + 0x40], rbx
lea rcx, str.Topmost_process_changed_to__s_n
mov qword [rsp + 0x38], rcx
mov r9d, 4
mov dword [rsp + 0x30], 0x360
mov r8d, 0x10000
mov qword [rsp + 0x28], r14
mov edx, eax
mov ecx, ebp
mov qword [rsp + 0x20], r12
call fcn.14000b530
xor edx, edx
mov r8d, esi
lea rax, [rsp + 0x50]
mov ebp, esi
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0
lea ecx, [rdx + 0xd]
mov qword [rsp + 0x20], 0
call fcn.140010350
mov rsi, rax
test rax, rax
je 0x140009a8d
test rbp, rbp
je 0x140009a01
lea rcx, [rax + 0x30]
mov r9, 0xffffffffffffffff
mov r8, rbx
mov edx, ebp
call fcn.140025d24
mov r8d, dword [rsp + 0x50]
lea rcx, [0x14008e310]
mov rdx, rsi
call fcn.140011130
test eax, eax
jne 0x140009a85
cmp dword [0x14008d0b0], 2
jl 0x140009a3d
test dword [0x14008d0fc], 0x10000
je 0x140009a3d
lea edx, [rax + 2]
mov ecx, 0x10000
call fcn.14000b080
jmp 0x140009a52
mov edx, 2
mov ecx, 0x10000
call fcn.14000b080
xor edi, edi
test eax, eax
je 0x140009a85
lea rcx, str.Error_sending_IPC_command_for_process_change
mov r9d, 2
mov qword [rsp + 0x38], rcx
mov r8d, 0x10000
mov dword [rsp + 0x30], 0x36c
mov edx, eax
mov qword [rsp + 0x28], r14
mov ecx, edi
mov qword [rsp + 0x20], r12
call fcn.14000b530
mov rcx, rsi
call fcn.140023f98
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r14, qword [rsp + 0x98]
lea rcx, [0x14008e5e8]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014190
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret