Function at 0x41f0b0
Capabilities:
Enumerate files on windows
Enumerate processes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c0
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 2
mov dword [ebp - 0x394], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x390]
mov dword [ebp - 0x398], eax
push ecx
push eax
mov dword [ebp - 0x390], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41f2d9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax]
lea eax, [ebp - 0x36c]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x41f2b8
push dword [ebp - 0x388]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41f2a3
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x3a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x41f283
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
lea eax, [ebp - 0x108]
push eax
push str._appdata_.minecraftmods.jar
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x41f1c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_expanding_environment_strings_while_checking_for_suspicious_mods_ran_by_the_game._Error:__d_n
call fcn.0041f350
add esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x41f2be
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41f200
push str.Error:_Unable_to_find_files_in_Minecrafts_mod_directory._n
call fcn.0041f350
mov esi, dword [ebp - 0x394]
add esp, 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x41f2be
test byte [ebp - 0x268], 0x10
jne 0x41f25d
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x41f25d
lea eax, [ebp - 0x23c]
push eax
push str.___Suspicious_mod_found:__s_n
call fcn.0041f350
add esp, 8
lea eax, [ebp - 0x268]
push eax
push esi
call ebx
test eax, eax
jne 0x41f200
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x394]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x41f2be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Error_getting_process_times_for__s_while_checking_for_suspicious_mods_ran_by_the_game._Error:__d_n
call fcn.0041f350
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x41f2be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Error_opening_process_for__s_while_checking_for_suspicious_mods_ran_by_the_game._Error:__d_n
call fcn.0041f350
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x390]
push eax
push dword [ebp - 0x398]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41f110
pop ebx
push dword [ebp - 0x398]
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00426399
mov esp, ebp
pop ebp
ret