Function at 0x10008ef0
Capabilities:
Enumerate files on windows
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1db4
call fcn.1001bac0
mov eax, dword [0x10148be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x1da4], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1dac], edi
test eax, eax
jne 0x10009062
mov dword [ebp - 0x1dac], eax
lea eax, [ebp - 0x1dac]
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x10008f5d
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001baaf
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1dac]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1db0], eax
test eax, eax
jle 0x100095c2
nop word [eax + eax]
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009050
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009049
push 0x104
lea eax, [ebp - 0x24c]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009049
lea eax, [ebp - 0x24c]
push eax
call fcn.10006a70
push eax
lea eax, [ebp - 0x44]
push 0x1003bc28
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10006ad0
add esp, 0x1c
test al, al
je 0x10009049
mov eax, dword [ebp + esi*4 - 0x1850]
movups xmm0, xmmword [ebp - 0x44]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x648]
push eax
movups xmmword [ebp - 0x1974], xmm0
lea eax, [ebp - 0x1954]
movups xmm0, xmmword [ebp - 0x34]
push 0x1003bc28
push eax
movups xmmword [ebp - 0x1964], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1978]
mov ecx, ebx
push eax
call fcn.10001db0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x1db0]
jl 0x10008f80
jmp 0x100095c2
cmp eax, 1
jne 0x10009252
test edi, edi
je 0x100095c2
push edi
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x1db0], esi
cmp esi, 0xffffffff
je 0x100095c2
push 0x424
lea eax, [ebp - 0x1d9c]
push 0
push eax
call fcn.1001e6d0
add esp, 0xc
mov dword [ebp - 0x1da0], 0x428
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
nop dword [eax]
push 0x1f4
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.1001e6d0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1b80], cx
je 0x1000910c
lea eax, [ebp - 0x1b80]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x239], al
lea eax, [ebp - 0x1b80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100090f0
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009115
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x10009141
mov al, byte [ebp + edx - 0x238]
cmp al, 0x41
jl 0x1000913c
cmp al, 0x5a
jg 0x1000913c
add al, 0x20
mov byte [ebp + edx - 0x238], al
inc edx
cmp edx, ecx
jle 0x10009124
push 0x1f4
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.1001e6d0
xor ecx, ecx
add esp, 0xc
cmp word [ebp - 0x1d80], cx
je 0x1000918c
lea eax, [ebp - 0x1d80]
nop dword [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x441], al
lea eax, [ebp - 0x1d80]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x10009170
lea ecx, [ebp - 0x440]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009195
sub ecx, edx
xor edx, edx
test ecx, ecx
js 0x100091c1
mov al, byte [ebp + edx - 0x440]
cmp al, 0x41
jl 0x100091bc
cmp al, 0x5a
jg 0x100091bc
add al, 0x20
mov byte [ebp + edx - 0x440], al
inc edx
cmp edx, ecx
jle 0x100091a4
movups xmm0, xmmword [ebp - 0x440]
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x238]
movups xmmword [ebp - 0x1974], xmm0
push eax
movups xmm0, xmmword [ebp - 0x430]
lea eax, [ebp - 0x1954]
push eax
movups xmmword [ebp - 0x1964], xmm0
call fcn.10015e00
mov eax, dword [ebx + 4]
add esp, 8
cmp eax, dword [ebx + 8]
jne 0x10009210
push 1
mov ecx, ebx
call fcn.10011540
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000922a
mov ecx, 0x4a
lea esi, [ebp - 0x1978]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db0]
add dword [ebx + 4], 0x128
lea eax, [ebp - 0x1da0]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x100090c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100095c2
cmp eax, 2
jne 0x100095c2
test edi, edi
je 0x10008f48
lea eax, [ebp - 0x1db0]
mov dword [ebp - 0x1db0], 0
push eax
push 0x1000
lea eax, [ebp - 0x1850]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10008f48
mov eax, dword [ebp - 0x1db0]
xor esi, esi
shr eax, 2
test eax, eax
jle 0x1000933d
mov ebx, eax
mov eax, dword [ebp + esi*4 - 0x1850]
test eax, eax
je 0x10009328
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10009321
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp + esi*4 - 0x1850], eax
jne 0x10009321
push 0x104
lea eax, [ebp - 0x850]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009321
lea eax, [ebp - 0x850]
push eax
call fcn.10006a70
push eax
lea eax, [ebp - 0x44]
push 0x1003bc28
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x104
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.10006ad0
add esp, 0x1c
test al, al
jne 0x10009331
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x100092a2
mov ebx, dword [ebp - 0x1da4]
mov edi, dword [ebp - 0x1dac]
lea eax, [ebp - 0x648]
mov dword [0x10a6b7b8], 0
push eax
push 0x1003bc2c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10015e40
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x24c]
push eax
push str._ls.
push 0x208
push eax
call fcn.10015e40
add esp, 0x10
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1db4], esi
cmp esi, 0xffffffff
je 0x100095c2
nop dword [eax]
nop word [eax + eax]
mov eax, dword [0x10a6b7b8]
cmp eax, 0xc8
jg 0x10009599
xor ecx, ecx
mov dword [ebp - 0x374], edi
cmp word [ebp - 0x1b9c], cx
je 0x1000940c
lea eax, [ebp - 0x1b9c]
nop word [eax + eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x1b9c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100093f0
mov edi, 0x1003bc45
mov byte [ebp - 0x1da4], 0x25
mov byte [ebp - 0x1da2], 0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da3], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da4]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10015e00
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da4], ax
mov byte [ebp - 0x1da2], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001e6d0
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.1001e6d0
lea eax, [ebp - 0x648]
push eax
push 0x1003bc2c
lea eax, [ebp - 0x24c]
push 0x208
push eax
call fcn.10015e40
add esp, 0x34
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1b9c]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._ls_ls
push 0x208
push eax
call fcn.10015e40
push 0x104
lea eax, [ebp - 0x1954]
push 0
push eax
call fcn.1001e6d0
xor ecx, ecx
add esp, 0x20
cmp word [ebp - 0x24c], cx
je 0x1000950c
lea eax, [ebp - 0x24c]
nop dword [eax]
mov al, byte [eax]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1955], al
lea eax, [ebp - 0x24c]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
jne 0x100094f0
mov al, byte [edi]
xor al, 0xe3
mov byte [ebp - 0x1da8], 0x25
mov byte [ebp - 0x1da7], al
lea eax, [ebp - 0x1954]
push eax
lea eax, [ebp - 0x1da8]
mov byte [ebp - 0x1da6], 0
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10015e00
xor eax, eax
push 0x104
push eax
mov word [ebp - 0x1da8], ax
mov byte [ebp - 0x1da6], al
lea eax, [ebp - 0x1954]
push eax
call fcn.1001e6d0
mov eax, dword [ebx + 4]
add esp, 0x18
cmp eax, dword [ebx + 8]
jne 0x10009573
push 1
mov ecx, ebx
call fcn.10011540
mov edi, dword [ebx + 4]
test edi, edi
je 0x1000958d
mov ecx, 0x4a
lea esi, [ebp - 0x374]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1db4]
add dword [ebx + 4], 0x128
mov eax, dword [0x10a6b7b8]
inc eax
mov dword [0x10a6b7b8], eax
lea eax, [ebp - 0x1bc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x1dac]
test eax, eax
jne 0x100093c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001baaf
mov esp, ebp
pop ebp
ret 8