Function at 0x40cb10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x7934
call fcn.0042eb80
mov eax, dword [0x442754]
xor eax, esp
mov dword [esp + 0x7930], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
jne 0x40cb6a
push 0x43bac8
call fcn.0041ca9e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7930]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
xor edi, edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40cf4d
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
lea esi, [esp + 0x138]
lea ecx, [esp + 0x34]
push str.360Safe.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf1b
lea edx, [esp + 0x34]
push str.360Tray.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf1b
lea eax, [esp + 0x34]
push str.360sd.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x40cbe9
push str.360
jmp 0x40cf20
lea ecx, [esp + 0x34]
push str.HipsTray.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x40cc09
push 0x43bb2c
jmp 0x40cf20
lea edx, [esp + 0x34]
push str.QQPCRTP.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x40cc29
push 0x43bb44
jmp 0x40cf20
lea eax, [esp + 0x34]
push str.MSASCuiL.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf14
lea ecx, [esp + 0x34]
push str.MSASCui.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf14
lea edx, [esp + 0x34]
push str.MsMpEng.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf14
lea eax, [esp + 0x34]
push str.avp.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf0d
lea ecx, [esp + 0x34]
push str.avpui.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf0d
lea edx, [esp + 0x34]
push str.edr_sec_plan.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf06
lea eax, [esp + 0x34]
push str.edr_monitor.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf06
lea ecx, [esp + 0x34]
push str.edr_agent.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cf06
lea edx, [esp + 0x34]
push str.360EntClient.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceff
lea eax, [esp + 0x34]
push str.QaxEntClient.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceff
lea ecx, [esp + 0x34]
push str.QAXTray.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceff
lea edx, [esp + 0x34]
push str.AliYunDun.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x40cd67
push 0x43bc38
jmp 0x40cf20
lea eax, [esp + 0x34]
push str.TopsecTray.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cef8
lea ecx, [esp + 0x34]
push str.TopsecMain.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cef8
lea edx, [esp + 0x34]
push str.JingYunMonSvr.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cef1
lea eax, [esp + 0x34]
push str.JingyunSdTray.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cef1
lea ecx, [esp + 0x34]
push str.JingyunSdSvr.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cef1
lea edx, [esp + 0x34]
push str.KSafeTray.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceea
lea eax, [esp + 0x34]
push str.KSafeSvc.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceea
lea ecx, [esp + 0x34]
push str.KWatch.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ceea
lea edx, [esp + 0x34]
push str.D_Safe_Manage.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cee3
lea eax, [esp + 0x34]
push str.d_manage.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cee3
lea ecx, [esp + 0x34]
push str.SafeDogGuardCenter.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cedc
lea edx, [esp + 0x34]
push str.SafeDogTray.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cedc
lea eax, [esp + 0x34]
push str.SafeDogServerUI.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40cedc
lea ecx, [esp + 0x34]
push str.YDService.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x40ced5
lea edx, [esp + 0x34]
push str.YDLive.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x40cf35
push 0x43bd7c
jmp 0x40cf20
push 0x43bd58
jmp 0x40cf20
push 0x43bd18
jmp 0x40cf20
push 0x43bce8
jmp 0x40cf20
push 0x43bcb0
jmp 0x40cf20
push 0x43bc64
jmp 0x40cf20
push 0x43bc20
jmp 0x40cf20
push 0x43bbe0
jmp 0x40cf20
push 0x43bba0
jmp 0x40cf20
push str.Windows_Defender
jmp 0x40cf20
push 0x43bafc
push 0x400
push esi
call fcn.0041f12a
add esp, 0xc
inc edi
add esi, 0x400
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
test eax, eax
jne 0x40cb95
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.0041c606
add esp, 4
mov esi, eax
mov byte [esi], 0
test edi, edi
jle 0x40cfa7
lea ebx, [esp + 0x138]
push ebx
push esi
call fcn.0041d490
add esp, 8
test eax, eax
jne 0x40cf9e
push ebx
push 0x400
push esi
call fcn.0041d30e
push 0x43a998
push 0x400
push esi
call fcn.0041d30e
add esp, 0x18
add ebx, 0x400
dec edi
jne 0x40cf71
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cfb0
sub eax, edx
mov eax, esi
jne 0x40cfc2
mov eax, 0x43bd88
mov ecx, dword [esp + 0x793c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret