Function at 0x1800611f0
Capabilities:
Get process image filename

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x660], rbx
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov r15d, r8d
mov dword [rsp + 0x40], r8d
mov r12, rdx
mov qword [rsp + 0x78], rdx
xor esi, esi
mov dword [rsp + 0x38], esi
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x180061b44
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, [0x18010e038]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180037120
lea r14, [rsi - 1]
test al, al
jne 0x18006129d
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x180061282
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180009210
nop
mov r8d, r15d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r13, [0x1801126b0]
test rax, rax
je 0x18006162b
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x300]
call fcn.1800d4600
mov r8d, 0x104
lea rdx, [rbp + 0x300]
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x18006145e
lea rax, [rbp + 0x300]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180061300
mov rbx, qword [rsp + 0x30]
test edi, edi
jne 0x180061382
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x18006161b
cmp dword [rdx + 0x10], 0
jge 0x18006134a
cmp dword [rbx - 0xc], 0
jl 0x180061b4f
mov dword [rbx - 0x10], esi
mov word [rbx], si
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800617e8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180061360
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800617e8
mov r13d, dword [rbx - 0x10]
lea r15, [rbp + 0x300]
sub r15, rbx
sar r15, 1
test edi, edi
js 0x180061b5a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800613bd
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.180009160
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
cmp r15, r13
ja 0x180061414
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x180061431
test rdx, rdx
jne 0x1800613e9
call fcn.1800d7e04
mov dword [rax], 0x16
call fcn.1800d79d8
jmp 0x180061431
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x180061407
call fcn.1800d7e04
mov dword [rax], 0x22
call fcn.1800d79d8
jmp 0x180061431
mov r8, r15
mov rcx, rbx
call fcn.1800d4190
jmp 0x180061431
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [rbp + 0x300]
mov rcx, rbx
call fcn.180009440
cmp edi, dword [rbx - 0xc]
jg 0x180061b65
mov dword [rbx - 0x10], edi
mov word [r15 + rbx], si
lea r13, [0x1801126b0]
mov r15d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800617e8
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180061616
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x2a8], xmm0
mov byte [rbp + 0x298], 0
mov r8d, 0x6b
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x298]
call fcn.18000a3d0
nop
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x248], xmm0
mov byte [rbp + 0x238], 0
mov r8d, 3
lea rdx, [0x180112978]
lea rcx, [rbp + 0x238]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, r15d
lea r8, str.getAppNameById_GetProcessImageFileName__d_failed.__d
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.18007d7e0
mov dword [rsp + 0x38], 2
mov r9d, 0x183
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x238]
lea rcx, [rbp - 0x80]
call fcn.18000dda0
mov rbx, rax
mov rax, qword [rsp + 0x58]
mov rdx, r13
test rax, rax
cmovne rdx, rax
mov rcx, rbx
call fcn.18000c590
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp - 0x80]
call fcn.18000f5c0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006157d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x250]
cmp rdx, 0x10
jb 0x1800615be
inc rdx
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800615b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b70
call fcn.1800a4c5c
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x248], xmm0
mov byte [rbp + 0x238], 0
mov rdx, qword [rbp + 0x2b0]
cmp rdx, 0x10
jb 0x180061616
inc rdx
mov rcx, qword [rbp + 0x298]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061611
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b76
call fcn.1800a4c5c
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800617e8
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x1800617e3
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x2c8], xmm0
mov byte [rbp + 0x2b8], 0
mov r8d, 0x6b
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x2b8]
call fcn.18000a3d0
nop
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x268], xmm0
mov byte [rbp + 0x258], 0
mov r8d, 3
lea rdx, [0x180112978]
lea rcx, [rbp + 0x258]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, r15d
lea r8, str.getAppNameById_OpenProcess__d_failed.__d
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.18007d7e0
mov dword [rsp + 0x38], 4
mov r9d, 0x18a
lea r8, [rbp + 0x2b8]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x68]
call fcn.18000dda0
mov rbx, rax
mov rax, qword [rsp + 0x60]
mov rdx, r13
test rax, rax
cmovne rdx, rax
mov rcx, rbx
call fcn.18000c590
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0x68]
call fcn.18000f5c0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006174a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x270]
cmp rdx, 0x10
jb 0x18006178b
inc rdx
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061786
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b7c
call fcn.1800a4c5c
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x268], xmm0
mov byte [rbp + 0x258], 0
mov rdx, qword [rbp + 0x2d0]
cmp rdx, 0x10
jb 0x1800617e3
inc rdx
mov rcx, qword [rbp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800617de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b82
call fcn.1800a4c5c
mov rbx, qword [rsp + 0x30]
call fcn.18007dd60
mov r9, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r9 + 0x10]
cmp al, 1
jne 0x1800619df
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x2e8], xmm0
mov byte [rbp + 0x2d8], 0
mov r8d, 0x6b
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x2d8]
call fcn.18000a3d0
nop
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
mov r8d, 3
lea rdx, [0x180112978]
lea rcx, [rbp + 0x278]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
lea rcx, [rbx - 0x18]
call fcn.180008df0
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, str.getAppNameById__d__s_
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.18007d7e0
mov r15, rax
or dword [rsp + 0x38], 8
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800618cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r9d, 0x18c
lea r8, [rbp + 0x2d8]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x150]
call fcn.18000dda0
mov rbx, rax
mov rax, qword [r15]
test rax, rax
cmovne r13, rax
mov rdx, r13
mov rcx, rbx
call fcn.18000c590
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0x150]
call fcn.18000f5c0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180061941
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x290]
cmp rdx, 0x10
jb 0x180061982
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006197d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b88
call fcn.1800a4c5c
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], 0
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x1800619da
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800619d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061b8e
call fcn.1800a4c5c
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jne 0x180061a5c
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x180061b94
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
lea rdi, str.unknown
mov rdx, rdi
mov rcx, r12
call fcn.180037120
test al, al
jne 0x180061a39
mov rax, r14
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x180061a20
mov r8d, eax
mov rdx, rdi
mov rcx, r12
call fcn.180009210
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180061b0c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x180061b0c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x180061b39
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180037120
test al, al
jne 0x180061abc
test rbx, rbx
je 0x180061aab
mov rsi, r14
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x180061aa1
mov r8d, esi
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180009210
nop
mov rbx, qword [rsp + 0x48]
lea rcx, [rbx - 0x18]
call fcn.180008df0
add rax, 0x18
mov qword [r12], rax
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x180061aee
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180061b0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r12
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.1800a5130
mov rbx, qword [rsp + 0x660]
add rsp, 0x620
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008c20
nop
mov ecx, 0x80004005
call fcn.180008c20
nop
mov ecx, 0x80070057
call fcn.180008c20
int3
mov ecx, 0x80070057
call fcn.180008c20
int3
mov ecx, 0x80070057
call fcn.180008c20
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
int3
mov ecx, 0x80004005
call fcn.180008c20
int3