Function at 0x6d5bf210
Capabilities:
Check http status code
Connect to http server
Create http request
Delete registry value
Parse url
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
lea ebp, [esp - 0x11e0]
mov eax, 0x11e0
call fcn.6d5ca7f0
push 0xfffffffffffffffe
push 0x6d5db6c0
push 0x6d5ca792
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x6d5e2a5c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x11dc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x11e8]
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0x11f0]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 0x11f4]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp + 0x11f8]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0x11fc]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0x1200]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0x1210]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp + 0x1214]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 0x1218]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp + 0x121c]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp + 0x1220]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp + 0x1224]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp + 0x1228]
mov dword [ebp - 0x20], edx
xor eax, eax
mov word [ebp + 0x11cc], ax
mov dword [ebp + 0x11ce], eax
mov dword [ebp + 0x11d2], eax
mov dword [ebp + 0x11d6], eax
mov word [ebp + 0x11da], ax
xor ecx, ecx
mov word [ebp + 0x11b8], cx
mov dword [ebp + 0x11ba], eax
mov dword [ebp + 0x11be], eax
mov dword [ebp + 0x11c2], eax
mov dword [ebp + 0x11c6], eax
mov word [ebp + 0x11ca], ax
xor edx, edx
mov word [ebp + 0x1190], dx
mov dword [ebp + 0x1192], eax
mov dword [ebp + 0x1196], eax
mov dword [ebp + 0x119a], eax
mov dword [ebp + 0x119e], eax
mov word [ebp + 0x11a2], ax
mov word [ebp + 0x11a4], ax
mov dword [ebp + 0x11a6], eax
mov dword [ebp + 0x11aa], eax
mov dword [ebp + 0x11ae], eax
mov dword [ebp + 0x11b2], eax
mov word [ebp + 0x11b6], ax
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x6d5bf367
sub eax, ecx
sar eax, 1
je 0x6d5bfbec
push esi
call fcn.6d5bb4a0
add esp, 4
test eax, eax
je 0x6d5bfbec
cmp dword [0x6d5e2fd8], 0
jne 0x6d5bf570
push 0x28
push 0x6d5e2fb0
push 0x28
push 0x6d5e2f88
call fcn.6d5bb070
mov dword [ebp - 0x1c], 0x40
lea ecx, [ebp - 0x1c]
push ecx
push 0x6d5e2f48
push str.VisitorId
push 0
call fcn.6d5bc5d0
add esp, 0x20
test eax, eax
je 0x6d5bf3da
cmp dword [ebp - 0x1c], 0x10
jae 0x6d5bf520
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
mov esi, eax
mov edi, edx
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
push str._lx_lx_lx
lea edx, [ebp + 0x1150]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf417
sub eax, edx
sar eax, 1
cmp eax, 0x10
jae 0x6d5bf455
lea eax, [ebp + 0x1150]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
mov ecx, 0x10
sub ecx, eax
push ecx
push 0x6d5d85b0
lea edx, [ebp + 0x1150]
push edx
call dword [sym.imp.MSVCR100.dll_wcsncat]
add esp, 0xc
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf460
sub eax, edx
sar eax, 1
shr eax, 1
push eax
lea eax, [ebp + 0x1150]
push eax
push 0x6d5e2f48
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp + 0x1150]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf490
sub eax, edx
sar eax, 1
shr eax, 1
add eax, eax
xor ecx, ecx
mov word [eax + 0x6d5e2f48], cx
mov edi, 0x6d5e2f48
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x6d5bf4b4
mov edx, dword [0x6d5d85ac]
mov dword [edi], edx
lea eax, [ebp + eax + 0x1150]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf4d1
sub eax, edx
mov edi, 0x6d5e2f48
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x6d5bf4e6
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.6d5bc490
push 0x6d5e2f48
push str.VisitorId
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0
call fcn.6d5bca80
add esp, 0x10
lea eax, [ebp + 0x700]
push eax
call fcn.6d5bd0b0
add esp, 4
test eax, eax
je 0x6d5bf54c
push 0x3c
lea ecx, [ebp + 0x700]
push ecx
push 0x6d5e2f0c
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
jmp 0x6d5bf566
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x6d5d83e0]
mov word [eax + 0x6d5e2f0c], cx
add eax, 2
test cx, cx
jne 0x6d5bf550
mov dword [0x6d5e2fd8], 1
xor edx, edx
mov word [ebp + 0xb00], dx
push str.__xml_version_1.0__encoding_UTF_8_____request_
lea ecx, [ebp - 0x24]
call fcn.6d592e00
push 0x6d5d08f4
push 0x6d5d8bc4
push ecx
mov eax, esp
mov ebx, dword [ebp - 0x24]
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf5a6
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
add esp, 0xc
mov eax, dword [ebp - 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf5b4
sub eax, edx
sar eax, 1
mov dword [ebp - 0x48], eax
push 0x6d5d8bc0
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, dword [sym.imp.MSVCR100.dll_wcsstr]
call edi
add esp, 8
mov esi, eax
cmp dword [ebp - 0x20], 0
jne 0x6d5bf5f5
push str.suninstallstat
push 0x6d5cfa40
lea edx, [ebp + 0x1128]
push edx
jmp 0x6d5bf605
mov eax, dword [ebp - 0x20]
push eax
push 0x6d5cfa40
lea ecx, [ebp + 0x1128]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test esi, esi
je 0x6d5bf635
mov eax, esi
sub eax, dword [ebp - 0x30]
sar eax, 1
mov dword [ebp - 0x48], eax
add esi, 2
push esi
push 0x6d5cfa40
lea edx, [ebp + 0x1128]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x1128]
push eax
push str.reportsuiteid
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x6d5bf656
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
push 0x6d5e2f48
push str.visitorid
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf677
lea edx, [ebx + 8]
push edx
call esi
call fcn.6d5bee40
add esp, 0xc
push 0x6d5e2f48
push str.prop21
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf698
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
push str.https:__
mov esi, dword [ebp - 0x30]
push esi
call edi
add esp, 0x14
test eax, eax
je 0x6d5bf72f
push 0x1c
push str.https:__sjremetrics.java.com
push esi
call dword [sym.imp.MSVCR100.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x6d5bf6e4
push 0xb3e9fd
push 0x6d5d8b08
lea ecx, [ebp + 0x700]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x6d5bf707
xor eax, eax
jmp 0x6d5bf6f0
movzx ecx, word [eax + str.nonprodpasswd]
mov word [ebp + eax + 0x700], cx
add eax, 2
test cx, cx
jne 0x6d5bf6f0
lea edx, [ebp + 0x700]
push edx
push str.prop20
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x6d5bf728
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
jmp 0x6d5bf757
push str.nonhttpspasswd
push str.prop20
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf74c
lea ecx, [ebx + 8]
push ecx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
add esp, 0xc
mov edi, dword [ebp - 0x68]
push edi
push str.pagename
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf772
lea edx, [ebx + 8]
push edx
call esi
call fcn.6d5bee40
add esp, 0xc
mov ecx, str.jfxic
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bf7a7
test dx, dx
je 0x6d5bf7a3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bf7a7
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bf781
xor eax, eax
jmp 0x6d5bf7ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x6d5bfa11
mov eax, dword [ebp - 0x28]
push eax
push str.evar2
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf7cc
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x6d5bf844
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf7e0
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x6d5bf844
mov ecx, 0x6d5d8a88
mov eax, esi
jmp 0x6d5bf800
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bf826
test dx, dx
je 0x6d5bf822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bf826
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bf800
xor eax, eax
jmp 0x6d5bf82b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x6d5bf844
push esi
push str.evar3
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf861
lea edx, [ebx + 8]
push edx
jmp 0x6d5bf85b
push 0x6d5e2f0c
push str.evar3
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf861
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
add esp, 0xc
mov ecx, 0x6d5d8a74
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bf896
test dx, dx
je 0x6d5bf892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bf896
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bf870
xor eax, eax
jmp 0x6d5bf89b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5bfa0b
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x6d5bf8e6
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bf8b0
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x6d5bf8e6
push esi
push str.evar15
push ecx
mov eax, esp
mov dword [eax], ebx
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x6d5bf8df
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
jmp 0x6d5bf931
xor eax, eax
jmp 0x6d5bf8f0
movzx ecx, word [eax + 0x6d5d83e0]
mov word [ebp + eax + 0x600], cx
add eax, 2
test cx, cx
jne 0x6d5bf8f0
lea edx, [ebp + 0x600]
push edx
push str.evar15
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf926
lea eax, [ebx + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
add esp, 0xc
call fcn.6d5bb560
push eax
push 0x6d5d8a5c
lea ecx, [ebp + 0x11a4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp + 0x11a4]
push edx
push str.evar40
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf96a
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
add esp, 0xc
mov ecx, 0x13
mov word [ebp - 0x7c], cx
mov edx, dword [ebp + 0x120c]
mov dword [ebp - 0x74], edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x38]
call fcn.6d5a8310
mov eax, dword [eax]
test eax, eax
je 0x6d5bf99a
mov eax, dword [eax]
jmp 0x6d5bf99c
xor eax, eax
push eax
push str.evar26
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf9b1
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.6d592330
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c]
push eax
push str.evar27
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bf9e3
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
mov edx, dword [ebp - 0x44]
push edx
push str.evar28
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfa03
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
add esp, 0xc
mov esi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
push str.i586
push str.evar4
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfa2a
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
push 0x6d5e2fb0
push str.evar5
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfa4b
lea edx, [ebx + 8]
push edx
call esi
call fcn.6d5bee40
add esp, 0xc
push 0x6d5e2f88
push str.evar6
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfa6c
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
add esp, 0xc
mov eax, dword [ebp + 0x11ec]
test eax, eax
jne 0x6d5bfac3
mov dword [ebp - 0x44], 0x14
jmp 0x6d5bfa90
movzx ecx, word [eax + 0x6d5d83e0]
mov word [ebp + eax + 0x1100], cx
add eax, 2
test cx, cx
jne 0x6d5bfa90
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp + 0x1100]
push edx
push str.Method
push 0
call fcn.6d5bc5d0
add esp, 0x10
jmp 0x6d5bfadf
lea edx, [ebp + 0x1100]
sub edx, eax
jmp 0x6d5bfad0
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x6d5bfad0
lea eax, [ebp + 0x1100]
push eax
push str.evar7
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfafa
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
mov edx, dword [ebp - 0x5c]
push edx
push str.evar8
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfb1a
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
add esp, 0xc
mov ecx, 0x6d5d8a74
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bfb56
test dx, dx
je 0x6d5bfb52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bfb56
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bfb30
xor eax, eax
jmp 0x6d5bfb5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5bffb9
push str.event6_event7
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5bfb7c
add ebx, 8
push ebx
call esi
call fcn.6d5bee40
xor ecx, ecx
mov word [ebp + 0xd00], cx
push 0x400
lea edx, [ebp + 0xd00]
push edx
push str.InstallStatus
call fcn.6d5bd380
push 0
call fcn.6d5bd5a0
add esp, 0x1c
mov ecx, str.reinstall
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bfbdb
test dx, dx
je 0x6d5bfbd7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bfbdb
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bfbb5
xor eax, eax
jmp 0x6d5bfbe0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5bfc14
lea ecx, [ebp - 0x24]
call fcn.6d592330
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11dc]
xor ecx, ebp
call fcn.6d5ca6ac
lea esp, [ebp + 0x11e0]
pop ebp
ret
mov ecx, str.exists
lea eax, [ebp + 0xd00]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bfc46
test dx, dx
je 0x6d5bfc42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bfc46
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bfc20
xor eax, eax
jmp 0x6d5bfc4b
sbb eax, eax
sbb eax, 0xffffffff
mov esi, dword [ebp + 0x1208]
test eax, eax
jne 0x6d5bfc65
cmp esi, 0x643
je 0x6d5bfc6d
cmp esi, 0x642
je 0x6d5bfc6d
cmp esi, 0x666
jne 0x6d5bfc78
mov esi, 0xffffff80
mov dword [ebp + 0x1208], esi
call fcn.6d5bd650
test eax, eax
je 0x6d5bfca7
cmp esi, 0x643
je 0x6d5bfc91
cmp esi, 0x642
jne 0x6d5bfca7
call fcn.6d5bb810
neg eax
sbb eax, eax
add eax, 0xffffff76
mov dword [ebp + 0x1208], eax
jmp 0x6d5bfce9
test esi, esi
jne 0x6d5bfce9
mov ecx, str.decline
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bfcdc
test dx, dx
je 0x6d5bfcd8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bfcdc
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bfcb6
xor eax, eax
jmp 0x6d5bfce1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5bfe01
call fcn.6d5bc490
xor edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x6d5bfd88
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6d5bfd32
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x6d5bfd3f
push eax
call ebx
call fcn.6d5bc490
xor edi, edi
test eax, eax
je 0x6d5bfdc6
mov dword [ebp - 0x1c], edi
lea edx, [ebp - 0x1c]
push edx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6d5bfdfa
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
jmp 0x6d5bfdfa
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x2021f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6d5bfd32
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
jmp 0x6d5bfd32
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6d5bfdfa
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
test edi, edi
je 0x6d5bfe01
push eax
call ebx
lea ecx, [ebp + 0x1190]
push ecx
lea edx, [ebp + 0x11b8]
push edx
lea eax, [ebp + 0x11cc]
push eax
mov edi, dword [ebp + 0x1208]
push edi
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.6d5bd710
add esp, 0x14
lea edx, [ebp + 0x1190]
push edx
push str.evar17
push ecx
mov eax, esp
mov esi, dword [ebp - 0x24]
mov dword [eax], esi
mov ebx, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test esi, esi
je 0x6d5bfe4d
lea eax, [esi + 8]
push eax
call ebx
call fcn.6d5bee40
add esp, 0xc
lea ecx, [ebp + 0x11cc]
push ecx
push str.evar18
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x6d5bfe70
lea edx, [esi + 8]
push edx
call ebx
call fcn.6d5bee40
add esp, 0xc
lea eax, [ebp + 0x11b8]
push eax
push str.evar19
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x6d5bfe93
lea ecx, [esi + 8]
push ecx
call ebx
call fcn.6d5bee40
add esp, 0xc
mov ecx, str.decline
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bfecc
test dx, dx
je 0x6d5bfec8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bfecc
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bfea6
xor eax, eax
jmp 0x6d5bfed1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x6d5bfbe4
push edi
push str._jre_d
lea edx, [ebp + 0xb00]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0xd00]
lea edx, [eax + 2]
jmp 0x6d5bff00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bff00
sub eax, edx
sar eax, 1
je 0x6d5bff95
mov ecx, str.exists
lea eax, [ebp + 0xd00]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bff46
test dx, dx
je 0x6d5bff42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bff46
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bff20
xor eax, eax
jmp 0x6d5bff4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x6d5bff95
lea eax, [ebp + 0xd00]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5bff57
sub eax, edx
lea edi, [ebp + 0xb00]
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x6d5bff70
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [sym.imp.kernel32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x24]
lea eax, [ebp + 0xb00]
push eax
push str.products
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x6d5c041f
add esi, 8
push esi
call ebx
jmp 0x6d5c041f
mov ecx, 0x6d5d8914
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bffe6
test dx, dx
je 0x6d5bffe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bffe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5bffc0
xor eax, eax
jmp 0x6d5bffeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5c0171
call fcn.6d5bc490
xor edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x6d5c0095
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x1c]
push ecx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6d5c003c
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x6d5c0049
push eax
call ebx
call fcn.6d5bc490
xor edi, edi
test eax, eax
je 0x6d5c00d3
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6d5c0107
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
jmp 0x6d5c0107
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
push 0x2021f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6d5c003c
mov edi, 1
push str.VisitorId
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
jmp 0x6d5c003c
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x20]
push ecx
push 0x2021f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6d5c0107
mov edi, 1
push str.Method
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x20]
test edi, edi
je 0x6d5c010e
push eax
call ebx
push str.event11
push str.events
push ecx
mov eax, esp
mov esi, dword [ebp - 0x24]
mov dword [eax], esi
test esi, esi
je 0x6d5c012e
lea edx, [esi + 8]
push edx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
mov eax, dword [ebp + 0x1208]
push eax
push str._jre_d
lea ecx, [ebp + 0xb00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea edx, [ebp + 0xb00]
push edx
push str.products
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x6d5c041f
add esi, 8
push esi
jmp 0x6d5c0419
mov ecx, 0x6d5d88fc
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5c019e
test dx, dx
je 0x6d5c019a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5c019e
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5c0178
xor eax, eax
jmp 0x6d5c01a3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5c01c9
push str.event1
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c041f
add ebx, 8
push ebx
call esi
jmp 0x6d5c041f
mov ecx, 0x6d5d88e4
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5c01f6
test dx, dx
je 0x6d5c01f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5c01f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5c01d0
xor eax, eax
jmp 0x6d5c01fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5c0301
push str.event2
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c021c
lea eax, [ebx + 8]
push eax
call esi
call fcn.6d5bee40
add esp, 0xc
mov eax, dword [ebp + 0x1208]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x6d5c0243
push eax
push 0x6d5d88cc
lea ecx, [ebp + 0x700]
push ecx
jmp 0x6d5c0250
push eax
push 0x6d5d76c0
lea edx, [ebp + 0x700]
push edx
call edi
add esp, 0xc
lea eax, [ebp + 0x700]
push eax
push str.evar9
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c0270
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
add esp, 0xc
mov eax, dword [ebp + 0x1204]
test eax, eax
jne 0x6d5c0291
push eax
push 0x6d5d88cc
lea edx, [ebp + 0x700]
push edx
jmp 0x6d5c029e
push eax
push 0x6d5d76c0
lea eax, [ebp + 0x700]
push eax
call edi
add esp, 0xc
lea ecx, [ebp + 0x700]
push ecx
push str.evar10
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c02be
lea edx, [ebx + 8]
push edx
call esi
call fcn.6d5bee40
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push str.NotifyInstall
push 0
call fcn.6d5bc840
add esp, 0x18
cmp dword [ebp - 0x28], 0
jne 0x6d5c02f2
push 0x6d5d88a8
push str.evar11
jmp 0x6d5c01b1
push 0x6d5d8890
push str.evar11
jmp 0x6d5c01b1
mov ecx, str.jfxic
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5c032e
test dx, dx
je 0x6d5c032a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5c032e
add eax, 4
add ecx, 4
test dx, dx
jne 0x6d5c0308
xor eax, eax
jmp 0x6d5c0333
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x6d5c0427
push str.event20
push str.events
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c0354
lea ecx, [ebx + 8]
push ecx
call esi
call fcn.6d5bee40
mov esi, dword [ebp + 0x1208]
push esi
push str._jfx_d
lea edx, [ebp + 0xb00]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp + 0xb00]
push eax
push str.products
push ecx
mov eax, esp
mov dword [eax], ebx
mov edi, dword [sym.imp.kernel32.dll_InterlockedIncrement]
test ebx, ebx
je 0x6d5c0396
lea ecx, [ebx + 8]
push ecx
call edi
call fcn.6d5bee40
add esp, 0xc
mov edx, dword [ebp - 0x54]
push edx
push str.evar16
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c03b6
lea eax, [ebx + 8]
push eax
call edi
call fcn.6d5bee40
add esp, 0xc
mov ecx, dword [ebp - 0x58]
push ecx
push str.evar17
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c03d6
lea edx, [ebx + 8]
push edx
call edi
call fcn.6d5bee40
add esp, 0xc
mov eax, dword [ebp - 0x64]
push eax
push str.evar18
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c03f6
lea ecx, [ebx + 8]
push ecx
call edi
call fcn.6d5bee40
add esp, 0xc
cmp esi, 3
jne 0x6d5c0427
mov edx, dword [ebp - 0x40]
push edx
push str.evar19
push ecx
mov eax, esp
mov dword [eax], ebx
test ebx, ebx
je 0x6d5c041f
add ebx, 8
push ebx
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
call fcn.6d5bee40
add esp, 0xc
push str.__request_
lea ecx, [ebp - 0x28]
call fcn.6d592e00
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
call fcn.6d594760
lea ecx, [ebp - 0x28]
call fcn.6d592330
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push str.jupdate
call dword [sym.imp.wininet.dll_InternetOpenW]
mov dword [ebp - 0x3c], eax
cmp eax, esi
je 0x6d5c07ed
push 0x3c
push esi
lea ecx, [ebp + 0x1154]
push ecx
call sub.MSVCR100.dll_memset
mov dword [ebp + 0x1154], 0x3c
lea edx, [ebp + 0x400]
mov dword [ebp + 0x1164], edx
mov eax, 0x200
mov dword [ebp + 0x1168], eax
xor ecx, ecx
mov word [ebp + 0x116c], cx
lea edx, [ebp]
mov dword [ebp + 0x1180], edx
mov dword [ebp + 0x1184], eax
lea ecx, [ebp + 0x200]
mov dword [ebp + 0x1188], ecx
mov dword [ebp + 0x118c], eax
mov edi, dword [ebp - 0x48]
push edi
mov ebx, dword [ebp - 0x30]
push ebx
lea edx, [ebp + 0xd00]
push edx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0x18
xor eax, eax
mov word [ebp + edi*2 + 0xd00], ax
lea ecx, [ebp + 0x1154]
push ecx
push eax
push edi
lea edx, [ebp + 0xd00]
push edx
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
push esi
push esi
push 3
push 0x6d5cda3c
push 0x6d5cda3c
mov eax, dword [ebp + 0x116c]
push eax
mov ecx, dword [ebp + 0x1164]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.wininet.dll_InternetConnectW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x6d5c07ed
lea edx, [ebp + 0xd00]
cmp dword [ebp + 0x1184], esi
je 0x6d5c0563
mov ecx, dword [ebp + 0x1180]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x6d5c0550
jmp 0x6d5c0581
mov ecx, 0x6d5d77fc
jmp 0x6d5c0570
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x6d5c0570
cmp dword [ebp + 0x118c], 0
je 0x6d5c05cc
mov eax, dword [ebp + 0x1188]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6d5c0592
sub eax, edx
lea edi, [ebp + 0xd00]
add edi, 0xfffffffe
jmp 0x6d5c05b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x6d5c05b0
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.https:__
push ebx
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
push 0
test eax, eax
je 0x6d5c0604
push 0x4c00000
push 0
push 0x6d5cda3c
push str.HTTP_1.1
lea eax, [ebp + 0xd00]
push eax
push str.POST
mov ecx, dword [ebp - 0x34]
push ecx
jmp 0x6d5c0625
push 0x4400000
push 0
push 0x6d5cda3c
push str.HTTP_1.1
lea edx, [ebp + 0xd00]
push edx
push str.POST
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.wininet.dll_HttpOpenRequestW]
mov esi, eax
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x6d5c07ed
mov edi, 1
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x24]
call fcn.6d5a16c0
mov ebx, eax
lea ecx, [ebp - 0x24]
call fcn.6d593e30
push eax
mov ecx, dword [ebx]
push ecx
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_HttpSendRequestW]
test eax, eax
jne 0x6d5c06ab
test edi, edi
je 0x6d5c07ed
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x2ee2
je 0x6d5c06a7
sub ecx, 5
je 0x6d5c06a7
sub ecx, 0x16
je 0x6d5c06a7
xor edi, edi
mov dword [ebp - 0x2c], edi
push edi
push 7
push eax
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.wininet.dll_InternetErrorDlg]
cmp eax, 0x2f00
jne 0x6d5c0640
jmp 0x6d5c0638
xor edi, edi
jmp 0x6d5c063d
test edi, edi
je 0x6d5c07ed
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov ebx, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
push 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x20000013
push esi
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
jne 0x6d5c06e9
call edi
mov ebx, eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x20]
cmp eax, 0x197
jne 0x6d5c0767
cmp dword [ebp - 0x2c], 0
je 0x6d5c0767
push 0
push 7
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.wininet.dll_InternetErrorDlg]
cmp eax, 0x2f00
je 0x6d5c0727
mov dword [ebp - 0x2c], 0
jmp 0x6d5c06f0
lea ecx, [ebp - 0x24]
call fcn.6d5a16c0
mov edi, eax
lea ecx, [ebp - 0x24]
call fcn.6d593e30
push eax
mov ecx, dword [edi]
push ecx
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_HttpSendRequestW]
mov dword [ebp - 0x1c], 4
push 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x20000013
push esi
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
jmp 0x6d5c06f0
cmp eax, 0xc8
jne 0x6d5c078c
mov dword [ebp - 0x50], 1
lea ecx, [ebp - 0x40]
push ecx
push 0x400
lea edx, [ebp + 0xd00]
push edx
push esi
call dword [sym.imp.wininet.dll_InternetReadFile]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x6d5c0797
mov eax, dword [eax]
jmp 0x6d5c0799
xor eax, eax
push str.prop20
push eax
mov ebx, dword [sym.imp.MSVCR100.dll_wcsstr]
call ebx
add esp, 8
mov edi, eax
test edi, edi
je 0x6d5c07d7
add edi, 0xe
push str.prop20
push edi
call ebx
add esp, 8
sub eax, edi
sar eax, 1
sub eax, 2
je 0x6d5c07d7
push eax
push 0x6d5d87f0
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x6d5c07e2
mov eax, dword [eax]
jmp 0x6d5c07e4
xor eax, eax
push eax
call fcn.6d5bc1c0
add esp, 4
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], 0xfffffffe
call fcn.6d5c0842
test edi, edi
je 0x6d5c0834
lea eax, [edi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jne 0x6d5c0834
mov eax, dword [edi]
test eax, eax
je 0x6d5c081b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x6d5c082b
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x50]
jmp 0x6d5bfbf1