Function at 0x1400eec10
Capabilities:
Get process image filename

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x270]
xor r12d, r12d
mov qword [rsp + 0x68], rax
mov edi, r8d
mov rax, qword [rbp + 0x278]
mov esi, edx
mov dword [rsp + 0x30], edx
mov r13, rcx
mov qword [rsp + 0x50], rcx
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x48], r12
mov r15, r9
mov qword [rsp + 0x58], r12
mov ebx, r12d
mov r14d, r12d
call sub.msvcrt.dll_memset
test r13, r13
jne 0x1400eeca4
mov ecx, 0xc004e001
mov r12d, ecx
call fcn.140082a8c
jmp 0x1400eeea5
cmp dword [r13], 0x50
jne 0x1400eec92
cmp esi, 0x37
jb 0x1400eecbb
mov r12d, 0x80070001
mov ecx, r12d
jmp 0x1400eec9a
cmp edi, 0x500000
jbe 0x1400eecde
lea rdx, [0x140449528]
mov r12d, 0x8007006f
lea rcx, [0x140439ac8]
call fcn.1400f6768
jmp 0x1400eecb6
mov qword [rsp + 0x38], r12
mov rsi, r12
test r15, r15
je 0x1400eed77
lea r8, [rsp + 0x38]
mov edx, edi
mov rcx, r15
call fcn.1400ef4f4
mov r12d, eax
test eax, eax
jns 0x1400eed13
mov ecx, eax
call fcn.140082a8c
mov rsi, qword [rsp + 0x38]
jmp 0x1400eed77
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1400eed3d
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rdi
call rax
mov rdi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x38]
xor esi, esi
test rdi, rdi
je 0x1400eed64
mov rax, qword [rdi]
mov r15, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, r15
call rax
mov rax, r15
mov rcx, rdi
call rax
xor eax, eax
test r13, r13
cmovne rax, r13
mov r13, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov ecx, r12d
call fcn.140082b34
test rsi, rsi
je 0x1400eed9f
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rsi
call rax
test r12d, r12d
js 0x1400eee55
movsxd rcx, dword [rsp + 0x30]
lea rax, [0x140451850]
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rdi, rax
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r13
call rax
mov esi, eax
mov r12d, eax
test eax, eax
js 0x1400eee58
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov dword [rsp + 0x38], edx
test rcx, rcx
je 0x1400eee32
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call fcn.140071c14
mov r12d, eax
test eax, eax
jns 0x1400eee29
mov ecx, eax
call fcn.140082a8c
mov rdi, qword [rsp + 0x50]
mov r15d, ebx
jmp 0x1400eee3a
mov rax, qword [rsp + 0x50]
mov edx, dword [rsp + 0x38]
mov r15d, edx
mov rbx, rax
xor edi, edi
mov ecx, r12d
call fcn.140082b34
test rdi, rdi
je 0x1400eee50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12d, r12d
jns 0x1400eee8d
mov esi, r12d
mov ecx, esi
call fcn.140082a8c
mov ecx, r12d
cmp r12d, 0xc004d301
je 0x1400eee7c
mov eax, ecx
cmp ecx, 0xc004d500
jle 0x1400eeea5
cmp eax, 0xc004d502
jg 0x1400eeea5
mov edx, r12d
lea rcx, [0x140451770]
call fcn.1400a6204
jmp 0x1400eeea5
mov rax, qword [rsp + 0x68]
mov r12d, esi
mov rcx, qword [rsp + 0x60]
mov dword [rax], r15d
mov rax, rbx
mov qword [rcx], rax
xor ebx, ebx
mov ecx, r12d
call fcn.140099230
lea rdx, [rsp + 0x44]
xor ecx, ecx
mov r15d, eax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
xor r12d, r12d
mov edi, eax
test eax, eax
jne 0x1400eef3f
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov edi, eax
test eax, eax
jne 0x1400eef3f
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400eef31
mov r8d, 0x104
lea rdx, [rbp - 0x20]
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
jne 0x1400eef31
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
lea rdx, [0x14044b34c]
or edi, 0x80070000
lea rcx, [0x140431068]
test eax, eax
cmovle edi, eax
call fcn.1400f7b8c
jmp 0x1400eef35
mov edi, dword [rsp + 0x44]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
jmp 0x1400eef4c
test edi, edi
js 0x1400eef4c
movzx edi, di
or edi, 0x80010000
cmp dword [0x140448890], 5
jbe 0x1400ef033
movabs rdx, 0x400000000000
test qword [0x1404488a0], rdx
je 0x1400ef033
mov rax, qword [0x1404488a8]
and rax, rdx
cmp rax, qword [0x1404488a8]
jne 0x1400ef033
mov eax, dword [rsp + 0x30]
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x40], rax
or rax, 0xffffffffffffffff
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x60], 1
mov qword [rbp - 0x28], 4
mov qword [rbp - 0x38], 4
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400eefcb
lea eax, [rax*2 + 2]
mov dword [rbp - 0x44], r12d
mov dword [rbp - 0x48], eax
lea rcx, [rbp - 0x20]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x60], rax
lea rdx, [0x14043d326]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x58], 4
mov qword [rbp - 0x70], rax
lea rcx, [0x140448890]
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], 8
mov r9d, 7
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.140302978
mov ecx, r15d
call fcn.140082b34
test r14, r14
je 0x1400ef049
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14044bc50]
lea rcx, [0x140431188]
call fcn.1400f823c
test rbx, rbx
je 0x1400ef07d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x14044c0d4]
lea rcx, [0x14043bb7c]
call fcn.1400f7eec
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400ef0a7
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x58], r12
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400ef0dd
mov rdi, qword [rbx]
lea rdx, [0x14044d0b0]
lea rcx, [0x140435710]
call fcn.1400f8590
mov rax, qword [0x1403cf6d0]
mov rcx, qword [rdi + 0x10]
call rax
mov rax, qword [rdi + 0x10]
mov rcx, rbx
call rax
mov eax, r15d
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140389660
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret