Function at 0x41ca50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c7f1
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str.sfsw
push 0x5971f4
push eax
mov dword [ebp - 0x388], eax
call fcn.00450580
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x37c], eax
add esp, 8
mov dword [ebp - 4], eax
xor edx, edx
xor ecx, ecx
call fcn.0041d230
push 0x22c
lea eax, [ebp - 0x360]
mov dword [ebp - 0x380], ebx
push ebx
push eax
call fcn.004d9fe0
add esp, 0x10
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41caff
mov byte [ebp - 0x361], 0
jmp 0x41cc76
lea eax, [ebp - 0x360]
mov dword [ebp - 0x360], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41cb2a
push esi
call ebx
mov byte [ebp - 0x361], 0
jmp 0x41cc76
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov eax, 4
mov byte [ebp - 0x36c], 0
mov dword [ebp - 0x370], 0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
push 1
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00450b00
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
push 1
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x12c]
call fcn.00450b00
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x358]
lea ecx, [ebp - 0x370]
push eax
call fcn.0045f120
add esp, 4
test al, al
je 0x41cc05
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x384]
call fcn.0041cf90
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41cc2e
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x41cc2e
push eax
call fcn.004e1b56
add esp, 4
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0
call fcn.00450c20
lea eax, [ebp - 0x360]
push eax
push esi
call edi
test eax, eax
mov eax, 4
jne 0x41cb35
push esi
call ebx
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x384]
mov byte [ebp - 0x361], 1
mov dword [ebp - 0x368], eax
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, str.Q360MonMutex
cmp dword [esi - 4], 0
jne 0x41cc99
push esi
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x41ce12
add esi, 0x204
cmp esi, 0x5c7a1c
jl 0x41cc81
mov dword [ebp - 0x374], 0
xor bl, bl
xor bh, bh
cmp byte [ebp - 0x361], bl
je 0x41ce24
mov ecx, dword [ebp - 0x380]
mov eax, 0xe070381d
mov esi, dword [ebp - 0x368]
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x36c], eax
je 0x41ce24
xor edi, edi
test eax, eax
je 0x41ce88
add esi, 0xc
nop dword [eax + eax]
test bh, bh
je 0x41cd0c
test bl, bl
jne 0x41ce88
cmp byte [esi + 0x110], 0
mov eax, esi
jne 0x41cd1a
mov eax, dword [esi - 4]
add eax, 4
lea ecx, [ebp - 0x134]
push eax
call fcn.0044fe90
lea ecx, [ebp - 0x134]
call fcn.00450ab0
test bh, bh
jne 0x41cd84
cmp byte [ebp - 0x18], bh
lea eax, [ebp - 0x128]
push str.kxetray.exe
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call fcn.004d9502
add esp, 8
test eax, eax
jne 0x41cd82
cmp byte [ebp - 0x18], bh
lea eax, [ebp - 0x128]
push str.kxescore.exe
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call fcn.004d9502
add esp, 8
test eax, eax
je 0x41cd84
mov bh, 1
test bl, bl
jne 0x41cdd4
cmp byte [ebp - 0x18], bl
lea eax, [ebp - 0x128]
push str.qqpctray.exe
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call fcn.004d9502
add esp, 8
test eax, eax
jne 0x41cdd2
cmp byte [ebp - 0x18], bl
lea eax, [ebp - 0x128]
push str.qqpcrtp.exe
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call fcn.004d9502
add esp, 8
test eax, eax
je 0x41cdd4
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41cdfd
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x41cdfd
push eax
call fcn.004e1b56
add esp, 4
inc edi
add esi, 0x124
cmp edi, dword [ebp - 0x36c]
jb 0x41cd00
jmp 0x41ce88
push eax
call ebx
mov dword [ebp - 0x374], 1
jmp 0x41ccb1
mov esi, str.Q360MonMutex
nop dword [eax]
cmp dword [esi - 4], 1
jne 0x41ce48
push esi
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x41cf6c
add esi, 0x204
cmp esi, 0x5c7a1c
jl 0x41ce30
xor bh, bh
mov esi, str.Q360MonMutex
nop dword [eax]
cmp dword [esi - 4], 2
jne 0x41ce78
push esi
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x41cf7a
add esi, 0x204
cmp esi, 0x5c7a1c
jl 0x41ce60
xor bl, bl
cmp dword [ebp - 0x374], 0
mov esi, 0x594578
mov edi, dword [ebp - 0x388]
mov ecx, 0x59457c
mov eax, esi
cmove eax, ecx
push eax
push 0x5971f4
push edi
call fcn.00450580
test bh, bh
mov ecx, 0x59457c
mov eax, esi
cmove eax, ecx
push eax
push 0x5971f4
push edi
call fcn.00450580
test bl, bl
mov eax, 0x59457c
cmove esi, eax
push esi
push 0x5971f4
push edi
call fcn.00450580
mov ebx, dword [ebp - 0x368]
add esp, 0x24
test ebx, ebx
je 0x41cf4e
mov edx, dword [ebp - 0x380]
push ecx
mov ecx, ebx
call fcn.0041d230
mov ecx, dword [ebp - 0x378]
mov eax, 0xe070381d
sub ecx, ebx
add esp, 4
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xe07038
ja 0x41cf88
imul eax, eax, 0x124
cmp eax, 0x1000
jb 0x41cf45
test bl, 0x1f
jne 0x41cf88
mov eax, dword [ebx - 4]
cmp eax, ebx
jae 0x41cf88
sub ebx, eax
cmp ebx, 4
jb 0x41cf88
cmp ebx, 0x23
ja 0x41cf88
mov ebx, eax
push ebx
call fcn.004d6cf8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bh, 1
jmp 0x41ce58
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x41ce88
call fcn.004e1d90
int3