Function at 0x43601d
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x4c9d68
call fcn.0044d7c5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push 0x228
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x238]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], esi
call fcn.0044d1b0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4364e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.0041217e
and dword [ebp - 4], 0
push str.360tray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x4364ac
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x4364ac
push str.360sd.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x4364a3
push str.360rp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x4364a3
push str.ksafetray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43649a
push str.ksafesvc.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43649a
push str.kscan.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436491
push str.kxetray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436491
push str.qqpctray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436488
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436488
push str.qqpcrtp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436488
push str.avgnt.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43647f
push str.avcenter.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43647f
push str.egui.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436476
push str.ekrn.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436476
push str.rstray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43646a
push str.ravmond.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43646a
push str.avp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x436257
or dword [ebp - 0x240], 0x100
jmp 0x4364b3
push str.msmpeng.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x43627a
or dword [ebp - 0x240], 0x200
jmp 0x4364b3
push str.ccsvchst.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x43629d
or dword [ebp - 0x240], 0x400
jmp 0x4364b3
push str.bdagent.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x4362c0
or dword [ebp - 0x240], 0x800
jmp 0x4364b3
push str.kvmonxp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43645e
push str.kvsrvxp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43645e
push str.uiseagnt.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436452
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436452
push str.coreserviceshell.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436452
push str.uiwatchdog.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436452
push str.mcshield.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x436373
or dword [ebp - 0x240], 0x4000
jmp 0x4364b3
push str.cfp.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x436396
or dword [ebp - 0x240], 0x8000
jmp 0x4364b3
push str.baidusd.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436446
push str.baidusdsvc.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436446
push str.baidusdtray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x436446
push str.baiduantray.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43643a
push str.baiduan.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43643a
push str.baiduansvc.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
je 0x43643a
push str.radar.exe
lea ecx, [ebp - 0x244]
call fcn.0040fc45
test eax, eax
jne 0x4364b3
or dword [ebp - 0x240], 0x40000
jmp 0x4364b3
or dword [ebp - 0x240], 0x20000
jmp 0x4364b3
or dword [ebp - 0x240], 0x10000
jmp 0x4364b3
or dword [ebp - 0x240], 0x2000
jmp 0x4364b3
or dword [ebp - 0x240], 0x1000
jmp 0x4364b3
or dword [ebp - 0x240], 0x80
jmp 0x4364b3
or dword [ebp - 0x240], 0x40
jmp 0x4364b3
or dword [ebp - 0x240], 0x20
jmp 0x4364b3
or dword [ebp - 0x240], 0x10
jmp 0x4364b3
or dword [ebp - 0x240], 8
jmp 0x4364b3
or dword [ebp - 0x240], 4
jmp 0x4364b3
or dword [ebp - 0x240], 2
jmp 0x4364b3
or dword [ebp - 0x240], 1
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov dword [ebp - 0x248], eax
call fcn.0040f083
cmp dword [ebp - 0x248], 0
jne 0x436086
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x502868
push esi
lea ecx, [ebp - 0x24c]
call fcn.0040fd3c
push dword [ebp - 0x240]
lea eax, [ebp - 0x24c]
push 0x4d6b88
push eax
mov dword [ebp - 4], 1
call fcn.0041182d
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.0040f61d
add eax, 0x10
add esp, 0x10
mov dword [ebp - 0x244], eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call fcn.00410878
push esi
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 3
call fcn.0040fd3c
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], 4
call fcn.0043477a
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x248]
push 0x4d6b64
push eax
call fcn.00429e17
add esp, 0x10
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x244]
push eax
mov byte [ebp - 4], 5
call fcn.0041ed16
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0040f083
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x248]
push str._n_nError
push eax
call fcn.00429e17
add esp, 0xc
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x244]
push eax
mov byte [ebp - 4], 6
call fcn.0041ed16
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0040f083
push esi
lea ecx, [ebp - 0x248]
call fcn.0040fd3c
push 0
lea edi, [ebp - 0x254]
mov byte [ebp - 4], 7
call fcn.0042a11d
push dword [ebx]
mov byte [ebp - 4], 8
push dword [eax]
lea eax, [ebp - 0x248]
push 0x4d6e00
push eax
call fcn.0041182d
mov ecx, dword [ebp - 0x254]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.0040f083
push dword [ebp + 0x10]
mov esi, dword [ebp - 0x248]
mov edi, dword [ebp - 0x244]
push esi
push edi
push dword [ebp - 0x250]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.0040f083
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x26c]
call fcn.00410276
mov ecx, dword [ebp - 0x25c]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [edi - 0x10]
call fcn.0040f083
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, ebx
call fcn.0044d848
ret