Function at 0x10009940
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1db4
call fcn.10018c20
mov eax, dword [0x101469e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1da4], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1dac], edi
test eax, eax
jne 0x10009ab2
mov dword [ebp - 0x1dac], eax
lea eax, [ebp - 0x1dac]
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x100099ad
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018c0f
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1dac]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1db0], eax
test eax, eax
jle 0x1000a012
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009aa0
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009a99
push 0x104
lea eax, [ebp - 0x24c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009a99
lea eax, [ebp - 0x24c]
push eax
call fcn.10007390
push eax
lea eax, [ebp - 0x44]
push 0x10039c5c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.100073f0
add esp, 0x1c
test al, al
je 0x10009a99
mov eax, dword [ebp + esi*4 - 0x1850]
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x648]
push eax
movups xmmword [ebp - 0x1974], xmm0
lea eax, [ebp - 0x1954]
movups xmm0, xmmword [ebp - 0x34]
push 0x10039c5c
push eax
movups xmmword [ebp - 0x1964], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1978]
mov ecx, ebx
push eax
call fcn.10002190
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1db0]
jl 0x100099d0
jmp 0x1000a012
cmp eax, 1
jne 0x10009ca2
test edi, edi
je 0x1000a012
push edi
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x1db0], esi
cmp esi, 0xffffffff
je 0x1000a012
push 0x424
lea eax, [ebp - 0x1d9c]
push 0
push eax
call fcn.1001ba80
add esp, 0xc
mov dword [ebp - 0x1da0], 0x428
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.1001ba80
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b80], cx
je 0x10009b5c
lea eax, [ebp - 0x1b80]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x239], al
lea eax, [ebp - 0x1b80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009b40
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009b65
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009b91
mov al, byte [ebp + edx - 0x238]
cmp al, 0x41
jl 0x10009b8c
cmp al, 0x5a
jg 0x10009b8c
add al, 0x20
mov byte [ebp + edx - 0x238], al
inc edx
cmp edx, ecx
jle 0x10009b74
push 0x1f4
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.1001ba80
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d80], cx
je 0x10009bdc
lea eax, [ebp - 0x1d80]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x441], al
lea eax, [ebp - 0x1d80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009bc0
lea ecx, [ebp - 0x440]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009be5
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009c11
mov al, byte [ebp + edx - 0x440]
cmp al, 0x41
jl 0x10009c0c
cmp al, 0x5a
jg 0x10009c0c
add al, 0x20
mov byte [ebp + edx - 0x440], al
inc edx
cmp edx, ecx
jle 0x10009bf4
movups xmm0, xmmword [ebp - 0x440]
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x238]
movups xmmword [ebp - 0x1974], xmm0
push eax
movups xmm0, xmmword [ebp - 0x430]
lea eax, [ebp - 0x1954]
push eax
movups xmmword [ebp - 0x1964], xmm0
call fcn.10014470
mov eax, dword [ebx + 4]
add esp, 8
cmp eax, dword [ebx + 8]
jne 0x10009c60
push 1
mov ecx, ebx
call fcn.1000fe00
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009c7a
mov ecx, 0x4a
lea esi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db0]
add dword [ebx + 4], 0x128
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10009b10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000a012
cmp eax, 2
jne 0x1000a012
test edi, edi
je 0x10009998
lea eax, [ebp - 0x1db0]
mov dword [ebp - 0x1db0], 0
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10009998
mov eax, dword [ebp - 0x1db0]
xor esi, esi
shr eax, 2
test eax, eax
jle 0x10009d8d
mov ebx, eax
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009d78
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009d71
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp + esi*4 - 0x1850], eax
jne 0x10009d71
push 0x104
lea eax, [ebp - 0x850]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009d71
lea eax, [ebp - 0x850]
push eax
call fcn.10007390
push eax
lea eax, [ebp - 0x44]
push 0x10039c5c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.100073f0
add esp, 0x1c
test al, al
jne 0x10009d81
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10009cf2
mov ebx, dword [ebp - 0x1da4]
mov edi, dword [ebp - 0x1dac]
lea eax, [ebp - 0x648]
mov dword [0x10a69820], 0
push eax
push 0x10039c60
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.100144b0
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x24c]
push eax
push str._ls.
push 0x208
push eax
call fcn.100144b0
add esp, 0x10
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1db4], esi
cmp esi, 0xffffffff
je 0x1000a012
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10a69820]
cmp eax, 0xc8
jg 0x10009fe9
xor ecx, ecx
mov dword [ebp - 0x374], edi
cmp word [ebp - 0x1b9c], cx
je 0x10009e5c
lea eax, [ebp - 0x1b9c]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x1b9c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009e40
mov edi, 0x10039c79
mov byte [ebp - 0x1da4], 0x25
mov byte [ebp - 0x1da2], 0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da3], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da4]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10014470
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da4], ax
mov byte [ebp - 0x1da2], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001ba80
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1001ba80
lea eax, [ebp - 0x648]
push eax
push 0x10039c60
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.100144b0
add esp, 0x34
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1b9c]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.100144b0
push 0x104
lea eax, [ebp - 0x1954]
push 0
push eax
call fcn.1001ba80
xor ecx, ecx
add esp, 0x20
cmp word [ebp - 0x24c], cx
je 0x10009f5c
lea eax, [ebp - 0x24c]
nop dword [eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x24c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009f40
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da8], 0x25
mov byte [ebp - 0x1da7], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da8]
mov byte [ebp - 0x1da6], 0
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10014470
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da8], ax
mov byte [ebp - 0x1da6], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001ba80
mov eax, dword [ebx + 4]
add esp, 0x18
cmp eax, dword [ebx + 8]
jne 0x10009fc3
push 1
mov ecx, ebx
call fcn.1000fe00
mov edi, dword [ebx + 4]
test edi, edi
je 0x10009fdd
mov ecx, 0x4a
lea esi, [ebp - 0x374]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db4]
add dword [ebx + 4], 0x128
mov eax, dword [0x10a69820]
inc eax
mov dword [0x10a69820], eax
lea eax, [ebp - 0x1bc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x1dac]
test eax, eax
jne 0x10009e10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018c0f
mov esp, ebp
pop ebp
ret 8