Function at 0x10005909
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe40
push esi
xor esi, esi
mov dword [ebp - 0xfc], 0x3b
push edi
mov eax, esi
mov dword [ebp - 0xf8], 0x1e
mov dword [ebp - 0xf4], 0x50
mov dword [ebp - 0xf0], 0x21
mov dword [ebp - 0xec], 0xffffff36
sub eax, dword [ebp + esi*4 - 0xfc]
inc esi
cmp esi, 5
jl 0x1000594a
mov dword [ebp - 0x2c], eax
call fcn.10005902
mov edx, 0x25a
mov ecx, str.SRRemoveRestorePoint
mov edi, dword [eax + 0xc]
movzx eax, byte [str.SRRemoveRestorePoint]
add edi, 0x14
mov dword [ebp - 0xe8], edi
jmp 0x1000598c
add edx, eax
inc ecx
cmp edx, 0x1a81
ja 0x100059c7
movzx eax, byte [ecx]
test eax, eax
jne 0x1000597e
mov eax, dword [0x1002a23c]
imul esi, eax, 0x28e14703
mov dword [0x1002a45c], esi
call fcn.10001465
push 0x53
mov ecx, 0x1b68
mov eax, str.SleepingProgramsImpactSum
pop edx
add ecx, edx
inc eax
cmp ecx, 0x107f
ja 0x100059d8
movsx edx, byte [eax]
test edx, edx
jne 0x100059b3
jmp 0x100059dd
call fcn.10001df3
mov eax, dword [0x1002a23c]
add eax, 0x56f6f5f7
jmp 0x10005995
call fcn.10001a1a
mov eax, esi
and eax, 0x98e14f41
mov dword [0x1002a23c], eax
call fcn.1000128b
mov eax, dword [edi]
mov dword [ebp - 0xc8], eax
cmp eax, edi
je 0x10006f4a
push 0x28
pop ecx
push 0x11
pop eax
push 0x1b
pop edx
push 0x3c
mov byte [ebp - 0x8a], cl
mov byte [ebp - 0x5e], cl
pop ecx
push 0x11
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x64], dl
pop edx
push 0x3a
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 0xb2], cl
mov byte [ebp - 0x48], cl
pop ecx
push 0xc
mov dword [ebp - 0xd0], ecx
mov byte [ebp - 0x5b], cl
pop ecx
mov dword [ebp - 0xd8], eax
mov byte [ebp - 0x85], al
xor eax, eax
mov word [ebp - 0x8c], 0x8307
mov dword [ebp - 0x89], 0x53484dcb
mov dword [ebp - 0x84], 0xceb7e062
mov dword [ebp - 0x98], 0x4a3b5823
mov dword [ebp - 0x94], 0xae864db3
mov dword [ebp - 0x90], 0x27274b4c
mov dword [ebp - 0x68], 0x600ac4c
mov dword [ebp - 0x63], 0x7ffa55a3
mov byte [ebp - 0x5f], 0x67
mov word [ebp - 0xb4], 0x7247
mov dword [ebp - 0xb1], 0x983d5764
mov dword [ebp - 0xad], 0xaf234dfa
mov byte [ebp - 0xa9], 0x25
mov byte [ebp - 0xa8], dl
mov dword [ebp - 0x74], 0x816d3dc
mov dword [ebp - 0x70], 0x996a4da2
mov word [ebp - 0x6c], 0xda9e
mov byte [ebp - 0x6a], 0x74
mov dword [ebp - 0xa4], 0xd44e43ba
mov dword [ebp - 0xa0], 0x8db2714d
mov dword [ebp - 0x9c], 0xb0c48309
mov dword [ebp - 0x44], 0xdbda0914
mov dword [ebp - 0x40], 0x4162abaf
mov dword [ebp - 0x3c], 0x85338e12
mov dword [ebp - 0x50], 0xc1458494
mov dword [ebp - 0x4c], 0x80a18a46
mov dword [ebp - 0x80], 0x6071dd1c
mov dword [ebp - 0x7c], 0x7600cf7b
mov word [ebp - 0x78], 0xfcdd
mov byte [ebp - 0x76], 0xdd
mov dword [ebp - 0xc4], 0x4f644266
mov dword [ebp - 0xc0], 0xaaee5c23
mov dword [ebp - 0xbc], 0x3124c901
mov byte [ebp - 0xb8], 0x9f
mov byte [ebp - 0x5c], 0x18
mov dword [ebp - 0x5a], 0x575ff8a
mov dword [ebp - 0x56], 0xfa302602
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xdc], 0x13
mov dword [ebp - 0xe0], 0xa
mov dword [ebp - 0xe4], 0xf
xor esi, 0xff8695ee
mov dword [ebp - 0xc], eax
add esi, 0x30866b98
lea edi, [ebp - 0xdcc]
mov dword [ebp - 0x14], esi
mov esi, str.Install_started_but_was_cancelled_from_application
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp + ecx - 0x398], cl
inc ecx
cmp ecx, 0x100
jb 0x10005baf
or dword [ebp - 0x14], 0x2a368f32
mov esi, eax
xor edx, edx
mov cl, byte [ebp + esi - 0x398]
push 0x32
mov eax, esi
mov byte [ebp - 0xd], cl
pop edi
div edi
movzx ecx, cl
movzx eax, byte [ebp + edx - 0xdcc]
add eax, dword [ebp - 0xc]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0xc], ecx
mov al, byte [ebp + ecx - 0x398]
mov byte [ebp + esi - 0x398], al
inc esi
mov al, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x398], al
cmp esi, 0x100
jb 0x10005bc8
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, esi
mov edi, esi
lea eax, [ecx + 1]
movzx edx, al
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov cl, byte [ebp + edx - 0x398]
movzx esi, cl
add eax, esi
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x398]
mov byte [ebp + edx - 0x398], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x398], cl
call fcn.1000128b
mov ecx, dword [ebp - 0x18]
push 0xc
movzx eax, byte [ebp + ecx - 0x398]
add eax, esi
movzx eax, al
mov al, byte [ebp + eax - 0x398]
xor al, byte [ebp + edi - 0x8c]
movzx eax, al
mov word [ebp + edi*2 - 0x1a8], ax
inc edi
pop eax
cmp edi, eax
jb 0x10005c1b
push 7
pop ecx
mov esi, str.h_scrollbar_page_plus_hover
lea edi, [ebp - 0x27c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov word [ebp - 0x190], ax
mov dword [ebp - 0xc], esi
mov byte [ebp + eax - 0x498], al
inc eax
cmp eax, 0x100
jb 0x10005ca5
mov edi, dword [ebp - 0x14]
xor edx, edx
mov cl, byte [ebp + esi - 0x498]
mov eax, esi
mov byte [ebp - 0xd], cl
div dword [ebp - 0x34]
movzx ecx, cl
add edi, 0xe0ed590a
and edi, 0x4719c4a2
movzx eax, byte [ebp + edx - 0x27c]
add eax, dword [ebp - 0xc]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0xc], ecx
mov al, byte [ebp + ecx - 0x498]
mov byte [ebp + esi - 0x498], al
inc esi
mov al, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x498], al
cmp esi, 0x100
jb 0x10005cb7
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], esi
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
push 0xc
mov cl, byte [ebp + edi - 0x498]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x498]
mov byte [ebp + edi - 0x498], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x498], cl
movzx eax, byte [ebp + edi - 0x498]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x498]
xor al, byte [ebp + esi - 0x98]
movzx eax, al
mov word [ebp + esi*2 - 0x1c4], ax
inc esi
pop eax
cmp esi, eax
jb 0x10005d15
mov edi, dword [ebp - 0x14]
xor esi, esi
inc esi
cmp esi, 0x14a5
je 0x10005d8f
cmp byte [esi + str.SleepingProgramsImpactSum], 0
jne 0x10005d7b
jmp 0x10005d94
call section..text
mov esi, edi
xor esi, 0x9c7e8eb3
movzx eax, byte [str.SRRemoveRestorePoint]
add edi, 0x2bdc58db
mov dword [ebp - 0x14], edi
mov edx, 0x1191
mov ecx, str.SRRemoveRestorePoint
jmp 0x10005dc6
add edx, eax
inc ecx
cmp edx, 0x212d
ja 0x10005dcc
movzx eax, byte [ecx]
test eax, eax
jne 0x10005db8
jmp 0x10005dda
call fcn.10001df3
lea edi, [esi + 0x3aa9a601]
mov dword [ebp - 0x14], edi
call fcn.10001ee4
push 0xe
pop ecx
mov esi, str.com.avast.ipm.ClientParameters.WindowsSecurityCenterStatus
lea edi, [ebp - 0xe40]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov word [ebp - 0x1ac], ax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
mov dword [ebp - 0xc], esi
mov byte [ebp + eax - 0x598], al
inc eax
cmp eax, 0x100
jb 0x10005e00
mov edi, esi
mov esi, dword [ebp - 0x14]
xor edx, edx
mov cl, byte [ebp + edi - 0x598]
mov eax, edi
mov byte [ebp - 0xd], cl
div dword [ebp - 0xd0]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0xe40]
add eax, dword [ebp - 0xc]
add ecx, eax
mov al, byte [str.pkey_dsa_ctrl_str]
movzx edx, cl
mov ecx, str.pkey_dsa_ctrl_str
mov dword [ebp - 0xc], edx
jmp 0x10005e53
sub al, 0x30
cmp al, 9
ja 0x10005e59
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10005e4a
jmp 0x10005e5f
xor esi, 0x5da9e960
mov al, byte [ebp + edx - 0x598]
xor esi, 0x5013b9be
mov byte [ebp + edi - 0x598], al
inc edi
mov al, byte [ebp - 0xd]
mov byte [ebp + edx - 0x598], al
cmp edi, 0x100
jb 0x10005e14
mov dword [ebp - 0x14], esi
xor esi, esi
mov dword [ebp - 4], esi
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + edi - 0x598]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x598]
mov byte [ebp + edi - 0x598], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x598], cl
movzx eax, byte [ebp + edi - 0x598]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x598]
xor al, byte [ebp + esi - 0x68]
movzx eax, al
mov word [ebp + esi*2 - 0x15c], ax
inc esi
cmp esi, 0xb
jb 0x10005e90
mov esi, str.BALLOON5_240
lea edi, [ebp - 0x28]
xor eax, eax
mov word [ebp - 0x146], ax
mov eax, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
or eax, 0x4ad5a83d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
mov ecx, esi
mov byte [ebp + ecx - 0x698], cl
inc ecx
cmp ecx, 0x100
jb 0x10005f0d
xor eax, 0x65aa06
mov edi, esi
or eax, 0x9c1a5171
mov dword [ebp - 0x14], eax
movzx eax, byte [str.nested_too_deep]
mov edx, 0xe73
mov ecx, str.nested_too_deep
jmp 0x10005f4d
add edx, eax
inc ecx
cmp edx, 0x2226
ja 0x10005f53
movzx eax, byte [ecx]
test eax, eax
jne 0x10005f3f
jmp 0x10005f58
call fcn.10001ee4
mov ecx, str.LangRef8916
call fcn.10002669
xor edx, edx
mov cl, byte [ebp + edi - 0x698]
mov eax, edi
mov byte [ebp - 0xd], cl
div dword [ebp - 0xd4]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x28]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x698]
mov byte [ebp + edi - 0x698], al
inc edi
mov al, byte [ebp - 0xd]
mov byte [ebp + esi - 0x698], al
cmp edi, 0x100
jb 0x10005f2c
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], esi
mov edx, esi
push edi
call fcn.10001dc8
lea eax, [edx + 1]
movzx eax, al
mov dword [ebp - 0xc], eax
pop ecx
mov cl, byte [ebp + eax - 0x698]
mov eax, dword [ebp - 4]
movzx edx, cl
add eax, edx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0xc]
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x698]
mov byte [ebp + edx - 0x698], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x698], cl
mov eax, edx
movzx eax, byte [ebp + eax - 0x698]
add eax, dword [ebp - 0x18]
movzx eax, al
mov al, byte [ebp + eax - 0x698]
xor al, byte [ebp + esi - 0xb4]
movzx eax, al
mov word [ebp + esi*2 - 0x218], ax
inc esi
cmp esi, 0xd
jb 0x10005fb0
mov esi, str.AvResOutTermEvent
lea edi, [ebp - 0xfc]
xor eax, eax
mov word [ebp - 0x1fe], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x14]
or edi, 0xf22ed918
xor esi, esi
lea eax, [edi - 0x40925569]
mov dword [ebp - 0x18], eax
mov eax, esi
mov byte [ebp + eax - 0x798], al
inc eax
cmp eax, 0x100
jb 0x10006052
push 0x13
pop eax
mov edx, eax
mov ecx, str.nested_too_deep
mov al, byte [str.nested_too_deep]
mov byte [ebp - 0xd], al
movzx eax, al
jmp 0x10006086
add edx, eax
inc ecx
cmp edx, 0xa3e
ja 0x1000608c
movzx eax, byte [ecx]
test eax, eax
jne 0x10006078
jmp 0x1000609d
mov ecx, str.pkey_dsa_ctrl_str
call fcn.10001ce6
imul edi, dword [ebp - 0x18], 0x29eff0e
add edi, 0x6639e6bc
mov dword [ebp - 0x14], edi
push str.Invalid_bit_depth_for_RGBA_image
call fcn.10001941
pop ecx
mov edi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x798]
mov eax, esi
mov byte [ebp - 5], cl
div dword [ebp - 0xd8]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0xfc]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x798]
mov byte [ebp + esi - 0x798], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + edi - 0x798], al
cmp esi, 0x100
jb 0x100060b3
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0xc], esi
mov eax, esi
mov dword [ebp - 0x14], esi
inc eax
cmp eax, 0x1a37
jl 0x10006118
cmp byte [eax + str.SleepingProgramsImpactSum], 0
jne 0x10006107
cmp eax, 0x1013
jle 0x10006124
call section..text
lea ecx, [edi + 0x6f897553]
mov dword [ebp - 4], ecx
mov edx, str.SleepingProgramsImpactSum
mov al, 0x53
sub al, 0x30
cmp al, 9
ja 0x10006143
inc edx
mov al, byte [edx]
test al, al
jne 0x10006134
jmp 0x1000614c
xor ecx, 0x96e38f95
mov dword [ebp - 4], ecx
call fcn.10001df3
mov eax, dword [ebp - 0x14]
add edi, 0xdcecac7a
or edi, 0xb6a95f16
inc eax
movzx eax, al
mov dword [ebp - 0x14], eax
mov cl, byte [ebp + eax - 0x798]
mov eax, dword [ebp - 0xc]
movzx edx, cl
add eax, edx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0x798]
mov byte [ebp + edx - 0x798], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x798], cl
mov eax, edx
mov ecx, dword [ebp - 4]
add ecx, 0x16f2d76e
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + eax - 0x798]
add eax, dword [ebp - 0x18]
movzx eax, al
mov al, byte [ebp + eax - 0x798]
xor al, byte [ebp + esi - 0x74]
movzx eax, al
mov word [ebp + esi*2 - 0x174], ax
inc esi
cmp esi, 0xb
jb 0x1000612d
mov dword [ebp - 0x14], edi
mov esi, str.div.DetailContainer_
push 5
pop ecx
lea edi, [ebp - 0x260]
or dword [ebp - 4], 0x737ab6fc
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov word [ebp - 0x15e], ax
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0xc], esi
mov byte [ebp + eax - 0x898], al
inc eax
cmp eax, 0x100
jb 0x10006200
xor edx, edx
mov dword [ebp - 0x18], 0x15
mov eax, esi
mov cl, byte [ebp + esi - 0x898]
div dword [ebp - 0x18]
mov byte [ebp - 5], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x260]
add eax, dword [ebp - 0xc]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0xc], ecx
mov al, byte [ebp + ecx - 0x898]
mov byte [ebp + esi - 0x898], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + ecx - 0x898], al
cmp esi, 0x100
jb 0x1000620f
xor esi, esi
mov dword [ebp - 0xc], esi
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0xc]
push 0xc
mov cl, byte [ebp + edi - 0x898]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0x898]
mov byte [ebp + edi - 0x898], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x898], cl
movzx eax, byte [ebp + edi - 0x898]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x898]
xor al, byte [ebp + esi - 0xa4]
movzx eax, al
mov word [ebp + esi*2 - 0x1e0], ax
inc esi
pop eax
cmp esi, eax
jb 0x10006265
mov edi, dword [ebp - 4]
xor eax, eax
mov dl, byte [str.SRRemoveRestorePoint]
sub edi, 0x6d0543ef
mov word [ebp - 0x1c8], ax
mov ecx, str.SRRemoveRestorePoint
mov dword [ebp - 4], edi
test dl, dl
je 0x10006304
mov al, dl
sub al, 0x30
cmp al, 9
ja 0x100062fb
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100062ec
jmp 0x10006304
xor edi, 0xe24a23ed
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x14]
lea edi, [ebp - 0x248]
push 5
pop ecx
mov esi, str.SOFTWARE_UPDATER_96
sub eax, 0x5fc7d416
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, esi
test dl, dl
je 0x10006349
inc ecx
cmp ecx, 0x184b
je 0x10006338
cmp byte [ecx + str.SRRemoveRestorePoint], 0
jne 0x10006324
jmp 0x10006349
push ecx
push eax
call fcn.1000222c
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or eax, 0x10f02578
lea edi, [eax + 0x7e0e72ee]
mov ecx, str.pkey_dsa_ctrl_str
mov al, byte [str.pkey_dsa_ctrl_str]
jmp 0x10006364
sub al, 0x30
cmp al, 9
ja 0x1000636a
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000635b
jmp 0x10006370
or edi, 0xcef7e84f
imul eax, edi, 0x8383a6ad
mov ecx, str.SleepingProgramsImpactSum
mov dword [ebp - 0xc], eax
call fcn.10001b02
mov al, byte [ebp - 0xd]
mov ecx, str.nested_too_deep
jmp 0x10006396
sub al, 0x30
cmp al, 9
ja 0x100063be
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000638d
mov eax, dword [ebp - 0xc]
imul edx, eax, 0x66a543e8
mov eax, esi
mov byte [ebp + eax - 0x998], al
inc eax
cmp eax, 0x100
jb 0x100063a5
mov al, byte [ebp - 0xd]
mov ecx, str.nested_too_deep
jmp 0x100063dd
mov edi, dword [ebp - 0xc]
and edi, 0x3bcce3d3
call section..text
lea eax, [edi + 0x7fcd52db]
jmp 0x1000639d
sub al, 0x30
cmp al, 9
ja 0x100063e3
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100063d4
jmp 0x100063e9
sub edx, 0x604a956d
mov al, byte [str.pkey_dsa_ctrl_str]
and edi, 0xdbd419da
mov ecx, str.pkey_dsa_ctrl_str
jmp 0x10006404
sub al, 0x30
cmp al, 9
ja 0x1000640a
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100063fb
jmp 0x10006410
lea edx, [edi + 0x6f7168be]
imul edi, edx, 0xee1bce1c
mov dword [ebp - 4], edi
mov edi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x998]
mov eax, esi
mov byte [ebp - 5], cl
div dword [ebp - 0xdc]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x248]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x998]
mov byte [ebp + esi - 0x998], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + edi - 0x998], al
cmp esi, 0x100
jb 0x1000641b
mov edi, dword [ebp - 4]
xor esi, esi
xor edi, 0xc445858e
sub edi, 0x57dbe708
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], esi
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0xc]
push 0xc
mov cl, byte [ebp + edi - 0x998]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0x998]
mov byte [ebp + edi - 0x998], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x998], cl
movzx eax, byte [ebp + edi - 0x998]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x998]
xor al, byte [ebp + esi - 0x44]
movzx eax, al
mov word [ebp + esi*2 - 0x1fc], ax
inc esi
pop eax
cmp esi, eax
jb 0x1000647b
mov esi, str.AVG_BG_URL
lea edi, [ebp - 0x108]
xor eax, eax
mov word [ebp - 0x1e4], ax
mov al, byte [str.SRRemoveRestorePoint]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.SRRemoveRestorePoint
mov ecx, esi
jmp 0x10006509
sub al, 0x30
cmp al, 9
ja 0x10006524
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10006500
mov eax, dword [ebp - 4]
imul edi, eax, 0xf6f89558
call fcn.10001465
mov al, byte [str.SRRemoveRestorePoint]
mov ecx, esi
jmp 0x10006537
mov eax, dword [ebp - 4]
and eax, 0x9087f2ff
jmp 0x10006510
sub al, 0x30
cmp al, 9
ja 0x1000653d
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1000652e
jmp 0x10006543
add edi, 0xf624c2d
call fcn.1000117c
xor esi, esi
mov eax, esi
mov byte [ebp + eax - 0xa98], al
inc eax
cmp eax, 0x100
jb 0x1000654c
and edi, 0x528259ac
mov dword [ebp - 0x14], edi
mov edi, esi
mov ecx, str.leveldb.H9
call fcn.10002669
xor edx, edx
mov cl, byte [ebp + esi - 0xa98]
mov eax, esi
mov byte [ebp - 5], cl
div dword [ebp - 0xe0]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x108]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0xa98]
mov byte [ebp + esi - 0xa98], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + edi - 0xa98], al
cmp esi, 0x100
jb 0x10006566
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0xc], esi
mov eax, esi
mov dword [ebp - 0x18], esi
inc eax
lea esi, [edi - 0x15024605]
movzx eax, al
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], esi
mov cl, byte [ebp + eax - 0xa98]
mov eax, dword [ebp - 0xc]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0xa98]
mov byte [ebp + edi - 0xa98], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0xa98], cl
mov eax, dword [ebp - 0x14]
lea edi, [esi + 0x54bc4066]
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xa98]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0xa98]
xor al, byte [ebp + ecx - 0x50]
movzx eax, al
mov word [ebp + ecx*2 - 0x11c], ax
inc ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp ecx, 9
jb 0x100065c4
mov dword [ebp - 0x14], edi
mov esi, str.In_process_minidump_generation_failed_with_error__d.
push 0xd
pop ecx
lea edi, [ebp - 0xe04]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x10a], ax
mov ecx, str.pkey_dsa_ctrl_str
mov al, byte [str.pkey_dsa_ctrl_str]
movsb byte es:[edi], byte [esi]
jmp 0x10006671
sub al, 0x30
cmp al, 9
ja 0x100066ad
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10006668
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
push ecx
push edx
and edi, 0x1ce30331
call fcn.1000222c
sub edx, 0x52aad388
xor esi, esi
pop ecx
pop ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], esi
mov eax, esi
inc eax
cmp eax, 0xecc
je 0x100066ba
cmp byte [eax + str.SleepingProgramsImpactSum], 0
jne 0x1000669a
jmp 0x100066c9
mov edx, dword [ebp - 4]
mov edi, edx
or edi, 0xedb8151c
jmp 0x1000667b
call fcn.100026e6
mov eax, edi
and eax, 0x50414f11
mov dword [ebp - 4], eax
and edi, 0x51007022
or edi, 0x40b0111
call fcn.1000174b
mov ecx, dword [ebp - 0x18]
mov byte [ebp + ecx - 0xb98], cl
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x100
jb 0x10006698
mov edi, esi
xor edx, edx
mov dword [ebp - 0x18], 0x34
mov eax, edi
mov cl, byte [ebp + edi - 0xb98]
div dword [ebp - 0x18]
mov byte [ebp - 5], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0xe04]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0xb98]
mov byte [ebp + edi - 0xb98], al
inc edi
mov al, byte [ebp - 5]
mov byte [ebp + esi - 0xb98], al
cmp edi, 0x100
jb 0x100066f2
mov al, byte [ebp - 0xd]
xor esi, esi
mov ecx, str.nested_too_deep
jmp 0x10006756
sub al, 0x30
cmp al, 9
ja 0x100068ec
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10006749
mov eax, dword [ebp - 4]
xor eax, 0x45d6c94d
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp + edi - 0xb98]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0xb98]
mov byte [ebp + edi - 0xb98], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0xb98], cl
movzx eax, byte [ebp + edi - 0xb98]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0xb98]
xor al, byte [ebp + esi - 0x80]
movzx eax, al
mov word [ebp + esi*2 - 0x18c], ax
inc esi
cmp esi, 0xb
jb 0x1000676a
push 7
xor eax, eax
lea edi, [ebp - 0x298]
pop ecx
mov esi, str.Sontiq_licence_check_failed
mov word [ebp - 0x176], ax
rep movsd dword es:[edi], dword [esi]
imul edi, dword [ebp - 4], 0x2ec42e3b
xor esi, esi
mov dword [ebp - 4], edi
mov byte [ebp + eax - 0xc98], al
inc eax
cmp eax, 0x100
jb 0x100067eb
mov edi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0xc98]
mov eax, esi
mov byte [ebp - 5], cl
div dword [ebp - 0x34]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x298]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0xc98]
mov byte [ebp + esi - 0xc98], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + edi - 0xc98], al
cmp esi, 0x100
jb 0x100067fc
mov edi, dword [ebp - 4]
xor esi, esi
and edi, 0x8ab2f805
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], edi
mov edi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp + edi - 0xc98]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0xc98]
mov byte [ebp + edi - 0xc98], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0xc98], cl
movzx eax, byte [ebp + edi - 0xc98]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0xc98]
xor al, byte [ebp + esi - 0xc4]
movzx eax, al
mov word [ebp + esi*2 - 0x234], ax
inc esi
cmp esi, 0xd
jb 0x10006853
mov edi, dword [ebp - 0x14]
xor eax, eax
xor esi, esi
mov word [ebp - 0x21a], ax
cmp byte [str.SRRemoveRestorePoint], al
je 0x10006903
inc esi
cmp esi, 0x12b3
jl 0x100068f9
cmp byte [esi + str.SRRemoveRestorePoint], al
jne 0x100068c8
mov eax, dword [ebp - 4]
cmp esi, 0x1ab0
jle 0x10006906
xor edi, 0xf7b09482
jmp 0x1000690b
mov eax, dword [ebp - 4]
sub eax, 0x63e8fce9
jmp 0x1000675d
mov eax, dword [ebp - 4]
add eax, 0x74310bb5
jmp 0x10006906
mov eax, dword [ebp - 4]
sub eax, 0x49117c29
mov cl, byte [str.pkey_dsa_ctrl_str]
xor edi, 0xb8fab840
mov dword [ebp - 0x14], edi
mov edx, str.pkey_dsa_ctrl_str
mov dword [0x1002a23c], edi
jmp 0x10006932
sub cl, 0x30
cmp cl, 9
ja 0x10006938
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x10006927
jmp 0x10006947
imul edi, eax, 0x9c4bb1a2
mov dword [ebp - 0x14], edi
mov dword [0x1002a23c], edi
sub eax, 0x63a792ae
mov dword [ebp - 4], eax
call fcn.10001347
mov cl, byte [ebp - 0xd]
lea edi, [ebp - 0x144]
mov esi, str.Options_Cookies
mov eax, str.nested_too_deep
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x10006978
sub cl, 0x30
cmp cl, 9
ja 0x100069a4
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x1000696d
mov edi, dword [ebp - 4]
imul edx, edi, 0x4dcd095c
xor esi, esi
mov eax, esi
mov byte [ebp + eax - 0xd98], al
inc eax
cmp eax, 0x100
jb 0x10006989
mov al, byte [str.pkey_dsa_ctrl_str]
mov ecx, str.pkey_dsa_ctrl_str
jmp 0x100069b8
mov edi, dword [ebp - 4]
or edi, 0xc1186f85
jmp 0x1000697f
sub al, 0x30
cmp al, 9
ja 0x100069ef
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100069af
mov edi, dword [ebp - 0x14]
or edx, 0x895aa0fd
mov eax, esi
mov dword [0x1002a45c], edx
cmp byte [str.pkey_dsa_ctrl_str], al
je 0x10006a21
inc eax
cmp eax, 0x1b5f
je 0x10006a03
cmp byte [eax + str.pkey_dsa_ctrl_str], 0
jne 0x100069d5
cmp eax, 0x1174
jle 0x10006a21
jmp 0x10006a18
mov edi, dword [ebp - 0x14]
sub edi, 0x7cfc1fac
mov dword [ebp - 0x14], edi
mov dword [0x1002a23c], edi
jmp 0x100069bf
push ecx
push edi
call fcn.1000222c
pop ecx
and edx, 0x218609f5
pop ecx
mov dword [0x1002a45c], edx
push ecx
push ecx
call fcn.10001119
pop ecx
pop ecx
or edi, 0xc7edf7db
mov dword [ebp - 0xc], edi
mov edi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0xd98]
mov eax, esi
mov byte [ebp - 5], cl
div dword [ebp - 0xe4]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x144]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0xd98]
mov byte [ebp + esi - 0xd98], al
inc esi
mov al, byte [ebp - 5]
mov byte [ebp + edi - 0xd98], al
cmp esi, 0x100
jb 0x10006a2c
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 1]
xor esi, esi
movzx ecx, al
mov dword [ebp - 0x38], ecx
mov al, byte [ebp + ecx - 0xd98]
mov byte [ebp - 5], al
movzx eax, al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, esi
cmp byte [str.pkey_dsa_ctrl_str], al
je 0x10006aca
inc eax
cmp eax, 0x1523
je 0x10006ac3
cmp byte [eax + str.pkey_dsa_ctrl_str], 0
jne 0x10006ab0
jmp 0x10006aca
imul edi, dword [ebp - 0xc], 0x37aaf697
mov eax, dword [ebp - 4]
add edi, 0xa4acac98
and edi, 0xa15c5ae3
push 0xa
mov al, byte [ebp + eax - 0xd98]
mov byte [ebp + ecx - 0xd98], al
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov byte [ebp + eax - 0xd98], cl
mov ecx, dword [ebp - 0x38]
movzx eax, byte [ebp + ecx - 0xd98]
add eax, dword [ebp - 0x18]
movzx eax, al
mov al, byte [ebp + eax - 0xd98]
xor al, byte [ebp + edx - 0x5c]
movzx eax, al
mov word [ebp + edx*2 - 0x134], ax
inc edx
pop eax
cmp edx, eax
jb 0x10006a7f
mov ecx, dword [ebp - 0xc8]
xor eax, eax
mov word [ebp - 0x120], ax
lea eax, [edi + 0x18beb0a0]
mov edi, eax
mov dword [ebp - 0x14], eax
or edi, 0x8149c03a
mov dword [0x1002a45c], eax
mov ecx, dword [ecx + 0x20]
mov dword [ebp - 4], ecx
mov dword [0x1002a23c], edi
call fcn.1000587e
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1a8]
call fcn.1001497f
test eax, eax
je 0x10006f09
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1c4]
call fcn.1001497f
test eax, eax
je 0x10006e84
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x15c]
call fcn.1001497f
test eax, eax
je 0x10006e20
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x218]
call fcn.1001497f
test eax, eax
je 0x10006dff
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x174]
call fcn.1001497f
test eax, eax
je 0x10006dd3
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1e0]
call fcn.1001497f
test eax, eax
je 0x10006d9a
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1fc]
call fcn.1001497f
test eax, eax
je 0x10006d75
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x11c]
call fcn.1001497f
test eax, eax
je 0x10006cff
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18c]
call fcn.1001497f
test eax, eax
je 0x10006cdc
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x234]
call fcn.1001497f
test eax, eax
je 0x10006ca5
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x134]
call fcn.1001497f
test eax, eax
je 0x10006c7a
mov edx, dword [ebp - 0xc8]
or edi, 0x1fe9f345
mov dword [0x1002a23c], edi
mov edx, dword [edx]
mov dword [ebp - 0xc8], edx
cmp edx, dword [ebp - 0xe8]
je 0x10006f4a
mov esi, dword [ebp - 0x14]
xor eax, eax
push 0xc
pop ecx
jmp 0x10005b8b
imul eax, edi, 0x39e5fa66
push 0x28
mov dword [ebp - 0x30], 0x56
mov dword [ebp - 0x2c], 0xffffff83
mov dword [0x1002a45c], eax
pop eax
add eax, dword [ebp + esi*4 - 0x30]
inc esi
cmp esi, 2
jl 0x10006c96
jmp 0x10006f4d
or edi, 0xd981b9cc
mov dword [0x1002a45c], edi
call fcn.10002396
push 0xa
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x25
mov dword [ebp - 0x20], 0x4a
mov dword [ebp - 0x1c], 0xffffff7c
movups xmm1, xmmword [ebp - 0x28]
push 0xc
jmp 0x10006e60
mov dword [ebp - 0x28], 0x49
mov dword [ebp - 0x24], 0x16
mov dword [ebp - 0x20], 0xd
mov dword [ebp - 0x1c], 0xffffffa2
push 0xf
jmp 0x10006e55
cmp byte [str.nested_too_deep], 0
je 0x10006d3f
xor eax, eax
inc eax
cmp eax, 0x1653
je 0x10006d24
cmp byte [eax + str.nested_too_deep], 0
jne 0x10006d0a
cmp eax, 0x272
jle 0x10006d3f
jmp 0x10006d33
mov edi, dword [ebp - 0x14]
or edi, 0x1059e3de
mov dword [0x1002a23c], edi
push ecx
push ecx
mov edx, edi
call fcn.100024c3
add esp, 8
push 8
pop ecx
imul eax, edi, 0xfd75c1a3
xorps xmm1, xmm1
mov dword [ebp - 0x28], 0x61
mov dword [ebp - 0x24], 0x1a
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0xffffff84
movups xmm0, xmmword [ebp - 0x28]
mov dword [0x1002a45c], eax
psubd xmm1, xmm0
jmp 0x10006e61
push 3
pop ecx
push 0x4a
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x58
mov dword [ebp - 0x3c], 0xffffff5c
pop eax
add eax, dword [ebp + esi*4 - 0x44]
inc esi
cmp esi, ecx
jl 0x10006d8c
jmp 0x10006f4d
mov eax, dword [ebp - 0x14]
xor eax, 0x41e4a288
mov dword [ebp - 0x30], 0x30
push 0x5f
and edi, 0x52bb3795
mov dword [0x1002a45c], eax
pop eax
mov dword [ebp - 0x2c], 0xffffff72
mov dword [0x1002a23c], edi
add eax, dword [ebp + esi*4 - 0x30]
inc esi
cmp esi, 2
jl 0x10006dc4
jmp 0x10006f4d
push 2
or edi, 0xb4591dc
mov dword [ebp - 0x30], 0x47
pop eax
mov dword [ebp - 0x2c], 0xffffffb8
mov dword [0x1002a23c], edi
add eax, dword [ebp + esi*4 - 0x30]
inc esi
cmp esi, 2
jl 0x10006df0
jmp 0x10006f4d
mov dword [ebp - 0x28], 0x2e
mov dword [ebp - 0x24], 0x4d
mov dword [ebp - 0x20], 0x5d
mov dword [ebp - 0x1c], 0xffffff36
jmp 0x10006cf8
lea eax, [edi - 0x69b7645b]
mov dword [ebp - 0x28], 0x1d
or edi, 0x343ec81f
mov dword [0x1002a45c], eax
mov dword [0x1002a23c], edi
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], 0x3e
mov dword [ebp - 0x1c], 0xffffff96
push 0xa
movups xmm0, xmmword [ebp - 0x28]
xorps xmm1, xmm1
psubd xmm1, xmm0
pop ecx
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, ecx
jmp 0x10006f4d
imul edx, edi, 0x7bae1c1d
mov dword [ebp - 0x30], 0x26
mov dword [ebp - 0x2c], 0xffffff9f
mov dword [ebp - 0x18], esi
sub edx, 0x18731f2c
mov dword [ebp - 0x34], edx
mov eax, esi
cmp byte [str.nested_too_deep], al
je 0x10006ece
inc eax
cmp eax, 0x1d0a
jl 0x10006ebf
cmp byte [eax + str.nested_too_deep], 0
jne 0x10006eae
cmp eax, 0xc1c
jle 0x10006ece
call fcn.10001a1a
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xcc]
mov ecx, edx
mov dword [0x1002a45c], ecx
sub edx, 0x18731f2c
mov ecx, dword [ebp - 0x18]
sub edi, 0x1cd27c1c
mov dword [ebp - 0x34], edx
add eax, dword [ebp + ecx*4 - 0x30]
inc ecx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x18], ecx
cmp ecx, 2
jl 0x10006ea4
mov dword [0x1002a23c], edi
jmp 0x10006f4d
mov dword [ebp - 0x28], 0x30
mov dword [ebp - 0x24], 0x22
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], 0xffffff77
movups xmm1, xmmword [ebp - 0x28]
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add eax, 0x31
jmp 0x10006f4d
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
leave
ret