Function at 0x4332f7
Capabilities:
Check for time delay via gettickcount
Enumerate process modules
Enumerate processes

Disassembly:
push 0xb50
mov eax, 0x4771b0
call fcn.0045bedd
mov eax, dword [ebp + 8]
push 0x12
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp + 0x10]
mov esi, ecx
pop edi
xor ebx, ebx
mov dword [ebp - 0xa9c], esi
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa90], edi
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xab4], eax
call fcn.0044825c
push eax
lea ecx, [ebp - 0xa84]
call fcn.0041872d
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xaa4], eax
cmp eax, 0xffffffff
jne 0x4333c5
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xaa4], eax
cmp eax, 0xffffffff
jne 0x4333c5
push str.CreateToolhelp32Snapshot_failed
lea ecx, [ebp - 0xa90]
call fcn.004020a6
push ebx
lea eax, [ebp - 0xa90]
push eax
push 2
mov byte [ebp - 4], 1
call fcn.004152d1
mov ecx, dword [ebp - 0xa90]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0xa84]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, edi
call fcn.0045bf60
ret
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0xaa4]
mov dword [ebp - 0x654], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x433430
push str.Process32First_failed
lea ecx, [ebp - 0xa90]
call fcn.004020a6
push ebx
lea eax, [ebp - 0xa90]
push eax
push 2
mov byte [ebp - 4], 2
call fcn.004152d1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xa90]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push dword [ebp - 0xaa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4333af
mov esi, dword [ebp - 0xa9c]
call fcn.0044825c
push eax
lea ecx, [ebp - 0xa8c]
call fcn.0041872d
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x64c]
push eax
mov dword [ebp - 0xa88], eax
lea eax, [ebp - 0xa84]
push str.Start_collected_process__ID:__ld
push eax
call fcn.00402086
add esp, 0xc
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
pop ecx
pop ecx
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0xa94]
call fcn.004020a6
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xae4], eax
mov eax, dword [esi]
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0xb10]
push eax
call fcn.004366d6
lea edi, [ebp - 0xae8]
mov esi, eax
call fcn.00436b64
test al, al
jne 0x4334ee
push str.Skipping_previously_failed_process
lea ecx, [ebp - 0xac4]
call fcn.004020a6
lea eax, [ebp - 0xac4]
push ebx
push eax
mov byte [ebp - 4], 5
call fcn.00415318
pop ecx
pop ecx
mov ecx, dword [ebp - 0xac4]
jmp 0x433c46
push dword [ebp - 0xa88]
push ebx
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xaa0], eax
cmp eax, ebx
jne 0x433556
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push dword [ebp - 0xa94]
push str.Unable_to_access_process:_Name:__s__ID:__ld
push eax
call fcn.00402086
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
mov ebx, dword [ebp - 0xa9c]
add esp, 0x18
lea eax, [ebp - 0xa88]
push eax
lea edi, [ebp - 0xb5c]
call fcn.004365fb
xor ebx, ebx
jmp 0x433c4e
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0xadc], 0x104
call fcn.00459cf0
add esp, 0xc
push str.Kernel32.dll
mov dword [ebp - 0xa98], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x43364d
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa98], eax
cmp eax, ebx
je 0x43364d
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0xaa0]
call dword [ebp - 0xa98]
test eax, eax
je 0x43364d
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xad8]
call fcn.004020a6
mov edi, dword [ebp - 0xaac]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xafc], eax
mov eax, dword [edi]
mov dword [ebp - 0xb00], eax
lea eax, [ebp - 0xad8]
push eax
lea eax, [ebp - 0xb08]
push eax
call fcn.00436550
lea edi, [ebp - 0xb00]
mov esi, eax
call fcn.00436b64
mov ecx, dword [ebp - 0xad8]
neg al
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0xa7d], al
call fcn.004025d2
cmp byte [ebp - 0xa7d], bl
je 0x43364d
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xa8c]
call fcn.0040211a
mov eax, dword [ebp - 0xa8c]
cmp dword [eax - 0xc], ebx
jne 0x433740
cmp dword [ebp - 0xa98], ebx
jne 0x433740
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0xaa0]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x433717
push esi
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xacc]
call fcn.004020a6
mov edi, dword [ebp - 0xaac]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xaf4], eax
mov eax, dword [edi]
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xacc]
push eax
lea eax, [ebp - 0xb20]
push eax
call fcn.00436550
lea edi, [ebp - 0xaf8]
mov esi, eax
call fcn.00436b64
mov ecx, dword [ebp - 0xacc]
neg al
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0xa7d], al
call fcn.004025d2
cmp byte [ebp - 0xa7d], bl
je 0x433740
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xa8c]
call fcn.0040211a
jmp 0x433740
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.00402086
add esp, 0xc
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
pop ecx
pop ecx
mov esi, dword [ebp - 0xa8c]
cmp dword [esi - 0xc], ebx
jne 0x433aa4
push dword [ebp - 0xa88]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0xab8], esi
cmp esi, 0xffffffff
je 0x433a76
lea eax, [ebp - 0xa7c]
push eax
push esi
mov dword [ebp - 0xa7c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x43378e
push esi
jmp 0x433a6b
mov dword [ebp - 0xa98], ebx
xor eax, eax
push 0x206
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00459cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0xa60]
push dword [ebp - 0xaa0]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x433a01
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0xac0]
call fcn.004020a6
mov edi, dword [ebp - 0xaac]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xaec], eax
mov eax, dword [edi]
mov dword [ebp - 0xaf0], eax
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.00436550
lea edi, [ebp - 0xaf0]
mov esi, eax
call fcn.00436b64
mov ecx, dword [ebp - 0xac0]
neg al
sbb al, al
inc al
add ecx, 0xfffffff0
mov byte [ebp - 0xa7d], al
call fcn.004025d2
cmp byte [ebp - 0xa7d], bl
je 0x433a2a
lea edi, [ebp - 0xa94]
call fcn.0040c442
push str.explorer.exe
mov ecx, eax
call fcn.0040ae5c
test eax, eax
jne 0x4338b7
push dword [ebp - 0xa8c]
lea eax, [ebp - 0xa84]
push dword [ebp - 0xa88]
push str.Skipping_process:_Name:_explorer.exe__ID:__ld__file_in_use:__s
push eax
call fcn.00402086
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
add esp, 0x18
lea edi, [ebp - 0xb44]
mov ebx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xa88]
push eax
call fcn.004365fb
mov dword [ebp - 0xa98], 1
xor ebx, ebx
jmp 0x433a2a
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0xa8c]
mov dword [ebp - 0xa90], 0x4de
call fcn.0040211a
mov esi, dword [ebp - 0xa8c]
push esi
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push dword [ebp - 0xa94]
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402086
add esp, 0x14
push ebx
lea eax, [ebp - 0xa84]
push eax
push 2
call fcn.004152d1
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0xa8c]
call fcn.0040c420
cmp eax, 0xffffffff
je 0x433970
mov ecx, dword [esi - 0xc]
sub ecx, eax
dec ecx
push ecx
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0xa8c]
call fcn.0040c468
lea eax, [ebp - 0xa7d]
push eax
mov byte [ebp - 4], 6
mov edi, dword [ebp - 0xae0]
push 0x48325c
push edi
push str.Wait_Collected_Files_List
mov esi, 0x4c46e8
mov byte [ebp - 0xa7d], 1
call fcn.0040b111
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 4
call fcn.004025d2
push dword [ebp + 0xc]
push dword [ebp - 0xaa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4339ca
cmp eax, ebx
je 0x4339ca
push str.Wait_failed
lea ecx, [ebp - 0xac8]
call fcn.004020a6
lea eax, [ebp - 0xac8]
push ebx
push eax
mov byte [ebp - 4], 8
call fcn.00415318
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xac8]
add ecx, 0xfffffff0
call fcn.004025d2
lea edi, [ebp - 0xb50]
jmp 0x433894
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xad0]
call fcn.004020a6
lea eax, [ebp - 0xad0]
push ebx
push eax
mov byte [ebp - 4], 7
call fcn.00415318
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xad0]
add ecx, 0xfffffff0
call fcn.004025d2
jmp 0x433a2a
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push str.GetModuleFileNameEx_failed_for_process__ID:__ld
push eax
call fcn.00402086
add esp, 0xc
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xab0]
mov dword [ecx], eax
cmp dword [ebp - 0xa98], ebx
jne 0x433a65
cmp eax, dword [ebp + 0xc]
jae 0x433a65
lea eax, [ebp - 0xa7c]
push eax
push dword [ebp - 0xab8]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x433794
push dword [ebp - 0xab8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x433c4e
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push str.CreateToolhelp32Snapshot::TH32CS_SNAPMODULE_failed_for_process__ID:__ld
push eax
call fcn.00402086
add esp, 0xc
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
pop ecx
pop ecx
jmp 0x433c4e
lea edi, [ebp - 0xa94]
call fcn.0040c442
push eax
lea ecx, [ebp - 0xaa8]
call fcn.004020ea
push str.acrotray.exe
lea ecx, [ebp - 0xaa8]
mov byte [ebp - 4], 9
call fcn.0040ae5c
test eax, eax
je 0x433bf6
push str.acrodist.exe
lea ecx, [ebp - 0xaa8]
call fcn.0040ae5c
test eax, eax
je 0x433bf6
push str.adobecollabsync.exe
lea ecx, [ebp - 0xaa8]
call fcn.0040ae5c
test eax, eax
je 0x433bf6
push esi
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push dword [ebp - 0xa94]
mov dword [ebp - 0xa90], 0x4de
push str.Entered_wait_for_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402086
add esp, 0x14
push ebx
lea eax, [ebp - 0xa84]
push eax
push 2
call fcn.004152d1
add esp, 0xc
lea eax, [ebp - 0xa7d]
push eax
push 0x48325c
push dword [ebp - 0xa94]
mov esi, 0x4c46e8
push str.Wait_Collected_Files_List
mov byte [ebp - 0xa7d], 1
call fcn.0040b111
push dword [ebp + 0xc]
push dword [ebp - 0xaa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x433bc3
cmp eax, ebx
je 0x433bc3
push str.Wait_failed
lea ecx, [ebp - 0xad4]
call fcn.004020a6
lea eax, [ebp - 0xad4]
push ebx
push eax
mov byte [ebp - 4], 0xb
call fcn.00415318
pop ecx
pop ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xad4]
add ecx, 0xfffffff0
call fcn.004025d2
lea edi, [ebp - 0xb38]
jmp 0x433c2c
push str.Timed_out_or_process_has_ended
lea ecx, [ebp - 0xabc]
call fcn.004020a6
lea eax, [ebp - 0xabc]
push ebx
push eax
mov byte [ebp - 4], 0xa
call fcn.00415318
pop ecx
pop ecx
mov ecx, dword [ebp - 0xabc]
add ecx, 0xfffffff0
call fcn.004025d2
jmp 0x433c40
push esi
push dword [ebp - 0xa88]
lea eax, [ebp - 0xa84]
push dword [ebp - 0xa94]
push str.Skipping_process:_Name:__s__ID:__ld__file_in_use:__s
push eax
call fcn.00402086
add esp, 0x14
lea eax, [ebp - 0xa84]
push ebx
push eax
call fcn.00415318
pop ecx
pop ecx
lea edi, [ebp - 0xb2c]
mov ebx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xa88]
push eax
call fcn.004365fb
xor ebx, ebx
mov ecx, dword [ebp - 0xaa8]
add ecx, 0xfffffff0
call fcn.004025d2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xa94]
mov esi, dword [ebp - 0xab0]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.004025d2
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xa8c]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, dword [ebp + 0xc]
cmp dword [esi], eax
jae 0x433ca2
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0xaa4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43342a
push dword [ebp - 0xaa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xa90]
mov ecx, esi
mov dword [ecx], eax
jmp 0x4333af