Function at 0x420a33
Capabilities:
Check if file exists
Enumerate processes
Inspect section memory permissions

Disassembly:
push 0x23c
mov eax, 0x4c7e75
call fcn.0044d7c5
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x23c], ebx
call fcn.0044d1b0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x23c]
push ecx
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x42115b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041217e
push str.360tray.exe
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], ebx
call fcn.0040fc45
test eax, eax
je 0x42112a
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42112a
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421125
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421125
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421120
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421120
push str.kxescore.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42111b
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42111b
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421116
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421116
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421116
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421111
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421111
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42110c
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42110c
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421104
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421104
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420c5a
or esi, 0x100
jmp 0x42112d
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420c79
or esi, 0x200
jmp 0x42112d
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420c98
or esi, 0x400
jmp 0x42112d
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420cb7
or esi, 0x800
jmp 0x42112d
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210fc
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210fc
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210f4
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210f4
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210f4
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210f4
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420d66
or esi, 0x4000
jmp 0x42112d
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x420d85
or esi, 0x8000
jmp 0x42112d
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ec
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ec
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ec
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210e4
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210e4
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210e4
push str.avastsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210dc
push str.avastui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210dc
push str.avgui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210d4
push str.avgwdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210d4
push str.avgidsagent.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210d4
push str.mpmon.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210cc
push str.mpsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210cc
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210c4
push str.dwengine.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210c4
push str.dwservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210c4
push str.clamtray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210bc
push str.clamwin.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210bc
push str.avkservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210b4
push str.avktray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210b4
push str.fsm32.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ac
push str.fsma32.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ac
push str.fsorsp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210ac
push str.twssrv.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210a1
push str.twister.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4210a1
push str.dgservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421096
push str.drivergenius.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421096
push str.dtlservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42108b
push str.drivethelife.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x42108b
push str.pcmaster.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x421054
or esi, 0x10000000
jmp 0x42112d
push str.winguard.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x421080
push str.winguard_x64.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x42112d
or esi, 0x40000000
jmp 0x42112d
or esi, 0x8000000
jmp 0x42112d
or esi, 0x4000000
jmp 0x42112d
or esi, 0x2000000
jmp 0x42112d
or esi, 0x1000000
jmp 0x42112d
or esi, 0x800000
jmp 0x42112d
or esi, 0x400000
jmp 0x42112d
or esi, 0x200000
jmp 0x42112d
or esi, 0x100000
jmp 0x42112d
or esi, 0x80000
jmp 0x42112d
or esi, 0x40000
jmp 0x42112d
or esi, 0x20000
jmp 0x42112d
or esi, 0x10000
jmp 0x42112d
or esi, 0x2000
jmp 0x42112d
or esi, 0x1000
jmp 0x42112d
or esi, 0x80
jmp 0x42112d
or esi, 0x40
jmp 0x42112d
or esi, 0x20
jmp 0x42112d
or esi, 0x10
jmp 0x42112d
or esi, 8
jmp 0x42112d
or esi, 4
jmp 0x42112d
or esi, 2
jmp 0x42112d
or esi, 1
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040f083
cmp edi, ebx
jne 0x420a8e
lea eax, [ebp - 0x248]
push eax
call fcn.004203d4
mov eax, dword [ebp - 0x248]
pop ecx
cmp dword [eax - 0xc], ebx
je 0x421184
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421184
or esi, 0x20000000
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, esi
call fcn.0044d848
ret