Function at 0x10005d60
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1dbc
call fcn.10034850
mov eax, dword [0x10049650]
xor eax, esp
mov dword [esp + 0x1db8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, edi
jne 0x10005ebe
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x578]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10005dcb
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1db8]
xor ecx, esp
call fcn.1002121a
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
shr esi, 2
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp esi, edi
jle 0x1000644f
mov eax, dword [esp + ecx*4 + 0x570]
lea edi, [esp + ecx*4 + 0x570]
test eax, eax
je 0x10005eac
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10005ea1
push 0x104
lea edx, [esp + 0x15b4]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005ea1
lea esi, [esp + 0x15b0]
call fcn.100049f0
push eax
lea eax, [esp + 0x1574]
push 0x10042a2c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x19bc]
push ecx
mov ecx, esi
call fcn.100047a0
add esp, 0x10
test al, al
je 0x10005e9d
mov edx, dword [edi]
lea eax, [esp + 0x19b0]
push eax
mov dword [esp + 0x24], edx
mov ecx, 8
lea esi, [esp + 0x1574]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push 0x10042a2c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call fcn.1001c450
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jl 0x10005de4
jmp 0x1000644f
cmp eax, 1
jne 0x1000611d
cmp ecx, edi
je 0x1000644f
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x1000644f
push 0x424
lea eax, [esp + 0x150]
push 0
push eax
call fcn.10024b90
add esp, 0xc
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [esp + 0x150], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x10005f20
push 0x1f4
lea edx, [esp + 0x15b4]
push 0
push edx
call fcn.10024b90
xor eax, eax
add esp, 0xc
cmp word [esp + 0x368], ax
je 0x10005f6c
lea ecx, [esp + 0x368]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x15b0], cl
inc eax
cmp word [esp + eax*2 + 0x368], 0
lea ecx, [esp + eax*2 + 0x368]
jne 0x10005f50
lea eax, [esp + 0x15b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005f76
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005fa2
mov al, byte [esp + ecx + 0x15b0]
cmp al, 0x41
jl 0x10005f9d
cmp al, 0x5a
jg 0x10005f9d
add al, 0x20
mov byte [esp + ecx + 0x15b0], al
inc ecx
cmp ecx, edx
jle 0x10005f85
push 0x1f4
lea edx, [esp + 0x17bc]
push 0
push edx
call fcn.10024b90
xor eax, eax
add esp, 0xc
cmp word [esp + 0x168], ax
je 0x10005fec
lea ecx, [esp + 0x168]
lea esp, [esp]
mov cl, byte [ecx]
mov byte [esp + eax + 0x17b8], cl
inc eax
cmp word [esp + eax*2 + 0x168], 0
lea ecx, [esp + eax*2 + 0x168]
jne 0x10005fd0
lea eax, [esp + 0x17b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005ff6
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10006022
mov al, byte [esp + ecx + 0x17b8]
cmp al, 0x41
jl 0x1000601d
cmp al, 0x5a
jg 0x1000601d
add al, 0x20
mov byte [esp + ecx + 0x17b8], al
inc ecx
cmp ecx, edx
jle 0x10006005
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], edx
mov ecx, 8
lea esi, [esp + 0x17b8]
lea edi, [esp + 0x24]
lea eax, [esp + 0x15b0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.1002145d
mov edi, dword [0x10acecb4]
add esp, 8
cmp dword [0x10acecb0], edi
jne 0x100060d1
mov ecx, dword [0x10acecb0]
mov ebx, dword [0x10acecac]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 0xdd67c7
ja 0x10006113
sub edi, ebx
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jbe 0x100060cd
mov ecx, eax
shr ecx, 1
mov edx, 0xdd67c8
sub edx, ecx
cmp edx, eax
jae 0x100060be
xor eax, eax
jmp 0x100060c0
add eax, ecx
cmp eax, esi
jae 0x100060c6
mov eax, esi
mov ecx, eax
call fcn.1001e510
mov ebx, dword [esp + 0x10]
mov edi, dword [0x10acecb0]
test edi, edi
je 0x100060e6
mov ecx, 0x4a
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
add dword [0x10acecb0], 0x128
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x10005f20
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000644f
push str.vector_T__too_long
call fcn.1002072e
cmp eax, 2
jne 0x1000644f
cmp ecx, edi
je 0x10005db2
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x578]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10005db2
mov esi, dword [esp + 0x10]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0xc], esi
test esi, esi
jle 0x100061fe
jmp 0x10006170
mov eax, dword [esp + ebx*4 + 0x570]
test eax, eax
je 0x100061f5
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100061ee
mov eax, dword [esp + 0x18]
cmp dword [esp + ebx*4 + 0x570], eax
jne 0x100061ee
push 0x104
lea ecx, [esp + 0x1bbc]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100061ee
lea esi, [esp + 0x1bb8]
call fcn.100049f0
push eax
lea edx, [esp + 0x1574]
push 0x10042a2c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x19bc]
push eax
mov ecx, esi
call fcn.100047a0
add esp, 0x10
test al, al
jne 0x100061fe
mov esi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x10006170
lea ecx, [esp + 0x19b0]
push ecx
lea edx, [esp + 0x15b4]
push 0x10042a30
push edx
mov edx, 0x208
mov dword [0x10acf000], 0
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x15b0]
push ecx
mov edx, ecx
push str._ls.
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x15b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x1000644f
mov bl, 0x73
cmp dword [0x10acf000], 0xc8
jg 0x1000642b
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x17b8], edx
cmp word [esp + 0x174], ax
je 0x100062c9
lea ecx, [esp + 0x174]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x20], cl
inc eax
cmp word [esp + eax*2 + 0x174], 0
lea ecx, [esp + eax*2 + 0x174]
jne 0x100062b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x17c4]
push ecx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0
call fcn.1002145d
xor eax, eax
push 0x104
push eax
lea edx, [esp + 0x34]
push edx
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], al
call fcn.10024b90
push 0x208
lea eax, [esp + 0x15cc]
push 0
push eax
call fcn.10024b90
lea ecx, [esp + 0x19d4]
push ecx
lea edx, [esp + 0x15d8]
push 0x10042a30
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0x30
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x15b4]
push edx
mov eax, edx
push str._ls_ls
push eax
mov edx, 0x208
call fcn.10001000
push 0x104
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.10024b90
xor eax, eax
add esp, 0x1c
cmp word [esp + 0x15b0], ax
je 0x100063af
lea ecx, [esp + 0x15b0]
mov dl, byte [ecx]
mov byte [esp + eax + 0x20], dl
inc eax
cmp word [esp + eax*2 + 0x15b0], 0
lea ecx, [esp + eax*2 + 0x15b0]
jne 0x10006396
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x17e4]
push edx
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0
call fcn.1002145d
xor eax, eax
push 0x104
push eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
lea eax, [esp + 0x34]
push eax
call fcn.10024b90
mov ecx, dword [0x10acecb0]
add esp, 0x18
cmp ecx, dword [0x10acecb4]
jne 0x10006405
call fcn.1001d820
mov edi, dword [0x10acecb0]
test edi, edi
je 0x10006421
mov ecx, 0x4a
lea esi, [esp + 0x17b8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
add dword [0x10acecb0], 0x128
inc dword [0x10acf000]
lea edx, [esp + 0x148]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000627c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1dc4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1002121a
mov esp, ebp
pop ebp
ret 4