Function at 0x180008aec
Capabilities:
Get process image filename

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x260
xor r14d, r14d
mov esi, r14d
test cl, cl
je 0x180008b6c
mov rcx, qword [0x180027668]
test rcx, rcx
je 0x180008b2b
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [0x180027668], r14
mov rcx, qword [0x180027688]
test rcx, rcx
je 0x180008b4c
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [0x180027688], r14
xor eax, eax
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [0x180027518]
test rax, rax
jne 0x180008b91
lea rcx, [0x1800010b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180027518], rax
test rax, rax
je 0x180008b4c
lea rdx, [0x180001b38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180027090], rax
mov r10, rax
test rax, rax
je 0x180008b4c
mov rax, qword [0x180027688]
mov ebx, 0x100000
test rax, rax
jne 0x180008bec
lea r9d, [rax + 4]
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180027688], rax
test rax, rax
je 0x180008b4c
mov r10, qword [0x180027090]
xor r9d, r9d
mov qword [0x180027510], rax
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 5]
call r10
mov dword [0x180027528], eax
test eax, eax
jns 0x180008c15
or eax, 0xffffffff
jmp 0x180008b4e
mov rdx, qword [0x180027510]
mov bpl, r14b
test rdx, rdx
je 0x180008d74
mov rcx, qword [rdx + 0x40]
test rcx, rcx
je 0x180008d52
lea rdx, [0x180001b58]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180008d4b
mov rax, qword [0x180027510]
xor edx, edx
mov ecx, 0x400
mov ebx, dword [rax + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180008c7f
mov r8d, ebx
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rdi, rdi
je 0x180008d4b
mov r8d, 0x104
mov word [rsp + 0x50], r14w
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov rdx, qword [0x180027668]
test rdx, rdx
jne 0x180008d20
mov rax, r14
cmp word [rsp + 0x50], r14w
je 0x180008cc4
inc rax
cmp word [rsp + rax*2 + 0x50], r14w
jne 0x180008cb9
lea rbx, [rax + 1]
lea rdx, [rbx + rbx]
test rdx, rdx
jne 0x180008cd6
mov rdx, r14
jmp 0x180008ce1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
mov rcx, rdx
test rdx, rdx
je 0x180008d16
test rbx, rbx
je 0x180008d16
lea r8, [rsp + 0x50]
sub r8, rdx
movzx eax, word [r8 + rcx]
dec rbx
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
je 0x180008d19
test rbx, rbx
jne 0x180008cf6
mov word [rcx - 2], r14w
jmp 0x180008d19
mov rdx, r14
mov qword [0x180027668], rdx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180008d42
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
add rsi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x180027510]
test bpl, bpl
jne 0x180008d74
mov eax, dword [rdx]
add rdx, rax
mov qword [0x180027510], rdx
cmp dword [rdx], r14d
jne 0x180008c28
mov bpl, 1
jmp 0x180008c28
xor ecx, ecx
cmp qword [0x180027640], rsi
je 0x180008d96
mov qword [0x180027640], rsi
call fcn.180005450
mov dword [0x180027634], eax
jmp 0x180008b4c
call fcn.180005450
sub eax, dword [0x180027634]
jmp 0x180008b4e