Function at 0x10004e10
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x1001c00c]
xor eax, esp
mov dword [esp + 0x2b8], eax
cmp dword [0x10126d18], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
jne 0x10005032
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10126d18], eax
mov word [esp + 0x10], 0x5c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x10004e67
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x1001c02c], 0xffffffff
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 3
mov byte [esp + 0x14], bl
je 0x10005029
cmp byte [0x1011c060], 0
je 0x10005029
mov word [esp + 0x18], 0x9bc1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x10004ea9
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x10126d14]
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 3
mov byte [esp + 0x1c], bl
test ecx, ecx
jne 0x10004ed4
xorps xmm0, xmm0
mov word [esp + 0x25], cx
movq qword [esp + 0x1d], xmm0
mov byte [esp + 0x27], cl
jmp 0x10004eee
movq xmm0, qword [ecx]
movq qword [esp + 0x1d], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x25], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x27], al
mov ecx, dword [0x10126d10]
test ecx, ecx
je 0x10004f1a
mov ecx, dword [ecx]
test ecx, ecx
je 0x10004f1a
movq xmm0, qword [ecx]
movq qword [esp + 0x28], xmm0
mov ax, word [ecx + 8]
mov word [esp + 0x30], ax
mov al, byte [ecx + 0xa]
mov byte [esp + 0x32], al
jmp 0x10004f2f
xorps xmm0, xmm0
mov word [esp + 0x30], 0
movq qword [esp + 0x28], xmm0
mov byte [esp + 0x32], 0
test esi, esi
jne 0x10004f45
push 0x40
lea eax, [esp + 0x37]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10004f68
movups xmm0, xmmword [esi]
movups xmmword [esp + 0x33], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [esp + 0x43], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [esp + 0x53], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [esp + 0x63], xmm0
push 0x40
lea eax, [esp + 0x77]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10004fd0
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10004fd0
push 0x104
lea eax, [esp + 0xbc]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10004fc9
lea ecx, [esp + 0xb8]
call fcn.1000fdd0
push eax
lea eax, [esp + 0x77]
push 0x100179c8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x73]
mov ecx, 0x20
push eax
lea eax, [esp + 0x37]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x29]
push eax
movzx eax, byte [esp + 0x2c]
push eax
call fcn.10010240
push eax
push 0
push 0x1011c1e0
call fcn.10007790
movzx eax, byte [esp + 0x39]
add esp, 0x20
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10003c60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.10011584
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.10004c00
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10011584
mov esp, ebp
pop ebp
ret