Function at 0x1002b620
Capabilities:
Check http status code
Connect to http server
Create http request
Delete registry value
Parse url
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
lea ebp, [esp - 0x11cc]
mov eax, 0x11cc
call fcn.100378e0
push 0xfffffffffffffffe
push 0x10047bf8
push 0x10037882
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x1004f860]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x11c8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x11d4]
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0x11dc]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp + 0x11e0]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp + 0x11e4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0x11e8]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp + 0x11ec]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 0x11fc]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x1200]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 0x1204]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp + 0x1208]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0x120c]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 0x1210]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp + 0x1214]
mov dword [ebp - 0x1c], edx
xor eax, eax
mov word [ebp + 0x11b8], ax
mov dword [ebp + 0x11ba], eax
mov dword [ebp + 0x11be], eax
mov dword [ebp + 0x11c2], eax
mov word [ebp + 0x11c6], ax
xor ecx, ecx
mov word [ebp + 0x1190], cx
mov dword [ebp + 0x1192], eax
mov dword [ebp + 0x1196], eax
mov dword [ebp + 0x119a], eax
mov dword [ebp + 0x119e], eax
mov word [ebp + 0x11a2], ax
xor edx, edx
mov word [ebp + 0x11a4], dx
mov dword [ebp + 0x11a6], eax
mov dword [ebp + 0x11aa], eax
mov dword [ebp + 0x11ae], eax
mov dword [ebp + 0x11b2], eax
mov word [ebp + 0x11b6], ax
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x1002b751
sub eax, ecx
sar eax, 1
je 0x1002bf9c
push esi
call fcn.10027980
add esp, 4
test eax, eax
je 0x1002bf9c
cmp dword [0x1004fdc8], 0
jne 0x1002b960
push 0x28
push 0x1004fda0
push 0x28
push 0x1004fd78
call fcn.10027550
mov dword [ebp - 0x20], 0x40
lea eax, [ebp - 0x20]
push eax
push 0x1004fd38
push str.VisitorId
push 0
call fcn.100289e0
add esp, 0x20
test eax, eax
je 0x1002b7c4
cmp dword [ebp - 0x20], 0x10
jae 0x1002b910
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
mov esi, eax
mov edi, edx
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
push str._lx_lx_lx
lea ecx, [ebp + 0x1150]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b801
sub eax, edx
sar eax, 1
cmp eax, 0x10
jae 0x1002b83f
lea edx, [ebp + 0x1150]
push edx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov ecx, 0x10
sub ecx, eax
push ecx
push 0x10045258
lea edx, [ebp + 0x1150]
push edx
call dword [sym.imp.MSVCR100.dll_wcsncat]
add esp, 0xc
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
jmp 0x1002b850
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b850
sub eax, edx
sar eax, 1
shr eax, 1
push eax
lea eax, [ebp + 0x1150]
push eax
push 0x1004fd38
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b880
sub eax, edx
sar eax, 1
shr eax, 1
add eax, eax
xor ecx, ecx
mov word [eax + 0x1004fd38], cx
mov edi, 0x1004fd38
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1002b8a4
mov edx, dword [0x10045254]
mov dword [edi], edx
lea eax, [ebp + eax + 0x1150]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b8c1
sub eax, edx
mov edi, 0x1004fd38
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1002b8d6
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100288a0
push 0x1004fd38
push str.VisitorId
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0
call fcn.10028e90
add esp, 0x10
lea eax, [ebp + 0x700]
push eax
call fcn.100294c0
add esp, 4
test eax, eax
je 0x1002b93c
push 0x3c
lea ecx, [ebp + 0x700]
push ecx
push 0x1004fcfc
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
jmp 0x1002b956
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x10045088]
mov word [eax + 0x1004fcfc], cx
add eax, 2
test cx, cx
jne 0x1002b940
mov dword [0x1004fdc8], 1
xor edx, edx
mov word [ebp + 0xb00], dx
push str.__xml_version_1.0__encoding_UTF_8_____request_
lea ecx, [ebp - 0x24]
call fcn.10002e00
push 0x1003d74c
push 0x10045854
push ecx
mov eax, esp
mov ebx, dword [ebp - 0x24]
mov dword [eax], ebx
test ebx, ebx
je 0x1002b996
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
add esp, 0xc
mov eax, dword [ebp - 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b9a4
sub eax, edx
sar eax, 1
mov dword [ebp - 0x38], eax
push 0x10045850
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, dword [sym.imp.MSVCR100.dll_wcsstr]
call edi
add esp, 8
mov esi, eax
cmp dword [ebp - 0x1c], 0
jne 0x1002b9e5
push str.suninstallstat
push 0x1003c898
lea edx, [ebp + 0x1128]
push edx
jmp 0x1002b9f5
mov eax, dword [ebp - 0x1c]
push eax
push 0x1003c898
lea ecx, [ebp + 0x1128]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test esi, esi
je 0x1002ba25
mov eax, esi
sub eax, dword [ebp - 0x30]
sar eax, 1
mov dword [ebp - 0x38], eax
add esi, 2
push esi
push 0x1003c898
lea edx, [ebp + 0x1128]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x1128]
push eax
push str.reportsuiteid
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x1002ba46
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
push 0x1004fd38
push str.visitorid
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002ba67
lea edx, [ebx + 8]
push edx
call esi
call fcn.1002b250
add esp, 0xc
push 0x1004fd38
push str.prop21
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002ba88
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
push str.https:__
mov esi, dword [ebp - 0x30]
push esi
call edi
add esp, 0x14
test eax, eax
je 0x1002bb1f
push 0x1c
push str.https:__sjremetrics.java.com
push esi
call dword [sym.imp.MSVCR100.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x1002bad4
push 0xb3e9fd
push 0x10045798
lea ecx, [ebp + 0x700]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x1002baf7
xor eax, eax
jmp 0x1002bae0
movzx ecx, word [eax + str.nonprodpasswd]
mov word [ebp + eax + 0x700], cx
add eax, 2
test cx, cx
jne 0x1002bae0
lea edx, [ebp + 0x700]
push edx
push str.prop20
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x1002bb18
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
jmp 0x1002bb47
push str.nonhttpspasswd
push str.prop20
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bb3c
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
add esp, 0xc
mov edi, dword [ebp - 0x58]
push edi
push str.pagename
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bb62
lea edx, [ebx + 8]
push edx
call esi
call fcn.1002b250
add esp, 0xc
mov ecx, str.jfxic
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bb97
test dx, dx
je 0x1002bb93
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bb97
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bb71
xor eax, eax
jmp 0x1002bb9c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002bdc3
mov eax, dword [ebp - 0x28]
push eax
push str.evar2
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bbbc
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x1002bc34
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002bbd0
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x1002bc34
mov ecx, 0x10045718
mov eax, esi
jmp 0x1002bbf0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bc16
test dx, dx
je 0x1002bc12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bc16
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bbf0
xor eax, eax
jmp 0x1002bc1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002bc34
push esi
push str.evar3
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bc51
lea edx, [ebx + 8]
push edx
jmp 0x1002bc4b
push 0x1004fcfc
push str.evar3
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bc51
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
add esp, 0xc
mov ecx, 0x10045704
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bc86
test dx, dx
je 0x1002bc82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bc86
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bc60
xor eax, eax
jmp 0x1002bc8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002bdbd
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x1002bcd6
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002bca0
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x1002bcd6
push esi
push str.evar15
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x1002bccf
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
jmp 0x1002bd21
xor eax, eax
jmp 0x1002bce0
movzx ecx, word [eax + 0x10045088]
mov word [ebp + eax + 0x600], cx
add eax, 2
test cx, cx
jne 0x1002bce0
lea edx, [ebp + 0x600]
push edx
push str.evar15
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bd16
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
add esp, 0xc
mov ecx, 0x13
mov word [ebp - 0x7c], cx
mov edx, dword [ebp + 0x11f8]
mov dword [ebp - 0x74], edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10015dd0
mov eax, dword [eax]
test eax, eax
je 0x1002bd4c
mov eax, dword [eax]
jmp 0x1002bd4e
xor eax, eax
push eax
push str.evar26
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bd63
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10002330
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c]
push eax
push str.evar27
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bd95
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
mov edx, dword [ebp - 0x3c]
push edx
push str.evar28
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bdb5
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
add esp, 0xc
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
push str.i586
push str.evar4
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bddc
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
push 0x1004fda0
push str.evar5
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bdfd
lea edx, [ebx + 8]
push edx
call esi
call fcn.1002b250
add esp, 0xc
push 0x1004fd78
push str.evar6
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002be1e
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
add esp, 0xc
mov eax, dword [ebp + 0x11d8]
test eax, eax
jne 0x1002be73
mov dword [ebp - 0x3c], 0x14
jmp 0x1002be40
movzx ecx, word [eax + 0x10045088]
mov word [ebp + eax + 0x1100], cx
add eax, 2
test cx, cx
jne 0x1002be40
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp + 0x1100]
push edx
push str.Method
push 0
call fcn.100289e0
add esp, 0x10
jmp 0x1002be8f
lea edx, [ebp + 0x1100]
sub edx, eax
jmp 0x1002be80
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x1002be80
lea eax, [ebp + 0x1100]
push eax
push str.evar7
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002beaa
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
mov edx, dword [ebp - 0x64]
push edx
push str.evar8
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002beca
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
add esp, 0xc
mov ecx, 0x10045704
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bf06
test dx, dx
je 0x1002bf02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bf06
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bee0
xor eax, eax
jmp 0x1002bf0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c369
push str.event6_event7
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002bf2c
add ebx, 8
push ebx
call esi
call fcn.1002b250
xor ecx, ecx
mov word [ebp + 0xd00], cx
push 0x400
lea edx, [ebp + 0xd00]
push edx
push str.InstallStatus
call fcn.10029790
push 0
call fcn.100299b0
add esp, 0x1c
mov ecx, str.reinstall
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bf8b
test dx, dx
je 0x1002bf87
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bf8b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bf65
xor eax, eax
jmp 0x1002bf90
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002bfc4
lea ecx, [ebp - 0x24]
call fcn.10002330
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c8]
xor ecx, ebp
call fcn.1003779c
lea esp, [ebp + 0x11cc]
pop ebp
ret
mov ecx, str.exists
lea eax, [ebp + 0xd00]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002bff6
test dx, dx
je 0x1002bff2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002bff6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002bfd0
xor eax, eax
jmp 0x1002bffb
sbb eax, eax
sbb eax, 0xffffffff
mov esi, dword [ebp + 0x11f4]
test eax, eax
jne 0x1002c015
cmp esi, 0x643
je 0x1002c01d
cmp esi, 0x642
je 0x1002c01d
cmp esi, 0x666
jne 0x1002c028
mov esi, 0xffffff80
mov dword [ebp + 0x11f4], esi
call fcn.10029a60
test eax, eax
je 0x1002c057
cmp esi, 0x643
je 0x1002c041
cmp esi, 0x642
jne 0x1002c057
call fcn.10027c30
neg eax
sbb eax, eax
add eax, 0xffffff76
mov dword [ebp + 0x11f4], eax
jmp 0x1002c099
test esi, esi
jne 0x1002c099
mov ecx, str.decline
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c08c
test dx, dx
je 0x1002c088
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c08c
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c066
xor eax, eax
jmp 0x1002c091
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c1b1
call fcn.100288a0
xor edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1002c138
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002c0e2
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1002c0ef
push eax
call ebx
call fcn.100288a0
xor edi, edi
test eax, eax
je 0x1002c176
mov dword [ebp - 0x20], edi
lea edx, [ebp - 0x20]
push edx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002c1aa
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
jmp 0x1002c1aa
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push 0x2021f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002c0e2
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
jmp 0x1002c0e2
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002c1aa
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
test edi, edi
je 0x1002c1b1
push eax
call ebx
lea ecx, [ebp + 0x11a4]
push ecx
lea edx, [ebp + 0x1190]
push edx
lea eax, [ebp + 0x11b8]
push eax
mov edi, dword [ebp + 0x11f4]
push edi
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.10029b20
add esp, 0x14
lea edx, [ebp + 0x11a4]
push edx
push str.evar17
push ecx
mov eax, esp
mov esi, dword [ebp - 0x24]
mov dword [eax], esi
mov ebx, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test esi, esi
je 0x1002c1fd
lea eax, [esi + 8]
push eax
call ebx
call fcn.1002b250
add esp, 0xc
lea ecx, [ebp + 0x11b8]
push ecx
push str.evar18
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1002c220
lea edx, [esi + 8]
push edx
call ebx
call fcn.1002b250
add esp, 0xc
lea eax, [ebp + 0x1190]
push eax
push str.evar19
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1002c243
lea ecx, [esi + 8]
push ecx
call ebx
call fcn.1002b250
add esp, 0xc
mov ecx, str.decline
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c27c
test dx, dx
je 0x1002c278
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c27c
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c256
xor eax, eax
jmp 0x1002c281
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002bf94
push edi
push str._jre_d
lea edx, [ebp + 0xb00]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0xd00]
lea edx, [eax + 2]
jmp 0x1002c2b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002c2b0
sub eax, edx
sar eax, 1
je 0x1002c345
mov ecx, str.exists
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c2f6
test dx, dx
je 0x1002c2f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c2f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c2d0
xor eax, eax
jmp 0x1002c2fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002c345
lea eax, [ebp + 0xd00]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002c307
sub eax, edx
lea edi, [ebp + 0xb00]
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1002c320
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [sym.imp.kernel32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x24]
lea eax, [ebp + 0xb00]
push eax
push str.products
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1002c7cf
add esi, 8
push esi
call ebx
jmp 0x1002c7cf
mov ecx, 0x100455bc
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c396
test dx, dx
je 0x1002c392
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c396
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c370
xor eax, eax
jmp 0x1002c39b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c521
call fcn.100288a0
xor edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1002c445
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x20]
push ecx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002c3ec
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1002c3f9
push eax
call ebx
call fcn.100288a0
xor edi, edi
test eax, eax
je 0x1002c483
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002c4b7
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
jmp 0x1002c4b7
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x1c]
push edx
push 0x2021f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002c3ec
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
jmp 0x1002c3ec
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x1c]
push ecx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002c4b7
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
test edi, edi
je 0x1002c4be
push eax
call ebx
push str.event11
push str.events
push ecx
mov eax, esp
mov esi, dword [ebp - 0x24]
mov dword [eax], esi
test esi, esi
je 0x1002c4de
lea edx, [esi + 8]
push edx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
mov eax, dword [ebp + 0x11f4]
push eax
push str._jre_d
lea ecx, [ebp + 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea edx, [ebp + 0xb00]
push edx
push str.products
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1002c7cf
add esi, 8
push esi
jmp 0x1002c7c9
mov ecx, 0x100455a4
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c54e
test dx, dx
je 0x1002c54a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c54e
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c528
xor eax, eax
jmp 0x1002c553
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c579
push str.event1
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c7cf
add ebx, 8
push ebx
call esi
jmp 0x1002c7cf
mov ecx, 0x1004558c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c5a6
test dx, dx
je 0x1002c5a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c5a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c580
xor eax, eax
jmp 0x1002c5ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c6b1
push str.event2
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c5cc
lea eax, [ebx + 8]
push eax
call esi
call fcn.1002b250
add esp, 0xc
mov eax, dword [ebp + 0x11f4]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x1002c5f3
push eax
push 0x10045574
lea ecx, [ebp + 0x700]
push ecx
jmp 0x1002c600
push eax
push 0x10044388
lea edx, [ebp + 0x700]
push edx
call edi
add esp, 0xc
lea eax, [ebp + 0x700]
push eax
push str.evar9
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c620
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
add esp, 0xc
mov eax, dword [ebp + 0x11f0]
test eax, eax
jne 0x1002c641
push eax
push 0x10045574
lea edx, [ebp + 0x700]
push edx
jmp 0x1002c64e
push eax
push 0x10044388
lea eax, [ebp + 0x700]
push eax
call edi
add esp, 0xc
lea ecx, [ebp + 0x700]
push ecx
push str.evar10
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c66e
lea edx, [ebx + 8]
push edx
call esi
call fcn.1002b250
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push str.NotifyInstall
push 0
call fcn.10028c50
add esp, 0x18
cmp dword [ebp - 0x28], 0
jne 0x1002c6a2
push 0x10045550
push str.evar11
jmp 0x1002c561
push 0x10045538
push str.evar11
jmp 0x1002c561
mov ecx, str.jfxic
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002c6de
test dx, dx
je 0x1002c6da
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002c6de
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002c6b8
xor eax, eax
jmp 0x1002c6e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002c7d7
push str.event20
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c704
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.1002b250
mov esi, dword [ebp + 0x11f4]
push esi
push str._jfx_d
lea edx, [ebp + 0xb00]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp + 0xb00]
push eax
push str.products
push ecx
mov eax, esp
mov dword [eax], ebx
mov edi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x1002c746
lea ecx, [ebx + 8]
push ecx
call edi
call fcn.1002b250
add esp, 0xc
mov edx, dword [ebp - 0x54]
push edx
push str.evar16
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c766
lea eax, [ebx + 8]
push eax
call edi
call fcn.1002b250
add esp, 0xc
mov ecx, dword [ebp - 0x60]
push ecx
push str.evar17
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c786
lea edx, [ebx + 8]
push edx
call edi
call fcn.1002b250
add esp, 0xc
mov eax, dword [ebp - 0x68]
push eax
push str.evar18
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c7a6
lea ecx, [ebx + 8]
push ecx
call edi
call fcn.1002b250
add esp, 0xc
cmp esi, 3
jne 0x1002c7d7
mov edx, dword [ebp - 0x4c]
push edx
push str.evar19
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x1002c7cf
add ebx, 8
push ebx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.1002b250
add esp, 0xc
push str.__request_
lea ecx, [ebp - 0x28]
call fcn.10002e00
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
call fcn.10004760
lea ecx, [ebp - 0x28]
call fcn.10002330
xor esi, esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push str.jupdate
call dword [sym.imp.wininet.dll_InternetOpenW]
mov dword [ebp - 0x44], eax
cmp eax, esi
je 0x1002cb9d
push 0x3c
push esi
lea ecx, [ebp + 0x1154]
push ecx
call sub.MSVCR100.dll_memset
mov dword [ebp + 0x1154], 0x3c
lea edx, [ebp + 0x400]
mov dword [ebp + 0x1164], edx
mov eax, 0x200
mov dword [ebp + 0x1168], eax
xor ecx, ecx
mov word [ebp + 0x116c], cx
lea edx, [ebp]
mov dword [ebp + 0x1180], edx
mov dword [ebp + 0x1184], eax
lea ecx, [ebp + 0x200]
mov dword [ebp + 0x1188], ecx
mov dword [ebp + 0x118c], eax
mov edi, dword [ebp - 0x38]
push edi
mov ebx, dword [ebp - 0x30]
push ebx
lea edx, [ebp + 0xd00]
push edx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0x18
xor eax, eax
mov word [ebp + edi*2 + 0xd00], ax
lea ecx, [ebp + 0x1154]
push ecx
push eax
push edi
lea edx, [ebp + 0xd00]
push edx
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
push esi
push esi
push 3
push 0x1003a9fc
push 0x1003a9fc
mov eax, dword [ebp + 0x116c]
push eax
mov ecx, dword [ebp + 0x1164]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.wininet.dll_InternetConnectW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1002cb9d
lea edx, [ebp + 0xd00]
cmp dword [ebp + 0x1184], esi
je 0x1002c913
mov ecx, dword [ebp + 0x1180]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1002c900
jmp 0x1002c931
mov ecx, 0x100444c4
jmp 0x1002c920
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1002c920
cmp dword [ebp + 0x118c], 0
je 0x1002c97c
mov eax, dword [ebp + 0x1188]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002c942
sub eax, edx
lea edi, [ebp + 0xd00]
add edi, 0xfffffffe
jmp 0x1002c960
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1002c960
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.https:__
push ebx
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
push 0
test eax, eax
je 0x1002c9b4
push 0x4c00000
push 0
push 0x1003a9fc
push str.HTTP_1.1
lea eax, [ebp + 0xd00]
push eax
push str.POST
mov ecx, dword [ebp - 0x34]
push ecx
jmp 0x1002c9d5
push 0x4400000
push 0
push 0x1003a9fc
push str.HTTP_1.1
lea edx, [ebp + 0xd00]
push edx
push str.POST
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.wininet.dll_HttpOpenRequestW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x1002cb9d
mov edi, 1
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x24]
call fcn.100113c0
mov ebx, eax
lea ecx, [ebp - 0x24]
call fcn.10003e30
push eax
mov ecx, dword [ebx]
push ecx
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_HttpSendRequestW]
test eax, eax
jne 0x1002ca5b
test edi, edi
je 0x1002cb9d
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x2ee2
je 0x1002ca57
sub ecx, 5
je 0x1002ca57
sub ecx, 0x16
je 0x1002ca57
xor edi, edi
mov dword [ebp - 0x2c], edi
push edi
push 7
push eax
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.wininet.dll_InternetErrorDlg]
cmp eax, 0x2f00
jne 0x1002c9f0
jmp 0x1002c9e8
xor edi, edi
jmp 0x1002c9ed
test edi, edi
je 0x1002cb9d
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov ebx, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push esi
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
jne 0x1002ca99
call edi
mov ebx, eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, 0x197
jne 0x1002cb17
cmp dword [ebp - 0x2c], 0
je 0x1002cb17
push 0
push 7
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.wininet.dll_InternetErrorDlg]
cmp eax, 0x2f00
je 0x1002cad7
mov dword [ebp - 0x2c], 0
jmp 0x1002caa0
lea ecx, [ebp - 0x24]
call fcn.100113c0
mov edi, eax
lea ecx, [ebp - 0x24]
call fcn.10003e30
push eax
mov ecx, dword [edi]
push ecx
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_HttpSendRequestW]
mov dword [ebp - 0x20], 4
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push esi
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
jmp 0x1002caa0
cmp eax, 0xc8
jne 0x1002cb3c
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0x4c]
push ecx
push 0x400
lea edx, [ebp + 0xd00]
push edx
push esi
call dword [sym.imp.wininet.dll_InternetReadFile]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x1002cb47
mov eax, dword [eax]
jmp 0x1002cb49
xor eax, eax
push str.prop20
push eax
mov ebx, dword [sym.imp.MSVCR100.dll_wcsstr]
call ebx
add esp, 8
mov edi, eax
test edi, edi
je 0x1002cb87
add edi, 0xe
push str.prop20
push edi
call ebx
add esp, 8
sub eax, edi
sar eax, 1
sub eax, 2
je 0x1002cb87
push eax
push 0x10045498
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x1002cb92
mov eax, dword [eax]
jmp 0x1002cb94
xor eax, eax
push eax
call fcn.100285d0
add esp, 4
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], 0xfffffffe
call fcn.1002cbf2
test edi, edi
je 0x1002cbe4
lea eax, [edi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jne 0x1002cbe4
mov eax, dword [edi]
test eax, eax
je 0x1002cbcb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x1002cbdb
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x50]
jmp 0x1002bfa1