Function at 0x10005530
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1dbc
call fcn.10027d40
mov eax, dword [0x1003a470]
xor eax, esp
mov dword [esp + 0x1db8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, edi
jne 0x1000568e
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x578]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x1000559b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1db8]
xor ecx, esp
call fcn.100164f9
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
shr esi, 2
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp esi, edi
jle 0x10005c1f
mov eax, dword [esp + ecx*4 + 0x570]
lea edi, [esp + ecx*4 + 0x570]
test eax, eax
je 0x1000567c
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10005671
push 0x104
lea edx, [esp + 0x15b4]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005671
lea esi, [esp + 0x15b0]
call fcn.10004310
push eax
lea eax, [esp + 0x1574]
push 0x10035724
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x19bc]
push ecx
mov ecx, esi
call fcn.100040c0
add esp, 0x10
test al, al
je 0x1000566d
mov edx, dword [edi]
lea eax, [esp + 0x19b0]
push eax
mov dword [esp + 0x24], edx
mov ecx, 8
lea esi, [esp + 0x1574]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push 0x10035724
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call fcn.100131c0
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jl 0x100055b4
jmp 0x10005c1f
cmp eax, 1
jne 0x100058ed
cmp ecx, edi
je 0x10005c1f
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x10005c1f
push 0x424
lea eax, [esp + 0x150]
push 0
push eax
call fcn.1001b890
add esp, 0xc
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [esp + 0x150], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x100056f0
push 0x1f4
lea edx, [esp + 0x15b4]
push 0
push edx
call fcn.1001b890
xor eax, eax
add esp, 0xc
cmp word [esp + 0x368], ax
je 0x1000573c
lea ecx, [esp + 0x368]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x15b0], cl
inc eax
cmp word [esp + eax*2 + 0x368], 0
lea ecx, [esp + eax*2 + 0x368]
jne 0x10005720
lea eax, [esp + 0x15b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005746
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005772
mov al, byte [esp + ecx + 0x15b0]
cmp al, 0x41
jl 0x1000576d
cmp al, 0x5a
jg 0x1000576d
add al, 0x20
mov byte [esp + ecx + 0x15b0], al
inc ecx
cmp ecx, edx
jle 0x10005755
push 0x1f4
lea edx, [esp + 0x17bc]
push 0
push edx
call fcn.1001b890
xor eax, eax
add esp, 0xc
cmp word [esp + 0x168], ax
je 0x100057bc
lea ecx, [esp + 0x168]
lea esp, [esp]
mov cl, byte [ecx]
mov byte [esp + eax + 0x17b8], cl
inc eax
cmp word [esp + eax*2 + 0x168], 0
lea ecx, [esp + eax*2 + 0x168]
jne 0x100057a0
lea eax, [esp + 0x17b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100057c6
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x100057f2
mov al, byte [esp + ecx + 0x17b8]
cmp al, 0x41
jl 0x100057ed
cmp al, 0x5a
jg 0x100057ed
add al, 0x20
mov byte [esp + ecx + 0x17b8], al
inc ecx
cmp ecx, edx
jle 0x100057d5
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], edx
mov ecx, 8
lea esi, [esp + 0x17b8]
lea edi, [esp + 0x24]
lea eax, [esp + 0x15b0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.10016709
mov edi, dword [0x1014134c]
add esp, 8
cmp dword [0x10141348], edi
jne 0x100058a1
mov ecx, dword [0x10141348]
mov ebx, dword [0x10141344]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 0xdd67c7
ja 0x100058e3
sub edi, ebx
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jbe 0x1000589d
mov ecx, eax
shr ecx, 1
mov edx, 0xdd67c8
sub edx, ecx
cmp edx, eax
jae 0x1000588e
xor eax, eax
jmp 0x10005890
add eax, ecx
cmp eax, esi
jae 0x10005896
mov eax, esi
mov ecx, eax
call fcn.100141b0
mov ebx, dword [esp + 0x10]
mov edi, dword [0x10141348]
test edi, edi
je 0x100058b6
mov ecx, 0x4a
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
add dword [0x10141348], 0x128
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x100056f0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10005c1f
push str.vector_T__too_long
call fcn.10015f59
cmp eax, 2
jne 0x10005c1f
cmp ecx, edi
je 0x10005582
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x578]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10005582
mov esi, dword [esp + 0x10]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0xc], esi
test esi, esi
jle 0x100059ce
jmp 0x10005940
mov eax, dword [esp + ebx*4 + 0x570]
test eax, eax
je 0x100059c5
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100059be
mov eax, dword [esp + 0x18]
cmp dword [esp + ebx*4 + 0x570], eax
jne 0x100059be
push 0x104
lea ecx, [esp + 0x1bbc]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100059be
lea esi, [esp + 0x1bb8]
call fcn.10004310
push eax
lea edx, [esp + 0x1574]
push 0x10035724
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x19bc]
push eax
mov ecx, esi
call fcn.100040c0
add esp, 0x10
test al, al
jne 0x100059ce
mov esi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x10005940
lea ecx, [esp + 0x19b0]
push ecx
lea edx, [esp + 0x15b4]
push 0x10035728
push edx
mov edx, 0x208
mov dword [0x1014167c], 0
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x15b0]
push ecx
mov edx, ecx
push str._ls.
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x15b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x10005c1f
mov bl, 0x73
cmp dword [0x1014167c], 0xc8
jg 0x10005bfb
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x17b8], edx
cmp word [esp + 0x174], ax
je 0x10005a99
lea ecx, [esp + 0x174]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x20], cl
inc eax
cmp word [esp + eax*2 + 0x174], 0
lea ecx, [esp + eax*2 + 0x174]
jne 0x10005a80
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x17c4]
push ecx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0
call fcn.10016709
xor eax, eax
push 0x104
push eax
lea edx, [esp + 0x34]
push edx
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], al
call fcn.1001b890
push 0x208
lea eax, [esp + 0x15cc]
push 0
push eax
call fcn.1001b890
lea ecx, [esp + 0x19d4]
push ecx
lea edx, [esp + 0x15d8]
push 0x10035728
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0x30
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x15b4]
push edx
mov eax, edx
push str._ls_ls
push eax
mov edx, 0x208
call fcn.10001000
push 0x104
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.1001b890
xor eax, eax
add esp, 0x1c
cmp word [esp + 0x15b0], ax
je 0x10005b7f
lea ecx, [esp + 0x15b0]
mov dl, byte [ecx]
mov byte [esp + eax + 0x20], dl
inc eax
cmp word [esp + eax*2 + 0x15b0], 0
lea ecx, [esp + eax*2 + 0x15b0]
jne 0x10005b66
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x17e4]
push edx
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0
call fcn.10016709
xor eax, eax
push 0x104
push eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
lea eax, [esp + 0x34]
push eax
call fcn.1001b890
mov ecx, dword [0x10141348]
add esp, 0x18
cmp ecx, dword [0x1014134c]
jne 0x10005bd5
call fcn.10013e60
mov edi, dword [0x10141348]
test edi, edi
je 0x10005bf1
mov ecx, 0x4a
lea esi, [esp + 0x17b8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
add dword [0x10141348], 0x128
inc dword [0x1014167c]
lea edx, [esp + 0x148]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005a4c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1dc4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.100164f9
mov esp, ebp
pop ebp
ret 4