Function at 0x5d28e0
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c810
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x746694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x74cb34]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x74c8b0]
cmp eax, dword [ecx + 4]
jg 0x5d2d5c
cmp dword [0x746400], 0
jne 0x5d2d3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov esi, eax
lea eax, [ebp - 0x470]
push 0
push eax
call fcn.006607e0
add esp, 0xc
mov dword [ebp - 0x474], 0x22c
xor eax, eax
mov dword [ebp - 0x478], eax
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5d29b0
cmp dword [ebp - 0x46c], esi
jne 0x5d2997
mov eax, dword [ebp - 0x45c]
cmp eax, esi
jne 0x5d29aa
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5d2985
jmp 0x5d29b0
mov dword [ebp - 0x478], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x478]
test eax, eax
je 0x5d2c59
push eax
xor esi, esi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x5d2a01
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x5d29f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5d2a09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x5d2b9e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.005be990
mov esi, eax
add esp, 8
cmp esi, 0x7463f0
je 0x5d2aae
mov edx, dword [0x746404]
cmp edx, 0x10
jb 0x5d2a6b
mov ecx, dword [0x7463f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d2a61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2d92
push edx
push ecx
call fcn.0065d157
add esp, 8
mov dword [0x746400], 0
mov dword [0x746404], 0xf
mov byte [0x7463f0], 0
movups xmm0, xmmword [esi]
movups xmmword [0x7463f0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x746400], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x230]
call fcn.00448860
push 0xffffffffffffffff
push 0x710db0
mov ecx, 0x7463f0
call fcn.005cdf30
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x5d2aec
push eax
push 0x70eff4
mov ecx, 0x7463f0
call fcn.005cdf30
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5d2d3c
mov edx, dword [0x746400]
inc ecx
sub edx, ecx
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
cmp dword [0x746400], ecx
jb 0x5d2d97
cmp dword [0x746404], 0x10
mov eax, 0x7463f0
push edx
cmovae eax, dword [0x7463f0]
add eax, ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.004484a0
mov edx, dword [0x746404]
cmp edx, 0x10
jb 0x5d2b7b
mov ecx, dword [0x7463f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d2b71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2da1
push edx
push ecx
call fcn.0065d157
add esp, 8
movups xmm0, xmmword [ebp - 0x230]
movups xmmword [0x7463f0], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [0x746400], xmm0
jmp 0x5d2d3c
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.005b3ce0
add esp, 0xc
push 5
push str.err:
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005a5ba0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [0x746404]
movq qword [ebp - 0x47c], xmm1
movups xmmword [ebp - 0x228], xmm0
cmp edx, 0x10
jb 0x5d2c3a
mov ecx, dword [0x7463f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d2c21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2d9c
push edx
push ecx
call fcn.0065d157
movups xmm0, xmmword [ebp - 0x228]
add esp, 8
movq xmm1, qword [ebp - 0x47c]
lea ecx, [ebp - 0x248]
movq qword [0x746400], xmm1
movups xmmword [0x7463f0], xmm0
call fcn.00448860
jmp 0x5d2d3c
mov edi, dword [0x746404]
cmp edi, 0xb
jb 0x5d2c96
cmp edi, 0x10
mov dword [0x746400], 0xb
push 0xb
mov esi, 0x7463f0
cmovae esi, dword [0x7463f0]
push str.err:_ppid0
push esi
call fcn.00660260
add esp, 0xc
mov byte [esi + 0xb], 0
jmp 0x5d2d3c
mov ecx, edi
mov eax, accept
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x5d2cac
mov ecx, accept
jmp 0x5d2cb9
lea eax, [edi + ecx]
mov ecx, 0xf
cmp eax, ecx
cmova ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x478], ecx
push eax
mov ecx, 0x7463f0
call fcn.00448c50
movq xmm0, qword [str.err:_ppid0]
mov esi, eax
mov eax, dword [ebp - 0x478]
mov dword [0x746404], eax
mov dword [0x746400], 0xb
movq qword [esi], xmm0
mov ax, word [0x69d698]
mov word [esi + 8], ax
mov al, byte [0x69d69a]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
cmp edi, 0x10
jb 0x5d2d36
mov ecx, dword [0x7463f0]
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x5d2d2c
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2da1
push edi
push ecx
call fcn.0065d157
add esp, 8
mov dword [0x7463f0], esi
mov eax, 0x7463f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d16a
mov esp, ebp
pop ebp
ret
push 0x74c8b0
call fcn.0065d30a
add esp, 4
cmp dword [0x74c8b0], 0xffffffff
jne 0x5d292d
push 0x692f80
call fcn.0065d73f
push 0x74c8b0
call fcn.0065d2c0
add esp, 8
jmp 0x5d292d
call fcn.00663c8b
call fcn.00448c00
call fcn.00663c8b
call fcn.00663c8b
int3