Function at 0x42feed
Capabilities:
Check if file exists
Enumerate processes
Inspect section memory permissions

Disassembly:
push 0x23c
mov eax, 0x4c9092
call fcn.0044d7c5
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x23c], ebx
call fcn.0044d1b0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x23c]
push ecx
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x430615
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041217e
push str.360tray.exe
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], ebx
call fcn.0040fc45
test eax, eax
je 0x4305e4
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305e4
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305df
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305df
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305da
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305da
push str.kxescore.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305d5
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305d5
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305d0
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305d0
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305d0
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305cb
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305cb
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305c6
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305c6
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305be
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305be
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x430114
or esi, 0x100
jmp 0x4305e7
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x430133
or esi, 0x200
jmp 0x4305e7
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x430152
or esi, 0x400
jmp 0x4305e7
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x430171
or esi, 0x800
jmp 0x4305e7
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305b6
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305b6
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305ae
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305ae
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305ae
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305ae
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x430220
or esi, 0x4000
jmp 0x4305e7
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x43023f
or esi, 0x8000
jmp 0x4305e7
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305a6
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305a6
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x4305a6
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43059e
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43059e
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43059e
push str.avastsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430596
push str.avastui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430596
push str.avgui.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43058e
push str.avgwdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43058e
push str.avgidsagent.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43058e
push str.mpmon.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430586
push str.mpsvc.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430586
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43057e
push str.dwengine.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43057e
push str.dwservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43057e
push str.clamtray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430576
push str.clamwin.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430576
push str.avkservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43056e
push str.avktray.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43056e
push str.fsm32.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430566
push str.fsma32.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430566
push str.fsorsp.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430566
push str.twssrv.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43055b
push str.twister.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43055b
push str.dgservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430550
push str.drivergenius.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430550
push str.dtlservice.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430545
push str.drivethelife.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x430545
push str.pcmaster.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x43050e
or esi, 0x10000000
jmp 0x4305e7
push str.winguard.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
je 0x43053a
push str.winguard_x64.exe
lea ecx, [ebp - 0x240]
call fcn.0040fc45
test eax, eax
jne 0x4305e7
or esi, 0x40000000
jmp 0x4305e7
or esi, 0x8000000
jmp 0x4305e7
or esi, 0x4000000
jmp 0x4305e7
or esi, 0x2000000
jmp 0x4305e7
or esi, 0x1000000
jmp 0x4305e7
or esi, 0x800000
jmp 0x4305e7
or esi, 0x400000
jmp 0x4305e7
or esi, 0x200000
jmp 0x4305e7
or esi, 0x100000
jmp 0x4305e7
or esi, 0x80000
jmp 0x4305e7
or esi, 0x40000
jmp 0x4305e7
or esi, 0x20000
jmp 0x4305e7
or esi, 0x10000
jmp 0x4305e7
or esi, 0x2000
jmp 0x4305e7
or esi, 0x1000
jmp 0x4305e7
or esi, 0x80
jmp 0x4305e7
or esi, 0x40
jmp 0x4305e7
or esi, 0x20
jmp 0x4305e7
or esi, 0x10
jmp 0x4305e7
or esi, 8
jmp 0x4305e7
or esi, 4
jmp 0x4305e7
or esi, 2
jmp 0x4305e7
or esi, 1
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040f083
cmp edi, ebx
jne 0x42ff48
lea eax, [ebp - 0x248]
push eax
call fcn.0042f24c
mov eax, dword [ebp - 0x248]
pop ecx
cmp dword [eax - 0xc], ebx
je 0x43063e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43063e
or esi, 0x20000000
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, esi
call fcn.0044d848
ret