Function at 0x10002ba0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x10026018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x11183b58], 0
mov eax, dword [ebp + 0xc]
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x33c], eax
jne 0x10002dff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.MSVCR100.dll_rand]
mov dword [0x11183b58], eax
mov word [ebp - 0x338], 0x86c1
call edi
and eax, 0x800000ff
jns 0x10002bfb
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x100263bc], 0xffffffff
mov byte [ebp - 0x336], al
mov byte [ebp - 0x335], 3
mov byte [ebp - 0x334], bl
je 0x10002c20
cmp byte [0x101263f0], 0
jne 0x10002c3c
lea eax, [ebp - 0x338]
call fcn.100028e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019876
mov esp, ebp
pop ebp
ret
mov word [ebp - 0x2b0], 0x9bc1
call edi
and eax, 0x800000ff
jns 0x10002c55
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x2ae], al
mov eax, dword [0x11183b60]
mov byte [ebp - 0x2ad], 3
mov byte [ebp - 0x2ac], bl
test eax, eax
jne 0x10002c8c
mov dword [ebp - 0x2ab], eax
mov dword [ebp - 0x2a7], eax
mov word [ebp - 0x2a3], ax
mov byte [ebp - 0x2a1], al
jmp 0x10002cb1
mov ecx, dword [eax]
mov dword [ebp - 0x2ab], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2a7], edx
mov cx, word [eax + 8]
mov word [ebp - 0x2a3], cx
mov dl, byte [eax + 0xa]
mov byte [ebp - 0x2a1], dl
mov eax, dword [0x11183b64]
test eax, eax
je 0x10002ce8
cmp dword [eax], 0
je 0x10002ce8
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x2a0], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x29c], edx
mov cx, word [eax + 8]
mov word [ebp - 0x298], cx
mov dl, byte [eax + 0xa]
mov byte [ebp - 0x296], dl
jmp 0x10002d03
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], eax
mov word [ebp - 0x298], ax
mov byte [ebp - 0x296], al
test esi, esi
jne 0x10002d1b
push 0x40
lea eax, [ebp - 0x295]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x10002d28
mov ecx, 0x10
lea edi, [ebp - 0x295]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x33c]
push 0x40
push 0
test esi, esi
jne 0x10002d47
lea ecx, [ebp - 0x255]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x10002da9
lea edx, [ebp - 0x255]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10002da9
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10002da2
lea esi, [ebp - 0x210]
call fcn.10014830
push eax
lea ecx, [ebp - 0x255]
push 0x100208a8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x255]
push edx
lea eax, [ebp - 0x295]
push eax
movzx eax, byte [ebp - 0x2ac]
lea ecx, [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x2ab]
push edx
push eax
mov eax, 0x20
call fcn.10016220
push eax
push 0
mov ecx, 0x10126568
call fcn.1000b840
movzx ecx, byte [ebp - 0x2af]
add esp, 0x1c
lea edx, [ebp - 0x2b0]
push edx
mov edx, 0x100263b8
call fcn.100018d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019876
mov esp, ebp
pop ebp
ret