Function at 0x1002b3b0
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
test dword [0x10049ed0], 0x80000
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x214], edi
mov esi, ecx
je 0x1002b5e7
mov eax, dword [0x1004be90]
test eax, eax
jne 0x1002b4cc
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1002b481
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x1002b430
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b430
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x20e], 0x5c
je 0x1002b466
push 0x10035d40
lea eax, [ebp - 0x20c]
push 0x104
push eax
call edi
add esp, 0xc
push str.psapi.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call edi
mov edi, dword [ebp - 0x214]
jmp 0x1002b498
push str.psapi.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1002b4bf
push str.GetProcessImageFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004be90], eax
jmp 0x1002b4c4
mov eax, dword [0x1004be90]
test eax, eax
je 0x1002b638
push 0x104
push edi
push esi
call eax
test eax, eax
je 0x1002b638
cmp dword [ebp + 0xc], 0
jbe 0x1002b5d1
lea edi, [ebx + 8]
lea ebx, [ebx]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b4f5
mov ebx, dword [ebp - 0x214]
sub eax, edx
sar eax, 1
push eax
push ebx
push edi
call dword [sym.imp.MSVCR110.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1002b5c2
lea edx, [edi - 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b526
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
call dword [sym.imp.MSVCR110.dll_memmove]
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b550
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b565
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002b580
sub edx, esi
mov esi, ebx
sar edx, 1
lea ebx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002b594
sub esi, ebx
mov ebx, dword [ebp - 0x214]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + edx*2]
sar esi, 1
push eax
lea eax, [ebx + esi*2]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
add edi, 0x210
dec dword [ebp + 0xc]
jne 0x1002b4f0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1002b632
push 0x104
push edi
push dword [ebp - 0x214]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, edi
call fcn.1002b0e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1002d28e
mov esp, ebp
pop ebp
ret