Function at 0x10025d80
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089f01
mov eax, dword fs:[0]
push eax
mov eax, 0x3818
call fcn.10053180
mov eax, dword [0x100b52f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.1005fb60
push 0x2000
lea eax, [ebp - 0x3810]
mov dword [ebp - 0x381c], 0
push 0
push eax
call fcn.1005fb60
add esp, 0x18
lea eax, [ebp - 0x381c]
push eax
push 0x800
lea eax, [ebp - 0x3810]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x100260e1
xor eax, eax
mov dword [ebp - 0x3824], eax
cmp dword [ebp - 0x381c], eax
jbe 0x100260e1
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov edi, dword [ebp + eax*4 - 0x3810]
push edi
push 0
push 0x410
call ebx
mov esi, eax
test esi, esi
jne 0x10025e4a
push edi
push eax
push 0x1010
call ebx
mov esi, eax
test esi, esi
je 0x100260c8
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.1005fb60
add esp, 0xc
lea eax, [ebp - 0x810]
xor edi, edi
push 0x400
push eax
push edi
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x10025eff
push 0x800
lea eax, [ebp - 0x1810]
mov edi, 1
push 0
push eax
call fcn.1005fb60
lea eax, [ebp - 0x810]
push 0x7e
push eax
call fcn.1005ef23
add esp, 0x14
test eax, eax
je 0x10025ee5
push 0x400
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x10025ee5
push 0x400
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.1006ee92
jmp 0x10025f2f
push 0x400
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.1006ee92
jmp 0x10025f2f
push 0x400
lea eax, [ebp - 0x810]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x10025f32
push 0x400
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.100231a0
mov edi, eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x100260c8
lea eax, [ebp - 0x1010]
push eax
call fcn.10071cb6
add esp, 4
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
call fcn.1000a780
test eax, eax
je 0x10026141
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x3818]
push str.a7713617_a1d9_44b4_8ae1_17cbc989b352
mov dword [ebp - 0x3818], eax
call fcn.10009430
test al, al
jne 0x10025fa2
push 0x24
push str.a7713617_a1d9_44b4_8ae1_17cbc989b352
lea ecx, [ebp - 0x3818]
call fcn.1000cfa0
mov dword [ebp - 4], 0
call fcn.1000a780
mov ecx, eax
test ecx, ecx
je 0x10026141
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x3814]
push ebx
mov dword [ebp - 0x3814], eax
call fcn.10009430
test al, al
jne 0x10025fff
test ebx, ebx
jne 0x10025fde
xor ecx, ecx
jmp 0x10025ff2
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10025fe3
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x3814]
call fcn.1000cfa0
lea eax, [ebp - 0x3818]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3814]
push eax
lea eax, [ebp - 0x3820]
push eax
call fcn.10054770
add esp, 0xc
mov edx, dword [ebp - 0x3814]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10026040
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3818]
mov eax, esi
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10026061
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, str.r2Q8siK2Mej2iu7Kc9o9Jg
xor edi, edi
test esi, esi
je 0x10026141
push esi
push dword [ebp - 0x3820]
call fcn.1006eed5
add esp, 8
test eax, eax
je 0x1002610e
add edi, 0x100
add esi, 0x100
cmp edi, 0x1a00
jb 0x10026068
mov edx, dword [ebp - 0x3820]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, ecx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100260c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x3824]
inc eax
mov dword [ebp - 0x3824], eax
cmp eax, dword [ebp - 0x381c]
jb 0x10025e20
push 0
push str.is_develop:__d
call fcn.1001f5a0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10053047
mov esp, ebp
pop ebp
ret
push ebx
push str.develop_tools:__s
call fcn.1001f5a0
mov edx, dword [ebp - 0x3820]
add esp, 8
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002613a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x100260f2
push 0x80004005
call fcn.10002fe0
int3