Function at 0x404420
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.004414b0
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110c]
push eax
push 0x1000
lea eax, [ebp - 0x1108]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4047b9
mov ebx, dword [ebp - 0x110c]
xor esi, esi
shr ebx, 2
test ebx, ebx
je 0x4047b9
nop
push dword [ebp + esi*4 - 0x1108]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4047b0
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x4047a9
mov ecx, str.360tray.exe
lea eax, [ebp - 0x108]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4044f0
test dl, dl
je 0x4044ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4044f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4044d0
xor eax, eax
jmp 0x4044f5
sbb eax, eax
or eax, 1
push eax
lea eax, [ebp - 0x108]
push eax
push str.Process_name:__s___d
call fcn.00401780
add esp, 0xc
lea eax, [ebp - 0x108]
mov ecx, str.360tray.exe
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404535
test dl, dl
je 0x404531
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404535
add eax, 2
add ecx, 2
test dl, dl
jne 0x404515
xor eax, eax
jmp 0x40453a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4048dd
mov ecx, str.360sd.exe
lea eax, [ebp - 0x108]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404570
test dl, dl
je 0x40456c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404570
add eax, 2
add ecx, 2
test dl, dl
jne 0x404550
xor eax, eax
jmp 0x404575
sbb eax, eax
or eax, 1
test eax, eax
je 0x4048dd
mov ecx, str.kxetray.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4045a8
test dl, dl
je 0x4045a4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4045a8
add eax, 2
add ecx, 2
test dl, dl
jne 0x404588
xor eax, eax
jmp 0x4045ad
sbb eax, eax
or eax, 1
test eax, eax
je 0x4048b6
mov ecx, str.ksafe.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4045e0
test dl, dl
je 0x4045dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4045e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4045c0
xor eax, eax
jmp 0x4045e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4048b6
mov ecx, str.QQPCRTP.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404618
test dl, dl
je 0x404614
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404618
add eax, 2
add ecx, 2
test dl, dl
jne 0x4045f8
xor eax, eax
jmp 0x40461d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40488f
mov ecx, str.hipstray.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404650
test dl, dl
je 0x40464c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404650
add eax, 2
add ecx, 2
test dl, dl
jne 0x404630
xor eax, eax
jmp 0x404655
sbb eax, eax
or eax, 1
test eax, eax
je 0x404868
mov ecx, str.wsctrl.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404688
test dl, dl
je 0x404684
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404688
add eax, 2
add ecx, 2
test dl, dl
jne 0x404668
xor eax, eax
jmp 0x40468d
sbb eax, eax
or eax, 1
test eax, eax
je 0x404868
mov ecx, str.usysdiag.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4046c0
test dl, dl
je 0x4046bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4046c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4046a0
xor eax, eax
jmp 0x4046c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x404868
mov ecx, str.avp.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4046f8
test dl, dl
je 0x4046f4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4046f8
add eax, 2
add ecx, 2
test dl, dl
jne 0x4046d8
xor eax, eax
jmp 0x4046fd
sbb eax, eax
or eax, 1
test eax, eax
je 0x404841
mov ecx, str.ccSvrHst.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404730
test dl, dl
je 0x40472c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404730
add eax, 2
add ecx, 2
test dl, dl
jne 0x404710
xor eax, eax
jmp 0x404735
sbb eax, eax
or eax, 1
test eax, eax
je 0x40481a
mov ecx, str.RavMon.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404768
test dl, dl
je 0x404764
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404768
add eax, 2
add ecx, 2
test dl, dl
jne 0x404748
xor eax, eax
jmp 0x40476d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4047f3
mov ecx, str.kavstart.exe
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4047a0
test dl, dl
je 0x40479c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4047a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x404780
xor eax, eax
jmp 0x4047a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4047cc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jl 0x404470
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.X__W
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x44b108
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x44b0b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.X__WaS
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x44b010
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x44afa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x44af50
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004402b2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push 0x44aeac
call fcn.00401780
add esp, 8
push 0
push 0
push str.X__W3
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004402b2
mov esp, ebp
pop ebp
ret