Function at 0x10005780
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x1001800c]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
call fcn.1000c7d0
cmp dword [0x10125bf0], 0
jne 0x100059a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10125bf0], eax
mov word [esp + 0x10], 0x5c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x100057dc
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x1001af3c], 0xffffffff
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 3
mov byte [esp + 0x14], bl
je 0x1000599e
cmp byte [0x1011af70], 0
je 0x1000599e
mov word [esp + 0x18], 0x9bc1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x1000581e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x10125bec]
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 3
mov byte [esp + 0x1c], bl
test ecx, ecx
jne 0x10005849
xorps xmm0, xmm0
mov word [esp + 0x25], cx
movq qword [esp + 0x1d], xmm0
mov byte [esp + 0x27], cl
jmp 0x10005863
movq xmm0, qword [ecx]
movq qword [esp + 0x1d], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x25], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x27], al
mov ecx, dword [0x10125be8]
test ecx, ecx
je 0x1000588f
mov ecx, dword [ecx]
test ecx, ecx
je 0x1000588f
movq xmm0, qword [ecx]
movq qword [esp + 0x28], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x30], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x32], al
jmp 0x100058a4
xorps xmm0, xmm0
mov word [esp + 0x30], 0
movq qword [esp + 0x28], xmm0
mov byte [esp + 0x32], 0
test esi, esi
jne 0x100058ba
push 0x40
lea eax, [esp + 0x37]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x100058dd
movups xmm0, xmmword [esi]
movups xmmword [esp + 0x33], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [esp + 0x43], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [esp + 0x53], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [esp + 0x63], xmm0
push 0x40
lea eax, [esp + 0x77]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10005945
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10005945
push 0x104
lea eax, [esp + 0xbc]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000593e
lea ecx, [esp + 0xb8]
call fcn.1000f7d0
push eax
lea eax, [esp + 0x77]
push 0x10014908
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x73]
mov ecx, 0x10018e28
push eax
lea eax, [esp + 0x37]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x29]
push eax
movzx eax, byte [esp + 0x2c]
push eax
call fcn.1000fb90
push eax
push 0
push 0x1011b140
call fcn.10008a00
movzx eax, byte [esp + 0x39]
add esp, 0x20
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10003d00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.10010f8a
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.100051f0
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f8a
mov esp, ebp
pop ebp
ret