Function at 0x1009aaa7
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c98a8
mov eax, dword fs:[0]
push eax
sub esp, 0xaf0
mov eax, dword [0x100f83e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xae4], ecx
lea ecx, [ebp - 0x22c]
call fcn.1002873d
and dword [ebp - 4], 0
and dword [ebp - 0x230], 0
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.100770c0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
and dword [ebp - 0x228], 0
push 0
push 0
xor ebx, ebx
call fcn.100623e7
pop ecx
pop ecx
test eax, eax
je 0x1009ab52
and dword [ebp - 0xad4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1000e1d2
mov eax, dword [ebp - 0xad4]
jmp 0x1009afb8
push 0x2001f
push 0x100d86a4
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x22c]
call fcn.1000e160
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x1009ab9f
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x100d86d4
lea ecx, [ebp - 0x22c]
call fcn.1000e30d
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x224]
push eax
call fcn.100779fb
pop ecx
test eax, eax
jbe 0x1009acb2
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009acb2
push 0x100d86e4
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009acb2
and dword [ebp - 0x238], 0
and dword [ebp - 0x240], 0
and dword [ebp - 0x244], 0
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.100b918a
add esp, 0x14
movzx eax, al
test eax, eax
je 0x1009acb2
push dword [ebp - 0x23c]
push dword [ebp - 0x244]
push dword [ebp - 0x240]
push dword [ebp - 0x238]
call fcn.100b903c
add esp, 0x10
mov esi, eax
mov edi, edx
push 1
push 1
push 9
push 3
call fcn.100b903c
add esp, 0x10
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xaf0], edx
mov eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xaf0]
jb 0x1009acb2
ja 0x1009aca8
mov eax, dword [ebp - 0xaec]
cmp eax, dword [ebp - 0xaf4]
jb 0x1009acb2
mov dword [ebp - 0x228], 1
cmp dword [ebp - 0x228], 0
je 0x1009ae99
and dword [ebp - 0x228], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x1009ae99
cmp dword [ebp - 0x248], 0
je 0x1009ae99
push 0x22c
push 0
lea eax, [ebp - 0x47c]
push eax
call fcn.100770c0
add esp, 0xc
mov dword [ebp - 0x47c], 0x22c
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x1009ae86
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x1009ae69
and word [ebp - 0x68c], 0
push 0x206
push 0
lea eax, [ebp - 0x68a]
push eax
call fcn.100770c0
add esp, 0xc
push 0x103
push dword [ebp - 0x480]
lea eax, [ebp - 0x68c]
push eax
call fcn.1007a8c7
add esp, 0xc
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x100d871c
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1009ae69
push dword [ebp - 0x474]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0xffffffff
je 0x1009ae67
cmp dword [ebp - 0x690], 0
je 0x1009ae67
mov dword [ebp - 0xabc], 0x428
lea eax, [ebp - 0xabc]
push eax
push dword [ebp - 0x690]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1009ae54
lea eax, [ebp - 0xa9c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
je 0x1009ae3e
push 0x100d8738
push dword [ebp - 0xac0]
call fcn.1007b1d0
pop ecx
pop ecx
test eax, eax
jne 0x1009ae3e
mov dword [ebp - 0x228], 1
jmp 0x1009ae54
lea eax, [ebp - 0xabc]
push eax
push dword [ebp - 0x690]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1009ae00
push dword [ebp - 0x690]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x690], 0xffffffff
jmp 0x1009ae86
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x24c], eax
jmp 0x1009ad27
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x248], 0xffffffff
cmp dword [ebp - 0x228], 0
je 0x1009af97
mov dword [ebp - 0xad0], 2
lea ecx, [ebp - 0xac8]
call fcn.10014aa8
mov byte [ebp - 4], 1
push dword [ebp - 0xad0]
push 0x100d8750
lea eax, [ebp - 0xac8]
push eax
call fcn.1001a6cc
add esp, 0xc
push 0x100d8760
lea ecx, [ebp - 0xad8]
call fcn.10003c37
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xafc], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xac8]
push eax
push dword [ebp - 0xafc]
lea eax, [ebp - 0xacc]
push eax
call fcn.10003da1
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xad8]
call fcn.10014b46
lea ecx, [ebp - 0xacc]
call fcn.10037237
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xac4], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xadc], esp
push 0x100d2fb7
call fcn.10001438
xor eax, eax
cmp dword [ebp - 0xac4], 0
sete al
push eax
push 0
push 0
push 0x3e8
mov ecx, 0x10114848
call fcn.100bbdb6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xacc]
call fcn.10014b46
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac8]
call fcn.10014b46
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xae0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1000e1d2
mov eax, dword [ebp - 0xae0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100770aa
leave
ret