Function at 0x4c64ca
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x584f5e
call fcn.004fb9d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x228
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x238]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x23c], ebx
call fcn.004fc1f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4c693e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0043479c
and dword [ebp - 4], 0
push str.360tray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c6909
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c6909
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c6904
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c6904
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68ff
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68ff
push str.kscan.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68fa
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68fa
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68f5
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68f5
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68f5
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68f0
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68f0
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68eb
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68eb
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68e3
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68e3
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c6700
or ebx, 0x100
jmp 0x4c690c
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c671f
or ebx, 0x200
jmp 0x4c690c
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c673e
or ebx, 0x400
jmp 0x4c690c
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c675d
or ebx, 0x800
jmp 0x4c690c
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68db
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68db
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68d3
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68d3
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68d3
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68d3
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c680c
or ebx, 0x4000
jmp 0x4c690c
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c682b
or ebx, 0x8000
jmp 0x4c690c
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68cb
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68cb
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68cb
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68c3
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68c3
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4c68c3
push str.radar.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4c690c
or ebx, 0x40000
jmp 0x4c690c
or ebx, 0x20000
jmp 0x4c690c
or ebx, 0x10000
jmp 0x4c690c
or ebx, 0x2000
jmp 0x4c690c
or ebx, 0x1000
jmp 0x4c690c
or ebx, 0x80
jmp 0x4c690c
or ebx, 0x40
jmp 0x4c690c
or ebx, 0x20
jmp 0x4c690c
or ebx, 0x10
jmp 0x4c690c
or ebx, 8
jmp 0x4c690c
or ebx, 4
jmp 0x4c690c
or ebx, 2
jmp 0x4c690c
or ebx, 1
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x248], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004310e3
cmp dword [ebp - 0x248], 0
jne 0x4c6533
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x602968
push esi
lea ecx, [ebp - 0x250]
call fcn.00431ef7
mov dword [ebp - 4], 3
push ebx
lea eax, [ebp - 0x250]
push 0x59c064
push eax
call fcn.00433c96
add esp, 0xc
push dword [ebp - 0x244]
lea ecx, [ebp - 0x24c]
call fcn.004324a9
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x26c]
call fcn.00432a3a
mov byte [ebp - 4], 6
push esi
lea ecx, [ebp - 0x240]
call fcn.00431ef7
mov byte [ebp - 4], 8
lea eax, [ebp - 0x240]
push eax
call fcn.004c57ea
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push 0x5ab284
push eax
call fcn.004b01ac
add esp, 0x10
mov byte [ebp - 4], 9
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0043a942
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.004310e3
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x244]
push str._n_nError
push eax
call fcn.004b01ac
add esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0043a942
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.004310e3
push esi
lea ecx, [ebp - 0x248]
call fcn.00431ef7
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x244]
push eax
xor ecx, ecx
call fcn.004b1e5e
mov byte [ebp - 4], 0xf
push dword [edi]
push dword [eax]
lea eax, [ebp - 0x248]
push 0x5ab248
push eax
call fcn.00433c96
add esp, 0x14
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.004310e3
push dword [ebp + 0x10]
mov esi, dword [ebp - 0x248]
push esi
push dword [ebp - 0x24c]
push dword [ebp - 0x254]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
mov byte [ebp - 4], 8
lea ecx, [esi - 0x10]
call fcn.004310e3
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x26c]
call fcn.00432a92
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, edi
call fcn.004fba53
ret