Function at 0x14000b550
Capabilities:
Check process job object
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov ecx, 0x2010
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
je 0x14000b7b4
mov rdi, rax
xor eax, eax
mov ecx, 0x2010
rep stosb byte [rdi], al
mov dword [r12 + 4], 0x400
mov qword [rsp + 0x20], rbx
mov r9d, 0x2010
mov r8, r12
lea edx, [rbx + 3]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x14000b7ab
mov r14d, ebx
mov r15d, ebx
mov eax, dword [r12]
test eax, eax
je 0x14000b7a0
nop
mov eax, r15d
mov rdi, qword [r12 + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp rdi, rax
jne 0x14000b5fd
inc r14d
jmp 0x14000b790
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000b790
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000b787
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x14000b77e
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14000b840
nop
lea rdx, str.WindowsSystem32conhost.exe
lea rcx, [rsp + 0x38]
call fcn.14000b840
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x14000b687
mov r9, qword [rax]
lea r11, [rsp + 0x58]
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x70]
cmp r13, 8
cmovae r11, rbp
mov r10, qword [rax + 0x10]
mov rax, qword [rsp + 0x68]
cmp r10, rax
ja 0x14000b6ea
sub rax, r10
test r10, r10
jne 0x14000b6b8
xor edi, edi
jmp 0x14000b6f1
lea rbx, [r11 + 2]
lea rbx, [rbx + rax*2]
mov rdi, r11
mov rax, rbx
sub rax, rdi
sar rax, 1
je 0x14000b6e5
movzx ecx, word [r9]
cmp word [rdi], cx
je 0x14000b7e4
add rdi, 2
sub rax, 1
jne 0x14000b6d2
mov rbx, qword [rsp + 0x30]
mov rdi, 0xffffffffffffffff
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000b734
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b72e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b82d
call fcn.140015df0
nop
lea eax, [r14 + 1]
cmp rdi, 0xffffffffffffffff
cmove eax, r14d
mov r14d, eax
cmp r13, 8
jb 0x14000b77e
lea rdx, [r13*2 + 2]
mov rax, rbp
cmp rdx, 0x1000
jb 0x14000b776
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b834
mov rcx, rbp
call fcn.140015df0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r15d
mov eax, dword [r12]
cmp r15d, eax
jb 0x14000b5e0
cmp r14d, eax
mov ebx, 0
setne bl
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140015dd0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test rdi, rdi
je 0x14000b6e5
mov rdx, r10
mov rcx, r9
test r10, r10
je 0x14000b814
mov r8, rdi
sub r8, r9
nop
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14000b824
add rcx, 2
sub rdx, 1
jne 0x14000b800
sub rdi, r11
sar rdi, 1
mov rbx, qword [rsp + 0x30]
jmp 0x14000b6f1
add rdi, 2
jmp 0x14000b6c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3