Function at 0x4bc893
Capabilities:
Check if file exists
Enumerate processes
Inspect section memory permissions

Disassembly:
push 0x23c
mov eax, 0x582739
call fcn.004fb9d0
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x23c], ebx
call fcn.004fc1f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x23c]
push ecx
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4bcfbb
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0043479c
mov dword [ebp - 4], ebx
push str.360tray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf8a
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf8a
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf85
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf85
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf80
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf80
push str.kxescore.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf7b
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf7b
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf76
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf76
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf76
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf71
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf71
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf6c
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf6c
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf64
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf64
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcaba
or esi, 0x100
jmp 0x4bcf8d
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcad9
or esi, 0x200
jmp 0x4bcf8d
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcaf8
or esi, 0x400
jmp 0x4bcf8d
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcb17
or esi, 0x800
jmp 0x4bcf8d
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf5c
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf5c
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf54
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf54
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf54
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf54
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcbc6
or esi, 0x4000
jmp 0x4bcf8d
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcbe5
or esi, 0x8000
jmp 0x4bcf8d
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf4c
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf4c
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf4c
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf44
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf44
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf44
push str.avastsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf3c
push str.avastui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf3c
push str.avgui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf34
push str.avgwdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf34
push str.avgidsagent.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf34
push str.mpmon.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf2c
push str.mpsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf2c
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf24
push str.dwengine.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf24
push str.dwservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf24
push str.clamtray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf1c
push str.clamwin.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf1c
push str.avkservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf14
push str.avktray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf14
push str.fsm32.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf0c
push str.fsma32.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf0c
push str.fsorsp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf0c
push str.twssrv.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf01
push str.twister.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcf01
push str.dgservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcef6
push str.drivergenius.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcef6
push str.dtlservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bceeb
push str.drivethelife.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bceeb
push str.pcmaster.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bceb4
or esi, 0x10000000
jmp 0x4bcf8d
push str.winguard.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4bcee0
push str.winguard_x64.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4bcf8d
or esi, 0x40000000
jmp 0x4bcf8d
or esi, 0x8000000
jmp 0x4bcf8d
or esi, 0x4000000
jmp 0x4bcf8d
or esi, 0x2000000
jmp 0x4bcf8d
or esi, 0x1000000
jmp 0x4bcf8d
or esi, 0x800000
jmp 0x4bcf8d
or esi, 0x400000
jmp 0x4bcf8d
or esi, 0x200000
jmp 0x4bcf8d
or esi, 0x100000
jmp 0x4bcf8d
or esi, 0x80000
jmp 0x4bcf8d
or esi, 0x40000
jmp 0x4bcf8d
or esi, 0x20000
jmp 0x4bcf8d
or esi, 0x10000
jmp 0x4bcf8d
or esi, 0x2000
jmp 0x4bcf8d
or esi, 0x1000
jmp 0x4bcf8d
or esi, 0x80
jmp 0x4bcf8d
or esi, 0x40
jmp 0x4bcf8d
or esi, 0x20
jmp 0x4bcf8d
or esi, 0x10
jmp 0x4bcf8d
or esi, 8
jmp 0x4bcf8d
or esi, 4
jmp 0x4bcf8d
or esi, 2
jmp 0x4bcf8d
or esi, 1
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004310e3
cmp edi, ebx
jne 0x4bc8ee
lea eax, [ebp - 0x248]
push eax
call fcn.004bbaca
pop ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x248]
cmp dword [eax - 0xc], ebx
je 0x4bcfeb
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bcfeb
or esi, 0x20000000
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, esi
call fcn.004fba53
ret