Function at 0x41e36a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x530d7c
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x59d300]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push esi
push edi
mov eax, dword [0x59d300]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [esp + 0x94]
mov edi, ecx
push eax
mov dword [esp + 0x20], edi
call fcn.0040e8c0
and dword [esp + 0x1b0], 0
push 0x54323c
lea esi, [esp + 0x1c]
call fcn.0040b812
push str.ClientID
lea esi, [esp + 0x58]
mov byte [esp + 0x1b4], 1
call fcn.0040b812
push str._GUID_
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 2
call fcn.0040b812
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 3
call fcn.0040f3b5
push edi
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 4
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.MachineID
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 5
call fcn.0040b812
push str._MID_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 6
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 7
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 8
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.Profile
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 9
call fcn.0040b812
push str._PROFILE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0xa
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0xb
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0xc
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
mov byte [esp + 0x1b0], 0xd
push str.DistributionSource
lea esi, [esp + 0x74]
call fcn.0040b812
push str._DISTSOURCE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0xe
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0xf
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x10
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.ToolbarVersion
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x11
call fcn.0040b812
push str._TBVERSION_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x12
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x13
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x14
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.Lang
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x15
call fcn.0040b812
push str._LANG_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x16
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x17
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x18
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.InstallDate
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x19
call fcn.0040b812
push str._INSTALLDATE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x1a
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
mov byte [esp + 0x1b4], 0x1b
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x1c
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push str.TrackingCode
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x1d
call fcn.0040b812
push str._TRACKINGCODE_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x1e
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x1f
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x20
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x54323c
lea esi, [esp + 0x58]
call fcn.0040b812
push 0x545154
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x21
call fcn.0040b812
push str._SG_
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x22
call fcn.0040b812
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3c]
mov byte [esp + 0x1b8], 0x23
call fcn.0040f3b5
push dword [esp + 0x14]
mov ebx, eax
mov edi, esi
mov byte [esp + 0x1b4], 0x24
call fcn.0041a036
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x3c]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x20]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], bl
call fcn.0040dac5
push 0x544d50
lea esi, [esp + 0x58]
call fcn.0040b812
push str.Partner_PartnerIdentifier
lea esi, [esp + 0x74]
mov byte [esp + 0x1b4], 0x25
call fcn.0040b812
push str.CONFIGXML
lea esi, [esp + 0x1c]
mov byte [esp + 0x1b4], 0x26
call fcn.0040b812
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xf8]
push eax
mov ecx, esi
mov byte [esp + 0x1bc], 0x27
call fcn.00417b55
add esp, 0xc
push ebx
push edi
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push edi
lea esi, [esp + 0x5c]
mov byte [esp + 0x1b8], 0x2b
call fcn.0040dac5
push str._PID_
lea esi, [esp + 0x38]
call fcn.0040b812
push dword [esp + 0x14]
lea ebx, [esp + 0xf4]
mov edi, esi
mov byte [esp + 0x1b4], 0x2c
call fcn.0041a036
pop ecx
push 0
push 1
mov byte [esp + 0x1b8], 0x2b
call fcn.0040dac5
lea eax, [esp + 0xd4]
push eax
call fcn.00420c70
mov byte [esp + 0x1b4], 0x2d
lea esi, [esp + 0x38]
mov dword [esp], str._UID_
call fcn.0040b812
push dword [esp + 0x14]
lea ebx, [esp + 0xd8]
mov edi, esi
mov byte [esp + 0x1b4], 0x2e
call fcn.0041a036
pop ecx
xor edi, edi
push edi
push 1
mov byte [esp + 0x1b8], 0x2d
call fcn.0040dac5
push str.FFGUID
push dword [esp + 0x18]
call fcn.00409171
cmp eax, 0xffffffff
je 0x41ebe3
push 7
pop esi
xor eax, eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], edi
mov word [esp + 0x74], ax
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x1b4], 0x2f
call fcn.0048de2d
pop ecx
test al, al
je 0x41ebd7
xor eax, eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], edi
mov word [esp + 0x58], ax
lea edx, [esp + 0x70]
lea ecx, [esp + 0x10c]
mov byte [esp + 0x1b0], 0x30
call fcn.0048cee1
push str.avg.install.guid
lea esi, [esp + 0x38]
mov byte [esp + 0x1b4], 0x31
call fcn.0040b812
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x110]
push eax
mov ecx, esi
mov byte [esp + 0x1b8], 0x32
call fcn.0048e0b9
push edi
push 1
mov byte [esp + 0x1b8], 0x31
call fcn.0040dac5
push str._FFGUID_
lea esi, [esp + 0x38]
call fcn.0040b812
push dword [esp + 0x14]
lea ebx, [esp + 0x58]
mov edi, esi
mov byte [esp + 0x1b4], 0x33
call fcn.0041a036
pop ecx
push 0
push 1
call fcn.0040dac5
lea edi, [esp + 0x10c]
call fcn.0048d0ef
push 0
push 1
mov esi, ebx
call fcn.0040dac5
xor edi, edi
push edi
push 1
lea esi, [esp + 0x78]
call fcn.0040dac5
push edi
push 1
lea esi, [esp + 0xdc]
call fcn.0040dac5
push edi
push 1
lea esi, [esp + 0xf8]
call fcn.0040dac5
lea ecx, [esp + 0x8c]
call fcn.0040b7c8
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ffa47
mov esp, ebp
pop ebp
ret