Function at 0x43681e
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push 0xb0c
mov eax, 0x48b524
call fcn.00464e7c
mov dword [ebp - 0xa98], edx
mov dword [ebp - 0xaa8], ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x12
pop esi
mov dword [ebp - 0xaac], edi
mov dword [ebp - 0xa88], esi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0xac0], eax
call fcn.0044afe1
push eax
lea ecx, [ebp - 0xa78]
call fcn.00402824
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0xa9c], ebx
cmp ebx, 0xffffffff
jne 0x4368dc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0xa9c], eax
cmp ebx, 0xffffffff
jne 0x4368dc
push str.CreateToolhelp32Snapshot_failed
lea ecx, [ebp - 0xa88]
call fcn.0040279b
push 0
push 2
lea edx, [ebp - 0xa88]
mov byte [ebp - 4], 1
pop ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0xa88]
lea ecx, [ecx - 0x10]
call fcn.00402def
jmp 0x437143
lea eax, [ebp - 0x64c]
mov dword [ebp - 0x64c], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x436937
push str.Process32First_failed
lea ecx, [ebp - 0xa88]
call fcn.0040279b
push 0
push 2
lea edx, [ebp - 0xa88]
mov byte [ebp - 4], 2
pop ecx
call fcn.00413e51
pop ecx
mov ecx, dword [ebp - 0xa88]
lea ecx, [ecx - 0x10]
call fcn.00402def
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x437143
call fcn.0044afe1
push eax
lea ecx, [ebp - 0xa84]
call fcn.00402824
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa78]
mov esi, dword [ebp - 0x644]
push esi
push str.Start_collected_process__ID:__ld
push eax
mov dword [ebp - 0xa80], esi
mov dword [ebp - 0xa8c], esi
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x10
lea eax, [ebp - 0x628]
lea ecx, [ebp - 0xa90]
push eax
call fcn.0040279b
mov edi, dword [ebp - 0xa98]
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xaf0]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.00439e4c
mov eax, dword [ebp - 0xae8]
cmp byte [eax + 0xd], 0
jne 0x4369c2
cmp esi, dword [eax + 0x10]
jae 0x4369c4
mov eax, dword [edi]
cmp eax, dword [edi]
je 0x436a03
push str.Skipping_previously_failed_process
lea ecx, [ebp - 0xab0]
call fcn.0040279b
push 0
lea edx, [ebp - 0xab0]
mov byte [ebp - 4], 5
call fcn.00413e99
pop ecx
mov ecx, dword [ebp - 0xab0]
lea ecx, [ecx - 0x10]
call fcn.00402def
mov edi, dword [ebp - 0xa84]
jmp 0x4370d9
push esi
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0xaa4], edi
test edi, edi
jne 0x436a5f
push esi
push dword [ebp - 0xa90]
lea eax, [ebp - 0xa78]
push str.Unable_to_access_process:_Name:__s__ID:__ld
push eax
call fcn.00402762
push edi
lea edx, [ebp - 0xa78]
call fcn.00413e99
mov ecx, dword [ebp - 0xa98]
lea eax, [ebp - 0xa8c]
add esp, 0x14
push eax
lea eax, [ebp - 0xaf8]
push eax
call fcn.00439db4
jmp 0x4369f8
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0xad4], 0x104
push 0
push eax
call fcn.00466990
add esp, 0xc
xor ebx, ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x436b1a
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x436b1a
lea eax, [ebp - 0xad4]
mov ecx, ebx
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push edi
call dword [0x4907c8]
call ebx
test eax, eax
je 0x436b1a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xab4]
call fcn.0040279b
mov eax, dword [ebp - 0xaa8]
lea ecx, [ebp - 0xab4]
push ecx
lea ecx, [ebp - 0xadc]
push ecx
mov edi, dword [eax]
mov ecx, eax
call fcn.0043427d
mov ecx, dword [ebp - 0xab4]
mov esi, dword [eax]
lea ecx, [ecx - 0x10]
call fcn.00402def
cmp esi, edi
je 0x436b1a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa84]
call fcn.004027df
mov edi, dword [ebp - 0xa84]
cmp dword [edi - 0xc], 0
jne 0x436bc1
test ebx, ebx
jne 0x436bc1
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0xaa4]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x436c13
push 0x104
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xacc]
call fcn.0040279b
mov eax, dword [ebp - 0xaa8]
lea ecx, [ebp - 0xacc]
push ecx
lea ecx, [ebp - 0xae0]
push ecx
mov ebx, dword [eax]
mov ecx, eax
call fcn.0043427d
mov ecx, dword [ebp - 0xacc]
mov esi, dword [eax]
lea ecx, [ecx - 0x10]
call fcn.00402def
cmp esi, ebx
je 0x436bc1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa84]
call fcn.004027df
mov edi, dword [ebp - 0xa84]
mov ebx, dword [ebp - 0xa80]
cmp dword [edi - 0xc], 0
jne 0x436f2f
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0xaa0], esi
cmp esi, 0xffffffff
je 0x436f08
lea eax, [ebp - 0xa74]
mov dword [ebp - 0xa74], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x436c3d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4370d3
mov ebx, dword [ebp - 0xa80]
lea eax, [ebp - 0xa78]
push ebx
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x10
jmp 0x436bc7
and dword [ebp - 0xa94], 0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00466990
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [ebp - 0xa58]
push dword [ebp - 0xaa4]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x436e93
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xac8]
call fcn.0040279b
mov eax, dword [ebp - 0xaa8]
lea ecx, [ebp - 0xac8]
push ecx
lea ecx, [ebp - 0xae4]
push ecx
mov ebx, dword [eax]
mov ecx, eax
call fcn.0043427d
mov ecx, dword [ebp - 0xac8]
mov esi, dword [eax]
lea ecx, [ecx - 0x10]
call fcn.00402def
cmp esi, ebx
je 0x436eb7
lea ecx, [ebp - 0xa90]
call fcn.0040ac0a
push str.explorer.exe
mov ecx, eax
call fcn.0040952b
test eax, eax
jne 0x436d3f
mov esi, dword [ebp - 0xa80]
lea eax, [ebp - 0xa78]
push edi
push esi
push str.Skipping_process:_Name:_explorer.exe__ID:__ld__file_in_use:__s
push eax
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x14
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xb00]
mov ecx, dword [ebp - 0xa98]
push eax
call fcn.00439db4
mov ebx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa94], 1
mov dword [ebp - 0xa80], ebx
jmp 0x436ebd
mov eax, 0x4de
lea ecx, [ebp - 0xa84]
mov dword [ebp - 0xa88], eax
lea eax, [ebp - 0x420]
push eax
call fcn.004027df
mov edi, dword [ebp - 0xa84]
lea eax, [ebp - 0xa78]
mov ebx, dword [ebp - 0xa80]
push edi
push ebx
push dword [ebp - 0xa90]
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402762
push 0
push 2
lea edx, [ebp - 0xa78]
pop ecx
call fcn.00413e51
push 0x5c
push edi
call fcn.004673a7
mov ecx, eax
add esp, 0x20
test ecx, ecx
je 0x436dfd
sub ecx, edi
sar ecx, 1
cmp ecx, 0xffffffff
je 0x436dfd
mov eax, dword [edi - 0xc]
sub eax, ecx
lea ecx, [ebp - 0xa84]
dec eax
push eax
lea eax, [ebp - 0xad8]
push eax
call fcn.0040abbb
lea eax, [ebp - 0xa79]
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0xad8]
mov ecx, 0x4e1f90
push eax
push 0x49c824
push esi
push str.Wait_Collected_Files_List
mov byte [ebp - 0xa79], 1
call fcn.004098b0
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 4
call fcn.00402def
push dword [ebp + 8]
push dword [ebp - 0xaa4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x436e5d
test eax, eax
je 0x436e5d
push str.Wait_failed
lea ecx, [ebp - 0xac4]
call fcn.0040279b
push 0
lea edx, [ebp - 0xac4]
mov byte [ebp - 4], 8
call fcn.00413e99
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xac4]
lea ecx, [ecx - 0x10]
call fcn.00402def
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xb08]
jmp 0x436d18
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xad0]
call fcn.0040279b
push 0
lea edx, [ebp - 0xad0]
mov byte [ebp - 4], 7
call fcn.00413e99
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xad0]
lea ecx, [ecx - 0x10]
call fcn.00402def
jmp 0x436ebd
push ebx
lea eax, [ebp - 0xa78]
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x10
jmp 0x436ec3
mov ebx, dword [ebp - 0xa80]
mov esi, dword [ebp - 0xaa0]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0xaac]
sub eax, dword [ebp - 0xac0]
cmp dword [ebp - 0xa94], 0
mov dword [ecx], eax
jne 0x436c07
cmp eax, dword [ebp + 8]
jae 0x436c07
lea eax, [ebp - 0xa74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x436c44
jmp 0x436c07
push ebx
lea eax, [ebp - 0xa78]
push str.CreateToolhelp32Snapshot::TH32CS_SNAPMODULE_failed_for_process__ID:__ld
push eax
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x10
jmp 0x4370d3
lea ecx, [ebp - 0xa90]
call fcn.0040ac0a
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00402d2a
lea esi, [eax + 0x10]
mov dword [ebp - 0xa94], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa94]
mov dword [esp], str.acrotray.exe
call fcn.0040952b
test eax, eax
je 0x437089
push str.acrodist.exe
lea ecx, [ebp - 0xa94]
call fcn.0040952b
test eax, eax
je 0x437089
push str.adobecollabsync.exe
lea ecx, [ebp - 0xa94]
call fcn.0040952b
test eax, eax
je 0x437089
push edi
push ebx
push dword [ebp - 0xa90]
mov eax, 0x4de
mov dword [ebp - 0xa88], eax
lea eax, [ebp - 0xa78]
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402762
xor ebx, ebx
lea edx, [ebp - 0xa78]
push ebx
push 2
pop ecx
call fcn.00413e51
add esp, 0x18
mov byte [ebp - 0xa79], 1
lea eax, [ebp - 0xa79]
mov ecx, 0x4e1f90
push eax
push 0x49c824
push dword [ebp - 0xa90]
push str.Wait_Collected_Files_List
call fcn.004098b0
push dword [ebp + 8]
push dword [ebp - 0xaa4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x437058
test eax, eax
je 0x437058
push str.Wait_failed
lea ecx, [ebp - 0xab8]
call fcn.0040279b
push ebx
lea edx, [ebp - 0xab8]
mov byte [ebp - 4], 0xb
call fcn.00413e99
pop ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xab8]
lea ecx, [ecx - 0x10]
call fcn.00402def
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xb10]
jmp 0x4370bf
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xabc]
call fcn.0040279b
push ebx
lea edx, [ebp - 0xabc]
mov byte [ebp - 4], 0xa
call fcn.00413e99
pop ecx
mov ecx, dword [ebp - 0xabc]
lea ecx, [ecx - 0x10]
call fcn.00402def
jmp 0x4370cb
push edi
push ebx
push dword [ebp - 0xa90]
lea eax, [ebp - 0xa78]
push str.Skipping_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402762
push 0
lea edx, [ebp - 0xa78]
call fcn.00413e99
add esp, 0x18
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xa98]
push eax
call fcn.00439db4
lea ecx, [esi - 0x10]
call fcn.00402def
mov ebx, dword [ebp - 0xa9c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xac0]
sub eax, esi
mov dword [ecx], eax
mov ecx, dword [ebp - 0xa90]
lea ecx, [ecx - 0x10]
call fcn.00402def
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402def
mov edi, dword [ebp - 0xaac]
mov eax, dword [ebp + 8]
cmp dword [edi], eax
jae 0x43712c
lea eax, [ebp - 0x64c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x436937
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
mov esi, dword [ebp - 0xa88]
mov dword [edi], eax
mov ecx, dword [ebp - 0xa78]
add ecx, 0xfffffff0
call fcn.00402def
mov eax, esi
call fcn.00464e26
ret