Function at 0x4278f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00512af0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x428009
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x244]
call fcn.0041c8a0
push str.360tray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x4279a0
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x4279b4
mov ecx, dword [ebp - 0x23c]
or ecx, 1
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.360sd.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x4279dc
push str.360rp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x4279f0
mov edx, dword [ebp - 0x23c]
or edx, 2
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.ksafetray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427a18
push str.ksafesvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427a2c
mov eax, dword [ebp - 0x23c]
or eax, 4
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.kxescore.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427a54
push str.kxetray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427a68
mov ecx, dword [ebp - 0x23c]
or ecx, 8
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.qqpctray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427aa4
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427aa4
push str.qqpcrtp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427ab8
mov edx, dword [ebp - 0x23c]
or edx, 0x10
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.avgnt.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ae0
push str.avcenter.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427af4
mov eax, dword [ebp - 0x23c]
or eax, 0x20
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.egui.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427b1c
push str.ekrn.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427b30
mov ecx, dword [ebp - 0x23c]
or ecx, 0x40
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.rstray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427b58
push str.ravmond.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427b6f
mov edx, dword [ebp - 0x23c]
or edx, 0x80
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.avp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427b99
mov eax, dword [ebp - 0x23c]
or eax, 0x100
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.msmpeng.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427bc4
mov ecx, dword [ebp - 0x23c]
or ecx, 0x200
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.ccsvchst.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427bef
mov edx, dword [ebp - 0x23c]
or edx, 0x400
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.bdagent.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427c19
mov eax, dword [ebp - 0x23c]
or eax, 0x800
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.kvmonxp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427c41
push str.kvsrvxp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427c58
mov ecx, dword [ebp - 0x23c]
or ecx, 0x1000
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.uiseagnt.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ca8
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ca8
push str.coreserviceshell.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ca8
push str.uiwatchdog.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427cbf
mov edx, dword [ebp - 0x23c]
or edx, 0x2000
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.mcshield.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427ce9
mov eax, dword [ebp - 0x23c]
or eax, 0x4000
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.cfp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427d14
mov ecx, dword [ebp - 0x23c]
or ecx, 0x8000
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.baidusd.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427d50
push str.baidusdsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427d50
push str.baidusdtray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427d67
mov edx, dword [ebp - 0x23c]
or edx, 0x10000
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.baiduantray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427da3
push str.baiduan.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427da3
push str.baiduansvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427db9
mov eax, dword [ebp - 0x23c]
or eax, 0x20000
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.avastsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427de1
push str.avastui.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427df8
mov ecx, dword [ebp - 0x23c]
or ecx, 0x40000
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.avgui.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427e34
push str.avgwdsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427e34
push str.avgidsagent.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427e4b
mov edx, dword [ebp - 0x23c]
or edx, 0x80000
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.mpmon.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427e73
push str.mpsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427e89
mov eax, dword [ebp - 0x23c]
or eax, 0x100000
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ec5
push str.dwengine.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427ec5
push str.dwservice.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427edc
mov ecx, dword [ebp - 0x23c]
or ecx, 0x200000
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.clamtray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427f04
push str.clamwin.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427f1b
mov edx, dword [ebp - 0x23c]
or edx, 0x400000
mov dword [ebp - 0x23c], edx
jmp 0x427fe3
push str.avkservice.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427f43
push str.avktray.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427f59
mov eax, dword [ebp - 0x23c]
or eax, 0x800000
mov dword [ebp - 0x23c], eax
jmp 0x427fe3
push str.fsm32.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427f95
push str.fsma32.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427f95
push str.fsorsp.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427fa9
mov ecx, dword [ebp - 0x23c]
or ecx, 0x1000000
mov dword [ebp - 0x23c], ecx
jmp 0x427fe3
push str.twssrv.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
je 0x427fd1
push str.twister.exe
lea ecx, [ebp - 0x244]
call fcn.00430140
test eax, eax
jne 0x427fe3
mov edx, dword [ebp - 0x23c]
or edx, 0x2000000
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x244]
call fcn.0040f740
jmp 0x42795c
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret