Function at 0x5d7d00
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6936cc
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x754b3c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7548c8]
cmp eax, dword [ecx + 4]
jg 0x5d817c
cmp dword [0x74e400], 0
jne 0x5d815c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov esi, eax
lea eax, [ebp - 0x470]
push 0
push eax
call fcn.00667150
add esp, 0xc
mov dword [ebp - 0x474], 0x22c
xor eax, eax
mov dword [ebp - 0x478], eax
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5d7dd0
cmp dword [ebp - 0x46c], esi
jne 0x5d7db7
mov eax, dword [ebp - 0x45c]
cmp eax, esi
jne 0x5d7dca
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5d7da5
jmp 0x5d7dd0
mov dword [ebp - 0x478], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x478]
test eax, eax
je 0x5d8079
push eax
xor esi, esi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x5d7e21
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x5d7e18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5d7e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x5d7fbe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.005c3530
mov esi, eax
add esp, 8
cmp esi, 0x74e3f0
je 0x5d7ece
mov edx, dword [0x74e404]
cmp edx, 0x10
jb 0x5d7e8b
mov ecx, dword [0x74e3f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d7e81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d81b2
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov dword [0x74e400], 0
mov dword [0x74e404], 0xf
mov byte [0x74e3f0], 0
movups xmm0, xmmword [esi]
movups xmmword [0x74e3f0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x74e400], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x230]
call fcn.00448860
push 0xffffffffffffffff
push 0x7182c8
mov ecx, 0x74e3f0
call fcn.005d2b80
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x5d7f0c
push eax
push 0x716504
mov ecx, 0x74e3f0
call fcn.005d2b80
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5d815c
mov edx, dword [0x74e400]
inc ecx
sub edx, ecx
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
cmp dword [0x74e400], ecx
jb 0x5d81b7
cmp dword [0x74e404], 0x10
mov eax, 0x74e3f0
push edx
cmovae eax, dword [0x74e3f0]
add eax, ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.004484a0
mov edx, dword [0x74e404]
cmp edx, 0x10
jb 0x5d7f9b
mov ecx, dword [0x74e3f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d7f91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d81c1
push edx
push ecx
call fcn.00663ac7
add esp, 8
movups xmm0, xmmword [ebp - 0x230]
movups xmmword [0x74e3f0], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [0x74e400], xmm0
jmp 0x5d815c
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.005b5810
add esp, 0xc
push 5
push str.err:
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005a5ba0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [0x74e404]
movq qword [ebp - 0x47c], xmm1
movups xmmword [ebp - 0x228], xmm0
cmp edx, 0x10
jb 0x5d805a
mov ecx, dword [0x74e3f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d8041
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d81bc
push edx
push ecx
call fcn.00663ac7
movups xmm0, xmmword [ebp - 0x228]
add esp, 8
movq xmm1, qword [ebp - 0x47c]
lea ecx, [ebp - 0x248]
movq qword [0x74e400], xmm1
movups xmmword [0x74e3f0], xmm0
call fcn.00448860
jmp 0x5d815c
mov edi, dword [0x74e404]
cmp edi, 0xb
jb 0x5d80b6
cmp edi, 0x10
mov dword [0x74e400], 0xb
push 0xb
mov esi, 0x74e3f0
cmovae esi, dword [0x74e3f0]
push str.err:_ppid0
push esi
call fcn.00666bd0
add esp, 0xc
mov byte [esi + 0xb], 0
jmp 0x5d815c
mov ecx, edi
mov eax, accept
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x5d80cc
mov ecx, accept
jmp 0x5d80d9
lea eax, [edi + ecx]
mov ecx, 0xf
cmp eax, ecx
cmova ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x478], ecx
push eax
mov ecx, 0x74e3f0
call fcn.00448c50
movq xmm0, qword [str.err:_ppid0]
mov esi, eax
mov eax, dword [ebp - 0x478]
mov dword [0x74e404], eax
mov dword [0x74e400], 0xb
movq qword [esi], xmm0
mov ax, word [0x6a53fc]
mov word [esi + 8], ax
mov al, byte [0x6a53fe]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
cmp edi, 0x10
jb 0x5d8156
mov ecx, dword [0x74e3f0]
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x5d814c
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d81c1
push edi
push ecx
call fcn.00663ac7
add esp, 8
mov dword [0x74e3f0], esi
mov eax, 0x74e3f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
push 0x7548c8
call fcn.00663c7a
add esp, 4
cmp dword [0x7548c8], 0xffffffff
jne 0x5d7d4d
push 0x69a340
call fcn.006640af
push 0x7548c8
call fcn.00663c30
add esp, 8
jmp 0x5d7d4d
call fcn.0066a5fb
call fcn.00448c00
call fcn.0066a5fb
call fcn.0066a5fb
int3