Function at 0x10005600
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1dbc
call fcn.10033670
mov eax, dword [0x10047650]
xor eax, esp
mov dword [esp + 0x1db8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, edi
jne 0x1000575e
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x578]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x1000566b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1db8]
xor ecx, esp
call fcn.1002005a
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
shr esi, 2
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp esi, edi
jle 0x10005cef
mov eax, dword [esp + ecx*4 + 0x570]
lea edi, [esp + ecx*4 + 0x570]
test eax, eax
je 0x1000574c
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10005741
push 0x104
lea edx, [esp + 0x15b4]
push edx
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005741
lea esi, [esp + 0x15b0]
call fcn.10004290
push eax
lea eax, [esp + 0x1574]
push 0x100409fc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x19bc]
push ecx
mov ecx, esi
call fcn.10004040
add esp, 0x10
test al, al
je 0x1000573d
mov edx, dword [edi]
lea eax, [esp + 0x19b0]
push eax
mov dword [esp + 0x24], edx
mov ecx, 8
lea esi, [esp + 0x1574]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push 0x100409fc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call fcn.1001b0e0
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jl 0x10005684
jmp 0x10005cef
cmp eax, 1
jne 0x100059bd
cmp ecx, edi
je 0x10005cef
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x10005cef
push 0x424
lea eax, [esp + 0x150]
push 0
push eax
call fcn.100239d0
add esp, 0xc
lea ecx, [esp + 0x148]
push ecx
push ebx
mov dword [esp + 0x150], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x100057c0
push 0x1f4
lea edx, [esp + 0x15b4]
push 0
push edx
call fcn.100239d0
xor eax, eax
add esp, 0xc
cmp word [esp + 0x368], ax
je 0x1000580c
lea ecx, [esp + 0x368]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x15b0], cl
inc eax
cmp word [esp + eax*2 + 0x368], 0
lea ecx, [esp + eax*2 + 0x368]
jne 0x100057f0
lea eax, [esp + 0x15b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005816
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x10005842
mov al, byte [esp + ecx + 0x15b0]
cmp al, 0x41
jl 0x1000583d
cmp al, 0x5a
jg 0x1000583d
add al, 0x20
mov byte [esp + ecx + 0x15b0], al
inc ecx
cmp ecx, edx
jle 0x10005825
push 0x1f4
lea edx, [esp + 0x17bc]
push 0
push edx
call fcn.100239d0
xor eax, eax
add esp, 0xc
cmp word [esp + 0x168], ax
je 0x1000588c
lea ecx, [esp + 0x168]
lea esp, [esp]
mov cl, byte [ecx]
mov byte [esp + eax + 0x17b8], cl
inc eax
cmp word [esp + eax*2 + 0x168], 0
lea ecx, [esp + eax*2 + 0x168]
jne 0x10005870
lea eax, [esp + 0x17b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005896
xor ecx, ecx
sub eax, edx
mov edx, eax
js 0x100058c2
mov al, byte [esp + ecx + 0x17b8]
cmp al, 0x41
jl 0x100058bd
cmp al, 0x5a
jg 0x100058bd
add al, 0x20
mov byte [esp + ecx + 0x17b8], al
inc ecx
cmp ecx, edx
jle 0x100058a5
mov edx, dword [esp + 0x150]
mov dword [esp + 0x20], edx
mov ecx, 8
lea esi, [esp + 0x17b8]
lea edi, [esp + 0x24]
lea eax, [esp + 0x15b0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.1002029d
mov edi, dword [0x101aba0c]
add esp, 8
cmp dword [0x101aba08], edi
jne 0x10005971
mov ecx, dword [0x101aba08]
mov ebx, dword [0x101aba04]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 0xdd67c7
ja 0x100059b3
sub edi, ebx
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jbe 0x1000596d
mov ecx, eax
shr ecx, 1
mov edx, 0xdd67c8
sub edx, ecx
cmp edx, eax
jae 0x1000595e
xor eax, eax
jmp 0x10005960
add eax, ecx
cmp eax, esi
jae 0x10005966
mov eax, esi
mov ecx, eax
call fcn.1001d2f0
mov ebx, dword [esp + 0x10]
mov edi, dword [0x101aba08]
test edi, edi
je 0x10005986
mov ecx, 0x4a
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
add dword [0x101aba08], 0x128
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x100057c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10005cef
push str.vector_T__too_long
call fcn.1001f56e
cmp eax, 2
jne 0x10005cef
cmp ecx, edi
je 0x10005652
lea ecx, [esp + 0x10]
push ecx
push 0x1000
lea edx, [esp + 0x578]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10005652
mov esi, dword [esp + 0x10]
shr esi, 2
xor ebx, ebx
mov dword [esp + 0xc], esi
test esi, esi
jle 0x10005a9e
jmp 0x10005a10
mov eax, dword [esp + ebx*4 + 0x570]
test eax, eax
je 0x10005a95
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10005a8e
mov eax, dword [esp + 0x18]
cmp dword [esp + ebx*4 + 0x570], eax
jne 0x10005a8e
push 0x104
lea ecx, [esp + 0x1bbc]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10005a8e
lea esi, [esp + 0x1bb8]
call fcn.10004290
push eax
lea edx, [esp + 0x1574]
push 0x100409fc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x19bc]
push eax
mov ecx, esi
call fcn.10004040
add esp, 0x10
test al, al
jne 0x10005a9e
mov esi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x10005a10
lea ecx, [esp + 0x19b0]
push ecx
lea edx, [esp + 0x15b4]
push 0x10040a00
push edx
mov edx, 0x208
mov dword [0x101abd5c], 0
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x15b0]
push ecx
mov edx, ecx
push str._ls.
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x15b4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x10005cef
mov bl, 0x73
cmp dword [0x101abd5c], 0xc8
jg 0x10005ccb
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x17b8], edx
cmp word [esp + 0x174], ax
je 0x10005b69
lea ecx, [esp + 0x174]
lea ebx, [ebx]
mov cl, byte [ecx]
mov byte [esp + eax + 0x20], cl
inc eax
cmp word [esp + eax*2 + 0x174], 0
lea ecx, [esp + eax*2 + 0x174]
jne 0x10005b50
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x17c4]
push ecx
mov byte [esp + 0x20], 0x25
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0
call fcn.1002029d
xor eax, eax
push 0x104
push eax
lea edx, [esp + 0x34]
push edx
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], al
call fcn.100239d0
push 0x208
lea eax, [esp + 0x15cc]
push 0
push eax
call fcn.100239d0
lea ecx, [esp + 0x19d4]
push ecx
lea edx, [esp + 0x15d8]
push 0x10040a00
push edx
mov edx, 0x208
call fcn.10001000
add esp, 0x30
lea eax, [esp + 0x15b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x174]
push ecx
lea edx, [esp + 0x15b4]
push edx
mov eax, edx
push str._ls_ls
push eax
mov edx, 0x208
call fcn.10001000
push 0x104
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.100239d0
xor eax, eax
add esp, 0x1c
cmp word [esp + 0x15b0], ax
je 0x10005c4f
lea ecx, [esp + 0x15b0]
mov dl, byte [ecx]
mov byte [esp + eax + 0x20], dl
inc eax
cmp word [esp + eax*2 + 0x15b0], 0
lea ecx, [esp + eax*2 + 0x15b0]
jne 0x10005c36
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x17e4]
push edx
mov byte [esp + 0x18], 0x25
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0
call fcn.1002029d
xor eax, eax
push 0x104
push eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
lea eax, [esp + 0x34]
push eax
call fcn.100239d0
mov ecx, dword [0x101aba08]
add esp, 0x18
cmp ecx, dword [0x101aba0c]
jne 0x10005ca5
call fcn.1001c600
mov edi, dword [0x101aba08]
test edi, edi
je 0x10005cc1
mov ecx, 0x4a
lea esi, [esp + 0x17b8]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
add dword [0x101aba08], 0x128
inc dword [0x101abd5c]
lea edx, [esp + 0x148]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005b1c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1dc4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1002005a
mov esp, ebp
pop ebp
ret 4