Function at 0x40a330
Capabilities:
Enumerate processes
Query environment variable

Disassembly:
push ebp
mov eax, 0x40a867
mov ebp, esp
push edi
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30c]
push esi
mov esi, 0x41f030
lea edi, [ebp - 0x28]
push ebx
sub esp, 0x34c
mov ebx, 0x422ec4
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2f4], esi
mov esi, 0xffffffff
mov dword [ebp - 0x2f0], ebx
mov ebx, 0x22
mov dword [ebp - 0x2e4], esp
mov dword [esp], edx
call fcn.00421aa0
mov dword [ebp - 0x310], esp
mov dword [esp], edi
mov dword [ebp - 0x308], esi
call fcn.004086c0
mov dword [esp + 8], ebx
mov ecx, str._TIME_:_n
lea eax, [ebp - 0x28]
mov dword [esp + 4], ecx
mov edx, 1
mov dword [esp], eax
mov dword [ebp - 0x308], edx
call fcn.00408730
lea edi, [ebp - 0x38]
mov dword [esp], edi
call sub.KERNEL32.dll_GetSystemTime
sub esp, 4
lea edx, [ebp - 0x48]
mov dword [esp], edx
call sub.KERNEL32.dll_GetLocalTime
movzx eax, word [ebp - 0x40]
sub esp, 4
mov ebx, str.Time_zone:_GMT__c_i_n
movzx edx, word [ebp - 0x30]
lea ecx, [ebp - 0x88]
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, 1
movzx esi, word [ebp - 0x40]
movzx edi, word [ebp - 0x30]
mov dword [esp + 4], ebx
mov dword [esp], ecx
sub esi, edi
sar esi, 0x1f
and esi, 2
add esi, 0x2b
mov dword [esp + 8], esi
mov dword [ebp - 0x308], eax
call sub.msvcrt.dll_sprintf
lea esi, [ebp - 0x88]
mov ecx, esi
lea esi, [esi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x40a430
and edx, 0x8080
je 0x40a8a2
add al, al
lea edi, [ebp - 0x88]
sbb ecx, 3
sub ecx, esi
lea esi, [ebp - 0x28]
mov dword [esp + 8], ecx
mov ecx, 1
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x308], ecx
call fcn.00408730
movzx edx, word [ebp - 0x3c]
mov dword [esp + 0x1c], edx
mov edx, str.Local_time:__i._i._i__i:_i:_i_n
movzx eax, word [ebp - 0x3e]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x88]
movzx edi, word [ebp - 0x40]
mov dword [esp + 0x14], edi
movzx esi, word [ebp - 0x48]
mov dword [esp + 0x10], esi
movzx ecx, word [ebp - 0x46]
mov dword [esp + 0xc], ecx
movzx ebx, word [ebp - 0x42]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ebx
call sub.msvcrt.dll_sprintf
lea esi, [ebp - 0x88]
mov ecx, esi
mov esi, esi
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x40a4d0
and edx, 0x8080
jne 0x40a4f6
shr eax, 0x10
add ecx, 2
add al, al
lea edi, [ebp - 0x88]
sbb ecx, 3
sub ecx, esi
lea esi, [ebp - 0x28]
mov dword [esp + 8], ecx
mov ecx, 1
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x308], ecx
call fcn.00408730
call sub.KERNEL32.dll_GetTickCount
mov ebx, 0x45e7b273
mul ebx
lea eax, [ebp - 0x88]
mov dword [esp], eax
shr edx, 0xe
mov dword [esp + 8], edx
mov edx, str.Uptime:__i_min_n
mov dword [esp + 4], edx
call sub.msvcrt.dll_sprintf
lea esi, [ebp - 0x88]
mov ecx, esi
mov edi, dword [ecx]
add ecx, 4
lea edx, [edi - 0x1010101]
not edi
and edx, edi
mov eax, edx
and eax, 0x80808080
je 0x40a553
and edx, 0x8080
jne 0x40a579
shr eax, 0x10
add ecx, 2
add al, al
lea eax, [ebp - 0x88]
sbb ecx, 3
sub ecx, esi
lea esi, [ebp - 0x28]
mov dword [esp + 8], ecx
mov ecx, 1
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x308], ecx
call fcn.00408730
mov edi, 2
mov ebx, 0x4251a7
lea edx, [ebp - 0x28]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.00408730
mov eax, 0x23
mov esi, str._PROGRAM_FILES_:_n
lea ecx, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.00408730
mov dword [esp], str.PROGRAMFILES
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x26
and eax, 0xfffffff0
call fcn.00421960
lea edi, [esp + 0x2f]
mov ebx, str._s.
and edi, 0xfffffff0
mov dword [ebp - 0x314], edi
mov dword [esp], str.PROGRAMFILES
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x314]
mov dword [esp], edx
call sub.msvcrt.dll_sprintf
lea esi, [ebp - 0x1a8]
mov dword [esp + 4], esi
mov ecx, dword [ebp - 0x314]
mov dword [esp], ecx
call sub.msvcrt.dll__findfirst
mov dword [ebp - 0x318], eax
test eax, eax
je 0x40a73e
cld
mov ecx, 2
mov edi, 0x4251e4
lea esi, [ebp - 0x194]
repe cmpsb byte [esi], byte es:[edi]
je 0x40a6fa
mov ecx, 3
mov edi, 0x4251e6
lea esi, [ebp - 0x194]
repe cmpsb byte [esi], byte es:[edi]
je 0x40a6fa
lea ecx, [ebp - 0x194]
mov esi, ecx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x40a68c
and edx, 0x8080
jne 0x40a6b2
shr eax, 0x10
add ecx, 2
add al, al
lea edi, [ebp - 0x194]
lea ebx, [ebp - 0x28]
sbb ecx, 3
mov dword [esp + 4], edi
sub ecx, esi
mov dword [esp], ebx
mov edx, 1
mov dword [esp + 8], ecx
mov dword [ebp - 0x308], edx
call fcn.00408730
mov eax, 1
mov ecx, 0x4251e9
lea esi, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], esi
call fcn.00408730
lea edi, [ebp - 0x1a8]
mov edx, 1
mov dword [esp + 4], edi
mov ebx, dword [ebp - 0x318]
mov dword [esp], ebx
mov dword [ebp - 0x308], edx
call sub.msvcrt.dll__findnext
test eax, eax
je 0x40a657
mov ecx, dword [ebp - 0x318]
mov esi, 1
mov dword [esp], ecx
mov dword [ebp - 0x308], esi
call sub.msvcrt.dll__findclose
mov edi, 2
mov ebx, 0x4251a7
lea edx, [ebp - 0x28]
mov dword [esp + 8], edi
mov eax, 1
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [ebp - 0x308], eax
call fcn.00408730
mov eax, 0x24
mov ecx, str._PROCESS_LIST_:_n
lea esi, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], esi
call fcn.00408730
mov dword [esp], 2
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x31c], eax
sub esp, 8
test eax, eax
je 0x40a8c9
mov esi, 0x128
lea edi, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], esi
mov dword [esp + 4], edi
mov ebx, dword [ebp - 0x31c]
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x40a8ad
lea esi, [ebp - 0x2b4]
mov ecx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x40a7dc
and edx, 0x8080
jne 0x40a802
shr eax, 0x10
add ecx, 2
add al, al
lea ebx, [ebp - 0x2b4]
lea edx, [ebp - 0x28]
sbb ecx, 3
sub ecx, esi
mov dword [esp + 8], ecx
mov ecx, 1
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [ebp - 0x308], ecx
call fcn.00408730
mov eax, 1
mov esi, 0x4251e9
lea edi, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408730
lea edx, [ebp - 0x2d8]
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0x31c]
mov dword [esp], ecx
call sub.KERNEL32.dll_Process32Next
jmp 0x40a7c9
shr eax, 0x10
add ecx, 2
jmp 0x40a454
mov edi, dword [ebp - 0x31c]
mov ebx, 1
mov dword [esp], edi
mov dword [ebp - 0x308], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov edx, 2
mov ecx, 0x4251a7
lea eax, [ebp - 0x28]
mov dword [esp + 8], edx
mov esi, 1
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [ebp - 0x308], esi
call fcn.00408730
mov ebx, dword [ebp - 0x24]
inc ebx
mov dword [esp], ebx
call fcn.0041f830
mov dword [ebp - 0x320], eax
mov esi, dword [ebp - 0x28]
mov dword [esp + 4], esi
mov edi, dword [ebp - 0x320]
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
lea ecx, [ebp - 0x28]
mov eax, 0xffffffff
lea esi, [ebp - 0x30c]
mov dword [esp], ecx
mov dword [ebp - 0x308], eax
call fcn.00408710
mov esp, dword [ebp - 0x310]
mov dword [esp], esi
call fcn.00421b80
mov eax, dword [ebp - 0x320]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret