Function at 0x4c9fbe
Capabilities:
Enumerate processes
Get disk information

Disassembly:
push ebp
push ebx
mov edx, 0x97
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4c9fc5
call fcn.005423e0
push dword [esp + 0x26c]
call fcn.004fa4e0
mov edx, dword [esp + 0x268]
lea ecx, [esp]
call fcn.004fa000
mov eax, str.psapi.dll
push eax
push 0xffffffff
call fcn.00521008
mov dword [esp + 0x244], eax
lea ebp, [esp + 0x18]
mov dword [ebp], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x248], eax
cmp dword [esp + 0x248], 0
je 0x4ca25c
push 0x20c
call fcn.005410b0
mov dword [esp + 0x24c], eax
push 0x104
call fcn.005410b0
mov dword [esp + 0x250], eax
mov edx, 0x61ff84
lea ecx, [esp + 0x254]
call fcn.004fa008
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24c]
call sub.KERNEL32.dll_Process32FirstW
mov dword [esp + 0x258], eax
cmp dword [esp + 0x258], 0
je 0x4ca0a5
push dword [esp + 4]
mov edx, 0x61f062
pop ecx
call fcn.004fa4a0
je 0x4ca0a5
mov eax, 1
jmp 0x4ca0a7
xor eax, eax
and eax, eax
je 0x4ca238
lea ebp, [esp + 0x18]
push dword [ebp + 8]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4ca21b
push 0x20c
push dword [esp + 0x250]
push dword [esp + 0x10]
mov eax, str.GetProcessImageFileNameW
push eax
push dword [esp + 0x254]
call fcn.005210be
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x254]
call fcn.005410d0
lea eax, [esp + 0x14]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 4]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x20]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.0053f8e0
call fcn.004fa4e0
and eax, eax
je 0x4ca212
mov dword [esp + 0xc], 0x41
jmp 0x4ca165
mov eax, 0x5a
cmp eax, dword [esp + 0xc]
jl 0x4ca212
push dword [esp + 0xc]
mov eax, dword [esp + 0x258]
push eax
pop eax
call fcn.004fa410
push 0x104
push dword [esp + 0x254]
mov eax, dword [esp + 0x25c]
push eax
call sub.KERNEL32.dll_QueryDosDeviceW
mov ebx, eax
add ebx, ebx
add ebx, 0xfffffffc
mov dword [esp + 0x14], ebx
push dword [esp + 0x14]
push dword [esp + 0x254]
push dword [esp + 0x254]
call fcn.00541550
and eax, eax
je 0x4ca208
mov edx, dword [esp + 0x254]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov ebx, dword [esp + 0x258]
add ebx, dword [esp + 0x20]
push ebx
call fcn.005410d0
pop eax
lea eax, [esp + 8]
push eax
call fcn.00542280
jmp 0x4ca212
inc dword [esp + 0xc]
jno 0x4ca165
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24c]
call sub.KERNEL32.dll_Process32NextW
mov dword [esp + 0x258], eax
jmp 0x4ca083
push dword [esp + 0x248]
call sub.KERNEL32.dll_CloseHandle
push dword [esp + 0x24c]
call fcn.00541120
push dword [esp + 0x250]
call fcn.00541120
push dword [esp + 0x244]
call fcn.00520f48
mov edx, dword [esp + 4]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
pop eax
push eax
call fcn.004fa470
pop edx
add eax, edx
jmp 0x4ca290
push dword [esp]
call fcn.00542440
push dword [esp + 0x10]
call fcn.00542440
push dword [esp + 0x254]
call fcn.00542440
push dword [esp + 4]
call fcn.00542440
add esp, 0x25c
pop ebx
pop ebp
ret 4