Function at 0x10073360
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x41c], edi
mov esi, ecx
call sym.iImportLib.dll_bool___cdecl_elex::os::IsX64System_void_
test al, al
je 0x10073577
mov eax, dword [0x100ebf7c]
test eax, eax
jne 0x10073457
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100733d4
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x416], 0x5c
je 0x1007340a
push 0x100a21f4
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
push str.psapi.dll
lea eax, [ebp - 0x414]
push 0x208
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10073444
push str.GetProcessImageFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100ebf7c], eax
jmp 0x10073449
mov eax, dword [0x100ebf7c]
test eax, eax
je 0x100735c8
mov edi, dword [ebp - 0x41c]
push 0x208
push edi
push esi
call eax
test eax, eax
je 0x100735c8
cmp dword [ebp + 0xc], 0
jbe 0x10073561
lea edi, [ebx + 8]
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10073480
mov ebx, dword [ebp - 0x41c]
sub eax, edx
sar eax, 1
push eax
push ebx
push edi
call dword [sym.imp.MSVCR110.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10073552
lea edx, [edi - 8]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100734b1
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
call dword [sym.imp.MSVCR110.dll_memmove]
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x100734e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100734e0
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100734f5
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10073510
sub edx, esi
mov esi, ebx
sar edx, 1
lea ebx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10073524
sub esi, ebx
mov ebx, dword [ebp - 0x41c]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + edx*2]
sar esi, 1
push eax
lea eax, [ebx + esi*2]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
add edi, 0x418
dec dword [ebp + 0xc]
jne 0x10073475
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
push 4
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x100735c2
push 0x208
push edi
push dword [ebp - 0x41c]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, edi
call fcn.10072f30
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret