Function at 0x4266f8
Capabilities:
Check for time delay via gettickcount
Enumerate process modules
Enumerate processes

Disassembly:
push 0xb48
mov eax, 0x45f694
call fcn.00447dc4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp + 0x10]
mov esi, ecx
xor edi, edi
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xa8c], 0x12
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xab0], eax
call fcn.00434582
push eax
lea ecx, [ebp - 0xa7c]
call fcn.0040210b
push edi
push 2
pop ebx
push ebx
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xaa0], eax
cmp eax, 0xffffffff
jne 0x4267c8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xaa0], eax
cmp eax, 0xffffffff
jne 0x4267c8
push str.CreateToolhelp32Snapshot_failed
lea ecx, [ebp - 0xa8c]
call fcn.00402060
push edi
lea eax, [ebp - 0xa8c]
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.00411fad
mov ecx, dword [ebp - 0xa8c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
mov ecx, dword [ebp - 0xa7c]
add ecx, 0xfffffff0
call fcn.0040253e
push 0x12
pop eax
call fcn.00447e47
ret
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0xaa0]
mov dword [ebp - 0x650], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x426845
push str.Process32First_failed
lea ecx, [ebp - 0xa8c]
call fcn.00402060
push edi
lea eax, [ebp - 0xa8c]
push eax
push ebx
mov byte [ebp - 4], bl
call fcn.00411fad
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xa8c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push dword [ebp - 0xaa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12
pop esi
mov ecx, dword [ebp - 0xa7c]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, esi
jmp 0x4267c2
mov esi, dword [ebp - 0xa98]
call fcn.00434582
push eax
lea ecx, [ebp - 0xa88]
call fcn.0040210b
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x648]
push eax
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xa7c]
push str.Start_collected_process__ID:__ld
push eax
call fcn.0040202c
lea eax, [ebp - 0xa7c]
add esp, 0xc
push eax
call fcn.00411ff4
pop ecx
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0xa94]
call fcn.00402060
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xaf4], eax
mov eax, dword [esi]
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0xb08]
push eax
call fcn.00428e05
lea edi, [ebp - 0xaf8]
mov esi, eax
call fcn.0042925d
test al, al
jne 0x4268ff
push str.Skipping_previously_failed_process
lea ecx, [ebp - 0xac0]
call fcn.00402060
lea eax, [ebp - 0xac0]
push eax
mov byte [ebp - 4], 5
call fcn.00411ff4
pop ecx
mov ecx, dword [ebp - 0xac0]
jmp 0x426fe2
push dword [ebp - 0xa80]
xor esi, esi
push esi
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xa9c], eax
cmp eax, esi
jne 0x426966
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push dword [ebp - 0xa94]
push str.Unable_to_access_process:_Name:__s__ID:__ld
push eax
call fcn.0040202c
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
mov ebx, dword [ebp - 0xa98]
add esp, 0x14
lea eax, [ebp - 0xa80]
push eax
lea edi, [ebp - 0xb54]
call fcn.00428d2a
jmp 0x426fea
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0xad8], 0x104
call fcn.00445f90
add esp, 0xc
push str.Kernel32.dll
mov dword [ebp - 0xa90], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x426a55
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa90], eax
cmp eax, esi
je 0x426a55
lea eax, [ebp - 0xad8]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0xa9c]
call dword [ebp - 0xa90]
test eax, eax
je 0x426a55
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xad4]
call fcn.00402060
mov edi, dword [ebp - 0xaa8]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xadc], eax
mov eax, dword [edi]
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xad4]
push eax
lea eax, [ebp - 0xb00]
push eax
call fcn.00428c2e
lea edi, [ebp - 0xae0]
mov esi, eax
call fcn.0042925d
mov ecx, dword [ebp - 0xad4]
mov bl, al
neg bl
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0040253e
test bl, bl
je 0x426a55
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa88]
call fcn.004020d4
mov ecx, dword [ebp - 0xa88]
xor eax, eax
cmp dword [ecx - 0xc], eax
jne 0x426b40
cmp dword [ebp - 0xa90], eax
jne 0x426b40
mov esi, 0x104
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
push dword [ebp - 0xa9c]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x426b19
push esi
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xac8]
call fcn.00402060
mov edi, dword [ebp - 0xaa8]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xaec], eax
mov eax, dword [edi]
mov dword [ebp - 0xaf0], eax
lea eax, [ebp - 0xac8]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00428c2e
lea edi, [ebp - 0xaf0]
mov esi, eax
call fcn.0042925d
mov ecx, dword [ebp - 0xac8]
mov bl, al
neg bl
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0040253e
test bl, bl
je 0x426b40
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa88]
call fcn.004020d4
jmp 0x426b40
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.0040202c
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
pop ecx
mov esi, dword [ebp - 0xa88]
cmp dword [esi - 0xc], 0
jne 0x426e52
push dword [ebp - 0xa80]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0xab4], esi
cmp esi, 0xffffffff
je 0x426e26
lea eax, [ebp - 0xa78]
push eax
push esi
mov dword [ebp - 0xa78], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x426b8f
push esi
jmp 0x426e1b
and dword [ebp - 0xa90], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00445f90
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0xa5c]
push dword [ebp - 0xa9c]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x426db2
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xabc]
call fcn.00402060
mov edi, dword [ebp - 0xaa8]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xae4], eax
mov eax, dword [edi]
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xb10]
push eax
call fcn.00428c2e
lea edi, [ebp - 0xae8]
mov esi, eax
call fcn.0042925d
mov ecx, dword [ebp - 0xabc]
mov bl, al
neg bl
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0040253e
test bl, bl
je 0x426dd9
lea edi, [ebp - 0xa94]
call fcn.0040a506
push str.explorer.exe
mov ecx, eax
call fcn.00408ff7
test eax, eax
jne 0x426cae
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa7c]
push dword [ebp - 0xa80]
push str.Skipping_process:_Name:_explorer.exe__ID:__ld__file_in_use:__s
push eax
call fcn.0040202c
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
add esp, 0x14
lea edi, [ebp - 0xb3c]
mov ebx, dword [ebp - 0xa98]
lea eax, [ebp - 0xa80]
push eax
call fcn.00428d2a
mov dword [ebp - 0xa90], 1
jmp 0x426dd9
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xa88]
mov dword [ebp - 0xa8c], 0x4de
call fcn.004020d4
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa7c]
push dword [ebp - 0xa80]
push dword [ebp - 0xa94]
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.0040202c
lea eax, [ebp - 0xa7c]
add esp, 0x14
push eax
call fcn.00411ff4
pop ecx
lea eax, [ebp - 0xa81]
push eax
push 0x47ed38
push dword [ebp - 0xa88]
mov esi, 0x49c488
push str.Wait_Collected_Files_List
mov byte [ebp - 0xa81], 1
call fcn.004091b7
push dword [ebp + 0xc]
push dword [ebp - 0xa9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x426d7d
test eax, eax
je 0x426d7d
push str.Wait_failed
lea ecx, [ebp - 0xac4]
call fcn.00402060
lea eax, [ebp - 0xac4]
push eax
mov byte [ebp - 4], 7
call fcn.00411ff4
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xac4]
add ecx, 0xfffffff0
call fcn.0040253e
lea edi, [ebp - 0xb48]
jmp 0x426c8d
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xacc]
call fcn.00402060
lea eax, [ebp - 0xacc]
push eax
mov byte [ebp - 4], 6
call fcn.00411ff4
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xacc]
add ecx, 0xfffffff0
call fcn.0040253e
jmp 0x426dd9
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.0040202c
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab0]
cmp dword [ebp - 0xa90], 0
mov ecx, dword [ebp - 0xaac]
mov dword [ecx], eax
jne 0x426e15
cmp eax, dword [ebp + 0xc]
jae 0x426e15
lea eax, [ebp - 0xa78]
push eax
push dword [ebp - 0xab4]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x426b96
push dword [ebp - 0xab4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x426fea
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push str.CreateToolhelp32Snapshot::TH32CS_SNAPMODULE_failed_for_process__ID:__ld
push eax
call fcn.0040202c
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
pop ecx
jmp 0x426fea
lea edi, [ebp - 0xa94]
call fcn.0040a506
push eax
lea ecx, [ebp - 0xaa4]
call fcn.004020a4
push str.acrotray.exe
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 8
call fcn.00408ff7
test eax, eax
je 0x426f96
push str.acrodist.exe
lea ecx, [ebp - 0xaa4]
call fcn.00408ff7
test eax, eax
je 0x426f96
push str.adobecollabsync.exe
lea ecx, [ebp - 0xaa4]
call fcn.00408ff7
test eax, eax
je 0x426f96
push esi
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push dword [ebp - 0xa94]
mov dword [ebp - 0xa8c], 0x4de
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.0040202c
lea eax, [ebp - 0xa7c]
add esp, 0x14
push eax
call fcn.00411ff4
pop ecx
lea eax, [ebp - 0xa81]
push eax
push 0x47ed38
push esi
push str.Wait_Collected_Files_List
mov esi, 0x49c488
mov byte [ebp - 0xa81], 1
call fcn.004091b7
push dword [ebp + 0xc]
push dword [ebp - 0xa9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x426f65
test eax, eax
je 0x426f65
push str.Wait_failed
lea ecx, [ebp - 0xad0]
call fcn.00402060
lea eax, [ebp - 0xad0]
push eax
mov byte [ebp - 4], 0xa
call fcn.00411ff4
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xad0]
add ecx, 0xfffffff0
call fcn.0040253e
lea edi, [ebp - 0xb30]
jmp 0x426fca
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xab8]
call fcn.00402060
lea eax, [ebp - 0xab8]
push eax
mov byte [ebp - 4], 9
call fcn.00411ff4
pop ecx
mov ecx, dword [ebp - 0xab8]
add ecx, 0xfffffff0
call fcn.0040253e
jmp 0x426fdc
push esi
push dword [ebp - 0xa80]
lea eax, [ebp - 0xa7c]
push dword [ebp - 0xa94]
push str.Skipping_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.0040202c
add esp, 0x14
lea eax, [ebp - 0xa7c]
push eax
call fcn.00411ff4
pop ecx
lea edi, [ebp - 0xb24]
mov ebx, dword [ebp - 0xa98]
lea eax, [ebp - 0xa80]
push eax
call fcn.00428d2a
mov ecx, dword [ebp - 0xaa4]
add ecx, 0xfffffff0
call fcn.0040253e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xa94]
mov esi, dword [ebp - 0xaac]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.0040253e
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xa88]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, dword [ebp + 0xc]
cmp dword [esi], eax
jae 0x42703f
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0xaa0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42683f
push dword [ebp - 0xaa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab0]
mov ecx, esi
mov esi, dword [ebp - 0xa8c]
mov dword [ecx], eax
jmp 0x42682d