Function at 0x4011b8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da2ff
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x524330]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
call fcn.00498fc7
mov eax, dword [eax + 4]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
push dword [eax + 0x60]
lea ecx, [ebp - 0x14]
call fcn.00403241
and dword [ebp - 4], 0
mov eax, 0x4ee044
test eax, eax
jne 0x40121e
and dword [ebp - 0x160], 0
jmp 0x401270
mov dword [ebp - 0x220], 0x4ee044
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x220]
mov al, byte [eax]
mov byte [ebp - 0x225], al
inc dword [ebp - 0x220]
cmp byte [ebp - 0x225], 0
jne 0x401235
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x160], eax
push dword [ebp - 0x160]
push 0x4ee044
lea ecx, [ebp - 0x14]
call fcn.00403e1c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
and dword [ebp - 0x144], 0
push 0x124
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.004bc450
add esp, 0xc
mov dword [ebp - 0x144], 0x128
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32First
mov byte [ebp - 0x15], 0
call fcn.00498191
push eax
lea ecx, [ebp - 0x148]
call fcn.00403ced
mov byte [ebp - 4], 1
lea eax, [ebp - 0x120]
test eax, eax
jne 0x4012f1
and dword [ebp - 0x164], 0
jmp 0x401345
lea eax, [ebp - 0x120]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x230]
mov al, byte [eax]
mov byte [ebp - 0x235], al
inc dword [ebp - 0x230]
cmp byte [ebp - 0x235], 0
jne 0x40130a
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x234]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x164], eax
push dword [ebp - 0x164]
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x148]
call fcn.00403e1c
push 0x525810
push 0x525810
lea eax, [ebp - 0x14c]
push eax
call fcn.004037e6
add esp, 0xc
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x170], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov dword [ebp - 0x16c], eax
push dword [ebp - 0x168]
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x148]
call fcn.00403e1c
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14c]
sub eax, 0x10
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
call fcn.0040110c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x178], eax
push dword [ebp - 0x178]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x148]
call fcn.00403e1c
push 0
push str.avastui.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
je 0x4014ed
push ecx
mov ecx, esp
mov dword [ebp - 0x150], esp
push str.avast__Antivirus
call fcn.00403241
call fcn.0045e8a1
pop ecx
mov byte [ebp - 0x241], al
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x4014ed
mov ecx, dword [ebp - 0x21c]
call fcn.00401851
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x1a0], eax
mov eax, str.avast
test eax, eax
jne 0x40147c
and dword [ebp - 0x19c], 0
jmp 0x4014ce
mov dword [ebp - 0x248], str.avast
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x248]
mov al, byte [eax]
mov byte [ebp - 0x24d], al
inc dword [ebp - 0x248]
cmp byte [ebp - 0x24d], 0
jne 0x401493
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x24c]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x19c], eax
push dword [ebp - 0x19c]
push str.avast
mov ecx, dword [ebp - 0x1a0]
call fcn.0040417d
mov byte [ebp - 0x15], 1
jmp 0x4017e2
push 0
push 0x4ee074
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401569
push 0
push str.avguard.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401569
push 0
push str.avgnt.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401569
push 0
push str.avira.oe.servicehost.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
je 0x401606
mov ecx, dword [ebp - 0x21c]
call fcn.00402202
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x1f8], eax
mov eax, str.avira
test eax, eax
jne 0x401595
and dword [ebp - 0x1f4], 0
jmp 0x4015e7
mov dword [ebp - 0x258], str.avira
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x258]
mov al, byte [eax]
mov byte [ebp - 0x25d], al
inc dword [ebp - 0x258]
cmp byte [ebp - 0x25d], 0
jne 0x4015ac
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x25c]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x1f4], eax
push dword [ebp - 0x1f4]
push str.avira
mov ecx, dword [ebp - 0x1f8]
call fcn.0040417d
mov byte [ebp - 0x15], 1
jmp 0x4017e2
push 0
push str.avgui.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401664
push 0
push str.avgcsrvx.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x401664
push 0
push str.avgwdsvc.exe
lea ecx, [ebp - 0x148]
call fcn.00403617
mov ecx, eax
call fcn.0040355e
cmp eax, 0xffffffff
je 0x401701
mov ecx, dword [ebp - 0x21c]
call fcn.00402448
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x208], eax
mov eax, 0x4ee0e8
test eax, eax
jne 0x401690
and dword [ebp - 0x204], 0
jmp 0x4016e2
mov dword [ebp - 0x268], 0x4ee0e8
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x268]
mov al, byte [eax]
mov byte [ebp - 0x26d], al
inc dword [ebp - 0x268]
cmp byte [ebp - 0x26d], 0
jne 0x4016a7
mov eax, dword [ebp - 0x268]
sub eax, dword [ebp - 0x26c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x204], eax
push dword [ebp - 0x204]
push 0x4ee0e8
mov ecx, dword [ebp - 0x208]
call fcn.0040417d
mov byte [ebp - 0x15], 1
jmp 0x4017e2
push 0
push str.dwengine.exe
lea ecx, [ebp - 0x148]
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x40174a
push 0
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x148]
call fcn.0040355e
cmp eax, 0xffffffff
jne 0x40174a
push 0
push str.dwservice.exe
lea ecx, [ebp - 0x148]
call fcn.0040355e
cmp eax, 0xffffffff
je 0x4017e2
mov ecx, dword [ebp - 0x21c]
call fcn.00402b87
mov eax, dword [ebp - 0x21c]
add eax, 4
mov dword [ebp - 0x210], eax
mov eax, str.dr.web
test eax, eax
jne 0x401776
and dword [ebp - 0x20c], 0
jmp 0x4017c8
mov dword [ebp - 0x278], str.dr.web
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x278]
mov al, byte [eax]
mov byte [ebp - 0x27d], al
inc dword [ebp - 0x278]
cmp byte [ebp - 0x27d], 0
jne 0x40178d
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0x27c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x20c], eax
push dword [ebp - 0x20c]
push str.dr.web
mov ecx, dword [ebp - 0x210]
call fcn.0040417d
mov byte [ebp - 0x15], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x148]
sub eax, 0x10
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
call fcn.0040110c
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40181f
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x4012c9
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
sub eax, 0x10
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
call fcn.0040110c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004bc439
leave
ret