Function at 0x10082aa0
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1dbc
call fcn.1008ec00
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov byte [0x101e6e9c], 1
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1db4], edi
test eax, eax
jne 0x10082bf8
mov dword [ebp - 0x1db4], eax
lea eax, [ebp - 0x1db4]
push eax
push 0x1000
lea eax, [ebp - 0x1858]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10082b0d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp - 0x1db4]
xor esi, esi
shr ebx, 2
test ebx, ebx
jle 0x10083167
mov eax, dword [ebp + esi*4 - 0x1858]
test eax, eax
je 0x10082bea
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10082be3
push 0x104
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10082be3
lea ecx, [ebp - 0x250]
call fcn.10087230
push eax
lea eax, [ebp - 0x48]
push 0x100d60e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [ebp - 0x650]
lea ecx, [ebp - 0x250]
call fcn.10086fc0
add esp, 4
test al, al
je 0x10082be3
mov eax, dword [ebp + esi*4 - 0x1858]
movups xmm0, xmmword [ebp - 0x48]
mov dword [ebp - 0x1980], eax
lea eax, [ebp - 0x650]
push eax
movups xmmword [ebp - 0x197c], xmm0
lea eax, [ebp - 0x195c]
movups xmm0, xmmword [ebp - 0x38]
push 0x100d60e8
push eax
movups xmmword [ebp - 0x196c], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1980]
push eax
call fcn.10083740
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10082b20
jmp 0x10083167
cmp eax, 1
jne 0x10082deb
test edi, edi
je 0x10083167
push edi
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10083167
push 0x424
lea eax, [ebp - 0x1da4]
push 0
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0x1da8], 0x428
lea eax, [ebp - 0x1da8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
nop dword [eax + eax]
push 0x1f4
lea eax, [ebp - 0x240]
push 0
push eax
call fcn.10090bb0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b88], cx
je 0x10082c9c
lea eax, [ebp - 0x1b88]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x241], al
lea eax, [ebp - 0x1b88]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10082c80
lea ecx, [ebp - 0x240]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10082ca5
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10082cd1
mov al, byte [ebp + edx - 0x240]
cmp al, 0x41
jl 0x10082ccc
cmp al, 0x5a
jg 0x10082ccc
add al, 0x20
mov byte [ebp + edx - 0x240], al
inc edx
cmp edx, ecx
jle 0x10082cb4
push 0x1f4
lea eax, [ebp - 0x448]
push 0
push eax
call fcn.10090bb0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d88], cx
je 0x10082d1c
lea eax, [ebp - 0x1d88]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x449], al
lea eax, [ebp - 0x1d88]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10082d00
lea ecx, [ebp - 0x448]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10082d25
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10082d51
mov al, byte [ebp + edx - 0x448]
cmp al, 0x41
jl 0x10082d4c
cmp al, 0x5a
jg 0x10082d4c
add al, 0x20
mov byte [ebp + edx - 0x448], al
inc edx
cmp edx, ecx
jle 0x10082d34
movups xmm0, xmmword [ebp - 0x448]
mov eax, dword [ebp - 0x1da0]
mov dword [ebp - 0x1980], eax
lea eax, [ebp - 0x240]
movups xmmword [ebp - 0x197c], xmm0
push eax
movups xmm0, xmmword [ebp - 0x438]
lea eax, [ebp - 0x195c]
push eax
movups xmmword [ebp - 0x196c], xmm0
call fcn.1003a9e0
mov eax, dword [0x101ef768]
add esp, 8
cmp eax, dword [0x101ef76c]
jne 0x10082da7
push ecx
call fcn.100837a0
mov eax, dword [0x101ef768]
test eax, eax
je 0x10082dbf
mov edi, eax
lea esi, [ebp - 0x1980]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x101ef768]
add eax, 0x128
mov dword [0x101ef768], eax
lea eax, [ebp - 0x1da8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x10082c50
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10083167
cmp eax, 2
jne 0x10083167
test edi, edi
je 0x10082af8
lea eax, [ebp - 0x1db8]
mov dword [ebp - 0x1db8], 0
push eax
push 0x1000
lea eax, [ebp - 0x1858]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10082af8
mov ebx, dword [ebp - 0x1db8]
xor esi, esi
shr ebx, 2
test ebx, ebx
jle 0x10082ed1
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1858]
test eax, eax
je 0x10082ec2
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10082ebb
mov eax, dword [ebp - 0x1db4]
cmp dword [ebp + esi*4 - 0x1858], eax
jne 0x10082ebb
push 0x104
lea eax, [ebp - 0x858]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10082ebb
lea ecx, [ebp - 0x858]
call fcn.10087230
push eax
lea eax, [ebp - 0x48]
push 0x100d60e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [ebp - 0x650]
lea ecx, [ebp - 0x858]
call fcn.10086fc0
add esp, 4
test al, al
jne 0x10082ecb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10082e40
mov edi, dword [ebp - 0x1db4]
lea eax, [ebp - 0x650]
mov dword [0x10232e20], 0
push eax
push 0x100d60fc
lea eax, [ebp - 0x250]
push 0x208
push eax
call fcn.10082660
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x250]
add esp, 0x10
push eax
call esi
lea eax, [ebp - 0x250]
push eax
push str._ls.
push 0x208
push eax
call fcn.10082660
add esp, 0x10
lea eax, [ebp - 0x1bd0]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10083167
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10232e20]
cmp eax, 0xc8
jg 0x10083144
xor ecx, ecx
mov dword [ebp - 0x380], edi
cmp word [ebp - 0x1ba4], cx
je 0x10082f9c
lea eax, [ebp - 0x1ba4]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1961], al
lea eax, [ebp - 0x1ba4]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10082f80
mov eax, 0x100d6115
mov byte [ebp - 0x1dac], 0x25
mov byte [ebp - 0x1daa], 0
mov al, byte [eax]
xor al, 0xe3
mov byte [ebp - 0x1dab], al
lea eax, [ebp - 0x1960]
push eax
lea eax, [ebp - 0x1dac]
push eax
lea eax, [ebp - 0x37c]
push eax
call fcn.1003a9e0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1dac], ax
mov byte [ebp - 0x1daa], al
push 0x104
push eax
lea eax, [ebp - 0x1960]
push eax
call fcn.10090bb0
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x208
push 0
push eax
call fcn.10090bb0
add esp, 0xc
lea eax, [ebp - 0x650]
push eax
push 0x100d60fc
lea eax, [ebp - 0x250]
push 0x208
push eax
call fcn.10082660
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
call esi
lea eax, [ebp - 0x1ba4]
push eax
lea eax, [ebp - 0x250]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.10082660
add esp, 0x14
lea eax, [ebp - 0x1960]
push 0x104
push 0
push eax
call fcn.10090bb0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x250], cx
je 0x1008309b
lea eax, [ebp - 0x250]
mov al, byte [eax]
mov byte [ebp + ecx - 0x1960], al
inc ecx
lea eax, [ebp - 0x250]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10083081
mov eax, 0x100d6115
mov byte [ebp - 0x1db0], 0x25
mov byte [ebp - 0x1dae], 0
mov al, byte [eax]
xor al, 0xe3
mov byte [ebp - 0x1daf], al
lea eax, [ebp - 0x1960]
push eax
lea eax, [ebp - 0x1db0]
push eax
lea eax, [ebp - 0x35c]
push eax
call fcn.1003a9e0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1db0], ax
mov byte [ebp - 0x1dae], al
push 0x104
push eax
lea eax, [ebp - 0x1960]
push eax
call fcn.10090bb0
mov eax, dword [0x101ef768]
add esp, 0xc
cmp eax, dword [0x101ef76c]
jne 0x10083111
push ecx
call fcn.100837a0
mov eax, dword [0x101ef768]
test eax, eax
je 0x10083135
mov edi, eax
lea esi, [ebp - 0x380]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x101ef768]
mov edi, dword [ebp - 0x1db4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
add eax, 0x128
mov dword [0x101ef768], eax
mov eax, dword [0x10232e20]
inc eax
mov dword [0x10232e20], eax
lea eax, [ebp - 0x1bd0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10082f50
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
mov byte [0x101e6e9c], 0
pop ebx
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 8