Function at 0x435120
Capabilities:
Check for time delay via gettickcount
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4a10eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
mov al, byte [0x4c71e8]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
mov dword [esp + 0x14], edi
jne 0x4175e2
or al, 1
mov byte [0x4c71e8], al
call esi
mov dword [0x4c71e4], eax
call esi
sub eax, dword [0x4c71e4]
cmp eax, 0x2710
jae 0x4175f8
xor eax, eax
jmp 0x4177e5
call esi
mov dword [0x4c71e4], eax
lea eax, [edi + 4]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 8], ebx
jne 0x417612
xor eax, eax
jmp 0x4177e5
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x41762c
xor eax, eax
jmp 0x4177e5
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x24]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4177d5
mov edx, dword [0x4b7080]
push ecx
mov ebp, esp
lea eax, [esp + 0x4c]
test eax, eax
mov dword [esp + 0x20], esp
mov dword [ebp], edx
je 0x41776f
lea ecx, [esp + 0x4c]
shr ecx, 0x10
jne 0x417719
mov eax, dword [0x4c6f78]
xor edi, edi
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x254]
mov eax, dword [eax + 8]
mov di, dx
push 0x100
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x4176b3
mov word [esp + 0x254], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x4176d3
lea eax, [esp + 0x254]
mov ecx, ebp
push eax
call fcn.00405d80
jmp 0x41776f
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.00406ac0
cmp eax, ebx
je 0x41770e
push esi
push eax
push edi
call fcn.00406fc0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x41770e
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.00406ac0
cmp eax, ebx
jne 0x4176e8
push 0xffffffffffffffff
mov ecx, ebp
call fcn.00406b80
jmp 0x41776f
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x41776f
lea ecx, [esi + esi + 0xe]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x41776f
mov dword [eax], 1
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
mov word [eax + esi*2 + 0xc], bx
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, ecx
mov dword [ebp], edi
jb 0x41776f
mov eax, ecx
lea esi, [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [edx + 4]
mov dword [esp + 0x460], ebx
push eax
call fcn.00405920
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x460], 0xffffffff
mov ecx, esi
call fcn.00417a80
cmp eax, ebx
je 0x4177b4
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00417800
test eax, eax
jne 0x4177cc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4177d1
jmp 0x417658
mov byte [esp + 0x18], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, dword [esp + 0x450]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x44c
ret
add ecx, 0x188
jmp 0x4175a0