Function at 0x140003790
Capabilities:
Enumerate process modules
Get common file path
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x360
mov rax, qword [0x140013010]
xor rax, rsp
mov qword [rsp + 0x350], rax
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x14000c458]
mov ebx, ecx
xor edx, edx
mov dword [rsp + 0x150], eax
mov r8d, 0x1f6
movaps xmmword [rsp + 0x140], xmm0
lea rcx, [rsp + 0x154]
xor ebp, ebp
call sub.VCRUNTIME140.dll_memset
lea ecx, [rbp + 0x16]
call fcn.140009e10
lea r8, str.chrome.exe
mov rcx, rax
lea edx, [rbp + 0xb]
mov rdi, rax
mov esi, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140003a38
lea r9, [rsp + 0x28]
mov qword [rsp + 0x388], r14
lea r8d, [rbp + 8]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
lea r14d, [rbp + 1]
mov rcx, rbx
test eax, eax
je 0x14000386b
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x140]
mov r9d, 0x105
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
jmp 0x140003885
mov r8d, 0x105
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
cmovne esi, r14d
lea rdx, [rsp + 0x140]
lea rcx, str.chrome.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000399b
test esi, esi
je 0x140003905
mov edx, 0x105
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov edx, 0xb
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov rdx, rdi
lea rcx, [rsp + 0x140]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rax
test rax, rax
je 0x140003905
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1400038f0
cmp word [rcx + rax*2], bp
je 0x14000399b
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x106
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140003a27
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x14000397b
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x30]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140003a27
lea r9, [rsp + 0x140]
lea r8, str._t_tChecking_:
lea rdx, str._s_____s_n
call fcn.140001040
jmp 0x140003a27
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x106
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140003a24
mov rcx, qword [0x140013ac8]
test rcx, rcx
jne 0x140003a09
lea r8, str.ChromeReprompt.txt
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14000b90c]
lea rdx, [rsp + 0x30]
lea rcx, [0x140013ac8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [0x140013ac8]
test rcx, rcx
je 0x140003a24
lea r9, [rsp + 0x140]
lea r8, str._t_tFound_Match_:
lea rdx, str._s_____s_n
call fcn.140001040
mov ebp, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x388]
mov rcx, rdi
call fcn.140009914
mov eax, ebp
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400098f0
mov rbx, qword [rsp + 0x390]
add rsp, 0x360
pop rdi
pop rsi
pop rbp
ret