Function at 0x1002b620
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.100481a0
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.10030050
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, 0x30
push eax
lea ecx, [ebp - 0x34]
call fcn.1001ae50
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.1002dbc0
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.1002f8d0
push eax
lea ecx, [ebp - 0x68]
call fcn.10007380
movzx ecx, al
test ecx, ecx
je 0x1002b692
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x34]
call fcn.1001afd0
mov al, byte [ebp - 9]
jmp 0x1002c12e
push str.COMMON
lea ecx, [ebp - 0x64]
call fcn.1001ad10
mov edx, dword [ebp + 8]
push edx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1002b815
mov ax, word [0x1009017c]
mov word [ebp - 0x66c], ax
push 0x206
push 0
lea ecx, [ebp - 0x66a]
push ecx
call fcn.10049500
add esp, 0xc
push 0x104
lea edx, [ebp - 0x66c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x1002b815
mov cx, word [0x10090180]
mov word [ebp - 0xe8c], cx
push 0x206
push 0
lea edx, [ebp - 0xe8a]
push edx
call fcn.10049500
add esp, 0xc
mov ax, word [0x10090184]
mov word [ebp - 0xc84], ax
push 0x206
push 0
lea ecx, [ebp - 0xc82]
push ecx
call fcn.10049500
add esp, 0xc
mov dx, word [0x10090188]
mov word [ebp - 0x874], dx
push 0x206
push 0
lea eax, [ebp - 0x872]
push eax
call fcn.10049500
add esp, 0xc
mov cx, word [0x1009018c]
mov word [ebp - 0xa7c], cx
push 0x206
push 0
lea edx, [ebp - 0xa7a]
push edx
call fcn.10049500
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
lea ecx, [ebp - 0x874]
push ecx
lea edx, [ebp - 0xc84]
push edx
lea eax, [ebp - 0xe8c]
push eax
lea ecx, [ebp - 0x66c]
push ecx
call fcn.10051ebc
add esp, 0x14
lea edx, [ebp - 0x874]
push edx
lea ecx, [ebp - 0x64]
call fcn.10028f00
push 0x10051b1b
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x64]
call fcn.100227f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0xf8]
push edx
lea ecx, [ebp - 0x64]
call fcn.100231d0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x64]
call fcn.100227f0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0xec]
push eax
call fcn.10021300
add esp, 0x14
lea ecx, [ebp - 0x64]
call fcn.1001c1d0
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.10030050
mov ecx, eax
call fcn.100310c0
lea ecx, [ebp - 0x4c]
call fcn.10005070
movzx edx, al
test edx, edx
je 0x1002b86b
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0xa], 0
lea ecx, [ebp - 0x4c]
call fcn.10003da0
lea ecx, [ebp - 0x64]
call fcn.1001af10
lea ecx, [ebp - 0x34]
call fcn.1001afd0
mov al, byte [ebp - 0xa]
jmp 0x1002c12e
push 0x10090190
lea ecx, [ebp - 0x140]
call fcn.10007850
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x128]
push edx
call fcn.100238d0
add esp, 8
lea ecx, [ebp - 0x140]
call fcn.100077e0
lea ecx, [ebp - 0x128]
call fcn.1001c1d0
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.10030050
mov ecx, eax
call fcn.100310c0
sub esp, 8
movsd xmm0, qword [0x10090070]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x158]
call fcn.10003920
lea ecx, [ebp - 0x158]
push ecx
push 0x100901a0
lea edx, [ebp - 0x2c0]
push edx
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xc0]
lea ecx, [ebp - 0x2c0]
call fcn.10003da0
lea ecx, [ebp - 0x158]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [0x10090090]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x170]
call fcn.10003920
lea eax, [ebp - 0x170]
push eax
push 0x100901ac
lea ecx, [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xc8]
lea ecx, [ebp - 0x2d8]
call fcn.10003da0
lea ecx, [ebp - 0x170]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [0x100903e0]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x188]
call fcn.10003920
lea edx, [ebp - 0x188]
push edx
push 0x100901c4
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xd0]
lea ecx, [ebp - 0x2f0]
call fcn.10003da0
lea ecx, [ebp - 0x188]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [0x10090060]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x1a0]
call fcn.10003920
lea ecx, [ebp - 0x1a0]
push ecx
push 0x100901dc
lea edx, [ebp - 0x308]
push edx
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xd8]
lea ecx, [ebp - 0x308]
call fcn.10003da0
lea ecx, [ebp - 0x1a0]
call fcn.10003da0
push 1
lea ecx, [ebp - 0x1b8]
call fcn.100039f0
lea eax, [ebp - 0x1b8]
push eax
push 0x100901e8
lea ecx, [ebp - 0x320]
push ecx
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 0xb], al
lea ecx, [ebp - 0x320]
call fcn.10003da0
lea ecx, [ebp - 0x1b8]
call fcn.10003da0
push 0
lea ecx, [ebp - 0x1d0]
call fcn.100039f0
lea edx, [ebp - 0x1d0]
push edx
push 0x100901f0
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 0xc], al
lea ecx, [ebp - 0x338]
call fcn.10003da0
lea ecx, [ebp - 0x1d0]
call fcn.10003da0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.100039f0
lea ecx, [ebp - 0x1e8]
push ecx
push 0x100901f8
lea edx, [ebp - 0x350]
push edx
lea ecx, [ebp - 0x94]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x350]
call fcn.10003da0
lea ecx, [ebp - 0x1e8]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [ebp - 0xc0]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x200]
call fcn.10003920
lea eax, [ebp - 0x200]
push eax
push 0x10090204
lea ecx, [ebp - 0x368]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xe8]
lea ecx, [ebp - 0x368]
call fcn.10003da0
lea ecx, [ebp - 0x200]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [ebp - 0xc8]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x218]
call fcn.10003920
lea edx, [ebp - 0x218]
push edx
push 0x10090210
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0x74]
lea ecx, [ebp - 0x380]
call fcn.10003da0
lea ecx, [ebp - 0x218]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [ebp - 0xd0]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x230]
call fcn.10003920
lea ecx, [ebp - 0x230]
push ecx
push str.EvaluationTimeoutSec
lea edx, [ebp - 0x398]
push edx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0x7c]
lea ecx, [ebp - 0x398]
call fcn.10003da0
lea ecx, [ebp - 0x230]
call fcn.10003da0
sub esp, 8
movsd xmm0, qword [ebp - 0xd8]
movsd qword [esp], xmm0
lea ecx, [ebp - 0x248]
call fcn.10003920
lea eax, [ebp - 0x248]
push eax
push 0x10090240
lea ecx, [ebp - 0x3b0]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004ce0
fstp qword [ebp - 0xe0]
lea ecx, [ebp - 0x3b0]
call fcn.10003da0
lea ecx, [ebp - 0x248]
call fcn.10003da0
movzx edx, byte [ebp - 0xb]
push edx
lea ecx, [ebp - 0x260]
call fcn.100039f0
lea eax, [ebp - 0x260]
push eax
push 0x1009024c
lea ecx, [ebp - 0x3c8]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x3c8]
call fcn.10003da0
lea ecx, [ebp - 0x260]
call fcn.10003da0
movzx edx, byte [ebp - 0xc]
push edx
lea ecx, [ebp - 0x278]
call fcn.100039f0
lea eax, [ebp - 0x278]
push eax
push 0x10090254
lea ecx, [ebp - 0x3e0]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x3e0]
call fcn.10003da0
lea ecx, [ebp - 0x278]
call fcn.10003da0
movzx edx, byte [ebp - 0xd]
push edx
lea ecx, [ebp - 0x290]
call fcn.100039f0
lea eax, [ebp - 0x290]
push eax
push 0x1009025c
lea ecx, [ebp - 0x3f8]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10005cf0
mov ecx, eax
call fcn.10004e40
mov byte [ebp - 1], al
lea ecx, [ebp - 0x3f8]
call fcn.10003da0
lea ecx, [ebp - 0x290]
call fcn.10003da0
movsd xmm0, qword [0x1009a9f0]
comisd xmm0, xmmword [ebp - 0x74]
ja 0x1002bd69
movsd xmm0, qword [0x1009a9f0]
comisd xmm0, xmmword [ebp - 0x7c]
jbe 0x1002bdd1
lea edx, [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.1002e370
mov dword [eax], 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Timeout_value_should_be_greater_than_0
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x20]
call fcn.1002fab0
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x94]
call fcn.10003da0
lea ecx, [ebp - 0x128]
call fcn.1001af10
lea ecx, [ebp - 0x4c]
call fcn.10003da0
lea ecx, [ebp - 0x64]
call fcn.1001af10
lea ecx, [ebp - 0x34]
call fcn.1001afd0
mov al, byte [ebp - 0xe]
jmp 0x1002c12e
movsd xmm0, qword [ebp - 0x74]
comisd xmm0, xmmword [ebp - 0x7c]
jbe 0x1002be45
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.1002e370
mov dword [eax], 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Attenuation_timeout_should_be_less_or_equal_to_final_timeout
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x20]
call fcn.1002fab0
mov byte [ebp - 0xf], 0
lea ecx, [ebp - 0x94]
call fcn.10003da0
lea ecx, [ebp - 0x128]
call fcn.1001af10
lea ecx, [ebp - 0x4c]
call fcn.10003da0
lea ecx, [ebp - 0x64]
call fcn.1001af10
lea ecx, [ebp - 0x34]
call fcn.1001afd0
mov al, byte [ebp - 0xf]
jmp 0x1002c12e
push 0x188
call fcn.10047aa3
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1002be68
mov ecx, dword [ebp - 0x24]
call fcn.10026260
mov dword [ebp - 0x28], eax
jmp 0x1002be6f
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xb4]
call fcn.1001ad60
lea ecx, [ebp - 0x110]
call fcn.1001ad60
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1002c03c
mov dword [ebp - 0x2c], 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.10031220
push eax
lea ecx, [ebp - 0x110]
call fcn.1001b080
lea ecx, [ebp - 0x410]
call fcn.1001af10
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0xb4]
call fcn.1002e300
push 0x10090350
lea eax, [ebp - 0x64]
push eax
push 0x10090348
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x428]
push edx
call fcn.1002fc80
add esp, 8
push eax
push 0x10090338
lea eax, [ebp - 0x64]
push eax
push 0x10090334
lea ecx, [ebp - 0xb4]
call fcn.100226e0
mov ecx, eax
call fcn.10022610
mov ecx, eax
call fcn.100226e0
mov ecx, eax
call fcn.10022610
mov ecx, eax
call fcn.100226e0
mov ecx, eax
call fcn.10022610
mov ecx, eax
call fcn.100226e0
lea ecx, [ebp - 0x428]
call fcn.1001af10
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x440]
push edx
call fcn.1002fc80
add esp, 8
push eax
lea ecx, [ebp - 0xb4]
call fcn.10022610
lea ecx, [ebp - 0x440]
call fcn.1001af10
push 0x10090354
lea ecx, [ebp - 0xb4]
call fcn.100226e0
push 0
call fcn.1002b3e0
add esp, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], edx
lea eax, [ebp - 0x9c]
push eax
call fcn.1002b3c0
add esp, 4
mov ecx, 9
mov esi, eax
lea edi, [ebp - 0x464]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x464]
push ecx
push 0x10090358
push 0x200
lea edx, [ebp - 0x108c]
push edx
call fcn.10053afd
add esp, 0x10
push str..log
lea eax, [ebp - 0x108c]
push eax
lea ecx, [ebp - 0xb4]
call fcn.100226e0
mov ecx, eax
call fcn.100226e0
lea ecx, [ebp - 0xb4]
call fcn.1001c1d0
push eax
lea ecx, [ebp - 0x2a8]
call fcn.1001ad10
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 8]
call fcn.1002fb90
lea ecx, [ebp - 0x2a8]
call fcn.1001af10
sub esp, 8
movsd xmm0, qword [ebp - 0xe0]
movsd qword [esp], xmm0
mov ecx, dword [ebp - 8]
call fcn.1002fc00
sub esp, 8
movsd xmm0, qword [ebp - 0x74]
movsd qword [esp], xmm0
mov ecx, dword [ebp - 8]
call fcn.1002fbc0
sub esp, 8
movsd xmm0, qword [ebp - 0x7c]
movsd qword [esp], xmm0
mov ecx, dword [ebp - 8]
call fcn.1002fb70
sub esp, 8
movsd xmm0, qword [ebp - 0xe8]
movsd qword [esp], xmm0
mov ecx, dword [ebp - 8]
call fcn.1002fbe0
movzx edx, byte [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
call fcn.1002fc40
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 8]
call fcn.1002fc20
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x4c
call fcn.1002e370
mov edx, dword [ebp - 8]
mov dword [eax], edx
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x6c
call fcn.1002e3a0
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [ebp - 0x110]
call fcn.1001af10
lea ecx, [ebp - 0xb4]
call fcn.1001af10
lea ecx, [ebp - 0x94]
call fcn.10003da0
lea ecx, [ebp - 0x128]
call fcn.1001af10
lea ecx, [ebp - 0x4c]
call fcn.10003da0
lea ecx, [ebp - 0x64]
call fcn.1001af10
lea ecx, [ebp - 0x34]
call fcn.1001afd0
push 0
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.10029e20
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4