Function at 0x41d9a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x513e87
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x571268]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push esi
push edi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [esp + 0x98]
mov edi, ecx
push eax
mov dword [esp + 0x24], edi
call fcn.00412897
and dword [esp + 0x1b0], 0
push 0x525140
lea esi, [esp + 0x1c]
call fcn.004076aa
push str.ClientID
lea esi, [esp + 0x58]
mov byte [esp + 0x1b4], 1
call fcn.004076aa
push str._GUID_
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 2
call fcn.004076aa
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 3
call fcn.0041339d
push edi
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 4
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.MachineID
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 5
call fcn.004076aa
push str._MID_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 6
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
mov byte [esp + 0x1b4], 7
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 8
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.Profile
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 9
call fcn.004076aa
push str._PROFILE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0xa
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0xb
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0xc
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.DistributionSource
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0xd
call fcn.004076aa
push str._DISTSOURCE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0xe
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0xf
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x10
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.ToolbarVersion
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x11
call fcn.004076aa
push str._TBVERSION_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x12
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x13
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x14
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.Lang
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x15
call fcn.004076aa
push str._LANG_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x16
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x17
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x18
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.InstallDate
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x19
call fcn.004076aa
push str._INSTALLDATE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x1a
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
mov byte [esp + 0x1b4], 0x1b
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x1c
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push str.TrackingCode
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x1d
call fcn.004076aa
push str._TRACKINGCODE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x1e
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x1f
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x20
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x525140
lea esi, [esp + 0x58]
call fcn.004076aa
push 0x529334
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x21
call fcn.004076aa
push str._SG_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x22
call fcn.004076aa
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x23
call fcn.0041339d
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x24
call fcn.0041a27e
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040754f
push 0x529348
lea esi, [esp + 0x58]
call fcn.004076aa
push str.Partner_PartnerIdentifier
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x25
call fcn.004076aa
push str.CONFIGXML
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x26
call fcn.004076aa
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xf8]
push eax
mov ecx, esi
mov byte [esp + 0x1bc], 0x27
call fcn.00423241
add esp, 0xc
push ebx
push edi
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], 0x2b
call fcn.0040754f
push str._PID_
lea esi, [esp + 0x38]
call fcn.004076aa
push dword [esp + 0x14]
lea ebx, [esp + 0xf4]
mov edi, esi
mov byte [esp + 0x1b4], 0x2c
call fcn.0041a27e
pop ecx
push 0
push 1
mov byte [esp + 0x1b8], 0x2b
call fcn.0040754f
lea eax, [esp + 0xd4]
push eax
call fcn.0041f89a
mov byte [esp + 0x1b4], 0x2d
lea esi, [esp + 0x38]
mov dword [esp], str._UID_
call fcn.004076aa
push dword [esp + 0x14]
lea ebx, [esp + 0xd8]
mov edi, esi
mov byte [esp + 0x1b4], 0x2e
call fcn.0041a27e
pop ecx
xor edi, edi
push edi
push 1
mov byte [esp + 0x1b8], 0x2d
call fcn.0040754f
push str.FFGUID
push dword [esp + 0x18]
call fcn.004111d3
cmp eax, 0xffffffff
je 0x41e220
push 7
pop esi
xor eax, eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], edi
mov word [esp + 0x74], ax
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x1b4], 0x2f
call fcn.00473d4c
pop ecx
test al, al
je 0x41e214
xor eax, eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], edi
mov word [esp + 0x58], ax
lea edx, [esp + 0x70]
lea ecx, [esp + 0x10c]
mov byte [esp + 0x1b0], 0x30
call fcn.00472e00
push str.avg.install.guid
lea esi, [esp + 0x38]
mov byte [esp + 0x1b4], 0x31
call fcn.004076aa
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x110]
push eax
mov ecx, esi
mov byte [esp + 0x1b8], 0x32
call fcn.00473fd8
push edi
push 1
mov byte [esp + 0x1b8], 0x31
call fcn.0040754f
push str._FFGUID_
lea esi, [esp + 0x38]
call fcn.004076aa
push dword [esp + 0x14]
lea ebx, [esp + 0x58]
mov edi, esi
mov byte [esp + 0x1b4], 0x33
call fcn.0041a27e
pop ecx
push 0
push 1
call fcn.0040754f
lea edi, [esp + 0x10c]
call fcn.0047300e
push 0
push 1
mov esi, ebx
call fcn.0040754f
xor edi, edi
push edi
push 1
lea esi, [esp + 0x78]
call fcn.0040754f
push edi
push 1
lea esi, [esp + 0xdc]
call fcn.0040754f
push edi
push 1
lea esi, [esp + 0xf8]
call fcn.0040754f
lea ecx, [esp + 0x8c]
call fcn.00405307
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004e6e1c
mov esp, ebp
pop ebp
ret