Function at 0x10002ecf
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov dword [ebp - 0x38], 0x21
lea edi, [ebp - 0x40]
mov dword [ebp - 0x34], 0x5d
mov esi, str.app.alpha.GetVaarHeaders
mov dword [ebp - 0x30], 0x14
mov dword [ebp - 0x2c], 0xffffff6a
movups xmm1, xmmword [ebp - 0x38]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
movaps xmm0, xmm1
mov dword [ebp - 0x14], 0xfe680245
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x10], 0xfd3f8eb9
movups xmm0, xmm1
movsb byte es:[edi], byte [esi]
mov esi, dword [0x10026444]
mov edi, dword [0x100263f4]
psrldq xmm0, 4
paddd xmm1, xmm0
mov dword [ebp - 0xc], 0x74651fe2
movd eax, xmm1
add eax, 5
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, eax
mov edx, str.WATAUAVAWH
inc ecx
lea edx, [edx + 2]
cmp ecx, 0x16bf
jl 0x10002f7f
cmp word [edx], ax
jne 0x10002f57
cmp ecx, 0x25a4
jle 0x10002f8c
call fcn.10001cdd
mov esi, edi
xor esi, 0x618bb0da
jmp 0x10002f9a
call fcn.10001e3e
mov esi, edi
or esi, 0xb36e5e90
mov edi, esi
xor edi, 0x9b87a3f7
mov dword [0x100263f4], edi
push 0x50
sub esi, 0xe729c1f
mov edx, 0x1af5
mov eax, str.PNG_read_error
pop ecx
add edx, ecx
inc eax
cmp edx, 0xe56
ja 0x10002fc1
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10002fad
jmp 0x10002fce
call fcn.10002da4
mov esi, edi
xor esi, 0x15c806c0
imul edi, esi, 0xc43b3020
mov dword [0x100263f4], edi
mov edx, dword [ebp - 8]
sub esi, 0x73804dae
push 0
pop eax
mov byte [ebp + edx - 0x148], dl
inc edx
mov dword [ebp - 8], edx
cmp edx, 0x100
jb 0x10002f50
xor edi, edi
mov dword [ebp - 8], esi
mov esi, edi
xor edx, edx
mov dword [ebp - 0x24], 0x18
mov eax, edi
mov cl, byte [ebp + edi - 0x148]
div dword [ebp - 0x24]
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x40]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x148]
mov byte [ebp + edi - 0x148], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + esi - 0x148], al
cmp edi, 0x100
jb 0x10003004
mov esi, dword [ebp - 8]
mov ecx, 0x19e8
push 0x4e
and esi, 0x24224c3e
mov eax, str.NmlOMjkL22_22
pop edx
xor edi, edi
add ecx, edx
inc eax
cmp ecx, 0x1129
ja 0x1000307c
movsx edx, byte [eax]
test edx, edx
jne 0x10003064
and esi, 0xbd61eb41
and esi, 0xc9c7423a
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], esi
mov dword [0x100263f4], esi
mov esi, edi
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp + esi - 0x148]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x20], eax
mov al, byte [ebp + eax - 0x148]
mov byte [ebp + esi - 0x148], al
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x148], cl
movzx eax, byte [ebp + esi - 0x148]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x148]
xor al, byte [ebp + edi - 0x14]
mov byte [ebp + edi - 0x34], al
inc edi
cmp edi, 0xc
jb 0x10003090
mov esi, dword [ebp - 8]
xor eax, eax
mov byte [ebp - 0x28], al
mov edx, 0x2178
mov dword [ebp - 0x14], 0x31
mov ecx, eax
mov dword [ebp - 0x10], 0x30
mov dword [ebp - 0xc], 0x1d5f
sub edx, dword [ebp + ecx*4 - 0x14]
inc ecx
cmp ecx, 3
jl 0x10003109
push 0xf
pop ecx
and esi, 0xb5f1ffec
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ecx
mov edi, 0x24c4
mov dword [ebp - 0x18], 0x44
mov ecx, eax
mov dword [ebp - 0x14], 0x23
mov dword [ebp - 0x10], 0x5f
mov dword [ebp - 0xc], 0x211b
mov dword [0x10026444], esi
sub edi, dword [ebp + ecx*4 - 0x1c]
inc ecx
cmp ecx, 5
jl 0x1000314b
mov esi, eax
mov dword [ebp - 0x1c], 0x4d
mov dword [ebp - 0x18], 0x2d
mov dword [ebp - 0x14], 0x15
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], 0xffffff6f
sub esi, dword [ebp + eax*4 - 0x1c]
inc eax
cmp eax, 5
jl 0x1000317a
mov ecx, dword [ebp - 0x44]
push edx
push 0x7ffe0000
lea edx, [ebp - 0x34]
call fcn.1001adf3
call eax
test eax, eax
je 0x10003244
mov esi, dword [0x10026444]
xor edi, edi
mov eax, dword [0x100263f4]
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x10], 0x60
mov dword [ebp - 0xc], 0xffffff4a
mov edx, str.NmlOMjkL22_22
mov cl, 0x4e
sub cl, 0x30
cmp cl, 9
ja 0x100031d9
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x100031c8
jmp 0x100031e1
mov esi, eax
xor esi, 0x7d00918e
push 0x57
mov ecx, 0x21bd
mov eax, str.WATAUAVAWH
pop edx
add ecx, edx
lea eax, [eax + 2]
cmp ecx, 0x1065
ja 0x1000320b
movzx edx, word [eax]
test edx, edx
jne 0x100031ee
mov eax, esi
xor eax, 0x9d80315d
jmp 0x1000321c
call fcn.10001906
sub esi, 0x6e281a3a
imul eax, esi, 0x75d24659
mov ecx, dword [ebp - 8]
or esi, 0xe76cc99c
sub ecx, dword [ebp + edi*4 - 0x14]
inc edi
mov dword [0x100263f4], eax
mov dword [ebp - 8], ecx
cmp edi, 3
jl 0x100031c1
mov dword [0x10026444], esi
mov eax, ecx
jmp 0x10003332
mov al, byte [edi + 0x7ffe0000]
mov byte [ebp - 1], al
test al, al
je 0x10003330
mov eax, dword [0x10026444]
xor edi, edi
push 0x15
mov edx, edi
mov dword [ebp - 0x3c], 0x14
mov dword [ebp - 0x38], 0x56
mov dword [ebp - 0x34], 0x42
mov dword [ebp - 0x30], 0x35
mov dword [ebp - 0x2c], 0xffffff31
pop edi
mov esi, str.com.avast.ipm.ClientParameters.BavProductType
mov cl, 0x63
sub cl, 0x30
cmp cl, 9
ja 0x1000329c
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x1000328b
jmp 0x100032a2
imul eax, eax, 0x297aa4eb
sub edi, dword [ebp + edx*4 - 0x3c]
xor eax, 0xe4427f21
inc edx
cmp edx, 5
jl 0x10003284
or dword [0x100263f4], 0x8a70d909
xorps xmm1, xmm1
mov dword [ebp - 0x38], 0x5c
mov dword [ebp - 0x34], 0x61
mov dword [ebp - 0x30], 0x3f
mov dword [ebp - 0x2c], 0xffffff12
movups xmm0, xmmword [ebp - 0x38]
mov dword [0x10026444], eax
movzx eax, byte [ebp - 1]
psubd xmm1, xmm0
cmp eax, edi
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
push 0
movd ecx, xmm1
pop edi
jne 0x1000332b
push 3
mov dword [ebp - 0x48], 0x52
mov dword [ebp - 0x44], 0xffffffac
pop eax
add eax, dword [ebp + edi*4 - 0x48]
inc edi
cmp edi, 2
jl 0x1000331f
jmp 0x10003332
lea eax, [ecx + 0xf]
jmp 0x10003332
mov eax, esi
pop edi
pop esi
leave
ret