Function at 0x47909d
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x344]
sub esp, 0x3c4
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x340], eax
and dword [ebp - 0x80], 0
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x7c]
push eax
push ebx
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push 4
pop esi
or edi, 0xffffffff
xor eax, eax
push 0x18e
push eax
mov word [ebp + 0x1b0], ax
lea eax, [ebp + 0x1b2]
push eax
call fcn.0048d310
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x1b0]
push 0x80b2a8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x1b0]
push 0xc8
push eax
call fcn.004922ca
add esp, 0x20
mov ecx, str.360TRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479155
test dx, dx
je 0x479151
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479155
add eax, esi
add ecx, esi
test dx, dx
jne 0x479131
xor eax, eax
jmp 0x479159
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.360SD.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479190
test dx, dx
je 0x47918c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479190
add eax, esi
add ecx, esi
test dx, dx
jne 0x47916c
xor eax, eax
jmp 0x479194
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.QQPCTRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4791cb
test dx, dx
je 0x4791c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4791cb
add eax, esi
add ecx, esi
test dx, dx
jne 0x4791a7
xor eax, eax
jmp 0x4791cf
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.HIPSTRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479206
test dx, dx
je 0x479202
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479206
add eax, esi
add ecx, esi
test dx, dx
jne 0x4791e2
xor eax, eax
jmp 0x47920a
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.KXETRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479241
test dx, dx
je 0x47923d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479241
add eax, esi
add ecx, esi
test dx, dx
jne 0x47921d
xor eax, eax
jmp 0x479245
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.KSAFETRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47927c
test dx, dx
je 0x479278
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47927c
add eax, esi
add ecx, esi
test dx, dx
jne 0x479258
xor eax, eax
jmp 0x479280
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.2345SAFETRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4792b7
test dx, dx
je 0x4792b3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4792b7
add eax, esi
add ecx, esi
test dx, dx
jne 0x479293
xor eax, eax
jmp 0x4792bb
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.BAIDUANTRAY.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4792f2
test dx, dx
je 0x4792ee
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4792f2
add eax, esi
add ecx, esi
test dx, dx
jne 0x4792ce
xor eax, eax
jmp 0x4792f6
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
mov ecx, str.AVPUI.EXE
lea eax, [ebp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x479329
test dx, dx
je 0x479325
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x479329
add eax, esi
add ecx, esi
test dx, dx
jne 0x479305
xor eax, eax
jmp 0x47932d
sbb eax, eax
sbb eax, edi
test eax, eax
je 0x479345
lea eax, [ebp - 0x7c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4790e1
jmp 0x47934c
mov dword [ebp - 0x80], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x340]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d1f2
add ebp, 0x344
leave
ret