Function at 0x5d2550
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c2a0
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x745694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x74bb34]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x74b8b0]
cmp eax, dword [ecx + 4]
jg 0x5d29cc
cmp dword [0x745400], 0
jne 0x5d29ac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov esi, eax
lea eax, [ebp - 0x470]
push 0
push eax
call fcn.006602b0
add esp, 0xc
mov dword [ebp - 0x474], 0x22c
xor eax, eax
mov dword [ebp - 0x478], eax
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5d2620
cmp dword [ebp - 0x46c], esi
jne 0x5d2607
mov eax, dword [ebp - 0x45c]
cmp eax, esi
jne 0x5d261a
lea eax, [ebp - 0x474]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5d25f5
jmp 0x5d2620
mov dword [ebp - 0x478], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x478]
test eax, eax
je 0x5d28c9
push eax
xor esi, esi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x5d2671
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x5d2668
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5d2679
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x5d280e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.005be600
mov esi, eax
add esp, 8
cmp esi, 0x7453f0
je 0x5d271e
mov edx, dword [0x745404]
cmp edx, 0x10
jb 0x5d26db
mov ecx, dword [0x7453f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d26d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2a02
push edx
push ecx
call fcn.0065cc27
add esp, 8
mov dword [0x745400], 0
mov dword [0x745404], 0xf
mov byte [0x7453f0], 0
movups xmm0, xmmword [esi]
movups xmmword [0x7453f0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x745400], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x230]
call fcn.00448860
push 0xffffffffffffffff
push 0x70fd30
mov ecx, 0x7453f0
call fcn.005cdba0
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x5d275c
push eax
push 0x70df74
mov ecx, 0x7453f0
call fcn.005cdba0
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5d29ac
mov edx, dword [0x745400]
inc ecx
sub edx, ecx
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
cmp dword [0x745400], ecx
jb 0x5d2a07
cmp dword [0x745404], 0x10
mov eax, 0x7453f0
push edx
cmovae eax, dword [0x7453f0]
add eax, ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.004484a0
mov edx, dword [0x745404]
cmp edx, 0x10
jb 0x5d27eb
mov ecx, dword [0x7453f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d27e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2a11
push edx
push ecx
call fcn.0065cc27
add esp, 8
movups xmm0, xmmword [ebp - 0x230]
movups xmmword [0x7453f0], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [0x745400], xmm0
jmp 0x5d29ac
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.005b3cc0
add esp, 0xc
push 5
push str.err:
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005a5ba0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [0x745404]
movq qword [ebp - 0x47c], xmm1
movups xmmword [ebp - 0x228], xmm0
cmp edx, 0x10
jb 0x5d28aa
mov ecx, dword [0x7453f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d2891
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2a0c
push edx
push ecx
call fcn.0065cc27
movups xmm0, xmmword [ebp - 0x228]
add esp, 8
movq xmm1, qword [ebp - 0x47c]
lea ecx, [ebp - 0x248]
movq qword [0x745400], xmm1
movups xmmword [0x7453f0], xmm0
call fcn.00448860
jmp 0x5d29ac
mov edi, dword [0x745404]
cmp edi, 0xb
jb 0x5d2906
cmp edi, 0x10
mov dword [0x745400], 0xb
push 0xb
mov esi, 0x7453f0
cmovae esi, dword [0x7453f0]
push str.err:_ppid0
push esi
call fcn.0065fd30
add esp, 0xc
mov byte [esi + 0xb], 0
jmp 0x5d29ac
mov ecx, edi
mov eax, accept
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x5d291c
mov ecx, accept
jmp 0x5d2929
lea eax, [edi + ecx]
mov ecx, 0xf
cmp eax, ecx
cmova ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x478], ecx
push eax
mov ecx, 0x7453f0
call fcn.00448c50
movq xmm0, qword [str.err:_ppid0]
mov esi, eax
mov eax, dword [ebp - 0x478]
mov dword [0x745404], eax
mov dword [0x745400], 0xb
movq qword [esi], xmm0
mov ax, word [0x69c638]
mov word [esi + 8], ax
mov al, byte [0x69c63a]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
cmp edi, 0x10
jb 0x5d29a6
mov ecx, dword [0x7453f0]
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x5d299c
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2a11
push edi
push ecx
call fcn.0065cc27
add esp, 8
mov dword [0x7453f0], esi
mov eax, 0x7453f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065cc3a
mov esp, ebp
pop ebp
ret
push 0x74b8b0
call fcn.0065cdda
add esp, 4
cmp dword [0x74b8b0], 0xffffffff
jne 0x5d259d
push 0x692a00
call fcn.0065d20f
push 0x74b8b0
call fcn.0065cd90
add esp, 8
jmp 0x5d259d
call fcn.0066375b
call fcn.00448c00
call fcn.0066375b
call fcn.0066375b
int3