Function at 0x1001311f
Capabilities:
Contain obfuscated stackstrings
Get process image filename

Disassembly:
push 0xb68
mov eax, 0x1003f651
call fcn.10019d4c
mov ebx, ecx
mov dword [ebp - 0xb2c], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa40], eax
call fcn.10014f11
mov esi, eax
mov dword [ebp - method.AutoLock.virtual_0], vtable.AutoLock.0
lea eax, [ebx + 0x30]
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb68], eax
lea eax, [ebx + 0x34]
push eax
mov dword [ebp - 0xa88], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0xa40]
and dword [ebp - 0xb08], 0
lea ecx, [ebx + 0x4c]
push eax
lea eax, [ebp - 0xb08]
push eax
call fcn.100146e1
mov eax, dword [ebp - 0xb08]
cmp eax, dword [ebx + 0x50]
jne 0x10013d9b
push str.COMMON
lea ecx, [ebp - 0xa84]
call fcn.1000c8be
mov byte [ebp - 4], 1
push dword [ebp - 0xa40]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0xb58], ebx
test ebx, ebx
je 0x100132cc
mov edi, 0x208
lea eax, [ebp - 0x21c]
push edi
push 0
push eax
call fcn.1001b300
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x100132cc
push edi
lea eax, [ebp - 0xa3c]
push 0
push eax
call fcn.1001b300
add esp, 0xc
lea eax, [ebp - 0x834]
push edi
push 0
push eax
call fcn.1001b300
add esp, 0xc
lea eax, [ebp - 0x424]
push edi
push 0
push eax
call fcn.1001b300
add esp, 0xc
lea eax, [ebp - 0x62c]
push edi
push 0
push eax
call fcn.1001b300
add esp, 0xc
lea eax, [ebp - 0x62c]
mov ecx, 0x104
push ecx
push eax
push ecx
lea eax, [ebp - 0x424]
push eax
push ecx
lea eax, [ebp - 0x834]
push eax
push ecx
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10025129
add esp, 0x24
lea eax, [ebp - 0x424]
lea ecx, [ebp - 0xa84]
push eax
call fcn.1000c92b
cmp dword [ebp - 0xa70], 8
lea eax, [ebp - 0xa84]
mov byte [ebp - 0xb08], 0
push dword [ebp - 0xb08]
cmovae eax, dword [ebp - 0xa84]
push ecx
push eax
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0xb34]
push eax
call fcn.1001471e
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0xabc]
rep stosd dword es:[edi], eax
call fcn.10014f11
cmp dword [ebp - 0xa70], 8
mov ecx, eax
lea eax, [ebp - 0xa84]
cmovae eax, dword [ebp - 0xa84]
push eax
lea eax, [ebp - 0xabc]
push eax
call fcn.1001603e
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 2
call fcn.10008ace
test al, al
je 0x10013320
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10013d85
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0xb04]
mov dword [eax], str.DefaultSettings
mov dword [eax + 4], 0xf
call fcn.10011576
pop ecx
pop ecx
push 6
pop ecx
xor eax, eax
mov byte [ebp - 4], 3
lea edi, [ebp - 0xaec]
rep stosd dword es:[edi], eax
call fcn.10014f11
cmp dword [ebp - 0xaf0], 8
mov ecx, eax
lea eax, [ebp - 0xb04]
cmovae eax, dword [ebp - 0xb04]
push eax
lea eax, [ebp - 0xaec]
push eax
call fcn.1001603e
movsd xmm1, qword [0x1006f0c0]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 5
push eax
push str.Threshold
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb4c], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [0x1006f108]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 7
push eax
push str.FirstEvaluationTimeSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb44], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [0x1006f118]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 9
push eax
push str.EvaluationTimeoutSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb74], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [0x1006f0b0]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0xb
push eax
push str.DiscretSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb64], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push 1
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0xd
push eax
push str.UseIO
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb08], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push 0
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0xf
push eax
push str.UseCPU
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb50], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push 0
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x11
push eax
push str.WriteLog
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x12
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb54], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push 0
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x13
push eax
mov edi, str.ReportLoadtime0
lea eax, [ebp - 0xb24]
push edi
push eax
lea ecx, [ebp - 0xaec]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb28], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [ebp - 0xb4c]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x15
push eax
push str.Threshold
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x16
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb34], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [ebp - 0xb44]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x17
push eax
push str.FirstEvaluationTimeSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb44], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [ebp - 0xb74]
lea ecx, [ebp - 0xa64]
call fcn.10008040
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xa64]
push eax
push str.EvaluationTimeoutSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb4c], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
movsd xmm1, qword [ebp - 0xb64]
lea ecx, [ebp - 0xa64]
call fcn.10008040
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x1b
push eax
push str.DiscretSec
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.10008906
lea ecx, [ebp - 0xb24]
movsd qword [ebp - 0xb64], xmm0
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push dword [ebp - 0xb08]
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x1d
push eax
push str.UseIO
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x1e
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb0a], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push dword [ebp - 0xb50]
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x1f
push eax
push str.UseCPU
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb0b], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push dword [ebp - 0xb54]
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x21
push eax
push str.WriteLog
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x22
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb09], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
call fcn.1000819d
push dword [ebp - 0xb28]
lea ecx, [ebp - 0xa64]
call fcn.10008149
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 0x23
push eax
push edi
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xabc]
call fcn.100092ec
mov ecx, eax
mov byte [ebp - 4], 0x24
call fcn.100089b2
lea ecx, [ebp - 0xb24]
mov byte [ebp - 0xb0c], al
call fcn.1000819d
lea ecx, [ebp - 0xa64]
mov byte [ebp - 4], 4
call fcn.1000819d
movsd xmm2, qword [0x1006f0e0]
movsd xmm1, qword [ebp - 0xb44]
comisd xmm2, xmm1
ja 0x10013d37
movsd xmm0, qword [ebp - 0xb4c]
comisd xmm2, xmm0
ja 0x10013d37
comisd xmm1, xmm0
jbe 0x1001398d
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xb34]
push eax
lea ecx, [ecx + 0x4c]
call fcn.10014814
push ebx
mov eax, dword [eax]
and dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, str.Attenuation_timeout_should_be_less_or_equal_to_final_timeout
jmp 0x10013d65
mov edi, 0x190
push edi
call fcn.100193f8
mov esi, eax
pop ecx
mov dword [ebp - 0xa88], esi
push edi
push 0
push esi
mov byte [ebp - 4], 0x25
call fcn.1001b300
add esp, 0xc
mov ecx, esi
call fcn.1000d924
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0xad4], ecx
push 7
mov edi, ecx
xor eax, eax
pop esi
mov dword [ebp - 0xac4], edi
mov dword [ebp - 0xac0], esi
mov word [ebp - 0xad4], ax
mov byte [ebp - 4], 0x27
cmp byte [ebp - 0xb09], al
je 0x10013c3c
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xa90], esi
mov word [ebp - 0xaa4], ax
lea eax, [ebp - 0xb08]
mov byte [ebp - 4], 0x29
push eax
push dword [ebp - 0xa40]
mov dword [ebp - 0xb08], ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [ebp - 0xb38]
lea eax, [ebp - 0xb24]
push eax
call fcn.100161e5
lea ecx, [ebp - 0xad4]
cmp ecx, eax
je 0x10013a5d
mov byte [ebp - 0xb28], 0
push dword [ebp - 0xb28]
push eax
call fcn.1000c952
mov esi, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xac4]
lea ecx, [ebp - 0xb24]
call fcn.1000be69
cmp esi, 8
lea eax, [ebp - 0xad4]
push edi
cmovae eax, dword [ebp - 0xad4]
lea ecx, [ebp - 0xaa4]
push eax
call fcn.1000bedd
push 0x1006e2d8
lea ecx, [ebp - 0xaa4]
call fcn.1000fac5
cmp dword [ebp - 0xa70], 8
mov ecx, eax
push dword [ebp - 0xa74]
lea eax, [ebp - 0xa84]
cmovae eax, dword [ebp - 0xa84]
push eax
call fcn.10010007
push str._ALT__
mov ecx, eax
call fcn.1000fac5
mov edx, dword [ebp - 0xb08]
lea ecx, [ebp - 0xb24]
mov esi, eax
call fcn.10012c87
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2a
call fcn.1000faec
push 0x1006e934
mov ecx, eax
call fcn.1000fac5
cmp dword [ebp - 0xa70], 8
mov ecx, eax
push dword [ebp - 0xa74]
lea eax, [ebp - 0xa84]
cmovae eax, dword [ebp - 0xa84]
push eax
call fcn.10010007
mov esi, 0x1006e93c
mov ecx, eax
push esi
call fcn.1000fac5
lea ecx, [ebp - 0xb24]
mov byte [ebp - 4], 0x29
call fcn.1000be69
mov edx, dword [ebp - 0xa40]
lea ecx, [ebp - 0xb24]
call fcn.10012c87
mov byte [ebp - 4], 0x2b
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10013b4c
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xaa4]
call fcn.10010007
lea ecx, [ebp - 0xb24]
mov byte [ebp - 4], 0x29
call fcn.1000be69
push esi
lea ecx, [ebp - 0xaa4]
call fcn.1000fac5
call fcn.10018b69
push 0
push 0x989680
push edx
push eax
call fcn.1003c330
mov dword [ebp - 0xa8c], eax
lea edi, [ebp - 0xa6c]
push 9
xor eax, eax
mov dword [ebp - 0xa88], edx
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xa6c]
push eax
call fcn.10024ef4
lea eax, [ebp - 0xa6c]
push eax
push 0x1006e940
lea eax, [ebp - 0x214]
push 0x200
push eax
call fcn.10026377
add esp, 0x18
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xaa4]
push eax
call fcn.1000fac5
push str..log
mov ecx, eax
call fcn.1000fac5
lea eax, [ebp - 0xa84]
mov ecx, ebx
push eax
lea eax, [ebp - 0xad4]
push eax
call fcn.1000f0be
lea ecx, [ebx + 4]
lea eax, [ebp - 0xaa4]
cmp ecx, eax
je 0x10013c2d
cmp dword [ebp - 0xa90], 8
push dword [ebp - 0xa94]
cmovae eax, dword [ebp - 0xaa4]
push eax
call fcn.1000bedd
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0x27
call fcn.1000be69
mov al, byte [ebp - 0xb0a]
movsd xmm0, qword [ebp - 0xb64]
mov edi, dword [ebp - 0xb2c]
mov byte [ebx + 1], al
mov al, byte [ebp - 0xb0b]
mov byte [ebx + 2], al
mov al, byte [ebp - 0xb0c]
lea ecx, [edi + 0x4c]
movsd qword [ebx + 0x160], xmm0
movsd xmm0, qword [ebp - 0xb44]
mov byte [ebx + 0x1c], al
lea eax, [ebp - 0xa40]
movsd qword [ebx + 0x150], xmm0
movsd xmm0, qword [ebp - 0xb4c]
push eax
movsd qword [ebx + 0x158], xmm0
lea eax, [ebp - 0xb34]
movsd xmm0, qword [ebp - 0xb34]
push eax
movsd qword [ebx + 0x168], xmm0
call fcn.10014814
lea ecx, [edi + 0x6c]
mov eax, dword [eax]
mov dword [eax + 0xc], ebx
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xb34]
push eax
call fcn.10014814
mov ecx, dword [ebp - 0xb58]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xad4]
call fcn.1000be69
lea ecx, [ebp - 0xaec]
call fcn.1000819d
lea ecx, [ebp - 0xb04]
call fcn.1000be69
lea ecx, [ebp - 0xabc]
call fcn.1000819d
lea ecx, [ebp - 0xa84]
call fcn.1000be69
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xb38]
push 0
push 1
push dword [ebp - 0xa40]
call fcn.1000d878
mov al, 1
jmp 0x10013daa
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xb34]
push eax
lea ecx, [ecx + 0x4c]
call fcn.10014814
push ebx
mov eax, dword [eax]
and dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, str.Timeout_value_should_be_greater_than_0
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.10012d2e
lea ecx, [ebp - 0xaec]
call fcn.1000819d
lea ecx, [ebp - 0xb04]
call fcn.1000be69
lea ecx, [ebp - 0xabc]
call fcn.1000819d
lea ecx, [ebp - 0xa84]
call fcn.1000be69
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
call fcn.10019cfb
ret 4