Function at 0x10009990
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1db4
call fcn.1001a920
mov eax, dword [0x101499e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1da4], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1dac], edi
test eax, eax
jne 0x10009b02
mov dword [ebp - 0x1dac], eax
lea eax, [ebp - 0x1dac]
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x100099fd
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a90f
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1dac]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1db0], eax
test eax, eax
jle 0x1000a062
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009af0
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009ae9
push 0x104
lea eax, [ebp - 0x24c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009ae9
lea eax, [ebp - 0x24c]
push eax
call fcn.100073e0
push eax
lea eax, [ebp - 0x44]
push 0x1003bc8c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10007440
add esp, 0x1c
test al, al
je 0x10009ae9
mov eax, dword [ebp + esi*4 - 0x1850]
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x648]
push eax
movups xmmword [ebp - 0x1974], xmm0
lea eax, [ebp - 0x1954]
movups xmm0, xmmword [ebp - 0x34]
push 0x1003bc8c
push eax
movups xmmword [ebp - 0x1964], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1978]
mov ecx, ebx
push eax
call fcn.10002190
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1db0]
jl 0x10009a20
jmp 0x1000a062
cmp eax, 1
jne 0x10009cf2
test edi, edi
je 0x1000a062
push edi
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x1db0], esi
cmp esi, 0xffffffff
je 0x1000a062
push 0x424
lea eax, [ebp - 0x1d9c]
push 0
push eax
call fcn.1001d760
add esp, 0xc
mov dword [ebp - 0x1da0], 0x428
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.1001d760
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b80], cx
je 0x10009bac
lea eax, [ebp - 0x1b80]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x239], al
lea eax, [ebp - 0x1b80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009b90
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009bb5
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009be1
mov al, byte [ebp + edx - 0x238]
cmp al, 0x41
jl 0x10009bdc
cmp al, 0x5a
jg 0x10009bdc
add al, 0x20
mov byte [ebp + edx - 0x238], al
inc edx
cmp edx, ecx
jle 0x10009bc4
push 0x1f4
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.1001d760
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d80], cx
je 0x10009c2c
lea eax, [ebp - 0x1d80]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x441], al
lea eax, [ebp - 0x1d80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009c10
lea ecx, [ebp - 0x440]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009c35
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009c61
mov al, byte [ebp + edx - 0x440]
cmp al, 0x41
jl 0x10009c5c
cmp al, 0x5a
jg 0x10009c5c
add al, 0x20
mov byte [ebp + edx - 0x440], al
inc edx
cmp edx, ecx
jle 0x10009c44
movups xmm0, xmmword [ebp - 0x440]
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x238]
movups xmmword [ebp - 0x1974], xmm0
push eax
movups xmm0, xmmword [ebp - 0x430]
lea eax, [ebp - 0x1954]
push eax
movups xmmword [ebp - 0x1964], xmm0
call fcn.10014bf0
mov eax, dword [ebx + 4]
add esp, 8
cmp eax, dword [ebx + 8]
jne 0x10009cb0
push 1
mov ecx, ebx
call fcn.10010170
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009cca
mov ecx, 0x4a
lea esi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db0]
add dword [ebx + 4], 0x128
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10009b60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000a062
cmp eax, 2
jne 0x1000a062
test edi, edi
je 0x100099e8
lea eax, [ebp - 0x1db0]
mov dword [ebp - 0x1db0], 0
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x100099e8
mov eax, dword [ebp - 0x1db0]
xor esi, esi
shr eax, 2
test eax, eax
jle 0x10009ddd
mov ebx, eax
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009dc8
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009dc1
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp + esi*4 - 0x1850], eax
jne 0x10009dc1
push 0x104
lea eax, [ebp - 0x850]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009dc1
lea eax, [ebp - 0x850]
push eax
call fcn.100073e0
push eax
lea eax, [ebp - 0x44]
push 0x1003bc8c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.10007440
add esp, 0x1c
test al, al
jne 0x10009dd1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10009d42
mov ebx, dword [ebp - 0x1da4]
mov edi, dword [ebp - 0x1dac]
lea eax, [ebp - 0x648]
mov dword [0x10a6c830], 0
push eax
push 0x1003bc90
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10014c30
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x24c]
push eax
push str._ls.
push 0x208
push eax
call fcn.10014c30
add esp, 0x10
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1db4], esi
cmp esi, 0xffffffff
je 0x1000a062
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10a6c830]
cmp eax, 0xc8
jg 0x1000a039
xor ecx, ecx
mov dword [ebp - 0x374], edi
cmp word [ebp - 0x1b9c], cx
je 0x10009eac
lea eax, [ebp - 0x1b9c]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x1b9c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009e90
mov edi, 0x1003bca9
mov byte [ebp - 0x1da4], 0x25
mov byte [ebp - 0x1da2], 0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da3], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da4]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10014bf0
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da4], ax
mov byte [ebp - 0x1da2], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001d760
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1001d760
lea eax, [ebp - 0x648]
push eax
push 0x1003bc90
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10014c30
add esp, 0x34
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1b9c]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.10014c30
push 0x104
lea eax, [ebp - 0x1954]
push 0
push eax
call fcn.1001d760
xor ecx, ecx
add esp, 0x20
cmp word [ebp - 0x24c], cx
je 0x10009fac
lea eax, [ebp - 0x24c]
nop dword [eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x24c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009f90
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da8], 0x25
mov byte [ebp - 0x1da7], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da8]
mov byte [ebp - 0x1da6], 0
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10014bf0
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da8], ax
mov byte [ebp - 0x1da6], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001d760
mov eax, dword [ebx + 4]
add esp, 0x18
cmp eax, dword [ebx + 8]
jne 0x1000a013
push 1
mov ecx, ebx
call fcn.10010170
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000a02d
mov ecx, 0x4a
lea esi, [ebp - 0x374]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db4]
add dword [ebx + 4], 0x128
mov eax, dword [0x10a6c830]
inc eax
mov dword [0x10a6c830], eax
lea eax, [ebp - 0x1bc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x1dac]
test eax, eax
jne 0x10009e60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a90f
mov esp, ebp
pop ebp
ret 8