Function at 0x1400063c0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140132060]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x14010eba8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov dword [rsp + 0x50], Ordinal_50
mov qword [rsp + 0x58], rdi
lea r9, [rbp - 0x70]
movups xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x60], rdi
lea r8, [rbp - 0x60]
mov dword [rsp + 0x68], edi
lea rcx, [rbp - 0x80]
movups xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x70], rdi
mov edx, 0x1fffff
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x68], rdi
movups xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x70], rbx
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm0
call rax
test eax, eax
js 0x1400066b5
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
movabs rax, 0x3f653b6f807ba484
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movabs r9, 0x4ae5d7914f3b71d5
mov qword [rsp + 0x48], r9
lea rax, [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
movabs r10, 0x4700151cf309d7e7
movabs r11, 0x4ae5d7914f3b71b0
mov qword [rbp - 0x30], r10
mov qword [rbp - 0x28], r11
sub r8, rax
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006503
inc rax
test ecx, ecx
jne 0x1400064f0
test edx, edx
je 0x1400066da
movabs rax, 0x3f653b6f8068a48b
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x40]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], r10
sub r8, rax
mov qword [rbp - 0x28], r11
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006557
inc rax
test ecx, ecx
jne 0x140006544
test edx, edx
je 0x1400066da
movabs rax, 0x697466739b67b884
mov qword [rbp - 0x30], r10
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
movabs r9, 0x4ae5d7914f5e09d5
mov qword [rbp - 0x28], r11
mov qword [rsp + 0x48], r9
lea rax, [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
sub r8, rax
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400065b5
inc rax
test ecx, ecx
jne 0x1400065a2
test edx, edx
je 0x1400066da
movabs rax, 0x697466739b6aa194
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x40]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], r10
sub r8, rax
mov qword [rbp - 0x28], r11
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006613
inc rax
test ecx, ecx
jne 0x140006600
test edx, edx
je 0x1400066da
movabs rax, 0x356567739f79af82
mov qword [rbp - 0x30], r10
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x40]
movabs rax, 0x4ae5d7912a43149e
mov qword [rbp - 0x28], r11
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
sub r9, rax
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
nop
movzx r8d, byte [rax]
movzx ecx, byte [rax + r9]
sub r8d, ecx
jne 0x140006675
inc rax
test ecx, ecx
jne 0x140006660
test r8d, r8d
je 0x1400066da
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rbp - 0x80]
lea r9, [rbp - 0x78]
mov dword [rsp + 0x30], 2
mov r8, rax
mov dword [rsp + 0x28], edi
mov rdx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp - 0x80]
test eax, eax
cmovns rdi, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400d7fe0
mov rbx, qword [rsp + 0x230]
add rsp, 0x200
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400066b8