Function at 0x1002c26e
Capabilities:
Get common file path
Link many functions at runtime
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x3f4]
sub esp, 0x474
mov eax, dword [0x10084500]
mov dword [ebp + 0x3f0], eax
push edi
lea eax, [ebp + 0x1c4]
push eax
push 0x104
mov byte [ebp - 0x61], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x1006f850
lea eax, [ebp + 0x1c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp + 0x1c4]
push eax
call edi
test eax, eax
mov dword [ebp - 0x7c], eax
je 0x1002c56b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetProcId
push eax
call esi
test eax, eax
je 0x1002c311
call eax
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1002c561
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1002c305
mov byte [ebp - 0x61], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002c561
push ebx
call fcn.1001e3c3
test al, al
je 0x1002c427
push str.psapi.dll
call edi
mov edi, eax
test edi, edi
je 0x1002c560
push str.EnumProcesses
push edi
call esi
push str.EnumProcessModules
push edi
mov ebx, eax
call esi
push str.GetModuleBaseNameA
push edi
mov dword [ebp - 0x70], eax
call esi
test ebx, ebx
mov dword [ebp - 0x74], eax
je 0x1002c560
cmp dword [ebp - 0x70], 0
je 0x1002c560
mov esi, 0x1000
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
push esi
push edi
call ebx
and dword [ebp - 0x68], 0
test dword [ebp - 0x6c], 0xfffffffc
jbe 0x1002c41b
mov eax, dword [ebp - 0x68]
push dword [edi + eax*4]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x1002c409
lea eax, [ebp - 0x80]
push eax
push 4
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [ebp - 0x70]
test eax, eax
je 0x1002c402
push 0x104
lea eax, [ebp + 0x2ec]
push eax
push dword [ebp - 0x78]
push ebx
call dword [ebp - 0x74]
test eax, eax
je 0x1002c402
mov esi, 0x1006f5b4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
lea eax, [ebp + 0x2ec]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
je 0x1002c3f9
add esi, 0xf
cmp esi, 0x1006f5c3
jl 0x1002c3d2
jmp 0x1002c402
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
inc dword [ebp - 0x68]
shr eax, 2
cmp dword [ebp - 0x68], eax
jb 0x1002c38b
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1002c560
push str.kernel32.dll
call edi
mov edi, eax
test edi, edi
je 0x1002c560
push 0x1006f920
push edi
call esi
push 0x1006f910
push edi
mov dword [ebp - 0x68], eax
call esi
push 0x1006f900
push edi
mov ebx, eax
call esi
push str.Module32First
push edi
mov dword [ebp - 0x70], eax
call esi
push str.Module32Next
push edi
mov dword [ebp - 0x6c], eax
call esi
xor edi, edi
cmp dword [ebp - 0x68], edi
mov dword [ebp - 0x74], eax
je 0x1002c560
cmp ebx, edi
je 0x1002c560
cmp dword [ebp - 0x70], edi
je 0x1002c560
cmp dword [ebp - 0x6c], edi
je 0x1002c560
cmp eax, edi
je 0x1002c560
push edi
push 2
call dword [ebp - 0x68]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x1002c560
lea ecx, [ebp + 0x2c8]
push ecx
push eax
mov dword [ebp + 0x2c8], 0x128
call ebx
jmp 0x1002c558
cmp dword [ebp + 0x2d0], edi
je 0x1002c54b
push dword [ebp + 0x2d0]
push 8
call dword [ebp - 0x68]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1002c54b
lea eax, [ebp - 0x60]
push eax
push ebx
mov dword [ebp - 0x60], 0x224
call dword [ebp - 0x6c]
jmp 0x1002c520
mov esi, 0x1006f5b4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
je 0x1002c526
add esi, 0xf
cmp esi, 0x1006f5c3
jl 0x1002c4f6
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [ebp - 0x74]
test eax, eax
jne 0x1002c4f1
jmp 0x1002c544
push dword [ebp + 0x2d0]
push edi
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
je 0x1002c544
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x2c8]
push eax
push dword [ebp - 0x78]
call dword [ebp - 0x70]
test eax, eax
jne 0x1002c4c6
pop ebx
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [ebp + 0x3f0]
mov al, byte [ebp - 0x61]
pop edi
call fcn.100568ae
add ebp, 0x3f4
leave
ret