Function at 0x10005c40
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1dbc
call fcn.10035930
mov eax, dword [0x1004a650]
xor eax, esp
mov dword [esp + 0x1db8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, edi
jne 0x10005d9e
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x578]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10005cab
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1db8]
xor ecx, esp
call fcn.1002206c
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
shr esi, 2
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp esi, edi
jle 0x1000632f
mov eax, dword [esp + ecx*4 + 0x570]
lea edi, [esp + ecx*4 + 0x570]
test eax, eax
je 0x10005d8c
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10005d81
push 0x104
lea edx, [esp + 0x15b4]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005d81
lea esi, [esp + 0x15b0]
call fcn.100048d0
push eax
lea eax, [esp + 0x1574]
push 0x10043a14
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x19bc]
push ecx
mov ecx, esi
call fcn.10004680
add esp, 0x10
test al, al
je 0x10005d7d
mov edx, dword [edi]
lea eax, [esp + 0x19b0]
push eax
mov dword [esp + 0x24], edx
mov ecx, 8
lea esi, [esp + 0x1574]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push 0x10043a14
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call fcn.1001d190
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jl 0x10005cc4
jmp 0x1000632f
cmp eax, 1
jne 0x10005ffd
cmp ecx, edi
je 0x1000632f
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x1000632f
push 0x424
lea eax, [esp + 0x150]
push 0
push eax
call fcn.10025d10
add esp, 0xc
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [esp + 0x150], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x10005e00
push 0x1f4
lea edx, [esp + 0x15b4]
push 0
push edx
call fcn.10025d10
xor eax, eax
add esp, 0xc
cmp word [esp + 0x368], ax
je 0x10005e4c
lea ecx, [esp + 0x368]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x15b0], cl
inc eax
cmp word [esp + eax*2 + 0x368], 0
lea ecx, [esp + eax*2 + 0x368]
jne 0x10005e30
lea eax, [esp + 0x15b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005e56
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005e82
mov al, byte [esp + ecx + 0x15b0]
cmp al, 0x41
jl 0x10005e7d
cmp al, 0x5a
jg 0x10005e7d
add al, 0x20
mov byte [esp + ecx + 0x15b0], al
inc ecx
cmp ecx, edx
jle 0x10005e65
push 0x1f4
lea edx, [esp + 0x17bc]
push 0
push edx
call fcn.10025d10
xor eax, eax
add esp, 0xc
cmp word [esp + 0x168], ax
je 0x10005ecc
lea ecx, [esp + 0x168]
lea esp, [esp]
mov cl, byte [ecx]
mov byte [esp + eax + 0x17b8], cl
inc eax
cmp word [esp + eax*2 + 0x168], 0
lea ecx, [esp + eax*2 + 0x168]
jne 0x10005eb0
lea eax, [esp + 0x17b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005ed6
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005f02
mov al, byte [esp + ecx + 0x17b8]
cmp al, 0x41
jl 0x10005efd
cmp al, 0x5a
jg 0x10005efd
add al, 0x20
mov byte [esp + ecx + 0x17b8], al
inc ecx
cmp ecx, edx
jle 0x10005ee5
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], edx
mov ecx, 8
lea esi, [esp + 0x17b8]
lea edi, [esp + 0x24]
lea eax, [esp + 0x15b0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.100222af
mov edi, dword [0x10acfcbc]
add esp, 8
cmp dword [0x10acfcb8], edi
jne 0x10005fb1
mov ecx, dword [0x10acfcb8]
mov ebx, dword [0x10acfcb4]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 0xdd67c7
ja 0x10005ff3
sub edi, ebx
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jbe 0x10005fad
mov ecx, eax
shr ecx, 1
mov edx, 0xdd67c8
sub edx, ecx
cmp edx, eax
jae 0x10005f9e
xor eax, eax
jmp 0x10005fa0
add eax, ecx
cmp eax, esi
jae 0x10005fa6
mov eax, esi
mov ecx, eax
call fcn.1001f310
mov ebx, dword [esp + 0x10]
mov edi, dword [0x10acfcb8]
test edi, edi
je 0x10005fc6
mov ecx, 0x4a
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
add dword [0x10acfcb8], 0x128
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x10005e00
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000632f
push str.vector_T__too_long
call fcn.1002157e
cmp eax, 2
jne 0x1000632f
cmp ecx, edi
je 0x10005c92
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x578]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10005c92
mov esi, dword [esp + 0x10]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0xc], esi
test esi, esi
jle 0x100060de
jmp 0x10006050
mov eax, dword [esp + ebx*4 + 0x570]
test eax, eax
je 0x100060d5
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100060ce
mov eax, dword [esp + 0x18]
cmp dword [esp + ebx*4 + 0x570], eax
jne 0x100060ce
push 0x104
lea ecx, [esp + 0x1bbc]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100060ce
lea esi, [esp + 0x1bb8]
call fcn.100048d0
push eax
lea edx, [esp + 0x1574]
push 0x10043a14
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x19bc]
push eax
mov ecx, esi
call fcn.10004680
add esp, 0x10
test al, al
jne 0x100060de
mov esi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x10006050
lea ecx, [esp + 0x19b0]
push ecx
lea edx, [esp + 0x15b4]
push 0x10043a18
push edx
mov edx, 0x208
mov dword [0x10ad0014], 0
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x15b0]
push ecx
mov edx, ecx
push str._ls.
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x15b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x1000632f
mov bl, 0x73
cmp dword [0x10ad0014], 0xc8
jg 0x1000630b
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x17b8], edx
cmp word [esp + 0x174], ax
je 0x100061a9
lea ecx, [esp + 0x174]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x20], cl
inc eax
cmp word [esp + eax*2 + 0x174], 0
lea ecx, [esp + eax*2 + 0x174]
jne 0x10006190
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x17c4]
push ecx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0
call fcn.100222af
xor eax, eax
push 0x104
push eax
lea edx, [esp + 0x34]
push edx
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], al
call fcn.10025d10
push 0x208
lea eax, [esp + 0x15cc]
push 0
push eax
call fcn.10025d10
lea ecx, [esp + 0x19d4]
push ecx
lea edx, [esp + 0x15d8]
push 0x10043a18
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0x30
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x15b4]
push edx
mov eax, edx
push str._ls_ls
push eax
mov edx, 0x208
call fcn.10001000
push 0x104
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.10025d10
xor eax, eax
add esp, 0x1c
cmp word [esp + 0x15b0], ax
je 0x1000628f
lea ecx, [esp + 0x15b0]
mov dl, byte [ecx]
mov byte [esp + eax + 0x20], dl
inc eax
cmp word [esp + eax*2 + 0x15b0], 0
lea ecx, [esp + eax*2 + 0x15b0]
jne 0x10006276
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x17e4]
push edx
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0
call fcn.100222af
xor eax, eax
push 0x104
push eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
lea eax, [esp + 0x34]
push eax
call fcn.10025d10
mov ecx, dword [0x10acfcb8]
add esp, 0x18
cmp ecx, dword [0x10acfcbc]
jne 0x100062e5
call fcn.1001e620
mov edi, dword [0x10acfcb8]
test edi, edi
je 0x10006301
mov ecx, 0x4a
lea esi, [esp + 0x17b8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
add dword [0x10acfcb8], 0x128
inc dword [0x10ad0014]
lea edx, [esp + 0x148]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000615c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1dc4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1002206c
mov esp, ebp
pop ebp
ret 4