Function at 0x456530
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55894d
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5b9f6c]
mov ebx, dword [ebp + 8]
test al, 1
jne 0x456784
or eax, 1
mov dword [0x5b9f6c], eax
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x4568ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f50], eax
push str.360tray.exe
mov ecx, 0x5b9f50
mov dword [ebp - 4], 0
call fcn.004093d0
test al, al
jne 0x4565bd
push 0xb
push str.360tray.exe
mov ecx, 0x5b9f50
call fcn.004157e0
mov dword [ebp - 4], 1
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x456909
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f54], eax
push str.360sd.exe
mov ecx, 0x5b9f54
mov byte [ebp - 4], 2
call fcn.004093d0
test al, al
jne 0x456608
push 9
push str.360sd.exe
mov ecx, 0x5b9f54
call fcn.004157e0
mov byte [ebp - 4], 3
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x456913
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f58], eax
push str.QQPCTray.exe
mov ecx, 0x5b9f58
mov byte [ebp - 4], 4
call fcn.004093d0
test al, al
jne 0x456650
push 0xc
push str.QQPCTray.exe
mov ecx, 0x5b9f58
call fcn.004157e0
mov byte [ebp - 4], 5
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x45691d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f5c], eax
push str.kxetray.exe
mov ecx, 0x5b9f5c
mov byte [ebp - 4], 6
call fcn.004093d0
test al, al
jne 0x456698
push 0xb
push str.kxetray.exe
mov ecx, 0x5b9f5c
call fcn.004157e0
mov byte [ebp - 4], 7
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x456927
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f60], eax
push str.HipsTray.exe
mov ecx, 0x5b9f60
mov byte [ebp - 4], 8
call fcn.004093d0
test al, al
jne 0x4566e0
push 0xc
push str.HipsTray.exe
mov ecx, 0x5b9f60
call fcn.004157e0
mov byte [ebp - 4], 9
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x456931
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f64], eax
push str.2345SafeTray.exe
mov ecx, 0x5b9f64
mov byte [ebp - 4], 0xa
call fcn.004093d0
test al, al
jne 0x456728
push 0x10
push str.2345SafeTray.exe
mov ecx, 0x5b9f64
call fcn.004157e0
mov byte [ebp - 4], 0xb
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x45693b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x5b9f68], eax
push str.LenovoTray.exe
mov ecx, 0x5b9f68
mov byte [ebp - 4], 0xc
call fcn.004093d0
test al, al
jne 0x456770
push 0xe
push str.LenovoTray.exe
mov ecx, 0x5b9f68
call fcn.004157e0
push 0x563990
mov dword [ebp - 4], 0xffffffff
call fcn.00461390
add esp, 4
test ebx, ebx
je 0x4567eb
cmp dword [ebx + 0x14], 8
mov eax, ebx
mov dword [ebx + 0x10], 0
jb 0x456799
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push 2
mov word [eax], cx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x244], esi
cmp esi, 0xffffffff
je 0x4567eb
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.0050b0c0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4567f2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4568e3
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x218]
push eax
push dword [edi*4 + 0x5b9f50]
call fcn.005160f9
add esp, 8
test eax, eax
jne 0x456898
call fcn.004106d0
mov ecx, eax
test ecx, ecx
je 0x4568ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x240], eax
lea eax, [edi + 1]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x240]
push str._02d
push eax
call fcn.0040f6a0
mov esi, dword [ebp - 0x240]
add esp, 0xc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x456861
sub eax, edx
mov ecx, ebx
sar eax, 1
push eax
push esi
call fcn.00428570
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x456898
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
cmp edi, 7
jb 0x456800
mov esi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4567f2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x4568dc
push 1
push 0x566d18
mov ecx, ebx
call fcn.00417590
mov ecx, dword [ebx + 0x10]
xor eax, eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
push 0x80004005
call fcn.004093b0
int3