Function at 0x180001140
Capabilities:
Get process image filename

Disassembly:
push rbx
push rbp
push r15
sub rsp, 0x40
mov r15, rcx
test edx, edx
je 0x180001384
cmp edx, 1
jne 0x180001397
mov qword [rsp + 0x60], rsi
lea rdx, str.DllMain
mov qword [rsp + 0x38], rdi
lea rcx, str._PPLmedic___ws__Process_attach_r_n
mov qword [rsp + 0x30], r14
call fcn.180001010
xor edi, edi
mov edx, 0x20a
xor ebx, ebx
xor esi, esi
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x180001230
mov edx, 0x20a
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180001230
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180001230
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x180001230
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
cmp rax, rbx
je 0x180001230
mov r8, rax
mov edx, 0x104
mov rcx, rbp
call fcn.180009ac8
mov r14d, 1
lea rdx, str.GetExeFileName
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8, rsi
lea rcx, str._PPLmedic___ws__Image_filename:__ws__LE:__d__Result:__d_r_n
call fcn.180001010
jmp 0x18000125f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
mov dword [rsp + 0x20], 0
mov r9d, eax
lea rdx, str.GetExeFileName
lea rcx, str._PPLmedic___ws__Image_filename:__ws__LE:__d__Result:__d_r_n
call fcn.180001010
xor r14d, r14d
test rdi, rdi
je 0x180001268
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
test rbx, rbx
je 0x180001280
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14d, r14d
mov r14, qword [rsp + 0x30]
je 0x180001397
lea rdx, str.WerFaultSecure.exe
mov rcx, rbp
call fcn.18000994c
test eax, eax
jne 0x180001379
lea ecx, [rax + 0x28]
call fcn.180002af0
mov rbx, rax
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
xor eax, eax
mov edx, 0x1000
mov ecx, 0x40
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
lea rax, str.PPLmedicPipe
mov qword [rbx], rax
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, 0x1000
mov ecx, 0x40
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx + 0x20], rax
xor edx, edx
mov rcx, qword [rbx]
call fcn.180001a30
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180001379
lea rcx, str.WerFaultLoaddEvent
call fcn.1800015f0
mov rcx, rbx
call fcn.1800016d0
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18000134e
cmp dword [rbx + 0x10], 0
je 0x180001344
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18000135d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18000136c
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 0x28
mov rcx, rbx
call fcn.180002b2c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180001397
lea rdx, str.DllMain
lea rcx, str._PPLmedic___ws__Process_detach_r_n
call fcn.180001010
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 1
add rsp, 0x40
pop r15
pop rbp
pop rbx
ret