Function at 0x100272d0
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1005a690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x41c], edi
mov esi, ecx
call fcn.1001b350
test al, al
je 0x100274e7
mov eax, dword [0x1005d874]
test eax, eax
jne 0x100273c7
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027344
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x416], 0x5c
je 0x1002737a
push 0x1004846c
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
push str.psapi.dll
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100273b4
push str.GetProcessImageFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005d874], eax
jmp 0x100273b9
mov eax, dword [0x1005d874]
test eax, eax
je 0x10027538
mov edi, dword [ebp - 0x41c]
push 0x208
push edi
push esi
call eax
test eax, eax
je 0x10027538
cmp dword [ebp + 0xc], 0
jbe 0x100274d1
lea edi, [ebx + 8]
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100273f0
mov ebx, dword [ebp - 0x41c]
sub eax, edx
sar eax, 1
push eax
push ebx
push edi
call dword [sym.imp.MSVCR110.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100274c2
lea edx, [edi - 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027421
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
call dword [sym.imp.MSVCR110.dll_memmove]
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x10027450
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027450
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027465
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10027480
sub edx, esi
mov esi, ebx
sar edx, 1
lea ebx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10027494
sub esi, ebx
mov ebx, dword [ebp - 0x41c]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + edx*2]
sar esi, 1
push eax
lea eax, [ebx + esi*2]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
add edi, 0x418
dec dword [ebp + 0xc]
jne 0x100273e5
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
push 4
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x10027532
push 0x208
push edi
push dword [ebp - 0x41c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, edi
call fcn.10026ea0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e328
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1003e328
mov esp, ebp
pop ebp
ret