Function at 0x1009abb7
Capabilities:
Check if file exists
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ca041
mov eax, dword fs:[0]
push eax
sub esp, 0xaf0
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xae4], ecx
lea ecx, [ebp - 0x22c]
call fcn.100223dd
and dword [ebp - 4], 0
and dword [ebp - 0x230], 0
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
and dword [ebp - 0x228], 0
push 0
push 0
xor ebx, ebx
call fcn.100621c7
pop ecx
pop ecx
test eax, eax
je 0x1009ac62
and dword [ebp - 0xad4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1000e1b0
mov eax, dword [ebp - 0xad4]
jmp 0x1009b0c8
push 0x2001f
push 0x100d969c
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x22c]
call fcn.1000e13e
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x1009acaf
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x100d96cc
lea ecx, [ebp - 0x22c]
call fcn.1000e2d4
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x224]
push eax
call fcn.10077b0b
pop ecx
test eax, eax
jbe 0x1009adc2
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009adc2
push 0x100d96dc
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009adc2
and dword [ebp - 0x238], 0
and dword [ebp - 0x240], 0
and dword [ebp - 0x244], 0
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.100b9351
add esp, 0x14
movzx eax, al
test eax, eax
je 0x1009adc2
push dword [ebp - 0x23c]
push dword [ebp - 0x244]
push dword [ebp - 0x240]
push dword [ebp - 0x238]
call fcn.100b9203
add esp, 0x10
mov esi, eax
mov edi, edx
push 1
push 1
push 9
push 3
call fcn.100b9203
add esp, 0x10
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xaf0], edx
mov eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xaf0]
jb 0x1009adc2
ja 0x1009adb8
mov eax, dword [ebp - 0xaec]
cmp eax, dword [ebp - 0xaf4]
jb 0x1009adc2
mov dword [ebp - 0x228], 1
cmp dword [ebp - 0x228], 0
je 0x1009afa9
and dword [ebp - 0x228], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x1009afa9
cmp dword [ebp - 0x248], 0
je 0x1009afa9
push 0x22c
push 0
lea eax, [ebp - 0x47c]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x47c], 0x22c
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x1009af96
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x1009af79
and word [ebp - 0x68c], 0
push 0x206
push 0
lea eax, [ebp - 0x68a]
push eax
call fcn.100771d0
add esp, 0xc
push 0x103
push dword [ebp - 0x480]
lea eax, [ebp - 0x68c]
push eax
call fcn.1007b1b2
add esp, 0xc
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x100d9714
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009af79
push dword [ebp - 0x474]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0xffffffff
je 0x1009af77
cmp dword [ebp - 0x690], 0
je 0x1009af77
mov dword [ebp - 0xabc], 0x428
lea eax, [ebp - 0xabc]
push eax
push dword [ebp - 0x690]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1009af64
lea eax, [ebp - 0xa9c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
je 0x1009af4e
push 0x100d9730
push dword [ebp - 0xac0]
call fcn.1007bcdc
pop ecx
pop ecx
test eax, eax
jne 0x1009af4e
mov dword [ebp - 0x228], 1
jmp 0x1009af64
lea eax, [ebp - 0xabc]
push eax
push dword [ebp - 0x690]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1009af10
push dword [ebp - 0x690]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x690], 0xffffffff
jmp 0x1009af96
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x24c], eax
jmp 0x1009ae37
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x248], 0xffffffff
cmp dword [ebp - 0x228], 0
je 0x1009b0a7
mov dword [ebp - 0xad0], 2
lea ecx, [ebp - 0xac8]
call fcn.10014b4b
mov byte [ebp - 4], 1
push dword [ebp - 0xad0]
push 0x100d9748
lea eax, [ebp - 0xac8]
push eax
call fcn.10008825
add esp, 0xc
push 0x100d9758
lea ecx, [ebp - 0xad8]
call fcn.10003bfa
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xafc], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xac8]
push eax
push dword [ebp - 0xafc]
lea eax, [ebp - 0xacc]
push eax
call fcn.10003d64
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xad8]
call fcn.10014be9
lea ecx, [ebp - 0xacc]
call fcn.10005b69
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xac4], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xadc], esp
push 0x100d3fd7
call fcn.10001465
xor eax, eax
cmp dword [ebp - 0xac4], 0
sete al
push eax
push 0
push 0
push 0x3e8
mov ecx, 0x101158b0
call fcn.100bbf7d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xacc]
call fcn.10014be9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac8]
call fcn.10014be9
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xae0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1000e1b0
mov eax, dword [ebp - 0xae0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100771ba
leave
ret