Function at 0x14006a147
Capabilities:
Get process image filename

Disassembly:
push rax
pushf
mov eax, 0x16d318da
pushf
not eax
add eax, 0xd985ca20
xor eax, 0xc92b7cbc
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xbd77ca4c
xor eax, 0x9c04908c
rol eax, 0x9f
popf
cmp eax, 4
jne 0x14006a184
popf
pop rax
jmp 0x14006a4d7
cmp eax, 0
jne 0x14006a193
popf
pop rax
jmp 0x14006a283
cmp eax, 3
jne 0x14006a1a2
popf
pop rax
jmp 0x14006a477
cmp eax, 1
jne 0x14006a1b1
popf
pop rax
jmp 0x14006a389
cmp eax, 0xd
jne 0x14006a1c0
popf
pop rax
jmp 0x14006aa0c
cmp eax, 7
jne 0x14006a1cf
popf
pop rax
jmp 0x14006a6f5
cmp eax, 0xe
jne 0x14006a1de
popf
pop rax
jmp 0x14006aabb
cmp eax, 0xb
jne 0x14006a1ed
popf
pop rax
jmp 0x14006a8c9
cmp eax, 0xc
jne 0x14006a1fc
popf
pop rax
jmp 0x14006a94b
cmp eax, 8
jne 0x14006a20b
popf
pop rax
jmp 0x14006a78c
cmp eax, 0x10
jne 0x14006a21a
popf
pop rax
jmp 0x14006ab51
cmp eax, 2
jne 0x14006a229
popf
pop rax
jmp 0x14006a43a
cmp eax, 9
jne 0x14006a238
popf
pop rax
jmp 0x14006a7c3
cmp eax, 0xa
jne 0x14006a247
popf
pop rax
jmp 0x14006a855
cmp eax, 6
jne 0x14006a256
popf
pop rax
jmp 0x14006a5b7
cmp eax, 0x11
jne 0x14006a265
popf
pop rax
jmp 0x14006abb2
cmp eax, 5
jne 0x14006a274
popf
pop rax
jmp 0x14006a534
cmp eax, 0xf
jne 0x14006a283
popf
pop rax
jmp 0x14006ab4a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140010010]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x30]
jmp 0x14006a2b2
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x4bed299f
pushf
not ecx
add ecx, 0xcec2ba1d
xor ecx, 0x90cac0d5
rol ecx, 0xbe
popf
pushf
not ecx
add ecx, 0xe50ff020
xor ecx, 0xe0981bf5
rol ecx, 0x58
popf
jmp 0x14006a2ef
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14006a343
push rax
pushf
mov eax, 0xb68a517e
pushf
not eax
add eax, 0xca5a23a2
xor eax, 0xcc74e478
rol eax, 0x68
popf
pushf
not eax
add eax, 0xb32766c5
xor eax, 0xd0a2369b
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x8515d834
xor eax, 0xc02b70a5
rol eax, 0xa0
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x99a739ee
pushf
not eax
add eax, 0x8984885a
xor eax, 0xa0266dcb
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xabf46d05
xor eax, 0xf91fee84
rol eax, 0x60
popf
pushf
not eax
add eax, 0x93940a42
xor eax, 0xbfe91b4f
rol eax, 0xb1
popf
jmp 0x14006a175
mov r8d, 0x6dbc187a
pushf
not r8d
add r8d, 0xa968d28b
xor r8d, 0xef5598e5
rol r8d, 0x11
popf
pushf
not r8d
add r8d, 0xf1be3e33
xor r8d, 0xafc29440
rol r8d, 0xe
popf
lea rdx, [rsp + 0x60]
mov rcx, rax
jmp 0x14006a3ca
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
jne 0x14006a407
push rax
pushf
mov eax, 0x5ef69ac3
pushf
not eax
add eax, 0x952de4b8
xor eax, 0x898263bd
rol eax, 4
popf
pushf
not eax
add eax, 0xec06a12d
xor eax, 0xf0b3fc11
rol eax, 0x5a
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x4340be91
pushf
not eax
add eax, 0x8b94cdcf
xor eax, 0x83545db1
rol eax, 0xac
popf
pushf
not eax
add eax, 0x8ab01e1b
xor eax, 0x8587506a
rol eax, 0x3a
popf
jmp 0x14006a175
mov rcx, rbx
jmp 0x14006a43e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x136d2be
pushf
not eax
add eax, 0xd3f6d4b1
xor eax, 0xa9f12c53
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xa0d7e972
xor eax, 0xef3f52a1
rol eax, 0xa6
popf
jmp 0x14006a175
xor al, al
jmp 0x14006abb5
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
push rax
pushf
mov eax, 0x9cfcd1cd
pushf
not eax
add eax, 0x9ef3a080
xor eax, 0x956adcd9
rol eax, 0xef
popf
pushf
not eax
add eax, 0xf0a11646
xor eax, 0xe76a0bf7
rol eax, 0x92
popf
jmp 0x14006a175
inc r8
cmp byte [rax + r8], 0
jne 0x14006a584
push rax
pushf
mov eax, 0xf5dbb9e4
pushf
not eax
add eax, 0xdee54aa7
xor eax, 0xa5c415cb
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xeef245e7
xor eax, 0x98034c11
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xde8fa892
xor eax, 0xc270ff04
rol eax, 0xb3
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x1020657e
pushf
not eax
add eax, 0xed694055
xor eax, 0xdc8db11f
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xa9780fd1
xor eax, 0xa26860ac
rol eax, 0xcf
popf
jmp 0x14006a175
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14007299f
nop
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0xa1c71d2e
pushf
not edx
add edx, 0xc1bb12cb
xor edx, 0x99da7822
rol edx, 0x1e
popf
pushf
not edx
add edx, 0xb2089196
xor edx, 0xb34e1fd1
rol edx, 0x42
popf
pushf
not edx
add edx, 0x9ec0c10f
xor edx, 0xf1fff931
rol edx, 0x48
popf
mov eax, dword [rdx + rcx]
mov r8d, 0x28dbab9c
pushf
not r8d
add r8d, 0xeecdf46f
xor r8d, 0xc79d211d
rol r8d, 0x77
popf
pushf
not r8d
add r8d, 0xb80a784b
xor r8d, 0xd089412e
rol r8d, 0x80
popf
test al, 1
jne 0x14006a69c
push rax
pushf
mov eax, 0x722ce961
pushf
not eax
add eax, 0xedaa98a4
xor eax, 0x99da4d73
rol eax, 0x67
popf
pushf
not eax
add eax, 0xaa6bc961
xor eax, 0x89c96148
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xdd65bce8
xor eax, 0x98c63918
rol eax, 0x18
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x94dc2279
pushf
not eax
add eax, 0x83b31347
xor eax, 0xf0eac83b
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xf96d304f
xor eax, 0xbbd58d1c
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xc46b58a6
xor eax, 0xd2cd9b80
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xd0519220
xor eax, 0xd757c741
rol eax, 0xcd
popf
jmp 0x14006a175
or eax, 1
mov dword [rdx + rcx], eax
lea rbx, [rcx + r8]
mov word [rbx + 9], 0x19d
mov dword [rbx], 0xe499fcd5
mov dword [rbx + 4], 0x81cc6988
mov byte [rbx + 8], 0xda
lea rcx, [0x182c29d91]
pushf
sub rcx, 0x42c1ee71
popf
call fcn.14007993f
nop
jmp 0x14006a7c3
lea rbx, [r8 + rcx]
push rax
pushf
mov eax, 0xce78effa
pushf
not eax
add eax, 0xab9a10e7
xor eax, 0xa3c5b361
rol eax, 0xef
popf
pushf
not eax
add eax, 0xce850e14
xor eax, 0x84be4ce1
rol eax, 0x3a
popf
jmp 0x14006a175
cmp byte [rbx + 0xa], 0
je 0x14006a80f
push rax
pushf
mov eax, 0x2113e749
pushf
not eax
add eax, 0xb7c18cb7
xor eax, 0xf6469434
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xcfb17885
xor eax, 0xcbad4d52
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xd97f1ff3
xor eax, 0xfca89746
rol eax, 0x66
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x3a8043e1
pushf
not eax
add eax, 0xdf1bad54
xor eax, 0xd76a2eac
rol eax, 0x97
popf
pushf
not eax
add eax, 0xa02fae2b
xor eax, 0xd979e0fe
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x8fd0a624
xor eax, 0xc4844878
rol eax, 0x18
popf
jmp 0x14006a175
xor byte [rbx], 0xbf
xor byte [rbx + 1], 0x9d
xor byte [rbx + 2], 0xef
xor byte [rbx + 3], 0x85
not byte [rbx + 4]
xor byte [rbx + 5], 0x47
xor byte [rbx + 6], 0xa9
xor byte [rbx + 7], 0xf9
xor byte [rbx + 8], 0xbf
xor byte [rbx + 9], 0x9d
mov byte [rbx + 0xa], 0
nop dword [rax]
push rax
pushf
mov eax, 0x238f6e71
pushf
not eax
add eax, 0xefdad9d5
xor eax, 0xb6169ece
rol eax, 0x11
popf
pushf
not eax
add eax, 0xb5468dc1
xor eax, 0x85ea4468
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x9d284171
xor eax, 0x95a48c40
rol eax, 0xcf
popf
jmp 0x14006a175
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14006a905
push rax
pushf
mov eax, 0xbbfae330
pushf
not eax
add eax, 0xe6daadb8
xor eax, 0xe4dbb0fb
rol eax, 0x28
popf
pushf
not eax
add eax, 0xf5fb1b6d
xor eax, 0xf1809e92
rol eax, 0x20
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x43c3c06a
pushf
not eax
add eax, 0x9c5b882b
xor eax, 0xe0d3c550
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xb29b9f3a
xor eax, 0xb958b3c2
rol eax, 0xe
popf
pushf
not eax
add eax, 0x881e0fcd
xor eax, 0x886d0afc
rol eax, 0xb0
popf
jmp 0x14006a175
lea rcx, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
cmp rbp, 0x10
cmovae rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov rdx, qword [rsp + 0x48]
call fcn.14006948f
cmp rax, 0xffffffffffffffff
setne bl
cmp rbp, 0x10
jb 0x14006a9b4
push rax
pushf
mov eax, 0xe5f81202
pushf
not eax
add eax, 0xa6361984
xor eax, 0xa2093b94
rol eax, 0x72
popf
pushf
not eax
add eax, 0xf638ad7a
xor eax, 0x85e3249b
rol eax, 0x81
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0xa5ba26cb
pushf
not eax
add eax, 0x97398ec2
xor eax, 0xdc75356f
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xa67fac5b
xor eax, 0xbbe26c6b
rol eax, 0x32
popf
pushf
not eax
add eax, 0xf7e3e014
xor eax, 0x96dfe6ff
rol eax, 0x84
popf
pushf
not eax
add eax, 0xf733c9e5
xor eax, 0xf8199dd1
rol eax, 1
popf
jmp 0x14006a175
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14006aa62
push rax
pushf
mov eax, 0x1968a37f
pushf
not eax
add eax, 0xc049dae9
xor eax, 0x9f4ed7d6
rol eax, 0x89
popf
pushf
not eax
add eax, 0xc584f2a9
xor eax, 0x9b33f9b4
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xbcd9b6b1
xor eax, 0xdce23244
rol eax, 0xe5
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0xf0c64456
pushf
not eax
add eax, 0xc5adffe2
xor eax, 0xf4c681da
rol eax, 0x35
popf
pushf
not eax
add eax, 0xebfb001d
xor eax, 0x90db04d0
rol eax, 3
popf
pushf
not eax
add eax, 0x85a68b7c
xor eax, 0x96e9d057
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xb5b5ceff
xor eax, 0xc615cc49
rol eax, 0xb4
popf
jmp 0x14006a175
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ab16
push rax
pushf
mov eax, 0xbebf2dd1
pushf
not eax
add eax, 0xb6be4081
xor eax, 0xc1f424c2
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xa1c3dfbf
xor eax, 0xaddaeed3
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xff980423
xor eax, 0xc12046c9
rol eax, 0x1b
popf
jmp 0x14006a175
push rax
pushf
mov eax, 0x7c41f956
pushf
not eax
add eax, 0xaff4ce96
xor eax, 0xb8cfba24
rol eax, 0xac
popf
pushf
not eax
add eax, 0x8194c048
xor eax, 0xaaa38790
rol eax, 0xf5
popf
jmp 0x14006a175
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006e5b4
push rax
pushf
mov eax, 0xd36f374
pushf
not eax
add eax, 0xde9a5788
xor eax, 0xd9ff7378
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xaa052743
xor eax, 0x9057a736
rol eax, 0x54
popf
pushf
not eax
add eax, 0xe82c8f9c
xor eax, 0xb8398eed
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xdb79a006
xor eax, 0xed772a63
rol eax, 0xa9
popf
jmp 0x14006a175
movzx eax, bl
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400777d1
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret