Function at 0x10005560
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1dbc
call fcn.10033ad0
mov eax, dword [0x10048650]
xor eax, esp
mov dword [esp + 0x1db8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, edi
jne 0x100056be
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x578]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x100055cb
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1db8]
xor ecx, esp
call fcn.100204ba
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
shr esi, 2
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp esi, edi
jle 0x10005c4f
mov eax, dword [esp + ecx*4 + 0x570]
lea edi, [esp + ecx*4 + 0x570]
test eax, eax
je 0x100056ac
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x100056a1
push 0x104
lea edx, [esp + 0x15b4]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100056a1
lea esi, [esp + 0x15b0]
call fcn.10004340
push eax
lea eax, [esp + 0x1574]
push 0x100419fc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x19bc]
push ecx
mov ecx, esi
call fcn.100040f0
add esp, 0x10
test al, al
je 0x1000569d
mov edx, dword [edi]
lea eax, [esp + 0x19b0]
push eax
mov dword [esp + 0x24], edx
mov ecx, 8
lea esi, [esp + 0x1574]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push 0x100419fc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call fcn.1001b310
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jl 0x100055e4
jmp 0x10005c4f
cmp eax, 1
jne 0x1000591d
cmp ecx, edi
je 0x10005c4f
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x10005c4f
push 0x424
lea eax, [esp + 0x150]
push 0
push eax
call fcn.10023e30
add esp, 0xc
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [esp + 0x150], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x10005720
push 0x1f4
lea edx, [esp + 0x15b4]
push 0
push edx
call fcn.10023e30
xor eax, eax
add esp, 0xc
cmp word [esp + 0x368], ax
je 0x1000576c
lea ecx, [esp + 0x368]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x15b0], cl
inc eax
cmp word [esp + eax*2 + 0x368], 0
lea ecx, [esp + eax*2 + 0x368]
jne 0x10005750
lea eax, [esp + 0x15b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005776
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x100057a2
mov al, byte [esp + ecx + 0x15b0]
cmp al, 0x41
jl 0x1000579d
cmp al, 0x5a
jg 0x1000579d
add al, 0x20
mov byte [esp + ecx + 0x15b0], al
inc ecx
cmp ecx, edx
jle 0x10005785
push 0x1f4
lea edx, [esp + 0x17bc]
push 0
push edx
call fcn.10023e30
xor eax, eax
add esp, 0xc
cmp word [esp + 0x168], ax
je 0x100057ec
lea ecx, [esp + 0x168]
lea esp, [esp]
mov cl, byte [ecx]
mov byte [esp + eax + 0x17b8], cl
inc eax
cmp word [esp + eax*2 + 0x168], 0
lea ecx, [esp + eax*2 + 0x168]
jne 0x100057d0
lea eax, [esp + 0x17b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100057f6
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005822
mov al, byte [esp + ecx + 0x17b8]
cmp al, 0x41
jl 0x1000581d
cmp al, 0x5a
jg 0x1000581d
add al, 0x20
mov byte [esp + ecx + 0x17b8], al
inc ecx
cmp ecx, edx
jle 0x10005805
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], edx
mov ecx, 8
lea esi, [esp + 0x17b8]
lea edi, [esp + 0x24]
lea eax, [esp + 0x15b0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.100206fd
mov edi, dword [0x10193a0c]
add esp, 8
cmp dword [0x10193a08], edi
jne 0x100058d1
mov ecx, dword [0x10193a08]
mov ebx, dword [0x10193a04]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 0xdd67c7
ja 0x10005913
sub edi, ebx
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jbe 0x100058cd
mov ecx, eax
shr ecx, 1
mov edx, 0xdd67c8
sub edx, ecx
cmp edx, eax
jae 0x100058be
xor eax, eax
jmp 0x100058c0
add eax, ecx
cmp eax, esi
jae 0x100058c6
mov eax, esi
mov ecx, eax
call fcn.1001d750
mov ebx, dword [esp + 0x10]
mov edi, dword [0x10193a08]
test edi, edi
je 0x100058e6
mov ecx, 0x4a
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
add dword [0x10193a08], 0x128
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x10005720
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10005c4f
push str.vector_T__too_long
call fcn.1001f9ce
cmp eax, 2
jne 0x10005c4f
cmp ecx, edi
je 0x100055b2
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x578]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x100055b2
mov esi, dword [esp + 0x10]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0xc], esi
test esi, esi
jle 0x100059fe
jmp 0x10005970
mov eax, dword [esp + ebx*4 + 0x570]
test eax, eax
je 0x100059f5
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100059ee
mov eax, dword [esp + 0x18]
cmp dword [esp + ebx*4 + 0x570], eax
jne 0x100059ee
push 0x104
lea ecx, [esp + 0x1bbc]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100059ee
lea esi, [esp + 0x1bb8]
call fcn.10004340
push eax
lea edx, [esp + 0x1574]
push 0x100419fc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x19bc]
push eax
mov ecx, esi
call fcn.100040f0
add esp, 0x10
test al, al
jne 0x100059fe
mov esi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x10005970
lea ecx, [esp + 0x19b0]
push ecx
lea edx, [esp + 0x15b4]
push 0x10041a00
push edx
mov edx, 0x208
mov dword [0x10193d5c], 0
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x15b0]
push ecx
mov edx, ecx
push str._ls.
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x15b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x10005c4f
mov bl, 0x73
cmp dword [0x10193d5c], 0xc8
jg 0x10005c2b
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x17b8], edx
cmp word [esp + 0x174], ax
je 0x10005ac9
lea ecx, [esp + 0x174]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x20], cl
inc eax
cmp word [esp + eax*2 + 0x174], 0
lea ecx, [esp + eax*2 + 0x174]
jne 0x10005ab0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x17c4]
push ecx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0
call fcn.100206fd
xor eax, eax
push 0x104
push eax
lea edx, [esp + 0x34]
push edx
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], al
call fcn.10023e30
push 0x208
lea eax, [esp + 0x15cc]
push 0
push eax
call fcn.10023e30
lea ecx, [esp + 0x19d4]
push ecx
lea edx, [esp + 0x15d8]
push 0x10041a00
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0x30
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x15b4]
push edx
mov eax, edx
push str._ls_ls
push eax
mov edx, 0x208
call fcn.10001000
push 0x104
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.10023e30
xor eax, eax
add esp, 0x1c
cmp word [esp + 0x15b0], ax
je 0x10005baf
lea ecx, [esp + 0x15b0]
mov dl, byte [ecx]
mov byte [esp + eax + 0x20], dl
inc eax
cmp word [esp + eax*2 + 0x15b0], 0
lea ecx, [esp + eax*2 + 0x15b0]
jne 0x10005b96
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x17e4]
push edx
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0
call fcn.100206fd
xor eax, eax
push 0x104
push eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
lea eax, [esp + 0x34]
push eax
call fcn.10023e30
mov ecx, dword [0x10193a08]
add esp, 0x18
cmp ecx, dword [0x10193a0c]
jne 0x10005c05
call fcn.1001ca60
mov edi, dword [0x10193a08]
test edi, edi
je 0x10005c21
mov ecx, 0x4a
lea esi, [esp + 0x17b8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
add dword [0x10193a08], 0x128
inc dword [0x10193d5c]
lea edx, [esp + 0x148]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005a7c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1dc4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.100204ba
mov esp, ebp
pop ebp
ret 4