Function at 0x436890
Capabilities:
Check for time delay via gettickcount
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4aa07b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
mov al, byte [0x4cf818]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
mov dword [esp + 0x14], edi
jne 0x4147f2
or al, 1
mov byte [0x4cf818], al
call esi
mov dword [0x4cf814], eax
call esi
sub eax, dword [0x4cf814]
cmp eax, 0x2710
jae 0x414808
xor eax, eax
jmp 0x4149f5
call esi
mov dword [0x4cf814], eax
lea eax, [edi + 4]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 8], ebx
jne 0x414822
xor eax, eax
jmp 0x4149f5
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x41483c
xor eax, eax
jmp 0x4149f5
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x24]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4149e5
mov edx, dword [0x4c0080]
push ecx
mov ebp, esp
lea eax, [esp + 0x4c]
test eax, eax
mov dword [esp + 0x20], esp
mov dword [ebp], edx
je 0x41497f
lea ecx, [esp + 0x4c]
shr ecx, 0x10
jne 0x414929
mov eax, dword [0x4cf6e8]
xor edi, edi
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x254]
mov eax, dword [eax + 8]
mov di, dx
push 0x100
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x4148c3
mov word [esp + 0x254], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x4148e3
lea eax, [esp + 0x254]
mov ecx, ebp
push eax
call fcn.00403cc0
jmp 0x41497f
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.00404560
cmp eax, ebx
je 0x41491e
push esi
push eax
push edi
call fcn.00404b30
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x41491e
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.00404560
cmp eax, ebx
jne 0x4148f8
push 0xffffffffffffffff
mov ecx, ebp
call fcn.00404620
jmp 0x41497f
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x41497f
lea ecx, [esi + esi + 0xe]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x41497f
mov dword [eax], 1
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
mov word [eax + esi*2 + 0xc], bx
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, ecx
mov dword [ebp], edi
jb 0x41497f
mov eax, ecx
lea esi, [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [edx + 4]
mov dword [esp + 0x460], ebx
push eax
call fcn.00403bd0
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x460], 0xffffffff
mov ecx, esi
call fcn.00414c90
cmp eax, ebx
je 0x4149c4
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00414a10
test eax, eax
jne 0x4149dc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4149e1
jmp 0x414868
mov byte [esp + 0x18], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, dword [esp + 0x450]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x44c
ret
add ecx, 0x184
jmp 0x4147b0