Function at 0x100e718
Capabilities:
Acquire debug privileges
Enumerate process modules
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
xor ebx, ebx
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], 0x19
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], 0x80004005
cmp eax, 0xffffffff
jne 0x100e76b
mov eax, 0x80070490
jmp 0x100ea4c
push esi
cmp eax, ebx
jne 0x100e9d0
lea eax, [ebp - 0x424]
push eax
push 1
mov esi, 0x100238c
push esi
call fcn.0102663f
test eax, eax
jne 0x100e7a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1002340
call fcn.0101c26a
add esp, 0xc
cmp dword [ebp - 0x424], ebx
jne 0x100e7b3
mov dword [ebp - 0x424], 1
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x100e7e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100e7de
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x418], eax
jmp 0x100ea04
push ebx
push 0x1002300
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e36e
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100ea0c
lea eax, [ebp - 0x418]
push eax
push 0x19
push 4
call fcn.01026440
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 0x41c], eax
jl 0x100ea0c
lea eax, [ebp - 0x428]
push eax
push ebx
push 4
push ebx
push dword [ebp - 0x420]
call fcn.0102d660
push edx
push eax
call fcn.0100cf56
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100ea0c
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x41c]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x100e7ca
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x428]
jb 0x100e8fd
cmp dword [ebp - 0x41c], ebx
je 0x100e8a1
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 2
push ebx
push dword [ebp - 0x420]
mov dword [ebp - 0x41c], ebx
call fcn.0102d660
lea ecx, [ebp - 0x420]
push ecx
push edx
push eax
call fcn.0100cf56
cmp eax, ebx
mov dword [ebp - 0x418], eax
jl 0x100ea0c
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x420]
push 4
call fcn.01026440
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 0x41c], eax
jge 0x100e82c
jmp 0x100ea04
shr eax, 2
xor esi, esi
mov dword [ebp - 0x420], eax
cmp eax, ebx
jbe 0x100e9b2
mov eax, dword [ebp - 0x41c]
push dword [eax + esi*4]
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push edi
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x428], 0x104
call fcn.0100d382
test al, al
je 0x100e976
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x100e976
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100e994
push ebx
lea eax, [ebp - 0x434]
push eax
call fcn.0100d39e
inc esi
cmp esi, dword [ebp - 0x420]
jb 0x100e910
mov edi, dword [ebp - 0x42c]
jmp 0x100e9b2
lea eax, [ebp - 0x414]
push eax
push 0x10022c4
call fcn.0101c26a
mov eax, dword [ebp - 0x42c]
pop ecx
mov dword [eax + 0x70], edi
pop ecx
mov edi, eax
mov eax, dword [edi + 0x70]
cmp eax, ebx
jne 0x100e9d0
push 0x1002280
call fcn.0101c26a
pop ecx
mov dword [ebp - 0x418], 0x80070490
jmp 0x100ea0c
lea ecx, [ebp - 0x430]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x100e7ca
cmp dword [ebp - 0x430], 0x103
jne 0x100e9fa
mov dword [ebp - 0x418], ebx
jmp 0x100ea15
mov dword [ebp - 0x418], 1
cmp dword [ebp - 0x418], ebx
jge 0x100ea15
cmp dword [edi + 0x70], ebx
jne 0x100ea15
or dword [edi + 0x70], 0xffffffff
pop esi
cmp dword [ebp - 0x41c], ebx
je 0x100ea32
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x424], ebx
je 0x100ea46
push ebx
push ebx
push 0x100238c
call fcn.0102663f
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0102ea9b
leave
ret