Function at 0x4216b0
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc60
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x228
xor ebx, ebx
lea ecx, [ebp - 0xc40]
push ebx
push ecx
mov dword [ebp - 0xc60], eax
mov dword [ebp - 0xc44], 0x22c
call fcn.00427b00
add esp, 0xc
push 0x206
lea eax, [ebp - 0x212]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x214], dx
call fcn.00427b00
add esp, 0xc
push 0x7fe
lea edx, [ebp - 0xa12]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
mov word [ebp - 0xa14], cx
call fcn.00427b00
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0xc50], ebx
mov dword [ebp - 0xc5c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0xc54], edi
cmp edi, 0xffffffff
jne 0x421764
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4219c5
lea eax, [ebp - 0xc44]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x421780
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4219c1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x410
call ebx
mov dword [ebp - 0xc58], eax
test eax, eax
jne 0x4217ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4219ae
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x4217cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4219ae
lea edx, [ebp - 0x214]
push 0x4c8d30
push edx
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x421861
cmp dword [ebp - 0xc3c], esi
jne 0x421850
mov eax, dword [ebp - 0xc2c]
push eax
push 0
push 0x410
call ebx
mov dword [ebp - 0xc58], eax
test eax, eax
je 0x421879
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x421879
lea edx, [ebp - 0x214]
push str.cmd.exe
push edx
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x421861
mov esi, dword [ebp - 0xc2c]
lea eax, [ebp - 0xc44]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x421879
lea ecx, [ebp - 0xc44]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4217e7
lea esi, [ebp - 0x214]
call fcn.00412b60
mov edx, esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421884
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4219ae
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.0049497a
mov esi, eax
add esp, 8
add esi, 2
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4218a0
sub eax, edx
sar eax, 1
inc eax
push eax
push esi
call fcn.00494dc3
lea ebx, [ebp - 0xc4c]
lea edi, [ebp - 0x214]
call fcn.00412c40
lea ecx, [ebp - 0xc48]
push ecx
mov eax, edi
call fcn.004213f0
mov edi, dword [ebp - 0xc4c]
add esp, 0xc
push 0x4c8794
push edi
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x42190b
add eax, 2
push 0x4c8794
push eax
call fcn.00494b9d
add esp, 8
test eax, eax
je 0x42190b
xor edx, edx
mov word [eax], dx
mov ecx, dword [ebp - 0xc48]
test ecx, ecx
jne 0x42191a
mov ecx, 0x4c8d70
mov eax, edi
test edi, edi
jne 0x421925
mov eax, 0x4c8d70
test esi, esi
jne 0x42192e
mov esi, 0x4c8d70
push ecx
push eax
push 0x1e
push esi
push 0x4c8d74
lea eax, [ebp - 0xa14]
push 0x400
push eax
call fcn.004266d6
add esp, 0x1c
lea ecx, [ebp - 0xc5c]
push ecx
lea edx, [ebp - 0xc50]
push edx
lea eax, [ebp - 0xa14]
push eax
call fcn.00412e80
add esp, 0xc
test eax, eax
jl 0x4219a8
mov edi, dword [ebp - 0xc5c]
inc edi
push edi
call fcn.004261ca
mov esi, eax
add esp, 4
test esi, esi
je 0x4219a8
push edi
push 0
push esi
call fcn.00427b00
mov ecx, dword [ebp - 0xc50]
add esp, 0xc
push ecx
push edi
push esi
call fcn.0042e825
mov edx, dword [ebp - 0xc60]
add esp, 0xc
mov dword [edx], esi
mov edi, dword [ebp - 0xc54]
mov eax, dword [ebp - 0xc58]
test eax, eax
je 0x4219bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp edi, ebx
je 0x4219cc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc50]
cmp eax, ebx
je 0x4219df
push eax
call fcn.00427598
add esp, 4
mov eax, dword [ebp - 0xc4c]
cmp eax, ebx
je 0x4219f2
push eax
call fcn.00427598
add esp, 4
mov eax, dword [ebp - 0xc48]
cmp eax, ebx
je 0x421a05
push eax
call fcn.00427598
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004265ea
mov esp, ebp
pop ebp
ret