Function at 0x4e6fc6
Capabilities:
Check if file exists
Enumerate processes
Inspect section memory permissions

Disassembly:
push 0x23c
mov eax, 0x58f0ca
call fcn.004fb9d0
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0x23c], ebx
call fcn.004fc1f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x23c]
push ecx
push eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4e76ee
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0043479c
mov dword [ebp - 4], ebx
push str.360tray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76bd
push str.zhudongfangyu.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76bd
push str.360sd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76b8
push str.360rp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76b8
push str.ksafetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76b3
push str.ksafesvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76b3
push str.kxescore.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76ae
push str.kxetray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76ae
push str.qqpctray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76a9
push str.qqpcwebshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76a9
push str.qqpcrtp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76a9
push str.avgnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76a4
push str.avcenter.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e76a4
push str.egui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e769f
push str.ekrn.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e769f
push str.rstray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7697
push str.ravmond.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7697
push str.avp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e71ed
or esi, 0x100
jmp 0x4e76c0
push str.msmpeng.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e720c
or esi, 0x200
jmp 0x4e76c0
push str.ccsvchst.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e722b
or esi, 0x400
jmp 0x4e76c0
push str.bdagent.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e724a
or esi, 0x800
jmp 0x4e76c0
push str.kvmonxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e768f
push str.kvsrvxp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e768f
push str.uiseagnt.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7687
push str.coreframeworkhost.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7687
push str.coreserviceshell.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7687
push str.uiwatchdog.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7687
push str.mcshield.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e72f9
or esi, 0x4000
jmp 0x4e76c0
push str.cfp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e7318
or esi, 0x8000
jmp 0x4e76c0
push str.baidusd.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e767f
push str.baidusdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e767f
push str.baidusdtray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e767f
push str.baiduantray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7677
push str.baiduan.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7677
push str.baiduansvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7677
push str.avastsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e766f
push str.avastui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e766f
push str.avgui.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7667
push str.avgwdsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7667
push str.avgidsagent.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7667
push str.mpmon.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e765f
push str.mpsvc.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e765f
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7657
push str.dwengine.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7657
push str.dwservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7657
push str.clamtray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e764f
push str.clamwin.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e764f
push str.avkservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7647
push str.avktray.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7647
push str.fsm32.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e763f
push str.fsma32.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e763f
push str.fsorsp.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e763f
push str.twssrv.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7634
push str.twister.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7634
push str.dgservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7629
push str.drivergenius.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7629
push str.dtlservice.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e761e
push str.drivethelife.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e761e
push str.pcmaster.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e75e7
or esi, 0x10000000
jmp 0x4e76c0
push str.winguard.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
je 0x4e7613
push str.winguard_x64.exe
lea ecx, [ebp - 0x240]
call fcn.00431e0c
test eax, eax
jne 0x4e76c0
or esi, 0x40000000
jmp 0x4e76c0
or esi, 0x8000000
jmp 0x4e76c0
or esi, 0x4000000
jmp 0x4e76c0
or esi, 0x2000000
jmp 0x4e76c0
or esi, 0x1000000
jmp 0x4e76c0
or esi, 0x800000
jmp 0x4e76c0
or esi, 0x400000
jmp 0x4e76c0
or esi, 0x200000
jmp 0x4e76c0
or esi, 0x100000
jmp 0x4e76c0
or esi, 0x80000
jmp 0x4e76c0
or esi, 0x40000
jmp 0x4e76c0
or esi, 0x20000
jmp 0x4e76c0
or esi, 0x10000
jmp 0x4e76c0
or esi, 0x2000
jmp 0x4e76c0
or esi, 0x1000
jmp 0x4e76c0
or esi, 0x80
jmp 0x4e76c0
or esi, 0x40
jmp 0x4e76c0
or esi, 0x20
jmp 0x4e76c0
or esi, 0x10
jmp 0x4e76c0
or esi, 8
jmp 0x4e76c0
or esi, 4
jmp 0x4e76c0
or esi, 2
jmp 0x4e76c0
or esi, 1
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004310e3
cmp edi, ebx
jne 0x4e7021
lea eax, [ebp - 0x248]
push eax
call fcn.004e6c52
pop ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x248]
cmp dword [eax - 0xc], ebx
je 0x4e771e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e771e
or esi, 0x20000000
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.004310e3
mov eax, esi
call fcn.004fba53
ret