Function at 0x4022a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4198c9
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x41f3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x421954], 1
jne 0x40236e
or dword [0x421954], 1
xor edi, edi
mov dword [ebp - 4], edi
push 0x2c
mov dword [0x421948], edi
call fcn.0040a6f6
add esp, 4
cmp eax, edi
je 0x40233b
mov dword [0x421944], eax
mov dword [eax], eax
mov eax, dword [0x421944]
mov dword [eax + 4], eax
mov eax, dword [0x421944]
mov dword [eax + 8], eax
mov eax, dword [0x421944]
mov byte [eax + 0x28], 1
mov ecx, dword [0x421944]
push 0x419ee0
mov byte [ecx + 0x29], 1
call fcn.0040b217
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x402370
lea edx, [ebp - 0x1e8]
push edx
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x1e8], edi
call fcn.0040a5f2
push 0x41da40
lea eax, [ebp - 0x1e4]
push eax
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.0040bb10
xor edi, edi
cmp dword [0x421948], edi
jne 0x402479
push str.kxetray.exe
call fcn.004034c0
push eax
lea ecx, [ebp - 0x1e0]
push ecx
call fcn.004030e0
push str.kxescore.exe
call fcn.004034c0
push eax
lea edx, [ebp - 0x1e0]
push edx
call fcn.004030e0
push str.qqpctray.exe
call fcn.004034c0
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.004030e0
push str.qqpcrtp.exe
call fcn.004034c0
push eax
lea ecx, [ebp - 0x1e0]
push ecx
call fcn.004030e0
push str.baidusd.exe
call fcn.004034c0
push eax
lea edx, [ebp - 0x1e0]
push edx
call fcn.004030e0
push str.360safe.exe
call fcn.004034c0
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.004030e0
push str.360sd.exe.exe
call fcn.004034c0
push eax
lea ecx, [ebp - 0x1e0]
push ecx
call fcn.004030e0
push str.avp.exe
call fcn.004034c0
push eax
lea edx, [ebp - 0x1e0]
push edx
call fcn.004030e0
push str.ekrn.exe
call fcn.004034c0
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.004030e0
push str.avgnt.exe
call fcn.004034c0
push eax
lea ecx, [ebp - 0x1e0]
push ecx
call fcn.004030e0
push str.mcshield.exe
call fcn.004034c0
push eax
lea edx, [ebp - 0x1e0]
push edx
call fcn.004030e0
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x1dc], esi
cmp esi, 0xffffffff
jne 0x402496
xor eax, eax
jmp 0x40264a
push 0x7f
lea eax, [ebp - 0x8f]
push edi
push eax
mov dword [ebp - 0x1e8], edi
mov byte [ebp - 0x90], 0
call fcn.00412870
push 0x124
lea ecx, [ebp - 0x1d4]
push edi
push ecx
call fcn.00412870
add esp, 0x18
lea edx, [ebp - 0x1d8]
push edx
push esi
mov dword [ebp - 0x1d8], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, edi
je 0x402644
jmp 0x4024f2
xor edi, edi
xor eax, eax
jmp 0x402500
mov cl, byte [ebp + eax - 0x1b4]
mov byte [ebp + eax - 0x90], cl
inc eax
test cl, cl
jne 0x402500
lea eax, [ebp - 0x90]
push eax
call fcn.004193a4
lea eax, [ebp - 0x90]
add esp, 4
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0xac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402542
sub eax, edx
push eax
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0xac]
call fcn.00403b60
lea edx, [ebp - 0xac]
mov dword [ebp - 4], 1
mov edi, dword [0x421944]
push edx
call fcn.00402af0
mov dword [ebp - 0x1f0], eax
cmp eax, dword [0x421944]
je 0x4025e3
cmp dword [eax + 0x20], 0x10
mov esi, dword [eax + 0x1c]
jb 0x402593
mov ecx, dword [eax + 0xc]
jmp 0x402596
lea ecx, [eax + 0xc]
mov ebx, dword [ebp - 0x9c]
mov eax, ebx
cmp ebx, esi
jb 0x4025a4
mov eax, esi
cmp dword [ebp - 0x98], 0x10
mov edx, dword [ebp - 0xac]
jae 0x4025b9
lea edx, [ebp - 0xac]
call fcn.004035f0
test eax, eax
jne 0x4025d4
cmp ebx, esi
jae 0x4025cb
or eax, 0xffffffff
jmp 0x4025d2
xor eax, eax
cmp ebx, esi
setne al
test eax, eax
sets al
test al, al
jne 0x4025e3
lea eax, [ebp - 0x1f0]
jmp 0x4025f4
mov eax, dword [0x421944]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1ec]
cmp dword [eax], edi
mov dword [ebp - 4], 0xffffffff
setne bl
cmp dword [ebp - 0x98], 0x10
jb 0x402618
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.0040a55f
add esp, 4
test bl, bl
jne 0x40263a
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4024f0
jmp 0x402644
mov dword [ebp - 0x1e8], 1
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a4cc
mov esp, ebp
pop ebp
ret