Function at 0x1400022e0
Capabilities:
Get process image filename

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x28
xor esi, esi
mov rbp, rdx
mov rbx, rcx
mov byte [rsp + 0x60], sil
mov qword [0x14020bea0], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
test rax, rax
jne 0x14000233d
lea rdx, str.Desktop
sub rbx, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x140002320
mov eax, 1
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, r12d
test eax, 0xffffff00
je 0x1400026e6
mov rcx, r12
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400026e6
lea rcx, [rsp + 0x60]
call fcn.140004e00
movzx edx, byte [rsp + 0x60]
dec edx
je 0x140002696
dec edx
je 0x140002656
dec edx
je 0x140002616
dec edx
je 0x1400025d6
dec edx
je 0x14000258d
lea rdx, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x68]
test r8d, r8d
je 0x140002562
mov eax, dword [rbp]
mov ecx, 0x430
mov qword [rsp + 0x20], r13
cmp r8d, eax
cmovne eax, r8d
xor edx, edx
mov dword [rbp], eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
je 0x14000252e
lea rdx, [0x14020b6a1]
mov r8d, 0x3ff
mov rcx, rax
mov qword [rsp + 0x50], rdi
call sub.PSAPI.DLL_GetProcessImageFileNameA
lea rcx, [0x14020b6a1]
mov dl, 0x5c
call fcn.140002720
lea rdi, [0x14020b6a0]
inc eax
test eax, eax
jle 0x14000243e
inc eax
mov rcx, rdi
movsxd rdx, eax
add rdx, rdi
sub rcx, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140002430
lea rdx, str..vshost
mov rcx, rdi
call fcn.1400021e0
lea rdx, str._32
mov rcx, rdi
call fcn.1400021e0
mov dl, 0x2e
mov rcx, rdi
call fcn.140002720
test eax, eax
jle 0x140002505
cdqe
mov r8, rdi
mov byte [rax + rdi], sil
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002493
inc rax
test ecx, ecx
jne 0x140002480
test edx, edx
je 0x140002505
mov rcx, rbx
mov byte [0x14020b6be], sil
sub rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdi]
inc rdi
mov byte [rcx + rdi - 1], al
test al, al
jne 0x1400024b0
mov dword [0x14020c3c8], esi
lea rdi, str.explorer
mov ecx, 9
mov rsi, rbx
repe cmpsb byte [rsi], byte [rdi]
jne 0x140002505
mov rcx, r12
call fcn.140002290
test eax, eax
je 0x140002505
lea rdx, str.Desktop
sub rbx, rdx
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x1400024f0
mov dword [rbp], 0xbad4f010
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov qword [0x14020bea0], r12
mov eax, 1
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.Desktop
sub rbx, rdx
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x140002540
mov eax, 1
mov r13, qword [rsp + 0x20]
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.Desktop
sub rbx, rdx
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x140002570
mov eax, 1
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp dword [rbp], 0xaa09dad0
je 0x14000260a
lea rcx, str.ProgramMenu
mov dword [rbp], 0xaa09dad0
sub rbx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x1400025b0
mov esi, 1
mov qword [0x14020bea0], r12
mov eax, esi
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp dword [rbp], 0xbad4f00d
je 0x14000260a
lea rdx, str.Desktop
mov dword [rbp], 0xbad4f00d
sub rbx, rdx
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x1400025f0
mov esi, 1
mov qword [0x14020bea0], r12
mov eax, esi
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp dword [rbp], 0xaa096e22
je 0x14000260a
lea rcx, str.TaskSwitcherWnd
mov dword [rbp], 0xaa096e22
sub rbx, rcx
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x140002630
mov esi, 1
mov qword [0x14020bea0], r12
mov eax, esi
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp dword [rbp], 0xaa09de02
je 0x14000260a
lea rcx, str.MMCMainFrame
mov dword [rbp], 0xaa09de02
sub rbx, rcx
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x140002670
mov esi, 1
mov qword [0x14020bea0], r12
mov eax, esi
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp dword [rbp], 0xaa090a17
je 0x14000260a
lea rcx, str.Dialog
mov dword [rbp], 0xaa09dad0
sub rbx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x1400026c0
mov esi, 1
mov qword [0x14020bea0], r12
mov eax, esi
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.Desktop
mov dword [rbp], 0xbad4f00d
sub rbx, rdx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rbx + rdx - 1], al
test al, al
jne 0x140002700
mov eax, 1
add rsp, 0x28
pop r12
pop rsi
pop rbp
pop rbx
ret