Function at 0x41fe00
Capabilities:
Check for time delay via gettickcount
Enumerate processes

Disassembly:
sub esp, 0x438
mov al, byte [0x4918ac]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
mov dword [esp + 0x18], edi
jne 0x40b0fd
or al, 1
mov byte [0x4918ac], al
call esi
mov dword [0x4918a8], eax
call esi
sub eax, dword [0x4918a8]
cmp eax, 0x2710
jae 0x40b119
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
call esi
mov dword [0x4918a8], eax
lea eax, [edi + 4]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 8], ebx
jne 0x40b139
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x40b159
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x1c]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b2e8
mov edx, dword [0x4881a0]
push ecx
mov ebp, esp
lea eax, [esp + 0x44]
test eax, eax
mov dword [ebp], edx
je 0x40b298
lea ecx, [esp + 0x44]
shr ecx, 0x10
jne 0x40b242
mov eax, dword [0x4917e0]
xor edi, edi
lea edx, [esp + 0x44]
lea ecx, [esp + 0x24c]
mov eax, dword [eax + 8]
mov di, dx
push 0x100
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x40b1dc
mov word [esp + 0x24c], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x40b1fc
lea eax, [esp + 0x24c]
mov ecx, ebp
push eax
call fcn.00402c90
jmp 0x40b298
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.004034f0
cmp eax, ebx
je 0x40b237
push esi
push eax
push edi
call fcn.00403a10
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x40b237
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.004034f0
cmp eax, ebx
jne 0x40b211
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004035b0
jmp 0x40b298
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x40b298
lea ecx, [esi + esi + 0xe]
push ecx
call fcn.0044aeaf
add esp, 4
cmp eax, ebx
je 0x40b298
mov dword [eax], 1
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
mov word [eax + esi*2 + 0xc], bx
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, ecx
mov dword [ebp], edi
jb 0x40b298
mov eax, ecx
lea esi, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, esp
lea eax, [edx + 4]
push eax
call fcn.00402ba0
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.0040b580
cmp eax, ebx
je 0x40b2c7
mov eax, dword [esp + 0x24]
mov ecx, esi
push eax
call fcn.0040b310
test eax, eax
jne 0x40b2df
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40b2e4
jmp 0x40b185
mov byte [esp + 0x14], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x438
ret
add ecx, 0x134
jmp 0x40b0d0