Function at 0x1400e9b1c
Capabilities:
Get process image filename

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x228]
sub rsp, 0x328
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rax, qword [rbp + 0x290]
xor r15d, r15d
mov qword [rbp - 0x80], rax
mov esi, r8d
mov rax, qword [rbp + 0x298]
mov r13d, edx
mov dword [rsp + 0x40], edx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x60], rax
lea rcx, [rbp]
mov qword [rsp + 0x50], r15
mov r12, r9
mov qword [rsp + 0x58], r15
mov ebx, r15d
mov r14d, r15d
call sub.msvcrt.dll_memset
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
test rdi, rdi
je 0x1400e9bb2
cmp dword [rdi], 0x50
je 0x1400e9bbc
mov ecx, 0xc004e001
mov r13d, ecx
jmp 0x1400e9bee
lea rdx, [0x140457ad0]
lea rcx, [0x140433d58]
call fcn.1400f3d14
cmp r13d, 0x37
jb 0x1400e9bdd
mov r13d, 0x80070001
jmp 0x1400e9beb
cmp esi, 0x500000
jbe 0x1400e9bf8
mov r13d, 0x8007006f
mov ecx, r13d
call fcn.14007ac40
jmp 0x1400e9e1e
xor eax, eax
mov qword [rsp + 0x38], rax
mov edi, eax
test r12, r12
jne 0x1400e9c21
lea rdx, [0x14045a6e4]
mov r13d, r12d
lea rcx, [0x14043fa2c]
call fcn.1400f43c0
jmp 0x1400e9cbe
lea r8, [rsp + 0x38]
mov edx, esi
mov rcx, r12
call fcn.1400ea868
xor r12d, r12d
mov r13d, eax
test eax, eax
jns 0x1400e9c48
mov ecx, eax
call fcn.14007ac40
mov rdi, qword [rsp + 0x38]
jmp 0x1400e9cbe
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x1400e9c72
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rsi
call rax
mov rsi, qword [rsp + 0x50]
mov rdi, r12
test rsi, rsi
je 0x1400e9cab
mov rax, qword [rsi]
lea rdx, [0x140455480]
lea rcx, [0x140443da4]
mov r12, qword [rax + 0x10]
call fcn.1400f4dac
mov rax, qword [0x1403d25b8]
mov rcx, r12
call rax
mov rax, r12
mov rcx, rsi
call rax
xor r12d, r12d
cmp qword [rsp + 0x38], r12
mov rax, r12
cmovne rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov ecx, r13d
call fcn.14007ace8
test rdi, rdi
je 0x1400e9ce6
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rdi
call rax
test r13d, r13d
js 0x1400e9dbb
movsxd rcx, dword [rsp + 0x40]
lea rax, [0x14045ca60]
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rdi, rax
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
mov rax, rdi
lea rdx, [rsp + 0x50]
call rax
mov esi, eax
mov r13d, eax
test eax, eax
js 0x1400e9dbe
mov rcx, qword [rsp + 0x58]
mov rax, r12
mov qword [rsp + 0x48], rax
mov edx, r12d
mov dword [rsp + 0x38], edx
mov r13d, r12d
test rcx, rcx
je 0x1400e9d81
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
call fcn.14006a87c
mov r13d, eax
test eax, eax
jns 0x1400e9d78
mov ecx, eax
call fcn.14007ac40
mov rdi, qword [rsp + 0x48]
mov r12d, ebx
jmp 0x1400e9d8b
mov rax, qword [rsp + 0x48]
mov edx, dword [rsp + 0x38]
xor ecx, ecx
mov r12d, edx
mov edi, ecx
mov rbx, rax
mov ecx, r13d
call fcn.14007ace8
test rdi, rdi
je 0x1400e9da1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x140451e84]
lea rcx, [0x140441bd0]
call fcn.1400f406c
xor edi, edi
test r13d, r13d
jns 0x1400e9df3
mov esi, r13d
mov ecx, esi
call fcn.14007ac40
mov ecx, r13d
cmp r13d, 0xc004d301
je 0x1400e9de2
mov eax, ecx
cmp ecx, 0xc004d501
je 0x1400e9de2
cmp eax, 0xc004d502
jne 0x1400e9e1e
mov edx, r13d
lea rcx, [0x14045c980]
call fcn.14009f4c8
jmp 0x1400e9e1e
lea rdx, [0x140456da4]
mov r13d, esi
lea rcx, [0x14042956c]
call fcn.1400f470c
mov rax, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x60]
mov dword [rax], r12d
mov rax, rbx
mov qword [rcx], rax
mov rbx, rdi
mov ecx, r13d
call fcn.140091db0
lea rdx, [rsp + 0x44]
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
mov r12d, eax
test eax, eax
jne 0x1400e9eab
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov r12d, eax
test eax, eax
jne 0x1400e9eab
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r12d, r12d
mov rdi, rax
test rax, rax
je 0x1400e9e9c
mov rcx, rax
lea rdx, [rbp]
mov r8d, 0x104
mov r14, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
jne 0x1400e9e9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
jmp 0x1400e9ea1
mov r12d, dword [rsp + 0x44]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
jmp 0x1400e9ebb
test r12d, r12d
js 0x1400e9ebb
movzx r12d, r12w
or r12d, 0x80010000
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rcx, [rbp]
call fcn.1400ea694
mov rsi, qword [rsp + 0x68]
xor r8d, r8d
mov rdi, qword [rsp + 0x70]
mov edx, eax
test eax, eax
js 0x1400e9f15
lea rdx, [0x1404559b8]
lea rcx, [0x140437824]
call fcn.1400f3670
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rsi
xor ecx, ecx
call fcn.1400ca704
mov r15, qword [rsp + 0x78]
mov edx, eax
xor r8d, r8d
mov eax, dword [0x14045c808]
inc eax
mov dword [0x14045c808], eax
cmp eax, 0x1388
jl 0x1400ea065
cmp dword [0x140451890], 5
jbe 0x1400ea046
movabs r9, 0x400000000000
test qword [0x1404518a0], r9
je 0x1400ea046
mov rax, qword [0x1404518a8]
and rax, r9
cmp rax, qword [0x1404518a8]
jne 0x1400ea046
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x38], r12d
test edx, edx
js 0x1400e9f7c
mov r12, r15
jmp 0x1400e9f99
lea rdx, [0x140454720]
lea rcx, [0x14043136c]
lea r12, str.NULL
call fcn.1400f4a64
xor r8d, r8d
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x10], rax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x60], 1
mov qword [rbp - 8], 4
mov qword [rbp - 0x18], 4
test r12, r12
je 0x1400e9fe8
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r8w
jne 0x1400e9fd5
lea ecx, [rax*2 + 2]
jmp 0x1400e9ff4
lea r12, [0x1403dd418]
mov ecx, 2
lea rax, [rsp + 0x40]
mov dword [rbp - 0x28], ecx
mov qword [rbp - 0x40], rax
lea rdx, [0x140445fc6]
lea rax, [rsp + 0x60]
mov dword [rbp - 0x24], r8d
mov qword [rbp - 0x50], rax
lea rcx, [0x140451890]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x30], r12
mov r9d, 7
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x38], 4
mov qword [rbp - 0x48], 8
call fcn.140301728
xor r12d, r12d
lea rdx, [0x140454ec4]
lea rcx, [0x14043773c]
mov dword [0x14045c808], r12d
call fcn.1400f3318
jmp 0x1400ea068
xor r12d, r12d
mov ecx, r13d
call fcn.14007ace8
test r15, r15
je 0x1400ea091
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r15 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
test rdi, rdi
je 0x1400ea0c5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x140455f0c]
lea rcx, [0x1404447ec]
call fcn.1400f50f4
xor ecx, ecx
call fcn.14007ace8
lea rdx, [0x140452688]
lea rcx, [0x140442150]
call fcn.1400f39c8
test rsi, rsi
je 0x1400ea10c
lea rdx, [0x1404572c0]
lea rcx, [0x14043cc5c]
call fcn.1400f3d14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
test r14, r14
je 0x1400ea11a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400ea128
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400ea152
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x58], r12
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x1400ea177
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov eax, r13d
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140388a40
add rsp, 0x328
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret