Function at 0x1400024a0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14006f008]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000250f
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
jne 0x140002516
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140002716
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140002540
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000273f
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x14000258c
mov qword [rsp + 0x48], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x38], sil
jmp 0x140002620
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x1400025c5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008a30
test rax, rax
je 0x140002704
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400025fd
mov rbp, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x1400025f0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002745
jmp 0x1400025a6
test rcx, rcx
je 0x1400025fd
call fcn.140008a30
mov rsi, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x3dc
mov eax, dword [rdx + rcx]
mov ebx, 0x1a8
add rbx, rcx
test al, 1
jne 0x14000266a
or eax, 1
mov dword [rdx + rcx], eax
mov word [rbx + 9], 0x123
mov dword [rbx], 0x16ef4255
mov dword [rbx + 4], 0xd3baf5d2
mov byte [rbx + 8], 0x5a
lea rcx, [0x140058690]
call fcn.140008c88
nop
cmp byte [rbx + 0xa], 0
je 0x1400026a0
xor byte [rbx], 0x3f
xor byte [rbx + 1], 0x23
xor byte [rbx + 2], 0x99
xor byte [rbx + 3], 0x77
xor byte [rbx + 4], 0xa5
xor byte [rbx + 5], 0xdb
xor byte [rbx + 6], 0xdf
xor byte [rbx + 7], 0xab
xor byte [rbx + 8], 0x3f
xor byte [rbx + 9], 0x23
mov byte [rbx + 0xa], 0
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400026a0
lea rcx, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
cmp rbp, 0x10
cmovae rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov rdx, qword [rsp + 0x48]
call fcn.140008560
cmp rax, 0xffffffffffffffff
setne bl
cmp rbp, 0x10
jb 0x140002713
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000270b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000270b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140008a74
movzx eax, bl
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140008a10
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3