Function at 0x14003b520
Capabilities:
Get process image filename

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x378
movaps xmmword [rsp + 0x360], xmm6
mov r13, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x358], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x78]
mov qword [rcx], r12
mov rax, qword [fcn.1401c9410]
call qword [0x1402f5008]
movaps xmm6, xmmword [0x14029ca60]
movups xmmword [r13], xmm6
movups xmmword [r13 + 0x20], xmm6
movups xmmword [r13 + 0x30], xmm6
mov qword [r13 + 0x40], r12
movups xmmword [r13 + 0x10], xmm6
xor r14d, r14d
mov byte [r13], r14b
mov byte [r13 + 0x20], r14b
xorps xmm0, xmm0
movups xmmword [r13 + 0x28], xmm0
mov qword [r13 + 0x38], r14
mov qword [rsp + 0x70], r12
movaps xmmword [rsp + 0x60], xmm6
lea rdi, [rsp + 0xd0]
mov qword [rdi + 0x10], r12
movaps xmmword [rdi], xmm6
lea rbx, [rsp + 0x110]
mov r8d, 0x240
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d06e0
lea rsi, [0x14029dd00]
mov qword [rbx - 0x10], rsi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx - 8], rax
mov byte [rbx], r14b
mov qword [rbx + 0x240], r14
lea rbx, [rsp + 0x100]
mov rcx, rbx
mov rdx, rdi
call fcn.14003c270
mov qword [rbx], rsi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x250]
mov rax, qword [0x1402cbde0]
and rax, rcx
cmp rax, qword [0x1402cbdc8]
je 0x14003c1ce
cmp qword [rsp + 0xe0], 0
mov qword [rsp + 0x58], r13
je 0x14003b693
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], 0
mov r14, qword [rsp + 0xd8]
cmp r14, rdi
je 0x14003b6b9
mov ebp, eax
xor eax, eax
mov rcx, r14
cmp dword [rcx + 0x18], ebp
je 0x14003bc6b
mov rcx, qword [rcx + 8]
cmp rcx, rdi
jne 0x14003b67f
jmp 0x14003b6bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [rsp + 0x60]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov dword [rsp + 0x40], 0
jmp 0x14003b734
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rcx], rcx
mov qword [rcx + 8], rcx
mov qword [rcx + 0x10], 0
mov dword [rsp + 0x40], 0
test rax, rax
je 0x14003b732
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
mov rax, qword [rax + 8]
mov rdx, qword [rcx]
mov qword [rdx + 8], rax
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rsp + 0x110], 0
cmp rcx, rbx
je 0x14003b732
cmp rcx, 0xfffffffffffffff0
je 0x14003c209
test rcx, rcx
je 0x14003c20c
mov rsi, qword [rcx + 8]
call fcn.1401cbbbc
mov rcx, rsi
cmp rsi, rbx
jne 0x14003b70e
xor ebx, ebx
cmp qword [rsp + 0xe0], 0
je 0x14003b795
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rax + 8]
mov rdx, qword [rcx]
mov qword [rdx + 8], rax
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rsp + 0xe0], 0
cmp rcx, rdi
je 0x14003b795
cmp rcx, 0xfffffffffffffff0
je 0x14003c190
test rcx, rcx
je 0x14003c18d
mov rsi, qword [rcx + 8]
call fcn.1401cbbbc
mov rcx, rsi
cmp rsi, rdi
jne 0x14003b771
cmp qword [rsp + 0x70], 0
je 0x14003bbf1
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x10]
xor edi, edi
mov ecx, 0x400
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14003b7e3
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r14, 0xffffffffffffffff
je 0x14003bb5d
call fcn.14017a3f0
mov rdi, r14
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r13, [rdi + 1]
cmp r13, 1
jbe 0x14003c212
mov dword [rsp + 0x44], ebx
lea r14, [rsp + 0x100]
mov r8d, 0x20a
mov rcx, r14
mov dl, 0xaa
call fcn.1401d06e0
mov rcx, rdi
mov rdx, r14
mov r8d, 0x104
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x14003c1e1
lea r15, [rsp + 0xd0]
mov qword [r15 + 0x10], r12
movaps xmmword [r15], xmm6
lea r12, [rsp + 0x80]
mov qword [r12], r14
mov rcx, r14
call fcn.1401cc340
mov qword [r12 + 8], rax
mov rcx, r15
mov rdx, r12
call fcn.1401b5140
xorps xmm0, xmm0
lea rdx, [rsp + 0xb0]
movaps xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov rcx, r15
call fcn.14003c560
test al, al
je 0x14003c193
movzx r15d, byte [rsp + 0xc7]
mov eax, r15d
and eax, 0x7f
test r15b, r15b
mov r12, qword [rsp + 0xb8]
cmovs rax, r12
test rax, rax
je 0x14003c19b
mov r14, qword [rsp + 0xb0]
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xc3]
mov dword [rsp + 0xf3], eax
cmp byte [rsp + 0xe7], 0
jns 0x14003b8e2
mov rcx, qword [rsp + 0xd0]
call fcn.1401cbbbc
test r15b, r15b
movzx eax, r15b
cmovs rax, r12
test rax, rax
je 0x14003c1fa
cmp r13, 2
mov rsi, qword [rsp + 0x58]
jb 0x14003b92a
call fcn.14017a3f0
cmp qword [0x1402e5b90], 0
je 0x14003bb64
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402f5008]
cmp byte [rsi + 0x3f], 0
jns 0x14003b93c
lea rax, [rsi + 0x28]
mov rcx, qword [rax]
call fcn.1401cbbbc
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r12
mov eax, dword [rsp + 0xf0]
mov ecx, dword [rsp + 0xf3]
mov dword [rsi + 0x38], eax
mov dword [rsi + 0x3b], ecx
mov byte [rsi + 0x3f], r15b
cmp qword [rsp + 0x70], 0
je 0x14003bbfa
xor eax, eax
mov qword [rsp + 0x50], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rdi, rax
mov eax, 0
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x14003ba13
lea r13, [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x50], rax
mov rbp, qword [sym.imp.USER32.dll_IsWindowVisible]
mov rbx, qword [sym.imp.USER32.dll_GetWindow]
lea r14, [rsp + 0x100]
mov r15, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea r12, [rsp + 0x60]
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x14003b9d6
mov rcx, rdi
mov edx, 2
call rbx
mov rdi, rax
test rax, rax
je 0x14003ba13
mov rcx, rdi
call rbp
test eax, eax
je 0x14003b9c4
mov dword [rsp + 0x100], 0
mov rcx, rdi
mov rdx, r14
call r15
mov eax, dword [rsp + 0x100]
mov rcx, r13
mov rsi, qword [rcx]
cmp rsi, r12
je 0x14003b9c4
lea rcx, [rsi + 8]
cmp dword [rsi + 0x10], eax
jne 0x14003b9fd
jmp 0x14003bbbe
mov rax, qword [fcn.1401c9410]
lea rdi, [rsp + 0x100]
mov rcx, rdi
call qword [0x1402f5008]
mov rbx, qword [rdi]
mov rax, qword [rsp + 0x78]
xor ecx, ecx
cmp rbx, rax
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
sub rbx, rax
cmovo rbx, rdx
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x50], xmm0
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x60], 0
mov dword [rdi], 0x68
lea rdi, [rsp + 0x100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [rdi + 0x3c]
shr eax, 0xb
and al, 1
mov r13, qword [rsp + 0x58]
cmp byte [r13 + 0x20], 0
jne 0x14003bc0d
test r13, r13
mov edx, dword [rsp + 0x44]
je 0x14003c1d8
mov rcx, qword [rsp + 0x50]
mov dword [r13], ecx
mov rcx, qword [rsp + 0x48]
mov qword [r13 + 8], rcx
mov qword [r13 + 0x10], rbx
mov ecx, dword [rsp + 0x40]
mov byte [r13 + 0x18], cl
mov byte [r13 + 0x19], al
mov byte [r13 + 0x20], 1
mov dword [r13 + 0x40], edx
cmp qword [rsp + 0x70], 0
je 0x14003bb2e
lea rdi, [rsp + 0x60]
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
mov rdx, qword [rcx]
mov qword [rdx + 8], rax
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rdi + 0x10], 0
cmp rcx, rdi
je 0x14003bb2e
cmp rcx, 0xfffffffffffffff0
je 0x14003c1db
test rcx, rcx
je 0x14003c1de
mov rsi, qword [rcx + 8]
call fcn.1401cbbbc
mov rcx, rsi
cmp rsi, rdi
jne 0x14003bb0a
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, r13
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x378
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x14003b7db
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c25e
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14003bba6
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x14003b914
xor ecx, ecx
mov dl, 1
jmp 0x14003bb9c
mov eax, dword [rsi + 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
jmp 0x14003ba13
mov rcx, rdi
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
jns 0x14003bbac
cmp qword [rsp + 0x48], 0
jne 0x14003b9c4
mov eax, dword [rsi + 0x10]
mov qword [rsp + 0x50], rax
mov rax, rdi
mov qword [rsp + 0x48], rdi
jmp 0x14003b9c4
mov dword [r13 + 0x40], ebx
jmp 0x14003bb2e
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x14003ba13
mov rcx, qword [rsp + 0x50]
mov dword [r13], ecx
mov rcx, qword [rsp + 0x48]
mov qword [r13 + 8], rcx
mov qword [r13 + 0x10], rbx
mov ecx, dword [rsp + 0x40]
mov byte [r13 + 0x18], cl
mov byte [r13 + 0x19], al
mov edx, dword [rsp + 0x44]
jmp 0x14003bad4
mov r8, r15
add r8, 0xfffffffffffffff6
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0xb0]
mov edx, 0xa
xor r9d, r9d
call fcn.140009b70
jmp 0x14003bd46
mov r12d, dword [rcx + 0x30]
mov ecx, 0x18
call fcn.1401cbbc4
test rax, rax
je 0x14003c23d
mov dword [rax + 0x10], r12d
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], 1
test r12d, r12d
je 0x14003bcd6
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
cmp dword [r14 + 0x18], r12d
je 0x14003bcea
mov r14, qword [r14 + 8]
cmp r14, rdi
jne 0x14003bcc5
jmp 0x14003bd46
mov eax, 1
movabs r12, 0xaaaaaaaaaaaaaaaa
jmp 0x14003b6bb
add r14, 0x3c
je 0x14003c24c
mov rcx, r14
call fcn.1401cc340
mov r15, rax
cmp rax, 0xa
ja 0x14003bc38
test r15, r15
je 0x14003bd33
mov r8, r15
add r8, r15
lea r13, [rsp + 0xb0]
mov rcx, r13
mov rdx, r14
call fcn.1401d0030
cmp byte [r13 + 0x17], 0
mov r13, qword [rsp + 0x58]
js 0x14003bd57
mov byte [rsp + 0xc7], r15b
mov word [rsp + r15*2 + 0xb0], 0
movzx eax, byte [rsp + 0xc7]
test al, al
js 0x14003bd61
and eax, 0x7f
jmp 0x14003bd69
mov qword [rsp + 0xb8], r15
jmp 0x14003bd3b
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14003c0e6
lea rdx, [rsp + 0x80]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdx + 0x10], rax
movaps xmmword [rdx], xmm6
call fcn.14003cbd0
lea rdx, [rsp + 0xb0]
movzx ecx, byte [rdx + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rdx + 8]
mov rcx, qword [rdx]
cmovns rcx, rdx
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
test rax, rax
js 0x14003c240
test rcx, rcx
jne 0x14003bdd6
test rax, rax
jne 0x14003c255
lea rax, str.explorer.exe
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
mov qword [rcx + 8], 0xc
lea rdx, [rsp + 0xf0]
call fcn.14003c390
test eax, eax
je 0x14003beb5
movzx ecx, byte [rsp + 0x97]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x80]
cmovns rcx, rdx
test rax, rax
js 0x14003c24f
test rcx, rcx
jne 0x14003be48
test rax, rax
jne 0x14003c258
movzx edx, byte [rsp + 0xc7]
mov r8d, edx
and r8d, 0x7f
test dl, dl
cmovs r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
lea r9, [rsp + 0xb0]
cmovns rdx, r9
test r8, r8
js 0x14003c252
test rdx, rdx
jne 0x14003be8d
test r8, r8
jne 0x14003c25b
cmp r8, rax
setne r9b
test rax, rax
je 0x14003beb8
cmp r8, rax
jne 0x14003beb8
xor r8d, r8d
movzx r9d, word [rdx + r8*2]
cmp r9w, word [rcx + r8*2]
jne 0x14003beca
inc r8
cmp rax, r8
jne 0x14003bea1
xor r9d, r9d
mov dword [rsp + 0x40], r9d
mov r13, qword [rsp + 0xd8]
jmp 0x14003bf51
mov r9b, 1
jmp 0x14003beb8
mov rcx, r15
call fcn.1401cc340
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xf0]
call fcn.14003c390
test eax, eax
je 0x14003bf4d
mov esi, dword [r13 + 0x18]
mov ecx, 0x18
call fcn.1401cbbc4
test rax, rax
je 0x14003c249
mov dword [rax + 0x10], esi
mov qword [rax + 8], rbx
mov rcx, qword [rsp + 0x100]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rsp + 0x100], rax
inc qword [rsp + 0x110]
mov r13, qword [r13 + 8]
cmp r13, rdi
je 0x14003c049
cmp dword [r13 + 0x18], ebp
je 0x14003bf4d
cmp dword [r13 + 0x30], r12d
jne 0x14003bf4d
movzx eax, byte [rsp + 0xc7]
mov r14d, eax
and r14d, 0x7f
test al, al
cmovs r14, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
lea rax, [rsp + 0xb0]
cmovns rsi, rax
test r14, r14
js 0x14003c20f
test rsi, rsi
jne 0x14003bfab
test r14, r14
jne 0x14003c23a
mov r15, r13
add r15, 0x3c
je 0x14003c18a
mov rcx, r15
call fcn.1401cc340
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xf0]
call fcn.14003c390
test eax, eax
jne 0x14003bf4d
movzx eax, byte [rsp + 0x97]
mov esi, eax
and esi, 0x7f
test al, al
cmovs rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x80]
cmovns r14, rax
test rsi, rsi
js 0x14003c243
test r14, r14
jne 0x14003becf
test rsi, rsi
je 0x14003becf
jmp 0x14003c246
lea rax, [rsp + 0x60]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
cmp qword [rsp + 0x110], 0
je 0x14003c0b7
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
mov r8, qword [rcx + 8]
mov r9, qword [rdx]
mov qword [r9 + 8], r8
mov r9, qword [rdx]
mov qword [r8], r9
mov r8, qword [rsp + 0x60]
mov qword [r8 + 8], rdx
mov qword [rdx], r8
mov qword [rsp + 0x60], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x110]
add qword [rsp + 0x70], rax
mov qword [rsp + 0x110], 0
cmp byte [rsp + 0x97], 0
mov r13, qword [rsp + 0x58]
movabs r12, 0xaaaaaaaaaaaaaaaa
jns 0x14003c166
mov rcx, qword [rsp + 0x80]
call fcn.1401cbbbc
jmp 0x14003c166
lea rax, [rsp + 0x60]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
cmp qword [rsp + 0x110], 0
je 0x14003c154
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
mov r8, qword [rcx + 8]
mov r9, qword [rdx]
mov qword [r9 + 8], r8
mov r9, qword [rdx]
mov qword [r8], r9
mov r8, qword [rsp + 0x60]
mov qword [r8 + 8], rdx
mov qword [rdx], r8
mov qword [rsp + 0x60], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x110]
add qword [rsp + 0x70], rax
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x40], 0
movabs r12, 0xaaaaaaaaaaaaaaaa
cmp byte [rsp + 0xc7], 0
jns 0x14003c17d
mov rcx, qword [rsp + 0xb0]
call fcn.1401cbbbc
mov rax, qword [rsp + 0x110]
jmp 0x14003b6d7
int3
int3
int3
mov r15b, byte [rsp + 0xc7]
xor r14d, r14d
mov dword [rsp + 0xf3], r14d
mov dword [rsp + 0xf0], r14d
test r15b, r15b
jns 0x14003c1c3
mov rcx, qword [rsp + 0xb0]
call fcn.1401cbbbc
xor r14d, r14d
xor r12d, r12d
xor r15d, r15d
jmp 0x14003b8cb
call fcn.1401509f0
jmp 0x14003b639
int3
int3
int3
xor r14d, r14d
mov dword [rsp + 0xf3], r14d
mov dword [rsp + 0xf0], r14d
xor r12d, r12d
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x44], eax
jmp 0x14003b8f6
int3
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x44], eax
xor r14d, r14d
mov dword [rsp + 0xf0], r14d
mov dword [rsp + 0xf3], r14d
xor r12d, r12d
xor r15d, r15d
jmp 0x14003b8f6
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
xor ecx, ecx
jmp 0x14003bb9a