Function at 0x43f000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a1dd
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x59024c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x597298]
mov ebx, dword [ebp + 8]
test al, 1
jne 0x43f254
or eax, 1
mov dword [0x597298], eax
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3cf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x59727c], eax
push str.360tray.exe
mov ecx, 0x59727c
mov dword [ebp - 4], 0
call fcn.00403470
test al, al
jne 0x43f08d
push 0xb
push str.360tray.exe
mov ecx, 0x59727c
call fcn.00403cb0
mov dword [ebp - 4], 1
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3d9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x597280], eax
push str.360sd.exe
mov ecx, 0x597280
mov byte [ebp - 4], 2
call fcn.00403470
test al, al
jne 0x43f0d8
push 9
push str.360sd.exe
mov ecx, 0x597280
call fcn.00403cb0
mov byte [ebp - 4], 3
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x597284], eax
push str.QQPCTray.exe
mov ecx, 0x597284
mov byte [ebp - 4], 4
call fcn.00403470
test al, al
jne 0x43f120
push 0xc
push str.QQPCTray.exe
mov ecx, 0x597284
call fcn.00403cb0
mov byte [ebp - 4], 5
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3ed
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x597288], eax
push str.kxetray.exe
mov ecx, 0x597288
mov byte [ebp - 4], 6
call fcn.00403470
test al, al
jne 0x43f168
push 0xb
push str.kxetray.exe
mov ecx, 0x597288
call fcn.00403cb0
mov byte [ebp - 4], 7
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3f7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x59728c], eax
push str.HipsTray.exe
mov ecx, 0x59728c
mov byte [ebp - 4], 8
call fcn.00403470
test al, al
jne 0x43f1b0
push 0xc
push str.HipsTray.exe
mov ecx, 0x59728c
call fcn.00403cb0
mov byte [ebp - 4], 9
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f401
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x597290], eax
push str.2345SafeTray.exe
mov ecx, 0x597290
mov byte [ebp - 4], 0xa
call fcn.00403470
test al, al
jne 0x43f1f8
push 0x10
push str.2345SafeTray.exe
mov ecx, 0x597290
call fcn.00403cb0
mov byte [ebp - 4], 0xb
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f40b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x597294], eax
push str.LenovoTray.exe
mov ecx, 0x597294
mov byte [ebp - 4], 0xc
call fcn.00403470
test al, al
jne 0x43f240
push 0xe
push str.LenovoTray.exe
mov ecx, 0x597294
call fcn.00403cb0
push 0x544fc0
mov dword [ebp - 4], 0xffffffff
call fcn.00449001
add esp, 4
test ebx, ebx
je 0x43f2bb
cmp dword [ebx + 0x14], 8
mov eax, ebx
mov dword [ebx + 0x10], 0
jb 0x43f269
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push 2
mov word [eax], cx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x244], esi
cmp esi, 0xffffffff
je 0x43f2bb
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004ee390
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43f2c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43f3b3
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x218]
push eax
push dword [edi*4 + 0x59727c]
call fcn.004f93be
add esp, 8
test eax, eax
jne 0x43f368
call fcn.004037c0
mov ecx, eax
test ecx, ecx
je 0x43f3cf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x240], eax
lea eax, [edi + 1]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x240]
push str._02d
push eax
call fcn.004036b0
mov esi, dword [ebp - 0x240]
add esp, 0xc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f331
sub eax, edx
mov ecx, ebx
sar eax, 1
push eax
push esi
call fcn.0042c850
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43f368
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
cmp edi, 7
jb 0x43f2d0
mov esi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43f2c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x43f3ac
push 1
push 0x548e58
mov ecx, ebx
call fcn.0040c8a0
mov ecx, dword [ebx + 0x10]
xor eax, eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448d5d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
push 0x80004005
call fcn.00403450
int3