Function at 0x43d560
Capabilities:
Check for time delay via gettickcount
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4aa56b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
mov al, byte [0x4d1c08]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
mov dword [esp + 0x14], edi
jne 0x419192
or al, 1
mov byte [0x4d1c08], al
call esi
mov dword [0x4d1c04], eax
call esi
sub eax, dword [0x4d1c04]
cmp eax, 0x2710
jae 0x4191a8
xor eax, eax
jmp 0x419395
call esi
mov dword [0x4d1c04], eax
lea eax, [edi + 4]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 8], ebx
jne 0x4191c2
xor eax, eax
jmp 0x419395
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x4191dc
xor eax, eax
jmp 0x419395
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x24]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x419385
mov edx, dword [0x4c2080]
push ecx
mov ebp, esp
lea eax, [esp + 0x4c]
test eax, eax
mov dword [esp + 0x20], esp
mov dword [ebp], edx
je 0x41931f
lea ecx, [esp + 0x4c]
shr ecx, 0x10
jne 0x4192c9
mov eax, dword [0x4d1ac8]
xor edi, edi
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x254]
mov eax, dword [eax + 8]
mov di, dx
push 0x100
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x419263
mov word [esp + 0x254], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x419283
lea eax, [esp + 0x254]
mov ecx, ebp
push eax
call fcn.00404c50
jmp 0x41931f
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.00405530
cmp eax, ebx
je 0x4192be
push esi
push eax
push edi
call fcn.00405b00
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x4192be
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.00405530
cmp eax, ebx
jne 0x419298
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004055f0
jmp 0x41931f
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x41931f
lea ecx, [esi + esi + 0xe]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x41931f
mov dword [eax], 1
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
mov word [eax + esi*2 + 0xc], bx
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, ecx
mov dword [ebp], edi
jb 0x41931f
mov eax, ecx
lea esi, [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [edx + 4]
mov dword [esp + 0x460], ebx
push eax
call fcn.00404b60
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x460], 0xffffffff
mov ecx, esi
call fcn.00419630
cmp eax, ebx
je 0x419364
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.004193b0
test eax, eax
jne 0x41937c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x419381
jmp 0x419208
mov byte [esp + 0x18], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, dword [esp + 0x450]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x44c
ret
add ecx, 0x1bc
jmp 0x419150