Function at 0x44b290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.0053ef70
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44b9a9
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x244]
call fcn.0041c8a0
push str.360tray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b340
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b354
mov ecx, dword [ebp - 0x23c]
or ecx, 1
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.360sd.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b37c
push str.360rp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b390
mov edx, dword [ebp - 0x23c]
or edx, 2
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.ksafetray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b3b8
push str.ksafesvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b3cc
mov eax, dword [ebp - 0x23c]
or eax, 4
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.kxescore.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b3f4
push str.kxetray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b408
mov ecx, dword [ebp - 0x23c]
or ecx, 8
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.qqpctray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b444
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b444
push str.qqpcrtp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b458
mov edx, dword [ebp - 0x23c]
or edx, 0x10
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.avgnt.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b480
push str.avcenter.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b494
mov eax, dword [ebp - 0x23c]
or eax, 0x20
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.egui.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b4bc
push str.ekrn.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b4d0
mov ecx, dword [ebp - 0x23c]
or ecx, 0x40
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.rstray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b4f8
push str.ravmond.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b50f
mov edx, dword [ebp - 0x23c]
or edx, 0x80
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.avp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b539
mov eax, dword [ebp - 0x23c]
or eax, 0x100
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.msmpeng.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b564
mov ecx, dword [ebp - 0x23c]
or ecx, 0x200
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.ccsvchst.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b58f
mov edx, dword [ebp - 0x23c]
or edx, 0x400
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.bdagent.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b5b9
mov eax, dword [ebp - 0x23c]
or eax, 0x800
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.kvmonxp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b5e1
push str.kvsrvxp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b5f8
mov ecx, dword [ebp - 0x23c]
or ecx, 0x1000
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.uiseagnt.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b648
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b648
push str.coreserviceshell.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b648
push str.uiwatchdog.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b65f
mov edx, dword [ebp - 0x23c]
or edx, 0x2000
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.mcshield.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b689
mov eax, dword [ebp - 0x23c]
or eax, 0x4000
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.cfp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b6b4
mov ecx, dword [ebp - 0x23c]
or ecx, 0x8000
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.baidusd.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b6f0
push str.baidusdsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b6f0
push str.baidusdtray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b707
mov edx, dword [ebp - 0x23c]
or edx, 0x10000
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.baiduantray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b743
push str.baiduan.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b743
push str.baiduansvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b759
mov eax, dword [ebp - 0x23c]
or eax, 0x20000
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.avastsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b781
push str.avastui.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b798
mov ecx, dword [ebp - 0x23c]
or ecx, 0x40000
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.avgui.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b7d4
push str.avgwdsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b7d4
push str.avgidsagent.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b7eb
mov edx, dword [ebp - 0x23c]
or edx, 0x80000
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.mpmon.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b813
push str.mpsvc.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b829
mov eax, dword [ebp - 0x23c]
or eax, 0x100000
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b865
push str.dwengine.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b865
push str.dwservice.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b87c
mov ecx, dword [ebp - 0x23c]
or ecx, 0x200000
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.clamtray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b8a4
push str.clamwin.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b8bb
mov edx, dword [ebp - 0x23c]
or edx, 0x400000
mov dword [ebp - 0x23c], edx
jmp 0x44b983
push str.avkservice.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b8e3
push str.avktray.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b8f9
mov eax, dword [ebp - 0x23c]
or eax, 0x800000
mov dword [ebp - 0x23c], eax
jmp 0x44b983
push str.fsm32.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b935
push str.fsma32.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b935
push str.fsorsp.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b949
mov ecx, dword [ebp - 0x23c]
or ecx, 0x1000000
mov dword [ebp - 0x23c], ecx
jmp 0x44b983
push str.twssrv.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
je 0x44b971
push str.twister.exe
lea ecx, [ebp - 0x244]
call fcn.00453fe0
test eax, eax
jne 0x44b983
mov edx, dword [ebp - 0x23c]
or edx, 0x2000000
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x244]
call fcn.0040f740
jmp 0x44b2fc
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret