Function at 0x437b40
Capabilities:
Check for time delay via gettickcount
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4b0b1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
mov al, byte [0x4d7588]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
mov dword [esp + 0x14], edi
jne 0x4152b2
or al, 1
mov byte [0x4d7588], al
call esi
mov dword [0x4d7584], eax
call esi
sub eax, dword [0x4d7584]
cmp eax, 0x2710
jae 0x4152c8
xor eax, eax
jmp 0x4154b5
call esi
mov dword [0x4d7584], eax
lea eax, [edi + 4]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [eax - 8], ebx
jne 0x4152e2
xor eax, eax
jmp 0x4154b5
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x4152fc
xor eax, eax
jmp 0x4154b5
mov ecx, 0x8b
xor eax, eax
lea edi, [esp + 0x24]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4154a5
mov edx, dword [0x4c8080]
push ecx
mov ebp, esp
lea eax, [esp + 0x4c]
test eax, eax
mov dword [esp + 0x20], esp
mov dword [ebp], edx
je 0x41543f
lea ecx, [esp + 0x4c]
shr ecx, 0x10
jne 0x4153e9
mov eax, dword [0x4d7448]
xor edi, edi
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x254]
mov eax, dword [eax + 8]
mov di, dx
push 0x100
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x415383
mov word [esp + 0x254], bx
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x4153a3
lea eax, [esp + 0x254]
mov ecx, ebp
push eax
call fcn.00404b70
jmp 0x41543f
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.004058b0
cmp eax, ebx
je 0x4153de
push esi
push eax
push edi
call fcn.00405e80
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x4153de
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.004058b0
cmp eax, ebx
jne 0x4153b8
push 0xffffffffffffffff
mov ecx, ebp
call fcn.00405970
jmp 0x41543f
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp esi, ebx
je 0x41543f
lea ecx, [esi + esi + 0xe]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x41543f
mov dword [eax], 1
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
mov word [eax + esi*2 + 0xc], bx
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, ecx
mov dword [ebp], edi
jb 0x41543f
mov eax, ecx
lea esi, [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [edx + 4]
mov dword [esp + 0x460], ebx
push eax
call fcn.00404710
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x460], 0xffffffff
mov ecx, esi
call fcn.00415750
cmp eax, ebx
je 0x415484
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.004154d0
test eax, eax
jne 0x41549c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4154a1
jmp 0x415328
mov byte [esp + 0x18], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, dword [esp + 0x450]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x44c
ret
add ecx, 0x188
jmp 0x415270