Function at 0x140056d10
Capabilities:
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rdx
mov esi, ecx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x140056ddc
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x140056ddc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x140056dd5
cmp eax, 0x57
je 0x140056dd5
call fcn.1400159c0
mov rdi, qword [rax]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], esi
lea rcx, str.OpenProcess_call_with_pid___d__failed_with_error___d_._Cannot_get_the_process_path_
mov qword [rsp + 0x30], rcx
lea rcx, str.ProcessUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 5
mov r9d, 0x13e
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommonprocessutils.cpp
lea rdx, str.mb::common::system::ProcessUtils::GetProcessPath
mov rcx, rax
call qword [rdi + 0x20]
mov eax, ebx
jmp 0x140057572
xor r14d, r14d
mov edx, r14d
mov qword [rbp - 1], rdx
mov edi, 7
mov qword [rbp + 7], rdi
mov word [rbp - 0x11], r14w
mov ebx, 0x104
nop dword [rax]
test rdx, rdx
je 0x140056e22
mov qword [rbp - 1], r14
lea rax, [rbp - 0x11]
cmp rdi, 8
cmovae rax, qword [rbp - 0x11]
mov word [rax], r14w
mov rdi, qword [rbp + 7]
mov rdx, qword [rbp - 1]
mov ecx, ebx
cmp rcx, rdx
ja 0x140056e41
mov qword [rbp - 1], rcx
lea rax, [rbp - 0x11]
cmp rdi, 8
cmovae rax, qword [rbp - 0x11]
mov word [rax + rcx*2], r14w
jmp 0x140056e96
mov r8, rcx
sub r8, rdx
mov rax, rdi
sub rax, rdx
cmp r8, rax
ja 0x140056e81
mov qword [rbp - 1], rcx
lea r9, [rbp - 0x11]
cmp rdi, 8
cmovae r9, qword [rbp - 0x11]
lea rdi, [r9 + rdx*2]
test r8, r8
je 0x140056e76
movzx eax, r14w
mov rcx, r8
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r14w
jmp 0x140056e96
mov word [rsp + 0x20], r14w
mov r9, r8
mov rdx, r8
lea rcx, [rbp - 0x11]
call fcn.14000d970
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov r8d, ebx
mov rcx, r12
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x140056f48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
je 0x140056ec8
cmp eax, 0x7a
jne 0x140056edb
add ebx, 0x104
mov rdi, qword [rbp + 7]
mov rdx, qword [rbp - 1]
jmp 0x140056e00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
cmp esi, 4
je 0x140057529
test eax, eax
je 0x140057529
call fcn.1400159c0
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x20]
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], esi
lea rcx, str.GetProcessImageFileName_for___d__failed_with_error___d_._Cannot_get_the_process_path_
mov qword [rsp + 0x30], rcx
lea rcx, str.ProcessUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0x186
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommonprocessutils.cpp
lea rdx, str.mb::common::system::ProcessUtils::GetProcessPath
mov rcx, rax
call rdi
jmp 0x140057529
lea rax, [rbp - 0x11]
mov rcx, qword [rbp - 0x11]
mov rdi, qword [rbp + 7]
cmp rdi, 8
cmovae rax, rcx
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140056f63
movdqa xmm0, xmmword [0x1402e5c30]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
cmp qword [rbp - 1], rdx
cmovb rdx, qword [rbp - 1]
lea r9, [rbp - 0x11]
cmp rdi, 8
cmovae r9, rcx
lea rcx, [rbp - 0x39]
cmp rdx, 7
ja 0x140056fb9
mov qword [rbp - 0x29], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.1401db870
mov word [rbp + rdi - 0x39], r14w
jmp 0x140056fbe
call fcn.14000c3b0
lea rcx, [rbp - 0x11]
call fcn.14000cdc0
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1402e5c30]
movdqu xmmword [rbp + 0x1f], xmm0
mov word [rbp + 0xf], r14w
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
call fcn.140056760
test eax, eax
je 0x140057026
lea rax, [rbp + 0xf]
cmp r15, rax
je 0x1400574e9
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
mov r8, qword [rbp + 0x1f]
mov rcx, r15
call fcn.14000c510
jmp 0x1400574e9
mov r9, r15
mov rbx, qword [r15 + 0x18]
cmp rbx, 8
jb 0x140057036
mov r9, qword [r15]
mov r10, qword [r15 + 0x10]
cmp r10, 0xb
jb 0x1400571d1
lea r11, [r10 - 0xa]
lea r11, [r9 + r11*2]
mov rcx, r9
lea rsi, str.DeviceMup
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x1400571d1
cmp word [rcx], 0x5c
je 0x14005707f
add rcx, 2
sub rax, 1
jmp 0x140057069
test rcx, rcx
je 0x1400571d1
mov edi, 0xb
mov rdx, rsi
mov r8, rcx
sub r8, rsi
movzx eax, word [rdx]
cmp word [r8 + rdx], ax
jne 0x1400570f0
add rdx, 2
sub rdi, 1
jne 0x140057096
sub rcx, r9
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x1400571d1
cmp rbx, 2
jb 0x1400570f9
mov rdi, r15
cmp rbx, 8
jb 0x1400570cc
mov rdi, qword [r15]
mov qword [r15 + 0x10], 2
mov r8d, 4
lea rdx, [0x1402dbb54]
mov rcx, rdi
call fcn.1401db870
mov word [rdi + 4], r14w
jmp 0x14005710d
add rcx, 2
jmp 0x140057060
lea r9, [0x1402dbb54]
mov edx, 2
mov rcx, r15
call fcn.14000c3b0
movdqa xmm0, xmmword [0x1402e5c30]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
mov rdx, qword [rbp - 1]
cmp rdx, 0xc
jb 0x1400575a6
add rdx, 0xfffffffffffffff4
lea r9, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae r9, qword [rbp - 0x11]
add r9, 0x18
lea rcx, [rbp - 0x39]
cmp rdx, 7
ja 0x140057168
mov qword [rbp - 0x29], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.1401db870
mov word [rbp + rdi - 0x39], r14w
jmp 0x14005716e
call fcn.14000c3b0
nop
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x29]
mov rcx, r15
call fcn.14000a750
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x1400574e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057368
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575a0
jmp 0x140057368
mov r9, r15
cmp rbx, 8
jb 0x1400571dd
mov r9, qword [r15]
cmp r10, 0x1a
jb 0x140057372
add r10, 0xffffffffffffffe7
lea r10, [r9 + r10*2]
mov rcx, r9
lea r11, str.DeviceLanmanRedirector_
nop dword [rax]
mov rax, r10
sub rax, rcx
sar rax, 1
je 0x140057372
cmp word [rcx], 0x5c
je 0x14005721f
add rcx, 2
sub rax, 1
jmp 0x140057209
test rcx, rcx
je 0x140057372
mov edi, 0x1a
mov rdx, r11
mov r8, rcx
sub r8, r11
movzx eax, word [rdx]
cmp word [r8 + rdx], ax
jne 0x140057290
add rdx, 2
sub rdi, 1
jne 0x140057236
sub rcx, r9
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140057372
cmp rbx, 4
jb 0x140057299
mov rdi, r15
cmp rbx, 8
jb 0x14005726c
mov rdi, qword [r15]
mov qword [r15 + 0x10], 4
mov r8d, 8
lea rdx, [0x1402e0838]
mov rcx, rdi
call fcn.1401db870
mov word [rdi + 8], r14w
jmp 0x1400572ad
add rcx, 2
jmp 0x140057200
lea r9, [0x1402e0838]
mov edx, 4
mov rcx, r15
call fcn.14000c3b0
movdqa xmm0, xmmword [0x1402e5c30]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
mov rdx, qword [rbp - 1]
cmp rdx, 0x1a
jb 0x1400575ac
add rdx, 0xffffffffffffffe6
lea r9, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae r9, qword [rbp - 0x11]
add r9, 0x34
lea rcx, [rbp - 0x39]
cmp rdx, 7
ja 0x140057308
mov qword [rbp - 0x29], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.1401db870
mov word [rbp + rdi - 0x39], r14w
jmp 0x14005730e
call fcn.14000c3b0
nop
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x29]
mov rcx, r15
call fcn.14000a750
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x1400574e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057368
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575b2
call fcn.1401d94a8
jmp 0x1400574e9
cmp rbx, 0xe
jb 0x1400573a8
mov rdi, r15
cmp rbx, 8
jb 0x140057384
mov rdi, qword [r15]
mov qword [r15 + 0x10], 0xe
mov r8d, 0x1c
lea rdx, str..Globalroot
mov rcx, rdi
call fcn.1401db870
mov word [rdi + 0x1c], r14w
jmp 0x1400573bc
lea r9, str..Globalroot
mov edx, 0xe
mov rcx, r15
call fcn.14000c3b0
movdqa xmm0, xmmword [0x1402e5c30]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
mov ebx, 1
mov edx, ebx
cmp qword [rbp - 1], rbx
cmovb rdx, qword [rbp - 1]
lea r9, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae r9, qword [rbp - 0x11]
lea rcx, [rbp - 0x39]
cmp rdx, 7
ja 0x140057411
mov qword [rbp - 0x29], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call fcn.1401db870
mov word [rbp + rdi - 0x39], r14w
jmp 0x140057416
call fcn.14000c3b0
lea rdx, [rbp - 0x39]
mov rdi, qword [rbp - 0x39]
mov r8, qword [rbp - 0x21]
cmp r8, 8
cmovae rdx, rdi
cmp qword [rbp - 0x29], rbx
jne 0x140057455
lea rcx, [0x1402d4ac8]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + rdx], ax
jne 0x140057455
add rcx, 2
sub rbx, 1
jne 0x140057440
jmp 0x140057457
mov bl, 1
cmp r8, 8
jb 0x140057492
lea rdx, [r8*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005748a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575b8
mov rcx, rdi
call fcn.1401d94a8
test bl, bl
je 0x1400574ce
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x1400574c0
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 8
jb 0x1400574b7
mov rax, qword [r15]
mov dword [rax + rcx*2], 0x5c
jmp 0x1400574ce
mov r9d, 0x5c
mov rcx, r15
call fcn.140009c30
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov r8, qword [rbp - 1]
mov rcx, r15
call fcn.14000a750
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140057529
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575be
call fcn.1401d94a8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x14005756f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005756a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005759a
call fcn.1401d94a8
mov eax, r14d
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401d9c30
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401e4d9c
nop
call fcn.1401e4d9c
nop
call fcn.1400092d0
int3
call fcn.1400092d0
int3
call fcn.1401e4d9c
int3
call fcn.1401e4d9c
nop
call fcn.1401e4d9c
int3