Function at 0x180001870
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x18002b018]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
xor ebx, ebx
mov edi, ebx
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
lea rcx, [rbx - 1]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], bl
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800018f0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1b0]
call fcn.180002bb0
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32Next]
mov r13, qword [rbp + 0x1c8]
mov r15, qword [rbp + 0x1b0]
test eax, eax
je 0x180001a9e
mov r14, qword [rbp + 0x1c0]
nop word [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180001990
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.180002bb0
nop
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea rsi, [rbp + 0x1b0]
cmp r13, 0x10
cmovae rsi, r15
cmp r14, 0x10
jae 0x1800019e0
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 0xf
jmp 0x180001a5c
mov rdi, r14
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180001a34
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001b30
mov rcx, rax
call fcn.180004da8
mov rcx, rax
test rax, rax
je 0x180001b2a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180001a43
test rcx, rcx
je 0x180001a40
call fcn.180004da8
jmp 0x180001a43
mov rax, rbx
mov qword [rsp + 0x20], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.180006d50
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1800044a0
cmp rax, 0xffffffffffffffff
jne 0x180001a97
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x180001960
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001ac1
mov rbx, qword [rbp - 0x78]
mov edi, dword [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x180001ac1
test edi, edi
je 0x180001ac1
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x28]
add rcx, rbx
call fcn.1800014b0
nop
cmp r13, 0x10
jb 0x180001af4
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x180001aec
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001b24
mov rcx, r15
call fcn.180004da0
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.180004d80
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18000b50c
nop
call fcn.18000b50c
nop
call fcn.180002b90
int3