Function at 0x10002d90
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1001d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push 0x10017758
mov dword [ebp - 0x244], ecx
call fcn.10002ce0
push 0x10017758
lea ecx, [ebp - 0x234]
call fcn.10002ce0
push str.SOFTWAREWGameBox
lea ecx, [ebp - 0x248]
call fcn.10002ce0
mov eax, dword [ebp - 0x248]
push 0xf003f
xor ebx, ebx
push eax
push 0x80000001
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
call fcn.100016d0
cmp eax, ebx
jne 0x10002e63
lea ecx, [ebp - 0x238]
push ecx
push 0x1001771c
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x238], 0x104
call fcn.10001780
cmp eax, ebx
jne 0x10002e63
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10002e41
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x234]
call fcn.10002330
mov ecx, dword [ebp - 0x234]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push ecx
call edi
test eax, eax
jne 0x10003019
push 0x10017758
lea ecx, [ebp - 0x240]
call fcn.10002ce0
push ebx
push str.WGAME_MAIN_FRAME
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp esi, ebx
je 0x10002f82
push 0x18b73
push ebx
push 0x427
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x18b73
jne 0x10002f82
lea edx, [ebp - 0x23c]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.10009880
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10002f82
lea ecx, [ebp - 0x230]
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10002f82
nop
mov ebx, dword [ebp - 0x228]
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x238]
call fcn.10002ce0
cmp ebx, dword [ebp - 0x23c]
je 0x10002f65
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002f52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x230]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002f10
jmp 0x10002f82
lea edx, [ebp - 0x238]
push edx
lea ecx, [ebp - 0x240]
call fcn.10002b20
lea ecx, [ebp - 0x238]
call fcn.10001f80
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002ff7
mov ecx, dword [ebp - 0x240]
push 0x5c
push ecx
call fcn.10009c37
add esp, 8
test eax, eax
jne 0x10002fad
or eax, 0xffffffff
jmp 0x10002fb5
sub eax, dword [ebp - 0x240]
sar eax, 1
inc eax
push eax
lea edx, [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x240]
call fcn.100022b0
push eax
lea ecx, [ebp - 0x234]
call fcn.10002b20
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002ff7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003019
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x234]
push ecx
call edi
pop edi
test eax, eax
je 0x1000309b
push 0x10017718
push 1
lea edx, [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x234]
call fcn.10002220
push eax
call fcn.100021c0
mov bl, al
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000306d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x10003083
push 1
push 0x10017718
lea ecx, [ebp - 0x234]
call fcn.100023e0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.100023e0
jmp 0x100031b0
mov edx, dword [0x1001d218]
mov eax, dword [edx + 0xc]
mov ecx, 0x1001d218
call eax
lea esi, [eax + 0x10]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov ebx, 0x105
sub eax, ebx
or eax, ecx
mov dword [ebp - 0x238], esi
jge 0x100030dc
push ebx
lea ecx, [ebp - 0x238]
call fcn.10002090
mov esi, dword [ebp - 0x238]
cmp dword [esi - 8], ebx
jge 0x100030eb
push 0x80070057
call fcn.100015c0
push 0x104
xor ecx, ecx
push esi
mov dword [esi - 0xc], ebx
push ecx
mov word [esi + 0x20a], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10003181
mov eax, dword [esi - 8]
push eax
push esi
call fcn.10009e89
add esp, 8
test eax, eax
js 0x100030e1
cmp eax, dword [esi - 8]
jg 0x100030e1
xor edx, edx
push 0x5c
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], dx
call fcn.10009c37
add esp, 8
test eax, eax
jne 0x1000313b
or eax, 0xffffffff
jmp 0x1000313f
sub eax, esi
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x238]
call fcn.100022b0
push eax
lea ecx, [ebp - 0x234]
call fcn.10002b20
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003181
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.100023e0
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100031b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0x10], 0
pop esi
pop ebx
je 0x100031d2
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100031e4
lea edx, [ebp - 0x234]
push edx
jmp 0x100031d9
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x244]
call fcn.10002b20
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x100031f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003217
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003258
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x244]
xor ecx, ebp
call fcn.10009816
mov esp, ebp
pop ebp
ret