Function at 0x66d6eb
Capabilities:
Get common file path
Get disk information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x670db8
call fcn.004c5428
push ecx
mov eax, 0x27b0
call fcn.004c03f0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xc0], 0xf
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 0xd4], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x27c0]
mov dword [edi + 0x2a70], eax
call fcn.0040101a
mov eax, 0x800
push eax
mov byte [ebp - 4], 1
lea esi, [edi + 0x126f]
push ebx
push esi
mov byte [ebp - 0x1698], bl
mov dword [ebp - 0x5c], eax
call fcn.004bee40
add esp, 0xc
cmp dword [edi + 0x2ab8], ebx
je 0x66d77f
lea eax, [edi + 0x2aa8]
cmp dword [eax + 0x14], 0x10
jb 0x66d771
mov eax, dword [eax]
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x66d773
jmp 0x66d79d
lea eax, [ebp - 0x5c]
push eax
push esi
lea eax, [ebp - 0x98]
push eax
push str.campaign_check
push str.SoftwareNetsetterBundleInstallN
call fcn.006691dd
add esp, 0x14
cmp byte [edi + 0x126f], bl
jne 0x66d7f5
push str.ERROR__CheckCampaign:_Campaign_check_URL_is_empty._r_n
push bind
mov esi, edi
call fcn.00666d3d
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push 1
lea ecx, [ebp - 0x16b8]
call fcn.004010ac
lea esi, [ebp - 0x27c0]
call fcn.0040cfe6
push ebx
push 1
lea ecx, [ebp - 0xd4]
call fcn.004010ac
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
add edi, 0x126e
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x66d7fb
mov eax, dword [ebp + 8]
push 0xd
pop ecx
mov esi, str._campaign_id_dtid_sos_type_dos_minor_dos_sp_d
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add eax, 0x2b18
movsb byte es:[edi], byte [esi]
cmp dword [eax + 0x14], 0x10
jb 0x66d820
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x600]
push str.ver_smon__dmonver__stime__d
push eax
call fcn.004baa18
lea eax, [ebp - 0x600]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66d83d
mov edi, dword [ebp + 8]
sub eax, edx
add edi, 0x126e
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66d84f
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x98]
push eax
and ecx, 3
push 0x6e56d0
push str.SoftwareNetsetterBundleInstallN
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x5c], pe_nt_image_headers32
call fcn.006691dd
mov edx, dword [ebp + 8]
add esp, 0x14
test eax, eax
jne 0x66d8db
lea edi, [edx + 0x126e]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x66d89f
mov esi, str.ip
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x500]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66d8b6
sub eax, esi
lea edi, [edx + 0x126e]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66d8c5
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x126e]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x66d8e1
mov esi, str.exe_name
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [edx + 0x2ae0]
movsb byte es:[edi], byte [esi]
cmp dword [eax + 0x14], 0x10
jb 0x66d901
mov eax, dword [eax]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66d903
sub eax, esi
lea edi, [edx + 0x126e]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66d912
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x103
and ecx, 3
lea eax, [ebp - 0x1ef]
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
mov byte [ebp - 0x1f0], bl
call fcn.004bee40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x66d9ed
mov esi, 0x6e56e8
lea eax, [ebp - 0x1f0]
push esi
push eax
call fcn.004bb1e0
pop ecx
pop ecx
test eax, eax
je 0x66d987
lea eax, [ebp - 0x1f0]
push esi
push eax
call fcn.004bb1e0
pop ecx
pop ecx
mov byte [eax + 1], bl
push 0x104
lea eax, [ebp - 0x1f0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x66d9ed
mov edi, dword [ebp + 8]
add edi, 0x126e
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x66d9ac
mov esi, str.fs
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1f0]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66d9c3
mov edi, dword [ebp + 8]
sub eax, edx
add edi, 0x126e
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66d9d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
lea eax, [esi + 0x35b8]
cmp dword [eax + 0x14], 0x10
jb 0x66d9fe
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x66da0c
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
lea edi, [esi + 0xa6f]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x35b0]
push eax
push dword [ebp + 0xc]
lea eax, [esi + 0x126f]
push dword [esi + 0x35b4]
push dword [esi + 0x2b54]
push dword [esi + 0x2b3c]
push dword [esi + 0x2b38]
push dword [ebp + 0x10]
push dword [esi + 0x2a70]
push eax
push edi
call fcn.004baa18
add esp, 0x28
cmp dword [esi + 0x2a9c], ebx
je 0x66dd75
lea eax, [esi + 0x2a8c]
cmp dword [eax + 0x14], 0x10
jb 0x66da70
mov eax, dword [eax]
lea ecx, [ebp - 0x58]
push ecx
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x66dd75
push 0x104
lea eax, [ebp - 0x400]
push eax
push ebx
push dword [ebp - 0x58]
xor edi, edi
inc edi
mov dword [ebp - 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x66dd16
mov eax, dword [ebp + 8]
add eax, 0x2a8c
cmp dword [eax + 0x14], 0x10
jb 0x66dabc
mov eax, dword [eax]
lea edx, [ebp - 0x2f8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x66dac4
lea edi, [ebp - 0x2f8]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x66dad5
mov esi, 0x6e56e8
lea eax, [ebp - 0x400]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66daec
lea edi, [ebp - 0x2f8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66dafc
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2f8]
push eax
and ecx, 3
push reloc.WSOCK32.dll_bind
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x66dcec
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x66dcb9
cmp dword [ebp - 0x4c], ebx
je 0x66dcb9
mov eax, dword [ebp - 0x54]
cmp eax, ebx
je 0x66dcb9
cmp dword [ebp - 0x3c], ebx
je 0x66dcb9
mov esi, 0x6f66ee
inc eax
push esi
push eax
call fcn.004ba95c
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x3c]
inc eax
push esi
push eax
call fcn.004ba95c
mov ecx, dword [ebp - 0x3c]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x54]
lea eax, [ecx + eax + 0xa]
push esi
push eax
call fcn.004ba95c
add esp, 0x18
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0xc], ebx
je 0x66dcb9
cmp dword [ebp + 0x10], ebx
je 0x66dcb9
cmp eax, ebx
je 0x66dcb9
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x4c], ebx
jbe 0x66dcb9
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x50]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
jne 0x66dcaa
cmp dword [ebp - 0x40], 1
jne 0x66dc2f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s_s
jmp 0x66dc42
cmp dword [ebp - 0x40], 4
jne 0x66dcaa
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebp + 0xc]
push str._s_d
push dword [ebp - 0x30]
call fcn.004baa18
mov eax, dword [ebp + 8]
add esp, 0x10
add eax, 0xa6f
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66dc58
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x30]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66dc69
sub eax, esi
add eax, edi
cmp eax, 0x800
jae 0x66dcaa
mov eax, dword [ebp - 0x30]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66dc80
mov edi, dword [ebp + 8]
sub eax, edx
add edi, 0xa6e
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66dc92
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x4c]
jb 0x66dbe7
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], ebx
je 0x66dcd0
push dword [ebp + 0xc]
call fcn.004bb742
pop ecx
cmp dword [ebp + 0x10], ebx
je 0x66dcde
push dword [ebp + 0x10]
call fcn.004bb742
pop ecx
cmp dword [ebp - 0x30], ebx
je 0x66dcec
push dword [ebp - 0x30]
call fcn.004bb742
pop ecx
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
push 0x104
lea ecx, [ebp - 0x400]
push ecx
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x66daac
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x2a8c]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x66dd31
mov eax, dword [eax]
push eax
push reloc.WSOCK32.dll_bind
lea ecx, [ebp - 0xb8]
call fcn.004b2ea2
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.004b38a4
push ebx
push edi
lea ecx, [ebp - 0xb4]
call fcn.004010ac
mov dword [ebp - 4], edi
jmp 0x66dd75
lea edi, [esi + 0xa6f]
push edi
push str.Installer:_Checking_for_campaign_status:__s_r_n
push bind
call fcn.00666d3d
add esp, 0xc
mov eax, str.surveytrue
cmp byte [esi + 0x35a9], bl
jne 0x66dda0
mov eax, str.surveyfalse
push eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
call fcn.0040189f
mov eax, edi
mov byte [ebp - 4], 5
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66ddc8
mov ecx, dword [ebp - 0x84]
sub eax, edi
add ecx, eax
cmp ecx, 0x800
jae 0x66de1c
cmp dword [ebp - 0x80], 0x10
mov eax, dword [ebp - 0x94]
jae 0x66ddf3
lea eax, [ebp - 0x94]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x66ddf5
sub eax, edx
lea edi, [esi + 0xa6e]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x66de04
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
add eax, 0xa6f
push eax
lea edi, [ebp - 0x1698]
call fcn.00668428
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, edi
push eax
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x34]
call fcn.00668441
push dword [ebp - 0xc4]
lea eax, [ebp - 0xe00]
push str.Content_Type:_application_x_www_form_urlencoded_r_nContent_Length:__d_r_n_r_n
push eax
mov dword [ebp - 0xdc], 0x6e1150
mov dword [ebp - 0xd8], ebx
call fcn.004baa18
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
sub eax, 0x50
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x801000
mov dword [ebp + 0x10], 0xfa0
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x40], eax
jmp 0x66de94
mov eax, dword [ebp - 0x40]
cmp dword [ebp + 0xc], ebx
jbe 0x66decd
mov edi, dword [ebp + 0x10]
xor edx, edx
mov ecx, 0x3e8
mov eax, edi
div ecx
mov esi, dword [ebp + 8]
push eax
push str.Installer:_CheckCampaign:_Sleeping_for__d_seconds_r_n
push bind
call fcn.00666d3d
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [edi + edi]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xc0], 0x10
mov ecx, dword [ebp - 0xd4]
jae 0x66dee2
lea ecx, [ebp - 0xd4]
lea edx, [ebp - 0xdc]
push edx
push eax
push dword [ebp - 0xc4]
lea eax, [ebp - 0xe00]
push ecx
push dword [ebp - 0x48]
push eax
push str.POST
push dword [ebp - 0x38]
lea eax, [ebp - 0x27c0]
push dword [ebp - 0x44]
push dword [ebp - 0x34]
call fcn.00666717
cmp eax, ebx
jne 0x66e060
mov edi, dword [ebp + 8]
push str.Installer:_POST_REQUEST:_r_n
push bind
mov esi, edi
call fcn.00666d3d
lea eax, [ebp - 0xe00]
push eax
push str._s_r_n
push bind
call fcn.00666d3d
mov eax, dword [ebp - 0xd4]
add esp, 0x14
cmp dword [ebp - 0xc0], 0x10
jae 0x66df5e
lea eax, [ebp - 0xd4]
push eax
push str._s_r_n
push bind
call fcn.00666d3d
add esp, 0xc
push str._________r_n
push bind
call fcn.00666d3d
mov eax, dword [ebp - 0x27b8]
pop ecx
pop ecx
cmp eax, 2
jae 0x66dfb2
mov eax, dword [ebp - 0x27c0]
cmp byte [eax], 0x31
je 0x66e08b
push str.Installer:_Campaign_is_no_longer_active_r_n
push bind
call fcn.00666d3d
pop ecx
pop ecx
jmp 0x66e076
cmp eax, 4
jbe 0x66e076
add eax, 0xfffffffc
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x27c0]
mov dword [ebp + 0xc], eax
cmp dword [edi + 0x35ac], ebx
je 0x66dfeb
push eax
push dword [ebp - 0x1810]
push str.CheckCampaign_HTTP_code:__d__response:__s_r_n
push bind
call fcn.00666d3d
add esp, 0x10
push dword [ebp + 0x10]
add dword [ebp + 0xc], 4
push dword [ebp + 0xc]
lea ecx, [ebp - 0x78]
call fcn.0040162b
mov byte [ebp - 4], 6
push 0xe
push str.UpgradePackage
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
lea esi, [edi + 0x31a9]
push eax
mov ecx, 0x400
mov byte [ebp - 4], 7
mov dword [ebp + 0x10], esi
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
mov eax, esi
cmp byte [eax], bl
je 0x66e0b1
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.004010ac
jmp 0x66e09c
mov esi, dword [ebp + 8]
push eax
push str.Installer:_failed_to_make_http_request._Returned_value:__d_r_n
push bind
call fcn.00666d3d
add esp, 0xc
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 5
jb 0x66de91
xor edi, edi
inc edi
jmp 0x66e123
push str.Installer:_Campaign_is_still_active_r_n
push bind
call fcn.00666d3d
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004010ac
xor edi, edi
jmp 0x66d7bb
push 6
push str.Status
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0xa
pop ecx
lea esi, [ebp - 0xe8]
mov byte [ebp - 4], 8
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
mov al, byte [ebp - 0xe8]
cmp al, 0x31
je 0x66e13e
cmp al, 0x33
je 0x66e13e
cmp al, 0x35
je 0x66e13e
cmp al, 0x32
je 0x66e135
cmp al, 0x34
je 0x66e135
cmp al, 0x36
je 0x66e135
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x78]
call fcn.004010ac
push ebx
push edi
lea ecx, [ebp - 0x94]
call fcn.004010ac
jmp 0x66d7bb
mov byte [edi + 0x3190], 1
jmp 0x66e144
mov byte [edi + 0x3190], bl
push 0xc
push str.Landing_Page
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
lea esi, [edi + 0x3088]
push eax
mov ecx, pe_nt_image_headers32
mov byte [ebp - 4], 9
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 4
push str.BIDC
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x17
lea esi, [edi + 0x954]
pop ecx
mov byte [ebp - 4], 0xa
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 3
push 0x6e5874
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0xb
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e213
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov dword [edi + 0x2a74], eax
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 0xf
pop esi
push 4
push str.left
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0xc
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e27b
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov dword [edi + 0x2a78], eax
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 5
push str.width
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0xd
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e2e0
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov dword [edi + 0x2a7c], eax
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 6
push str.height
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0xe
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e345
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov dword [edi + 0x2a80], eax
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 8
push str.minimize
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0xf
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e3aa
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov dword [edi + 0x2a84], eax
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 5
push str.sleep
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 0x10
call fcn.0066d632
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x66e40f
mov eax, dword [eax]
push eax
call fcn.004bb527
pop ecx
mov ecx, dword [ebp + 8]
push ebx
mov dword [ecx + 0x2a88], eax
push 1
lea ecx, [ebp - 0xb4]
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 0xf
pop edi
push 0xc
push str.Package_Name
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x400
mov byte [ebp - 4], 0x11
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push edi
push str.Preinstall_Page
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
add esi, 0x1a6f
push eax
mov ecx, 0x800
mov byte [ebp - 4], 0x12
mov dword [ebp + 0x10], esi
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 0xe
push str.Uninstall_Page
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
add esi, 0x226f
push eax
mov ecx, 0x800
mov byte [ebp - 4], 0x13
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004010ac
push 0xb
xor eax, eax
mov byte [ebp + 0xc], bl
lea edi, [ebp + 0xd]
push str.POST_ACTION
lea ecx, [ebp - 0x2c]
stosb byte es:[edi], al
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040182b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push 2
pop ecx
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 0x14
call fcn.0066d67a
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004010ac
cmp byte [ebp + 0xc], 0x31
jne 0x66e053
mov eax, dword [ebp + 0x10]
push ebx
lea ecx, [ebp - 0x78]
push 1
cmp byte [eax], bl
jne 0x66e58e
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004010ac
or edi, 0xffffffff
jmp 0x66d7bb
call fcn.004010ac
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004010ac
push 0xfffffffffffffffe
pop edi
jmp 0x66d7bb