Function at 0x1005e340
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1009e034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x41c], edi
mov esi, ecx
call fcn.1005ebf0
test al, al
je 0x1005e557
mov eax, dword [0x100a30a0]
test eax, eax
jne 0x1005e437
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e3b4
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x416], 0x5c
je 0x1005e3ea
push 0x1007d9c8
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
push str.psapi.dll
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1005e424
push str.GetProcessImageFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a30a0], eax
jmp 0x1005e429
mov eax, dword [0x100a30a0]
test eax, eax
je 0x1005e5a8
mov edi, dword [ebp - 0x41c]
push 0x208
push edi
push esi
call eax
test eax, eax
je 0x1005e5a8
cmp dword [ebp + 0xc], 0
jbe 0x1005e541
lea edi, [ebx + 8]
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005e460
mov ebx, dword [ebp - 0x41c]
sub eax, edx
sar eax, 1
push eax
push ebx
push edi
call dword [sym.imp.MSVCR110.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1005e532
lea edx, [edi - 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e491
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
call dword [sym.imp.MSVCR110.dll_memmove]
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x1005e4c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e4c0
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e4d5
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1005e4f0
sub edx, esi
mov esi, ebx
sar edx, 1
lea ebx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e504
sub esi, ebx
mov ebx, dword [ebp - 0x41c]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + edx*2]
sar esi, 1
push eax
lea eax, [ebx + esi*2]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
add edi, 0x418
dec dword [ebp + 0xc]
jne 0x1005e455
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e4e6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
push 4
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1005e5a2
push 0x208
push edi
push dword [ebp - 0x41c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, edi
call fcn.1005df10
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e4e6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1006e4e6
mov esp, ebp
pop ebp
ret