Function at 0x412580
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
xor ebx, ebx
push esi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4125d0
mov eax, dword [0x469448]
push 0x3f
push ebx
push 0x6c8
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44ef4c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
push edi
lea edx, [esp + 0x10]
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x10]
push edx
rep stosd dword es:[edi], eax
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
pop edi
jne 0x412634
push 0x3f
push eax
mov eax, dword [0x469448]
push 0x6c8
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44c244
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
mov esi, str.360AP.exe
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x412661
test cl, cl
je 0x41265d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x412661
add eax, 2
add esi, 2
test cl, cl
jne 0x41263d
xor eax, eax
jmp 0x412666
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412786
mov esi, str.kwifi.exe
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41269b
test cl, cl
je 0x412697
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41269b
add eax, 2
add esi, 2
test cl, cl
jne 0x412677
xor eax, eax
jmp 0x4126a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4127af
mov esi, str.mfwifizs.exe
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4126d5
test cl, cl
je 0x4126d1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4126d5
add eax, 2
add esi, 2
test cl, cl
jne 0x4126b1
xor eax, eax
jmp 0x4126da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4127d9
mov esi, str.QWi_Fi.exe
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41270f
test cl, cl
je 0x41270b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41270f
add eax, 2
add esi, 2
test cl, cl
jne 0x4126eb
xor eax, eax
jmp 0x412714
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412803
push 6
lea eax, [esp + 0x34]
push 0x464319
push eax
call fcn.0042aa40
add esp, 0xc
test eax, eax
jne 0x412739
mov ebx, 1
lea ecx, [esp + 0xc]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41282c
mov esi, str.360AP.exe
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x412779
test cl, cl
je 0x412775
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x412779
add eax, 2
add esi, 2
test cl, cl
jne 0x412755
xor eax, eax
jmp 0x41277e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41266e
mov eax, dword [0x469448]
push 0x3f
push 0
push 0x6c8
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44c1cc
jmp 0x412619
mov edx, dword [0x469448]
push 0x3f
push 0
push 0x6c8
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44c180
jmp 0x412619
mov ecx, dword [0x469448]
push 0x3f
push 0
push 0x6c8
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44c138
jmp 0x412619
mov eax, dword [0x469448]
push 0x3f
push 0
push 0x6c8
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44c0e8
jmp 0x412619
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x41286e
mov edx, dword [0x469448]
push 0x3f
push ebx
push 0x6c8
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x46944c
push 0x44ef0c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x128
ret