Function at 0x1000e455
Capabilities:
Get process image filename

Disassembly:
push 0xb70
mov eax, 0x1005b38f
call fcn.10035a7d
mov ebx, ecx
mov dword [ebp - 0xb30], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xaf4], eax
call fcn.10010082
mov esi, eax
mov dword [ebp - method.AutoLock.virtual_0], vtable.AutoLock.0
lea eax, [ebx + 0x30]
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xb70], eax
add eax, 4
push eax
mov dword [ebp - 0xb0c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
lea edi, [ebx + 0x4c]
mov dword [ebp - 4], eax
mov ecx, edi
lea eax, [ebp - 0xaf4]
mov dword [ebp - 0xb08], edi
push eax
lea eax, [ebp - 0xafc]
push eax
call fcn.1000fa52
mov eax, dword [ebp - 0xafc]
cmp eax, dword [ebx + 0x50]
jne 0x1000f0d2
push str.COMMON
lea ecx, [ebp - 0xa84]
call fcn.100032c7
mov byte [ebp - 4], 1
xor ecx, ecx
push dword [ebp - 0xaf4]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0xb34], ebx
test ebx, ebx
je 0x1000e665
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.10036d40
add esp, 0xc
lea eax, [ebp - 0x424]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1000e665
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0xa3c], ax
lea eax, [ebp - 0xa3a]
push edi
push eax
call fcn.10036d40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push 0x206
push edi
push eax
call fcn.10036d40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push 0x206
push edi
push eax
call fcn.10036d40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push 0x206
push edi
push eax
call fcn.10036d40
add esp, 0xc
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.1003e946
lea ecx, [ebp - 0x21c]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1000e5f6
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa84]
call fcn.1000d800
cmp dword [ebp - 0xa70], 7
lea ecx, [ebp - 0xa84]
mov edi, dword [ebp - 0xa84]
mov eax, dword [ebp - 0xa74]
cmova ecx, edi
seta dl
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0xa84]
test dl, dl
je 0x1000e648
mov ecx, edi
jmp 0x1000e64e
lea edi, [ebp - 0xa84]
push edi
push eax
push ecx
lea ecx, [ebp - 0xb00]
call fcn.1000faac
mov edi, dword [ebp - 0xb08]
add esp, 0xc
cmp dword [ebp - 0xa70], 7
lea eax, [ebp - 0xa84]
cmova eax, dword [ebp - 0xa84]
push eax
lea eax, [ebp - 0xb54]
push eax
call fcn.10010082
mov ecx, eax
call fcn.10011243
lea ecx, [ebp - 0xb54]
mov byte [ebp - 4], 2
call fcn.10014f10
test al, al
je 0x1000e6ac
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f0bc
push str.DefaultSettings
lea ecx, [ebp - 0xa54]
call fcn.100021e6
lea edx, [ebp - 0xa54]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xacc]
call fcn.100063d8
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 5
call fcn.100029cd
cmp dword [ebp - 0xab8], 7
lea eax, [ebp - 0xacc]
cmova eax, dword [ebp - 0xacc]
push eax
lea eax, [ebp - 0xb6c]
push eax
call fcn.10010082
mov ecx, eax
call fcn.10011243
push ecx
mov byte [ebp - 4], 6
movsd xmm0, qword [0x100892d0]
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 7
push eax
push str.Threshold
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb24]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [0x10089300]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 9
push eax
push str.FirstEvaluationTimeSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb1c]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [0x10089310]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0xb
push eax
push str.EvaluationTimeoutSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb7c]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [0x100892c0]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0xd
push eax
push str.DiscretSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb3c]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
push 1
lea ecx, [ebp - 0xa54]
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0xf
push eax
push str.UseIO
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xafc], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
xor eax, eax
lea ecx, [ebp - 0xa54]
push eax
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x11
push eax
push str.UseCPU
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov byte [ebp - 4], 0x12
mov ecx, eax
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xb28], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
xor eax, eax
lea ecx, [ebp - 0xa54]
push eax
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x13
push eax
push str.WriteLog
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb6c]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xb00], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [ebp - 0xb24]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x15
push eax
push str.Threshold
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x16
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb14]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [ebp - 0xb1c]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x17
push eax
push str.FirstEvaluationTimeSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb1c]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
push ecx
movsd xmm0, qword [ebp - 0xb7c]
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x19
push eax
push str.EvaluationTimeoutSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb24]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm0, qword [ebp - 0xb3c]
push ecx
push ecx
lea ecx, [ebp - 0xa54]
movsd qword [esp], xmm0
call fcn.10013800
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x1b
push eax
push str.DiscretSec
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.10014b90
lea ecx, [ebp - 0xa6c]
fstp qword [ebp - 0xb3c]
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
push dword [ebp - 0xafc]
lea ecx, [ebp - 0xa54]
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x1d
push eax
push str.UseIO
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x1e
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xaf6], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
push dword [ebp - 0xb28]
lea ecx, [ebp - 0xa54]
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x1f
push eax
push str.UseCPU
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xaf7], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
push dword [ebp - 0xb00]
lea ecx, [ebp - 0xa54]
call fcn.100138d0
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 0x21
push eax
push str.WriteLog
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xb54]
call fcn.10015b80
mov ecx, eax
mov byte [ebp - 4], 0x22
call fcn.10014cf0
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 0xaf5], al
call fcn.10013c80
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 6
call fcn.10013c80
movsd xmm2, qword [0x100892e8]
movsd xmm1, qword [ebp - 0xb1c]
comisd xmm2, xmm1
ja 0x1000f074
movsd xmm0, qword [ebp - 0xb24]
comisd xmm2, xmm0
ja 0x1000f074
comisd xmm1, xmm0
jbe 0x1000eccd
lea eax, [ebp - 0xaf4]
mov ecx, edi
push eax
lea eax, [ebp - 0xb14]
push eax
call fcn.1000faeb
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, str.Attenuation_timeout_should_be_less_or_equal_to_final_timeout
jmp 0x1000f09c
push 0x188
call fcn.10034eb8
pop ecx
mov dword [ebp - 0xb00], eax
mov ecx, eax
mov byte [ebp - 4], 0x23
call fcn.1000b8d1
mov ebx, eax
lea edi, [ebp - 0xa9c]
xor eax, eax
xor ecx, ecx
stosd dword es:[edi], eax
push 7
pop edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa88], edx
mov word [ebp - 0xa9c], ax
lea edi, [ebp - 0xa54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0xa44], ecx
mov dword [ebp - 0xa40], edx
mov word [ebp - 0xa54], ax
mov byte [ebp - 4], 0x25
cmp byte [ebp - 0xaf5], al
je 0x1000ef75
lea eax, [ebp - 0xafc]
mov dword [ebp - 0xafc], ecx
push eax
push dword [ebp - 0xaf4]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 0xa6c]
mov ecx, esi
push eax
call fcn.100113da
push eax
lea ecx, [ebp - 0xa54]
call fcn.10003290
lea ecx, [ebp - 0xa6c]
call fcn.10002975
push 7
pop edi
cmp dword [ebp - 0xa40], edi
lea eax, [ebp - 0xa54]
push dword [ebp - 0xa44]
cmova eax, dword [ebp - 0xa54]
lea ecx, [ebp - 0xa9c]
push eax
call fcn.1000d800
mov edx, dword [ebp - 0xafc]
lea ecx, [ebp - 0xa6c]
call fcn.1000dfce
mov esi, eax
push 0x10088984
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 4], 0x26
call fcn.100079fc
cmp dword [ebp - 0xa70], edi
mov ecx, eax
push dword [ebp - 0xa74]
lea eax, [ebp - 0xa84]
cmova eax, dword [ebp - 0xa84]
push eax
call fcn.10007b88
push 0x10088af4
push esi
push str._ALT__
mov ecx, eax
call fcn.100079fc
mov ecx, eax
call fcn.10007a23
mov ecx, eax
call fcn.100079fc
cmp dword [ebp - 0xa70], edi
mov ecx, eax
mov esi, 0x10088afc
lea eax, [ebp - 0xa84]
cmova eax, dword [ebp - 0xa84]
push esi
push dword [ebp - 0xa74]
push eax
call fcn.10007b88
mov ecx, eax
call fcn.100079fc
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 0x25
call fcn.10002975
mov edx, dword [ebp - 0xaf4]
lea ecx, [ebp - 0xa6c]
call fcn.1000dfce
mov byte [ebp - 4], 0x27
mov ecx, eax
cmp dword [eax + 0x14], edi
jbe 0x1000ee69
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xa9c]
call fcn.10007b88
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 0x25
call fcn.10002975
push esi
lea ecx, [ebp - 0xa9c]
call fcn.100079fc
xor eax, eax
push eax
call fcn.100405a6
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0xb04]
pop ecx
push eax
mov dword [ebp - 0xb00], edx
call fcn.1004089f
pop ecx
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0xaf0]
lea eax, [ebp - 0xaf0]
push eax
push 0x10088b00
lea eax, [ebp - 0x214]
push 0x200
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10040587
add esp, 0x10
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xa9c]
push str..log
push eax
call fcn.100079fc
mov ecx, eax
call fcn.100079fc
cmp dword [ebp - 0xa88], 7
lea eax, [ebp - 0xa9c]
lea ecx, [ebp - 0xab4]
cmova eax, dword [ebp - 0xa9c]
push eax
call fcn.100032c7
lea eax, [ebp - 0xa84]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0xa54]
mov ecx, ebx
push eax
call fcn.1000caa1
lea ecx, [ebx + 4]
lea eax, [ebp - 0xab4]
cmp ecx, eax
je 0x1000ef60
cmp dword [ebp - 0xaa0], 7
push dword [ebp - 0xaa4]
cmova eax, dword [ebp - 0xab4]
push eax
call fcn.1000d800
lea ecx, [ebp - 0xab4]
mov byte [ebp - 4], 0x25
call fcn.10002975
mov esi, dword [ebp - 0xb2c]
mov al, byte [ebp - 0xaf6]
movsd xmm0, qword [ebp - 0xb3c]
mov ecx, dword [ebp - 0xb08]
mov byte [ebx + 1], al
mov al, byte [ebp - 0xaf7]
movsd qword [ebx + 0x160], xmm0
movsd xmm0, qword [ebp - 0xb1c]
mov byte [ebx + 2], al
lea eax, [ebp - 0xaf4]
movsd qword [ebx + 0x150], xmm0
movsd xmm0, qword [ebp - 0xb24]
push eax
movsd qword [ebx + 0x158], xmm0
lea eax, [ebp - 0xb14]
movsd xmm0, qword [ebp - 0xb14]
push eax
movsd qword [ebx + 0x168], xmm0
call fcn.1000faeb
mov ecx, dword [ebp - 0xb30]
add ecx, 0x6c
mov eax, dword [eax]
mov dword [eax + 0xc], ebx
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xb14]
push eax
call fcn.1000faeb
mov ecx, dword [ebp - 0xb34]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xa54]
call fcn.10002975
lea ecx, [ebp - 0xa9c]
call fcn.10002975
lea ecx, [ebp - 0xb6c]
call fcn.10013c80
lea ecx, [ebp - 0xacc]
call fcn.10002975
lea ecx, [ebp - 0xb54]
call fcn.10013c80
lea ecx, [ebp - 0xa84]
call fcn.10002975
push dword [ebp - 0xb0c]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, esi
push eax
push 1
push dword [ebp - 0xaf4]
call fcn.1000b825
mov al, 1
jmp 0x1000f0e0
lea eax, [ebp - 0xaf4]
mov ecx, edi
push eax
lea eax, [ebp - 0xb14]
push eax
call fcn.1000faeb
xor ecx, ecx
push ebx
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, str.Timeout_value_should_be_greater_than_0
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.1000e08d
lea ecx, [ebp - 0xb6c]
call fcn.10013c80
lea ecx, [ebp - 0xacc]
call fcn.10002975
lea ecx, [ebp - 0xb54]
call fcn.10013c80
lea ecx, [ebp - 0xa84]
call fcn.10002975
push dword [ebp - 0xb0c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
call fcn.10035a2c
ret 4