Function at 0x10008760
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1db4
call fcn.10018ea0
mov eax, dword [0x101469e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1da4], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1dac], edi
test eax, eax
jne 0x100088d2
mov dword [ebp - 0x1dac], eax
lea eax, [ebp - 0x1dac]
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x100087cd
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018e82
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1dac]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1db0], eax
test eax, eax
jle 0x10008e32
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x100088c0
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100088b9
push 0x104
lea eax, [ebp - 0x24c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x100088b9
lea eax, [ebp - 0x24c]
push eax
call fcn.100063f0
push eax
lea eax, [ebp - 0x44]
push 0x10039c48
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10006450
add esp, 0x1c
test al, al
je 0x100088b9
mov eax, dword [ebp + esi*4 - 0x1850]
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x648]
push eax
movups xmmword [ebp - 0x1974], xmm0
lea eax, [ebp - 0x1954]
movups xmm0, xmmword [ebp - 0x34]
push 0x10039c48
push eax
movups xmmword [ebp - 0x1964], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1978]
mov ecx, ebx
push eax
call fcn.10001ea0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1db0]
jl 0x100087f0
jmp 0x10008e32
cmp eax, 1
jne 0x10008ac2
test edi, edi
je 0x10008e32
push edi
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x1db0], esi
cmp esi, 0xffffffff
je 0x10008e32
push 0x424
lea eax, [ebp - 0x1d9c]
push 0
push eax
call fcn.1001bad0
add esp, 0xc
mov dword [ebp - 0x1da0], 0x428
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.1001bad0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b80], cx
je 0x1000897c
lea eax, [ebp - 0x1b80]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x239], al
lea eax, [ebp - 0x1b80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10008960
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008985
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x100089b1
mov al, byte [ebp + edx - 0x238]
cmp al, 0x41
jl 0x100089ac
cmp al, 0x5a
jg 0x100089ac
add al, 0x20
mov byte [ebp + edx - 0x238], al
inc edx
cmp edx, ecx
jle 0x10008994
push 0x1f4
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.1001bad0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d80], cx
je 0x100089fc
lea eax, [ebp - 0x1d80]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x441], al
lea eax, [ebp - 0x1d80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100089e0
lea ecx, [ebp - 0x440]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008a05
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10008a31
mov al, byte [ebp + edx - 0x440]
cmp al, 0x41
jl 0x10008a2c
cmp al, 0x5a
jg 0x10008a2c
add al, 0x20
mov byte [ebp + edx - 0x440], al
inc edx
cmp edx, ecx
jle 0x10008a14
movups xmm0, xmmword [ebp - 0x440]
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x238]
movups xmmword [ebp - 0x1974], xmm0
push eax
movups xmm0, xmmword [ebp - 0x430]
lea eax, [ebp - 0x1954]
push eax
movups xmmword [ebp - 0x1964], xmm0
call fcn.10013200
mov eax, dword [ebx + 4]
add esp, 8
cmp eax, dword [ebx + 8]
jne 0x10008a80
push 1
mov ecx, ebx
call fcn.1000e7a0
mov edi, dword [ebx + 4]
test edi, edi
je 0x10008a9a
mov ecx, 0x4a
lea esi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db0]
add dword [ebx + 4], 0x128
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10008930
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10008e32
cmp eax, 2
jne 0x10008e32
test edi, edi
je 0x100087b8
lea eax, [ebp - 0x1db0]
mov dword [ebp - 0x1db0], 0
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x100087b8
mov eax, dword [ebp - 0x1db0]
xor esi, esi
shr eax, 2
test eax, eax
jle 0x10008bad
mov ebx, eax
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10008b98
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10008b91
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp + esi*4 - 0x1850], eax
jne 0x10008b91
push 0x104
lea eax, [ebp - 0x850]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10008b91
lea eax, [ebp - 0x850]
push eax
call fcn.100063f0
push eax
lea eax, [ebp - 0x44]
push 0x10039c48
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.10006450
add esp, 0x1c
test al, al
jne 0x10008ba1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10008b12
mov ebx, dword [ebp - 0x1da4]
mov edi, dword [ebp - 0x1dac]
lea eax, [ebp - 0x648]
mov dword [0x10a69830], 0
push eax
push 0x10039c4c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10013240
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x24c]
push eax
push str._ls.
push 0x208
push eax
call fcn.10013240
add esp, 0x10
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1db4], esi
cmp esi, 0xffffffff
je 0x10008e32
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10a69830]
cmp eax, 0xc8
jg 0x10008e09
xor ecx, ecx
mov dword [ebp - 0x374], edi
cmp word [ebp - 0x1b9c], cx
je 0x10008c7c
lea eax, [ebp - 0x1b9c]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x1b9c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10008c60
mov edi, 0x10039c65
mov byte [ebp - 0x1da4], 0x25
mov byte [ebp - 0x1da2], 0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da3], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da4]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10013200
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da4], ax
mov byte [ebp - 0x1da2], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001bad0
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1001bad0
lea eax, [ebp - 0x648]
push eax
push 0x10039c4c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10013240
add esp, 0x34
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1b9c]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.10013240
push 0x104
lea eax, [ebp - 0x1954]
push 0
push eax
call fcn.1001bad0
xor ecx, ecx
add esp, 0x20
cmp word [ebp - 0x24c], cx
je 0x10008d7c
lea eax, [ebp - 0x24c]
nop dword [eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x24c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10008d60
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da8], 0x25
mov byte [ebp - 0x1da7], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da8]
mov byte [ebp - 0x1da6], 0
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10013200
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da8], ax
mov byte [ebp - 0x1da6], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001bad0
mov eax, dword [ebx + 4]
add esp, 0x18
cmp eax, dword [ebx + 8]
jne 0x10008de3
push 1
mov ecx, ebx
call fcn.1000e7a0
mov edi, dword [ebx + 4]
test edi, edi
je 0x10008dfd
mov ecx, 0x4a
lea esi, [ebp - 0x374]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db4]
add dword [ebx + 4], 0x128
mov eax, dword [0x10a69830]
inc eax
mov dword [0x10a69830], eax
lea eax, [ebp - 0x1bc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x1dac]
test eax, eax
jne 0x10008c30
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018e82
mov esp, ebp
pop ebp
ret 8