Function at 0x1800012e0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x18000d010]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor r12d, r12d
lea rdx, [rbp + 0x3e0]
mov r8d, 0x104
mov edi, r12d
mov r15d, r12d
lea rcx, [r12 - 1]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
xorps xmm0, xmm0
lea rax, [rbp + 0x3e0]
movups xmmword [rbp + 0x380], xmm0
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], r12w
jne 0x180001345
movabs rbx, 0x7ffffffffffffffe
mov qword [rsp + 0x20], rbx
cmp rsi, rbx
ja 0x1800017d1
mov qword [rsp + 0x730], r13
cmp rsi, 8
jae 0x1800013c9
lea rbx, [rsi + rsi]
mov qword [rbp + 0x390], rsi
mov r8, rbx
mov qword [rbp + 0x398], 7
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x380]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx + 0x380], r12w
mov rax, qword [rbp + 0x398]
mov rsi, qword [rbp + 0x390]
mov r13, qword [rbp + 0x380]
mov qword [rsp + 0x20], rax
jmp 0x18000148a
mov rax, rsi
or rax, 7
cmp rax, rbx
jbe 0x1800013e5
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x18000141c
mov ecx, 0xa
mov rbx, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbx, rcx
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1800017d7
add rcx, rcx
cmp rcx, 0x1000
jb 0x180001448
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800017d7
mov rcx, rax
call fcn.180003590
test rax, rax
je 0x1800015ee
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x18000145a
test rcx, rcx
je 0x180001457
call fcn.180003590
mov r13, rax
jmp 0x18000145a
mov r13, r12
mov qword [rbp + 0x398], rbx
lea rdx, [rbp + 0x3e0]
lea rbx, [rsi + rsi]
mov qword [rbp + 0x380], r13
mov r8, rbx
mov qword [rbp + 0x390], rsi
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + r13], r12w
mov qword [rsp + 0x738], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x438
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x180001608
mov r15, qword [rsp + 0x20]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
mov r10, 0xffffffffffffffff
nop dword [rax]
inc r10
cmp word [rax + r10*2], r12w
jne 0x1800014e0
cmp r15, 8
lea rbx, [rbp + 0x380]
cmovae rbx, r13
cmp r10, rsi
ja 0x180001584
mov rax, rsi
sub rax, r10
test r10, r10
je 0x1800015fe
movzx r11d, word [rsp + 0x60]
inc rax
lea rdi, [rbx + rax*2]
mov rax, rbx
mov rcx, rdi
sub rcx, rax
sar rcx, 1
je 0x180001584
nop dword [rax]
cmp word [rax], r11w
je 0x180001542
add rax, 2
sub rcx, 1
jne 0x180001530
jmp 0x180001584
test rax, rax
je 0x180001584
lea rdx, [rsp + 0x60]
mov r8, r10
test r10, r10
je 0x180001578
lea rcx, [rsp + 0x60]
mov r9, rax
sub r9, rcx
nop
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x1800015f5
add rdx, 2
sub r8, 1
jne 0x180001560
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x1800015fe
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1800014d0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r12d
mov rax, qword [rsp + 0x20]
mov r14, qword [rsp + 0x738]
cmp rax, 8
jb 0x1800017a1
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x180001799
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001799
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, 2
jmp 0x180001521
mov rdi, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1800015a3
test r15d, r15d
je 0x1800015a3
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x378]
mov r14, rax
lea rcx, [rbp + 0x3a0]
lea rbx, [rbp + 0x628]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadStackLimits]
mov rdx, qword [rbp + 0x378]
mov esi, 1
cmp rbx, rdx
jae 0x1800016eb
nop dword [rax + rax]
mov rcx, qword [rbx]
cmp rcx, 0x1000
jb 0x1800016e2
cmp rcx, r14
jbe 0x180001692
lea rax, [r14 + 0x1000]
cmp rcx, rax
jae 0x180001692
mov r12d, esi
jmp 0x180001697
test r12d, r12d
je 0x1800016e2
cmp rcx, rdi
jbe 0x1800016e2
mov eax, r15d
add rax, rdi
cmp rcx, rax
jae 0x1800016e2
xorps xmm0, xmm0
lea rdx, [rbp + 0x3a8]
mov r8d, 0x30
movups xmmword [rbp + 0x3a8], xmm0
movups xmmword [rbp + 0x3b8], xmm0
movups xmmword [rbp + 0x3c8], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test byte [rbp + 0x3cc], 0x20
jne 0x180001746
mov rdx, qword [rbp + 0x378]
add rbx, 8
cmp rbx, rdx
jb 0x180001670
movsxd rax, dword [rdi + 0x3c]
lea r9, [rbp + 0x370]
mov edx, 0xc
mov ebx, dword [rax + rdi + 0x28]
add rbx, rdi
lea r8d, [rdx + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rbx], 0xb848
lea rax, [0x1800012c0]
mov word [rbx + 0xa], 0xe0ff
lea r9, [rbp + 0x370]
mov r8d, dword [rbp + 0x370]
mov edx, 0xc
mov rcx, rbx
mov qword [rbx + 2], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1800015a6
mov rbx, qword [rbx]
lea r9, [rbp + 0x370]
mov edx, 0xc
mov rcx, rbx
lea r8d, [rdx + 0x34]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rbx], 0xb848
lea rax, [0x1800012c0]
mov word [rbx + 0xa], 0xe0ff
lea r9, [rbp + 0x370]
mov r8d, dword [rbp + 0x370]
mov edx, 0xc
mov rcx, rbx
mov qword [rbx + 2], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1800015a6
mov rcx, r13
call fcn.18000394c
mov r13, qword [rsp + 0x730]
mov eax, esi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.180003570
mov rbx, qword [rsp + 0x740]
add rsp, 0x700
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800011d0
int3
call fcn.180001130
int3