Function at 0x10008fc0
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1db4
call fcn.1001bbd0
mov eax, dword [0x10149be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1da4], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1dac], edi
test eax, eax
jne 0x10009132
mov dword [ebp - 0x1dac], eax
lea eax, [ebp - 0x1dac]
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x1000902d
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1dac]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1db0], eax
test eax, eax
jle 0x10009692
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009120
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009119
push 0x104
lea eax, [ebp - 0x24c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009119
lea eax, [ebp - 0x24c]
push eax
call fcn.10006b40
push eax
lea eax, [ebp - 0x44]
push 0x1003cc28
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10006ba0
add esp, 0x1c
test al, al
je 0x10009119
mov eax, dword [ebp + esi*4 - 0x1850]
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x648]
push eax
movups xmmword [ebp - 0x1974], xmm0
lea eax, [ebp - 0x1954]
movups xmm0, xmmword [ebp - 0x34]
push 0x1003cc28
push eax
movups xmmword [ebp - 0x1964], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1978]
mov ecx, ebx
push eax
call fcn.10001db0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1db0]
jl 0x10009050
jmp 0x10009692
cmp eax, 1
jne 0x10009322
test edi, edi
je 0x10009692
push edi
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x1db0], esi
cmp esi, 0xffffffff
je 0x10009692
push 0x424
lea eax, [ebp - 0x1d9c]
push 0
push eax
call fcn.1001e7e0
add esp, 0xc
mov dword [ebp - 0x1da0], 0x428
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.1001e7e0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b80], cx
je 0x100091dc
lea eax, [ebp - 0x1b80]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x239], al
lea eax, [ebp - 0x1b80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100091c0
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100091e5
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009211
mov al, byte [ebp + edx - 0x238]
cmp al, 0x41
jl 0x1000920c
cmp al, 0x5a
jg 0x1000920c
add al, 0x20
mov byte [ebp + edx - 0x238], al
inc edx
cmp edx, ecx
jle 0x100091f4
push 0x1f4
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.1001e7e0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d80], cx
je 0x1000925c
lea eax, [ebp - 0x1d80]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x441], al
lea eax, [ebp - 0x1d80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009240
lea ecx, [ebp - 0x440]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009265
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009291
mov al, byte [ebp + edx - 0x440]
cmp al, 0x41
jl 0x1000928c
cmp al, 0x5a
jg 0x1000928c
add al, 0x20
mov byte [ebp + edx - 0x440], al
inc edx
cmp edx, ecx
jle 0x10009274
movups xmm0, xmmword [ebp - 0x440]
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x238]
movups xmmword [ebp - 0x1974], xmm0
push eax
movups xmm0, xmmword [ebp - 0x430]
lea eax, [ebp - 0x1954]
push eax
movups xmmword [ebp - 0x1964], xmm0
call fcn.10015f20
mov eax, dword [ebx + 4]
add esp, 8
cmp eax, dword [ebx + 8]
jne 0x100092e0
push 1
mov ecx, ebx
call fcn.10011670
mov edi, dword [ebx + 4]
test edi, edi
je 0x100092fa
mov ecx, 0x4a
lea esi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db0]
add dword [ebx + 4], 0x128
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10009190
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10009692
cmp eax, 2
jne 0x10009692
test edi, edi
je 0x10009018
lea eax, [ebp - 0x1db0]
mov dword [ebp - 0x1db0], 0
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10009018
mov eax, dword [ebp - 0x1db0]
xor esi, esi
shr eax, 2
test eax, eax
jle 0x1000940d
mov ebx, eax
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x100093f8
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100093f1
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp + esi*4 - 0x1850], eax
jne 0x100093f1
push 0x104
lea eax, [ebp - 0x850]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x100093f1
lea eax, [ebp - 0x850]
push eax
call fcn.10006b40
push eax
lea eax, [ebp - 0x44]
push 0x1003cc28
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.10006ba0
add esp, 0x1c
test al, al
jne 0x10009401
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x10009372
mov ebx, dword [ebp - 0x1da4]
mov edi, dword [ebp - 0x1dac]
lea eax, [ebp - 0x648]
mov dword [0x10a6c7b8], 0
push eax
push 0x1003cc2c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10015f60
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x24c]
push eax
push str._ls.
push 0x208
push eax
call fcn.10015f60
add esp, 0x10
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1db4], esi
cmp esi, 0xffffffff
je 0x10009692
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10a6c7b8]
cmp eax, 0xc8
jg 0x10009669
xor ecx, ecx
mov dword [ebp - 0x374], edi
cmp word [ebp - 0x1b9c], cx
je 0x100094dc
lea eax, [ebp - 0x1b9c]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x1b9c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100094c0
mov edi, 0x1003cc45
mov byte [ebp - 0x1da4], 0x25
mov byte [ebp - 0x1da2], 0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da3], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da4]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10015f20
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da4], ax
mov byte [ebp - 0x1da2], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001e7e0
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1001e7e0
lea eax, [ebp - 0x648]
push eax
push 0x1003cc2c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10015f60
add esp, 0x34
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1b9c]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.10015f60
push 0x104
lea eax, [ebp - 0x1954]
push 0
push eax
call fcn.1001e7e0
xor ecx, ecx
add esp, 0x20
cmp word [ebp - 0x24c], cx
je 0x100095dc
lea eax, [ebp - 0x24c]
nop dword [eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x24c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100095c0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da8], 0x25
mov byte [ebp - 0x1da7], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da8]
mov byte [ebp - 0x1da6], 0
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10015f20
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da8], ax
mov byte [ebp - 0x1da6], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001e7e0
mov eax, dword [ebx + 4]
add esp, 0x18
cmp eax, dword [ebx + 8]
jne 0x10009643
push 1
mov ecx, ebx
call fcn.10011670
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000965d
mov ecx, 0x4a
lea esi, [ebp - 0x374]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db4]
add dword [ebx + 4], 0x128
mov eax, dword [0x10a6c7b8]
inc eax
mov dword [0x10a6c7b8], eax
lea eax, [ebp - 0x1bc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x1dac]
test eax, eax
jne 0x10009490
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001bbbf
mov esp, ebp
pop ebp
ret 8