Function at 0x4c9f73
Capabilities:
Enumerate processes
Get disk information

Disassembly:
push ebp
push ebx
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4c9f7a
call fcn.005423e0
push dword [esp + 0x26c]
call fcn.004fa4e0
mov edx, dword [esp + 0x268]
lea ecx, [esp]
call fcn.004fa000
mov eax, str.psapi.dll
push eax
push 0xffffffff
call fcn.00521008
mov dword [esp + 0x244], eax
lea ebp, [esp + 0x18]
mov dword [ebp], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x248], eax
cmp dword [esp + 0x248], 0
je 0x4ca211
push 0x20c
call fcn.005410b0
mov dword [esp + 0x24c], eax
push 0x104
call fcn.005410b0
mov dword [esp + 0x250], eax
mov edx, 0x61ff4e
lea ecx, [esp + 0x254]
call fcn.004fa008
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24c]
call sub.KERNEL32.dll_Process32FirstW
mov dword [esp + 0x258], eax
cmp dword [esp + 0x258], 0
je 0x4ca05a
push dword [esp + 4]
mov edx, 0x61f062
pop ecx
call fcn.004fa4a0
je 0x4ca05a
mov eax, 1
jmp 0x4ca05c
xor eax, eax
and eax, eax
je 0x4ca1ed
lea ebp, [esp + 0x18]
push dword [ebp + 8]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4ca1d0
push 0x20c
push dword [esp + 0x250]
push dword [esp + 0x10]
mov eax, str.GetProcessImageFileNameW
push eax
push dword [esp + 0x254]
call fcn.005210be
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x254]
call fcn.005410d0
lea eax, [esp + 0x14]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 4]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x20]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.0053f8e0
call fcn.004fa4e0
and eax, eax
je 0x4ca1c7
mov dword [esp + 0xc], 0x41
jmp 0x4ca11a
mov eax, 0x5a
cmp eax, dword [esp + 0xc]
jl 0x4ca1c7
push dword [esp + 0xc]
mov eax, dword [esp + 0x258]
push eax
pop eax
call fcn.004fa410
push 0x104
push dword [esp + 0x254]
mov eax, dword [esp + 0x25c]
push eax
call sub.KERNEL32.dll_QueryDosDeviceW
mov ebx, eax
add ebx, ebx
add ebx, 0xfffffffc
mov dword [esp + 0x14], ebx
push dword [esp + 0x14]
push dword [esp + 0x254]
push dword [esp + 0x254]
call fcn.00541550
and eax, eax
je 0x4ca1bd
mov edx, dword [esp + 0x254]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov ebx, dword [esp + 0x258]
add ebx, dword [esp + 0x20]
push ebx
call fcn.005410d0
pop eax
lea eax, [esp + 8]
push eax
call fcn.00542280
jmp 0x4ca1c7
inc dword [esp + 0xc]
jno 0x4ca11a
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24c]
call sub.KERNEL32.dll_Process32NextW
mov dword [esp + 0x258], eax
jmp 0x4ca038
push dword [esp + 0x248]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 0x24c]
call fcn.00541120
push dword [esp + 0x250]
call fcn.00541120
push dword [esp + 0x244]
call fcn.00520f48
mov edx, dword [esp + 4]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
pop eax
push eax
call fcn.004fa470
pop edx
add eax, edx
jmp 0x4ca245
push dword [esp]
call fcn.00542440
push dword [esp + 0x10]
call fcn.00542440
push dword [esp + 0x254]
call fcn.00542440
push dword [esp + 4]
call fcn.00542440
add esp, 0x25c
pop ebx
pop ebp
ret 4