Function at 0x411e60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f6b1
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x388], ecx
xor eax, eax
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x37c], eax
push ecx
xor edx, edx
mov dword [ebp - 4], eax
xor ecx, ecx
call fcn.00412750
add esp, 4
mov dword [ebp - 0x380], 0
lea eax, [ebp - 0x368]
push 0x22c
push 0
push eax
call fcn.004e5200
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411ef4
xor bl, bl
jmp 0x412009
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x411f1e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x412009
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov byte [ebp - 0x374], 0
mov dword [ebp - 0x378], 0
lea ecx, [ebp - 0x138]
call fcn.004ad0c0
push 1
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x134], 0
call fcn.004ada80
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
cmove eax, dword [ebp - 0x130]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x360]
lea ecx, [ebp - 0x378]
push eax
call fcn.004aeac0
add esp, 4
test al, al
je 0x411faa
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x384]
call fcn.004124d0
cmp byte [ebp - 0x1c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x411fd3
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x411fd3
push eax
call fcn.004e4a56
add esp, 4
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0
call fcn.004af6c0
lea eax, [ebp - 0x368]
push eax
push esi
call edi
test eax, eax
jne 0x411f24
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x37c]
mov bl, 1
mov dword [ebp - 0x374], eax
xor edi, edi
lea ecx, [edi + 3]
call fcn.00412480
test eax, eax
lea ecx, [edi + 4]
setne byte [ebp - 0x370]
call fcn.00412480
test eax, eax
lea ecx, [edi + 5]
setne byte [ebp - 0x36f]
call fcn.00412480
test eax, eax
lea ecx, [edi + 6]
setne byte [ebp - 0x36b]
call fcn.00412480
test eax, eax
lea ecx, [edi + 7]
setne byte [ebp - 0x36d]
call fcn.00412480
test eax, eax
mov byte [ebp - 0x36a], 0
mov byte [ebp - 0x369], 0
setne byte [ebp - 0x36c]
mov byte [ebp - 0x36e], 0
test bl, bl
je 0x412385
mov ecx, dword [ebp - 0x380]
mov eax, 0xe070381d
mov esi, dword [ebp - 0x384]
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 8
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
je 0x412385
test ebx, ebx
je 0x4123ab
add esi, 0xc
nop
cmp byte [esi + 0x110], 0
mov eax, esi
jne 0x4120be
mov eax, dword [esi - 4]
add eax, 4
push 0x5c
push eax
call fcn.004e4b65
add esp, 8
test eax, eax
jne 0x4120e2
cmp byte [esi + 0x110], al
mov eax, esi
jne 0x4120dd
mov eax, dword [esi - 4]
add eax, 4
jmp 0x4120e5
add eax, 2
push eax
lea ecx, [ebp - 0x138]
call fcn.004ad210
test edi, edi
jne 0x41211e
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.360tray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp byte [ebp - 0x36b], 0
jne 0x412181
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.360rp.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36b]
test eax, eax
je 0x412181
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.360sd.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36b]
cmp byte [ebp - 0x36a], 0
jne 0x4121e4
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.kxetray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36a]
test eax, eax
je 0x4121e4
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.kxescore.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36a]
cmp byte [ebp - 0x369], 0
jne 0x412247
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.qqpctray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x369]
test eax, eax
je 0x412247
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.qqpcrtp.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x369]
cmp byte [ebp - 0x370], 0
jne 0x41227b
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.hipstray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x370]
cmp byte [ebp - 0x36f], 0
jne 0x4122af
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.lenovotray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36f]
cmp byte [ebp - 0x36e], 0
jne 0x4122e3
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.securityhealthsystray.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36e]
cmp byte [ebp - 0x36d], 0
jne 0x412317
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.PopBlock.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36d]
cmp byte [ebp - 0x36c], 0
jne 0x41234b
cmp byte [ebp - 0x1c], 0
lea eax, [ebp - 0x12c]
push str.ADSafe.exe
cmove eax, dword [ebp - 0x130]
add eax, 4
push eax
call fcn.004f89f8
add esp, 8
test eax, eax
sete byte [ebp - 0x36c]
cmp byte [ebp - 0x1c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x412374
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x412374
push eax
call fcn.004e4a56
add esp, 4
add esi, 0x124
sub ebx, 1
jne 0x4120b0
jmp 0x4123ab
mov ecx, 1
call fcn.00412480
test eax, eax
mov ecx, 2
setne byte [ebp - 0x36a]
call fcn.00412480
test eax, eax
setne byte [ebp - 0x369]
xor eax, eax
cmp byte [ebp - 0x36c], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x36d], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x36b], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x36e], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x36f], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x370], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x369], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x36a], al
setne al
push eax
xor eax, eax
test edi, edi
setne al
push eax
push str.sfsw_d_d_dsfw_d_d_d_d_d_d
push dword [ebp - 0x388]
call fcn.004ad750
mov ebx, dword [ebp - 0x384]
add esp, 0x2c
test ebx, ebx
je 0x412463
mov edx, dword [ebp - 0x380]
push ecx
mov ecx, ebx
call fcn.00412750
mov ecx, dword [ebp - 0x374]
mov eax, 0xe070381d
sub ecx, ebx
add esp, 4
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push ebx
call fcn.00412700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret