Function at 0x4351b2
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x4c9b74
call fcn.0044d7c5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040f61d
add eax, 0x10
mov dword [ebp - 0x250], eax
xor esi, esi
push esi
lea edi, [ebp - 0x244]
mov dword [ebp - 4], esi
call fcn.0042a11d
mov edi, eax
push 0x4d6ba4
lea eax, [ebp - 0x24c]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.004114f0
push edi
push eax
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 2
call fcn.0041ef94
add esp, 0x20
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.0040f083
push 0x228
lea eax, [ebp - 0x238]
push esi
push eax
xor edi, edi
mov dword [ebp - 0x23c], esi
call fcn.0044d1b0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, esi
je 0x435692
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041217e
push str.360tray.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 6
call fcn.0040fc45
test eax, eax
je 0x43565e
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43565e
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435659
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435659
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435654
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435654
push str.kscan.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43564f
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43564f
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43564a
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43564a
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43564a
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435645
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435645
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435640
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435640
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435638
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435638
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435455
or edi, 0x100
jmp 0x435661
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435474
or edi, 0x200
jmp 0x435661
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435493
or edi, 0x400
jmp 0x435661
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x4354b2
or edi, 0x800
jmp 0x435661
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435630
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435630
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435628
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435628
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435628
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435628
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435561
or edi, 0x4000
jmp 0x435661
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435580
or edi, 0x8000
jmp 0x435661
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435620
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435620
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435620
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435618
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435618
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x435618
push str.radar.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x435661
or edi, 0x40000
jmp 0x435661
or edi, 0x20000
jmp 0x435661
or edi, 0x10000
jmp 0x435661
or edi, 0x2000
jmp 0x435661
or edi, 0x1000
jmp 0x435661
or edi, 0x80
jmp 0x435661
or edi, 0x40
jmp 0x435661
or edi, 0x20
jmp 0x435661
or edi, 0x10
jmp 0x435661
or edi, 8
jmp 0x435661
or edi, 4
jmp 0x435661
or edi, 2
jmp 0x435661
or edi, 1
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 5
call fcn.0040f083
cmp dword [ebp - 0x248], esi
jne 0x435288
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x502868
push esi
lea ecx, [ebp - 0x248]
call fcn.0040fd3c
push edi
lea eax, [ebp - 0x248]
push 0x4d6b88
push eax
mov byte [ebp - 4], 7
call fcn.0041182d
add esp, 0xc
lea ecx, [ebp - 0x274]
call fcn.00410878
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.pcmaster.exe
mov byte [ebp - 4], 8
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0x24c], esp
push eax
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 9
call fcn.00420283
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 8
call fcn.00418668
push dword [ebp - 0x254]
mov byte [ebp - 4], 0xa
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435787
push dword [ebp - 0x254]
lea edi, [ebp - 0x24c]
call fcn.0042a11d
push eax
lea eax, [ebp - 0x244]
push 0x4d6b74
push eax
mov byte [ebp - 4], 0xb
call fcn.00429e17
add esp, 0x10
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x250]
push eax
mov byte [ebp - 4], 0xc
call fcn.0041ed16
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.0040f083
push esi
lea ecx, [ebp - 0x240]
call fcn.0040fd3c
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], 0xd
call fcn.0043477a
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push 0x4d6b64
push eax
call fcn.00429e17
add esp, 0x10
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x250]
push eax
mov byte [ebp - 4], 0xe
call fcn.0041ed16
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xd
call fcn.0040f083
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x244]
push str._n_nError
push eax
call fcn.00429e17
add esp, 0xc
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x250]
push eax
mov byte [ebp - 4], 0xf
call fcn.0041ed16
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.0040f083
push dword [ebp + 0x14]
mov esi, dword [ebp - 0x250]
push dword [ebp - 0x258]
push esi
push dword [ebp - 0x25c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040f083
mov ecx, dword [ebp - 0x254]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x274]
call fcn.00410276
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x258]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [esi - 0x10]
call fcn.0040f083
mov eax, edi
call fcn.0044d848
ret