Function at 0x1001a944
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x198
mov ecx, dword [0x1003d4dc]
add dword [0x1003d404], 0x5eec85f
add ecx, 0xc57e9445
push esi
push edi
push 0x30
pop edx
xor esi, esi
mov dword [0x1003d558], ecx
mov eax, esi
mov dword [ebp - 0x124], 0xb17
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], 0x1cfc
mov dword [ebp - 0x118], 0xac1
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], 0x47e
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], 0x1003
mov dword [ebp - 0x104], 0x4e5
mov dword [ebp - 0x100], 0x256
mov dword [ebp - 0xfc], 0x5e6
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf4], 0x1cec
cmp eax, 0xb
je 0x1001aa01
inc eax
cmp eax, 0xd
jl 0x1001a9f6
mov eax, dword [ebp + eax*4 - 0x124]
mov dword [ebp - 0x4c], eax
mov eax, esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], 0x17d0
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], 0xcfc
mov dword [ebp - 0xc8], 0x672
cmp eax, 4
je 0x1001aa54
inc eax
cmp eax, 8
jl 0x1001aa49
mov eax, dword [ebp + eax*4 - 0xe4]
mov edi, esi
push 0x5f
mov dword [ebp - 0x10], eax
pop eax
push ecx
mov dword [ebp - 0x3c], 0x1ee2
mov dword [ebp - 0x38], 0x242f
mov dword [ebp - 0x34], 0x1b65
mov dword [ebp - 0x30], 0x165b
mov dword [ebp - 0x2c], 0x2228
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x2630
mov dword [ebp - 0x1c], 0x1579
mov dword [ebp - 0x18], 0x1ae
mov dword [ebp - 0x14], 0x209
call dword [sym.imp.USER32.dll_GetParent]
imul ecx, eax, 0xb226172d
mov dword [ebp - 8], ecx
cmp edi, 5
je 0x1001aac3
inc edi
cmp edi, 0xb
jl 0x1001aab8
mov eax, dword [ebp + edi*4 - 0x3c]
xor edx, edx
xor eax, 0x5f
mov dword [ebp - 0x38], 0xc2f
inc edx
mov dword [ebp - 0x7c], eax
mov eax, esi
mov dword [ebp - 0x34], 0x1315
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0x1ab0
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0x5b5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x20de
cmp eax, 6
je 0x1001ab0f
inc eax
cmp eax, 0xa
jl 0x1001ab04
mov eax, dword [ebp + eax*4 - 0x38]
lea edi, [ebp - 0x8c]
mov dl, byte [str.CharProcs]
mov dword [ebp - 0x50], eax
mov eax, esi
mov esi, str.TimestampExp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dl, byte [ebp - 0x8c]
jne 0x1001ab6d
mov ecx, dword [0x1003d4dc]
mov edi, esi
test dl, dl
je 0x1001ab68
cmp byte [ebp + edi - 0x8c], 0
je 0x1001ab68
push ecx
mov edx, ecx
call fcn.1001973c
mov dl, byte [edi + 0x1003d4ad]
add esp, 4
inc edi
cmp dl, byte [ebp + edi - 0x8c]
je 0x1001ab3f
mov ecx, dword [ebp - 8]
mov eax, esi
mov edx, 0xc1
mov dword [ebp - 0xbc], 0x1df9
mov dword [ebp - 0xb8], 0x16d7
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], 0x8f2
mov dword [ebp - 0xac], 0x782
mov dword [ebp - 0xa8], 0x184a
mov dword [ebp - 0xa4], 0x1f69
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
cmp eax, 7
je 0x1001abcb
inc eax
cmp eax, 9
jl 0x1001abc0
mov eax, dword [ebp + eax*4 - 0xbc]
xor eax, edx
mov dword [ebp - 0x98], esi
xor ecx, 0x5823625d
mov dword [ebp - 0x48], eax
mov dword [ebp - 8], ecx
mov eax, esi
mov dword [0x1003d404], ecx
mov dword [ebp - 0x94], 0x20af
mov dword [ebp - 0x90], 0x20b7
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], 0x24c8
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
cmp eax, 6
je 0x1001ac26
inc eax
cmp eax, 7
jl 0x1001ac1b
mov eax, dword [ebp + eax*4 - 0x98]
mov edx, ecx
push ecx
mov dword [ebp - 0x54], eax
call fcn.1001973c
add esp, 4
mov dword [ebp - 0x38], 0x84e
imul eax, dword [0x1003d4dc], 0x540fc25b
mov edx, 0xea
mov dword [ebp - 0x34], 0x313
mov dword [ebp - 0x30], 0xb6f
mov dword [ebp - 0x2c], 0x51
mov dword [ebp - 0x28], 0x1266
mov dword [0x1003d558], eax
mov eax, esi
mov dword [ebp - 0x24], 0xca9
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0x2466
mov dword [ebp - 0x14], edx
cmp eax, 9
je 0x1001ac96
inc eax
cmp eax, 0xa
jl 0x1001ac8b
mov eax, dword [ebp + eax*4 - 0x38]
push str.ti.ecnerolf
xor eax, edx
push ecx
mov ecx, str.new_FFL2_registration_with_root_key:__hs
mov dword [ebp - 0x70], eax
call fcn.10019fff
pop ecx
pop ecx
mov eax, esi
lea edi, [ebp - 0xe4]
push 7
pop ecx
mov esi, str.DaysSinceSecureBrowserLaunched
mov dword [ebp - 4], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xe4], 0x70
jne 0x1001ad73
mov esi, dword [0x1003d558]
mov cl, 0x70
test cl, cl
je 0x1001ad10
cmp byte [ebp + eax - 0xe4], 0
je 0x1001ad10
push ecx
mov edx, str.moc.emoh_ta_sndnyd
mov ecx, esi
call fcn.10019d9d
mov eax, dword [ebp - 4]
inc eax
pop ecx
mov dword [ebp - 4], eax
mov cl, byte [eax + str.pj.igihcot.otab]
cmp cl, byte [ebp + eax - 0xe4]
je 0x1001acde
cmp dword [ebp - 8], eax
jae 0x1001ad73
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
push esi
push esi
mov edx, str.pj.odiakkoh.adeki
mov ecx, esi
call fcn.10019c1c
cmp dword [ebp - 8], 0xcf6
mov eax, dword [0x1003d4dc]
pop ecx
pop ecx
jne 0x1001ad47
imul esi, eax, 0x67dc3645
mov dword [0x1003d404], esi
jmp 0x1001ad4d
mov esi, dword [0x1003d404]
imul eax, eax, 0x83446d83
mov edx, esi
mov ecx, str.Combobox_FW_addresses
push eax
push eax
mov dword [0x1003d4dc], eax
call fcn.100194d8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
pop ecx
pop ecx
cmp eax, edi
jb 0x1001ad1b
xor esi, esi
mov dword [ebp - 0x38], 0x1eda
imul ecx, dword [0x1003d4dc], 0xd7c21111
mov eax, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 0xb86
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x17ad
mov dword [ebp - 0x28], 0x2200
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0xf9b
mov dword [ebp - 0x1c], 0x1ada
mov dword [ebp - 0x18], 0x1a71
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x74], ecx
mov dword [0x1003d404], ecx
cmp eax, 6
je 0x1001add2
inc eax
cmp eax, 0xb
jl 0x1001adc7
mov eax, dword [ebp + eax*4 - 0x3c]
mov edx, str.CharProcs
mov ecx, str.pj.igihcot.otab
mov dword [ebp - 8], eax
call fcn.1001811f
mov eax, dword [ebp - 0x74]
mov edi, esi
and eax, 0x5bda9bfd
mov dword [0x1003d4dc], eax
inc edi
cmp byte [edi + str.pj.igihcot.otab], 0
jne 0x1001adf7
call fcn.100189a8
mov eax, dword [0x1003d4dc]
mov dword [ebp - 0x74], eax
cmp edi, 0x10a6
jne 0x1001ae2d
and eax, 0x24505f2b
mov dword [ebp - 0x44], eax
mov dword [0x1003d558], eax
mov eax, dword [0x1003d404]
mov dword [ebp - 0xc], eax
jmp 0x1001ae44
mov eax, dword [0x1003d558]
mov dword [ebp - 0x44], eax
xor eax, 0xf44c4a3d
mov ecx, eax
mov dword [ebp - 0xc], eax
call fcn.1001897e
mov cl, byte [str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
lea edi, [ebp - 0x90]
mov dword [ebp - 0x78], esi
mov eax, esi
mov esi, str.pj.odiakkoh.ayot
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp cl, byte [ebp - 0x90]
jmp 0x1001ae8b
test cl, cl
je 0x1001ae90
cmp byte [ebp + eax - 0x90], 0
je 0x1001ae90
call fcn.1001960a
mov eax, dword [ebp - 4]
inc eax
mov cl, byte [eax + str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
cmp cl, byte [ebp + eax - 0x90]
mov dword [ebp - 4], eax
je 0x1001ae67
call fcn.1001865c
mov ecx, dword [ebp - 4]
movzx eax, byte [ebp + ecx - 0x90]
movzx ecx, byte [ecx + str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
sub ecx, eax
cmp ecx, 0x1005
jae 0x1001aec2
imul eax, dword [ebp - 0x44], 0xe6522443
mov edi, dword [ebp - 0x74]
mov dword [0x1003d558], eax
jmp 0x1001aee3
mov edi, dword [ebp - 0x44]
mov ecx, str.pj.etawi.okayim
and edi, 0xb39bab2e
push str.._AUStoredCustodyEntry_custody_asw__
push edi
mov dword [0x1003d4dc], edi
call fcn.10019fff
pop ecx
pop ecx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x94], 0x520
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], 0x2121
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], 0xfe7
mov dword [ebp - 0x80], ecx
cmp eax, 2
je 0x1001af27
inc eax
cmp eax, 7
jl 0x1001af1c
mov eax, dword [ebp + eax*4 - 0x98]
xor esi, esi
mov dword [ebp - 0x74], eax
mov eax, esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x72
mov dword [ebp - 0x38], 0x251e
mov dword [ebp - 0x34], 0x712
mov dword [ebp - 0x30], 0x8ef
mov dword [ebp - 0x2c], 0x2309
mov dword [ebp - 0x28], 0x4ef
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x89e
mov dword [ebp - 0x1c], 0x6ac
mov dword [ebp - 0x18], 0x2056
mov dword [ebp - 0x14], ecx
cmp eax, 0xb
je 0x1001af88
inc eax
cmp eax, 0xc
jl 0x1001af7d
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x128], eax
cmp dword [0x1003c2c0], esi
je 0x1001b028
mov ecx, dword [ebp - 0xc]
lea eax, [edi + 0x545bad58]
mov dword [0x1003d558], eax
and ecx, 0x33051f3b
mov eax, ecx
mov dword [ebp - 0x38], 0x22c7
or eax, 0xc963c955
mov dword [ebp - 0x34], 0x116b
mov dword [0x1003d4dc], eax
push 0x19
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
lea eax, [ecx - 0x6c33ec4c]
mov dword [ebp - 0x30], 0x782
mov dword [ebp - 0x28], 0x20c4
mov dword [ebp - 0x24], 0x2048
mov dword [ebp - 0x20], 0x18cf
mov dword [ebp - 0x1c], 0x152f
mov dword [ebp - 0x18], 0x202c
mov dword [ebp - 0x14], 0x1b2d
mov dword [0x1003d404], eax
cmp esi, 4
je 0x1001b01c
inc esi
cmp esi, 0xb
jl 0x1001b011
mov eax, dword [ebp + esi*4 - 0x3c]
xor eax, 0x18
jmp 0x1001ba5b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x50]
xor eax, 0x760b57a6
mov dword [0x1003d404], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword fs:[eax]
mov edi, dword [0x1003d558]
mov dword [ebp - 4], edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ecx*4 + 8]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
cmp dword [eax + 0x18], ecx
je 0x1001b334
mov ecx, 0xfa
mov eax, esi
mov dword [ebp - 0x3c], 0x14e6
mov dword [ebp - 0x38], 0x19ca
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x98b
mov dword [ebp - 0x2c], 0x25d2
mov dword [ebp - 0x28], 0x82
mov dword [ebp - 0x24], 0x1968
mov dword [ebp - 0x20], 0x18cd
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x36c
mov dword [ebp - 0x14], ecx
cmp eax, 0xa
je 0x1001b0b0
inc eax
cmp eax, 0xb
jl 0x1001b0a5
mov eax, dword [ebp + eax*4 - 0x3c]
mov edx, str.ais_shl_scr
xor eax, ecx
push ecx
mov ecx, edi
mov dword [ebp - 0x50], eax
call fcn.10019d9d
cmp byte [str.CharProcs], 0
mov edi, esi
pop ecx
je 0x1001b100
mov eax, dword [0x1003d4dc]
add eax, 0xe19034d1
mov dword [0x1003d404], eax
push str.Ljecyrillic
mov edx, str.pj.igihcot.otab
mov ecx, str.Launcher
call fcn.10018c81
inc edi
pop ecx
cmp byte [edi + str.CharProcs], 0
jne 0x1001b0e1
call fcn.100191fc
cmp edi, 0x19a3
jae 0x1001b137
mov edi, dword [0x1003d404]
mov eax, str.pj.igihcot.otab
or edi, 0x147b1a27
mov edx, eax
push str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile
push eax
mov dword [ebp - 4], edi
mov dword [0x1003d558], edi
call fcn.100183da
pop ecx
jmp 0x1001b14c
and dword [0x1003d404], 0x4ab773d1
push ecx
mov ecx, str.adtechus.com
call fcn.10019a83
or dword [0x1003d4dc], 0x5ce73bb6
mov eax, esi
pop ecx
mov dword [ebp - 0x198], 0x1039
mov dword [ebp - 0x194], 0x536
mov dword [ebp - 0x190], 0x2362
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], 0x652
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x180], 0x99b
mov dword [ebp - 0x17c], 0x165a
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x174], 0x10e5
mov dword [ebp - 0x170], 0x122
mov dword [ebp - 0x16c], 0x149b
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x164], esi
cmp eax, 3
je 0x1001b1dc
inc eax
cmp eax, 0xe
jl 0x1001b1d1
mov eax, dword [ebp + eax*4 - 0x198]
mov dword [ebp - 0x4c], eax
call fcn.10018ed7
mov edx, esi
lea edi, [ebp - 0x160]
push 0xd
pop ecx
mov esi, str.._AUIProductDefinition_setup_licensing_framework_asw__
mov dword [ebp - 0x44], edx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x160], 0x70
jne 0x1001b237
mov al, 0x70
test al, al
je 0x1001b237
cmp byte [ebp + edx - 0x160], 0
je 0x1001b237
call fcn.1001989e
mov edx, dword [ebp - 0x44]
inc edx
mov dword [ebp - 0x44], edx
mov al, byte [edx + str.pj.igihcot.otab]
cmp al, byte [ebp + edx - 0x160]
je 0x1001b20e
movzx eax, byte [ebp + edx - 0x160]
movzx ecx, byte [edx + str.pj.igihcot.otab]
sub ecx, eax
cmp ecx, 0x1c1e
jae 0x1001b25f
mov eax, dword [ebp - 4]
add eax, 0x457a81eb
mov dword [0x1003d404], eax
jmp 0x1001b271
mov edi, dword [ebp - 4]
and edi, 0x5295df71
mov dword [ebp - 4], edi
mov dword [0x1003d558], edi
push 4
pop eax
xor esi, esi
mov dword [ebp - 0xe4], eax
mov ecx, esi
mov dword [ebp - 0xe0], 0x1f1a
mov dword [ebp - 0xdc], 0x42d
mov dword [ebp - 0xd8], 0xb5a
mov dword [ebp - 0xd4], 0x1bbc
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], 0x1d7d
mov dword [ebp - 0xc8], 0x313
test ecx, ecx
je 0x1001b2ca
inc ecx
cmp ecx, 8
jl 0x1001b2c0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x50]
mov edx, dword [edx + 0x18]
mov dword [ebp - 0x7c], edx
mov eax, dword [edx + 0x3c]
lea eax, [eax + edi*8]
mov edi, dword [ebp - 4]
mov eax, dword [eax + edx + 0x78]
cmp eax, dword [ebp - 0x4c]
je 0x1001b317
add eax, edx
mov dword [ebp - 0x10], eax
mov edx, dword [eax + 0xc]
add edx, dword [ebp - 0x7c]
mov eax, dword [edx]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1001b317
mov eax, dword [ebp + ecx*4 - 0xe4]
mov eax, dword [eax + edx]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1001b334
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], ecx
cmp dword [ecx + 0x18], eax
mov ecx, 0xfa
jne 0x1001b062
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x1001b3b4
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], 0x76b
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], 0x90a
mov dword [ebp - 0xb4], 0x1ba5
mov dword [ebp - 0xb0], 0x1812
mov dword [ebp - 0xac], 0x2335
mov dword [ebp - 0xa8], 0x24d7
mov dword [ebp - 0xa4], 0x20ce
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], 0x21e7
cmp esi, 2
je 0x1001b3a8
inc esi
cmp esi, 0xb
jl 0x1001b39d
mov eax, dword [ebp + esi*4 - 0xc4]
jmp 0x1001ba5b
mov ecx, dword [ebp - 0x7c]
mov eax, dword [edx + 0x1c]
mov edi, dword [edx + 0x18]
add eax, ecx
mov edx, dword [edx + 0x20]
mov dword [ebp - 0x4c], eax
add edx, ecx
mov eax, dword [ebp - 0x10]
mov dword [0x1003d91c], ecx
mov dword [ebp - 0x78], edx
mov eax, dword [eax + 0x24]
add eax, ecx
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x38], 0x228
inc eax
mov dword [ebp - 0x34], 0x1913
mov ecx, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x1836
mov dword [ebp - 0x28], 0x2031
mov dword [ebp - 0x24], 0x1d32
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp ecx, 6
je 0x1001b41d
inc ecx
cmp ecx, 0xa
jl 0x1001b412
mov eax, edi
sub eax, dword [ebp + ecx*4 - 0x38]
mov ecx, dword [edx + eax*4]
mov eax, 0x775a
add ecx, dword [ebp - 0x7c]
cmp word [ecx], ax
jne 0x1001b50a
push 0x1c
pop edx
mov eax, esi
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], 0x19
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xd0], 0x17d8
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc8], 0x197d
cmp eax, 3
je 0x1001b47d
inc eax
cmp eax, 7
jl 0x1001b472
mov eax, dword [ebp + eax*4 - 0xe0]
mov edx, 0x226
xor eax, 0x1d
mov dword [ebp - 0x34], 0x6e9
mov dword [ebp - 0x54], eax
mov eax, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0xec
mov dword [ebp - 0x28], 0x23b
mov dword [ebp - 0x24], 0x5a9
mov dword [ebp - 0x20], 0x178f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x2598
cmp eax, 7
je 0x1001b4cf
inc eax
cmp eax, 9
jl 0x1001b4c4
mov dword [ebp - 0x48], eax
call fcn.1001a76d
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x50]
mov dword [edx*8 + 0x1003c2c4], eax
mov eax, edi
sub eax, dword [ebp - 0x54]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx + eax*4]
mov dword [edx*8 + 0x1003c2c8], eax
inc edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x70], edx
cmp edx, dword [ebp + eax*4 - 0x34]
je 0x1001b516
mov edx, dword [ebp - 0x78]
sub edi, 1
jne 0x1001b3db
mov edx, dword [ebp - 0x70]
mov edi, dword [ebp - 4]
mov eax, edx
sub eax, dword [ebp - 0x74]
mov dword [0x1003c2c0], edx
cmp dword [ebp - 8], eax
jae 0x1001ba3d
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x98]
mov eax, esi
mov esi, str.avast_employee_avast.com
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov cl, byte [str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
movsb byte es:[edi], byte [esi]
cmp cl, byte [ebp - 0x98]
jmp 0x1001b575
test cl, cl
je 0x1001b57a
cmp byte [ebp + eax - 0x98], 0
je 0x1001b57a
call fcn.1001865c
mov eax, dword [ebp - 0x10]
inc eax
mov cl, byte [eax + str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
cmp cl, byte [ebp + eax - 0x98]
mov dword [ebp - 0x10], eax
je 0x1001b551
mov ecx, str.SafeZone
call fcn.1001827f
mov ecx, dword [ebp - 0x10]
movzx eax, byte [ebp + ecx - 0x98]
movzx ecx, byte [ecx + str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
sub ecx, eax
cmp ecx, 0x18f5
jbe 0x1001b5b7
imul eax, dword [0x1003d4dc], 0xf3ea066f
mov dword [ebp - 4], eax
mov dword [0x1003d558], eax
call fcn.1001a4ef
mov eax, dword [ebp - 0x54]
mov ecx, 0xea
mov dword [ebp - 0x124], 0x1cda
mov dword [ebp - 0x120], 0xfe0
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], 0x18cb
mov dword [ebp - 0x110], 0x1f9f
mov dword [ebp - 0x10c], 0xbd4
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], 0xed1
mov dword [ebp - 0x100], 0x1ce7
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], 0x14bf
mov dword [ebp - 0xf4], 0x93e
cmp eax, 7
je 0x1001b63c
inc eax
cmp eax, 0xd
jl 0x1001b631
mov edi, dword [ebp + eax*4 - 0x124]
xor edi, ecx
mov dword [ebp - 0xb8], 0x1037
mov ecx, 0xf8
mov dword [ebp - 0x48], edi
xor esi, esi
mov dword [ebp - 0xb4], 0xc0b
mov eax, esi
mov dword [ebp - 0xb0], 0xe27
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], 0x42
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], 0x1a86
cmp eax, 6
je 0x1001b6a0
inc eax
cmp eax, 8
jl 0x1001b695
mov ecx, dword [ebp + eax*4 - 0xb8]
mov edx, dword [ebp - 0x70]
xor ecx, 0xf9
mov dword [ebp - 0x44], ecx
jmp 0x1001ba19
xor edx, edx
mov dword [ebp - 0x3c], 0x18e5
inc edx
mov dword [ebp - 0x38], 0x18f6
mov eax, esi
mov dword [ebp - 0x34], 0x440
mov dword [ebp - 0x30], 0x11cf
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0xc7c
mov dword [ebp - 0x24], 0x11e1
mov dword [ebp - 0x20], 0x20b3
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0x494
mov dword [ebp - 0x14], 0x235c
cmp eax, 8
je 0x1001b70d
inc eax
cmp eax, 0xb
jl 0x1001b702
mov eax, dword [ebp + eax*4 - 0x3c]
mov edx, dword [edi*8 + 0x1003c2c8]
add eax, edi
mov dword [ebp - 0xc], edx
cmp edx, dword [eax*8 + 0x1003c2c8]
jbe 0x1001ba12
xor ecx, ecx
mov dword [ebp - 0xc4], 0xca4
inc ecx
mov dword [ebp - 0xc0], 0x37a
mov eax, esi
mov dword [ebp - 0xbc], 0xceb
mov dword [ebp - 0xb8], 0x99e
mov dword [ebp - 0xb4], 0x622
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], 0xcdc
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], 0x2591
cmp eax, 5
je 0x1001b798
inc eax
cmp eax, 0xb
jl 0x1001b78d
mov eax, dword [ebp + eax*4 - 0xc4]
push 0x48
pop edx
mov dword [ebp - 0x54], eax
mov eax, esi
mov dword [ebp - 0x120], 0x1304
mov dword [ebp - 0x11c], 0xac7
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], 0x171
mov dword [ebp - 0x110], 0x784
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], 0x142
mov dword [ebp - 0x104], 0x2363
mov dword [ebp - 0x100], edx
mov dword [ebp - 0xfc], 0x1819
mov dword [ebp - 0xf8], 0x105d
mov dword [ebp - 0xf4], edx
cmp eax, 8
je 0x1001b81a
inc eax
cmp eax, 0xc
jl 0x1001b80f
mov eax, dword [ebp + eax*4 - 0x120]
xor eax, 0x49
mov dword [ebp - 0xf0], 0x974
mov dword [ebp - 0x50], eax
mov eax, esi
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], 0xf84
mov dword [ebp - 0xe4], 0x13d9
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], 0x16a9
mov dword [ebp - 0xd8], 0x3c0
mov dword [ebp - 0xd4], 0x1bd2
mov dword [ebp - 0xd0], 0x1bea
mov dword [ebp - 0xcc], 0x1850
mov dword [ebp - 0xc8], ecx
cmp eax, 0xa
je 0x1001b896
inc eax
cmp eax, 0xb
jl 0x1001b88b
mov eax, dword [ebp + eax*4 - 0xf0]
mov dword [ebp - 0x4c], eax
mov eax, 0x83
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], 0x10f5
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 0x19e7
mov dword [ebp - 0x150], 0x201d
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], 0xe28
mov dword [ebp - 0x144], 0x1961
mov dword [ebp - 0x140], 0x1b80
mov dword [ebp - 0x13c], 0x1256
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], 0x119b
mov dword [ebp - 0x130], 0xfc4
test esi, esi
je 0x1001b921
inc esi
cmp esi, 0xd
jl 0x1001b917
mov eax, dword [ebp + esi*4 - 0x160]
mov esi, dword [ebp - 4]
xor eax, 0x82
mov dword [ebp - 0x10], eax
mov ecx, esi
mov eax, dword [edi*8 + 0x1003c2c4]
or ecx, 0x7ab40c13
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x54]
lea edx, [esi + 0x6711a616]
add eax, edi
mov dword [0x1003d404], edx
push esi
push edx
mov edx, str.pj.aran.awageson
mov dword [0x1003d4dc], ecx
mov eax, dword [eax*8 + 0x1003c2c4]
mov dword [edi*8 + 0x1003c2c4], eax
call fcn.10019c1c
pop ecx
pop ecx
push 5
pop ecx
mov esi, str.analyze_based_on_file
mov al, byte [str.avcfg:__settings_Common_AfbBootTimeScanActionOnPackedFile]
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp al, byte [ebp - 0x94]
jne 0x1001b9be
mov edi, esi
test al, al
je 0x1001b9be
cmp byte [ebp + edi - 0x94], 0
je 0x1001b9be
call fcn.10018fcc
mov al, byte [edi + 0x1003d501]
inc edi
cmp al, byte [ebp + edi - 0x94]
je 0x1001b99b
mov eax, dword [0x1003d4dc]
mov edi, dword [ebp - 0x48]
and eax, 0x87dc0e7f
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 4], eax
mov dword [0x1003d558], eax
mov eax, dword [ebp - 0x50]
add eax, edi
mov eax, dword [eax*8 + 0x1003c2c8]
mov dword [edi*8 + 0x1003c2c8], eax
mov eax, dword [ebp - 0x4c]
add eax, edi
mov dword [eax*8 + 0x1003c2c4], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
add eax, edi
mov dword [eax*8 + 0x1003c2c8], ecx
mov edx, dword [0x1003c2c0]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x70], edx
jmp 0x1001ba15
mov edx, dword [ebp - 0x70]
inc edi
mov dword [ebp - 0x48], edi
mov eax, edx
sub eax, ecx
sub eax, dword [ebp - 8]
cmp edi, eax
jb 0x1001b6b8
mov ecx, dword [ebp - 8]
sub edx, dword [ebp - 0x74]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, edx
jb 0x1001b52d
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
lea ecx, [edi + 0x7645264b]
or edi, 0xdde3abe9
mov dword [0x1003d4dc], ecx
mov dword [0x1003d404], edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret