Function at 0x100064a0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001236a
mov eax, dword fs:[0]
push eax
mov eax, 0x1634
call fcn.10011b60
mov eax, dword [0x1001c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x158c]
push eax
push 0x1000
lea ecx, [ebp - 0x1460]
xor edi, edi
push ecx
mov dword [ebp - 0x158c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x100064fe
xor al, al
jmp 0x1000670a
lea edx, [ebp - 0x1640]
push edx
call fcn.10006f00
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x158c]
shr esi, 2
mov dword [ebp - 0x1590], edi
mov dword [ebp - 0x1598], esi
cmp esi, edi
jle 0x1000662b
lea eax, [ebp + edi*4 - 0x1460]
mov dword [ebp - 0x1594], eax
mov eax, dword [eax]
test eax, eax
je 0x1000661c
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10006615
push 0x104
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10006615
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x1640]
push edx
call fcn.10008cd0
push eax
call fcn.10008f30
add esp, 0xc
lea esi, [ebp - 0x258]
call fcn.1000df40
push eax
lea eax, [ebp - 0x50]
push 0x100178e0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x460]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.1000dca0
add esp, 4
test al, al
je 0x1000660f
mov edx, dword [ebp - 0x1594]
mov eax, dword [edx]
mov dword [ebp - 0x1588], eax
mov ecx, 8
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x1584]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x460]
push ecx
lea edx, [ebp - 0x1564]
push 0x10017b04
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x1588]
push eax
call fcn.100091e0
mov edi, dword [ebp - 0x1590]
mov esi, dword [ebp - 0x1598]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [ebp - 0x1590], edi
cmp edi, esi
jl 0x1000652a
cmp dword [ebp - 0x15e8], 0
lea esi, [ebp - 0x163c]
je 0x1000665b
mov ebx, esi
call fcn.10008760
test al, al
jne 0x10006647
xor esi, esi
mov ecx, dword [ebp - 0x15e8]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
test eax, eax
je 0x1000665d
xor esi, esi
lea ecx, [ebp - 0x163c]
mov byte [ebp - 0x15ec], 0
mov byte [ebp - 0x15f2], 0
call dword [sym.imp.MSVCP100.dll_protected:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Init_void_]
mov edx, dword [0x1012765c]
xor eax, eax
mov dword [ebp - 0x15e8], eax
mov dword [ebp - 0x15f0], edx
mov dword [ebp - 0x15f8], eax
cmp esi, eax
jne 0x100066ae
push eax
mov eax, dword [ebp - 0x1640]
mov ecx, dword [eax + 4]
push 2
lea ecx, [ebp + ecx - 0x1640]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
mov edx, dword [ebp - 0x1640]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x15e0]
mov dword [ebp - 0x1594], ecx
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
lea ecx, [ebp - 0x163c]
mov dword [ebp - 4], 1
call fcn.10006fe0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1640]
mov edx, dword [ecx + 4]
mov eax, dword [sym.imp.MSVCP100.dll_const_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::vftable]
lea ecx, [ebp - 0x15e0]
mov dword [ebp + edx - 0x1640], eax
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10011156
mov esp, ebp
pop ebp
ret