Function at 0x413df0
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Read .ini file
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x484a66
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x684], eax
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x698]
mov dword fs:[0], eax
push 0xffffffffffffffff
lea ebp, [ebx + 0x210]
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.TITLE_UPDATE
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x496ed4
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x103
lea ecx, [esp + 0x181]
push 0
push ecx
mov byte [esp + 0x188], 0
call fcn.0043abc0
add esp, 0xc
lea edx, [esp + 0x17c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x49501b
lea ecx, [esp + 0x14]
call fcn.00401fa0
push 0x49501b
lea ecx, [esp + 0x18]
mov dword [esp + 0x6a4], 0
call fcn.00401fa0
push 0x207
lea eax, [esp + 0x289]
push 0
mov byte [esp + 0x6a8], 1
push eax
mov byte [esp + 0x290], 0
call fcn.0043abc0
lea eax, [esp + 0x188]
add esp, 0xc
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413f10
lea edi, [esp + 0x284]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413f21
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x284]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413f40
mov ecx, dword [str.Version.ini]
mov edx, dword [0x496588]
mov dword [eax], ecx
mov ecx, dword [0x49658c]
mov dword [eax + 4], edx
mov dl, byte [0x496590]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x413f9a
push 0x38
push str.http:__www.jansh.com.cn_bankremote_lfbank_version_DF.ini
lea ecx, [esp + 0x18]
call fcn.00402410
push 0x41
push str.http:__www.jansh.com.cn_bankremote_lfbank_LFBank_ETOKEY_CK_DF.dat
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x414126
cmp eax, 0xd
jne 0x414049
mov esi, dword [0x4c6ba0]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x413fca
push 0
mov ecx, 0x4c6ba0
call fcn.00402360
mov esi, dword [0x4c6ba0]
test esi, esi
jne 0x413fd2
xor eax, eax
jmp 0x413fe0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413fd7
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00402410
mov esi, dword [0x4c6b9c]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x414012
push 0
mov ecx, 0x4c6b9c
call fcn.00402360
mov esi, dword [0x4c6b9c]
test esi, esi
jne 0x414028
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x414126
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414030
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x414126
cmp eax, 0xc
jne 0x4140a9
mov edx, dword [0x4c6b58]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x414075
push 0
mov ecx, 0x4c6b58
call fcn.00402360
mov edx, dword [0x4c6b58]
push edx
lea ecx, [esp + 0x14]
call fcn.004024e0
mov edx, dword [0x4c6b54]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4140a6
push 0
mov ecx, 0x4c6b54
call fcn.00402360
mov edx, dword [0x4c6b54]
push edx
jmp 0x41411d
cmp eax, 0xe
jne 0x4140cb
push 0
mov ecx, 0x4c6b7c
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, 0x4c6b78
jmp 0x414115
cmp eax, 0xb
jne 0x4140ed
push 0
mov ecx, 0x4c6b34
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, 0x4c6b30
jmp 0x414115
cmp eax, 0xffffffff
jne 0x414126
mov ecx, dword [0x4c0610]
push 0
add ecx, 0x14
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, dword [0x4c0610]
add ecx, 0x10
push 0
call fcn.004023b0
push eax
lea ecx, [esp + 0x18]
call fcn.004024e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x284]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x414153
lea edx, [esp + 0x284]
push edx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.before_download_ini
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x496ed4
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push eax
call esi
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x28c]
push ecx
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x414279
lea eax, [esp + 0x284]
push eax
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
push str.UPDATE2
mov eax, dword [ebp + 8]
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x49598c
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414245
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x6a0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414784
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x414784
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.download_ini_success
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x496ed4
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x103
lea edx, [esp + 0x79]
push 0
push edx
mov byte [esp + 0x80], 0
call fcn.0043abc0
add esp, 0xc
lea eax, [esp + 0x284]
push eax
push 0x104
lea ecx, [esp + 0x7c]
push ecx
push 0
push str.version
push str.version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x414382
lea edx, [esp + 0x284]
push edx
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x49598c
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x414239
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x414398
lea ecx, [esp + 0x74]
push ecx
mov ecx, str.SOFTWAREJANSHETO_KEY_TRFYCZ
jmp 0x4143e6
cmp eax, 0xd
jne 0x4143a9
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c0e69
jmp 0x4143e6
cmp eax, 0xc
jne 0x4143b5
mov ecx, 0x4c0739
jmp 0x4143e1
cmp eax, 0xe
jne 0x4143c6
lea ecx, [esp + 0x74]
push ecx
mov ecx, str.SOFTWAREEnterSafeInterPass3000_SBER
jmp 0x4143e6
cmp eax, 0xb
jne 0x4143d7
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c1599
jmp 0x4143e6
cmp eax, 0xffffffff
jne 0x4143ef
mov ecx, str.SOFTWAREJANSHNoKey_LF
lea eax, [esp + 0x74]
push eax
call fcn.00407f20
test eax, eax
je 0x414414
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
push str.VERSION0
jmp 0x4141f3
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.before_download_exe
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x496ed4
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x44
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x24], 0
call fcn.0043abc0
xor eax, eax
push 0x207
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x4a0], al
lea eax, [esp + 0x4a1]
push eax
mov dword [esp + 0x44], 0x44
call fcn.0043abc0
lea eax, [esp + 0x194]
add esp, 0x18
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4144b4
lea ecx, [esp + 0x48c]
sub eax, esi
dec ecx
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x4144c5
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x4aff94]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp eax, 0xd
je 0x4144f6
cmp eax, 0xc
je 0x4144f6
cmp eax, 0xe
je 0x4144f6
cmp eax, 0xb
jne 0x41452b
lea eax, [esp + 0x48c]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x414500
mov ecx, dword [str.Require.exe]
mov edx, dword [0x4977e4]
mov dword [eax], ecx
mov ecx, dword [0x4977e8]
mov dword [eax + 4], edx
mov dl, byte [0x4977ec]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x48c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x414556
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x14]
push 0
push 0
lea eax, [esp + 0x494]
push eax
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x4145d9
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x49598c
push eax
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x414361
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418ec9
mov edx, dword [ebp + 8]
push str.before_run_exe
push edx
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x496ed4
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4ac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x414690
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4146dd
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c48
mov edx, dword [ebp + 8]
push str.UpdateDriver
push edx
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push str.UPDATE3
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebp + 8]
push 0x49598c
push ecx
mov ecx, ebp
call fcn.00418ec9
mov edx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push edx
jmp 0x414770
cmp dword [esp + 0x18], 4
push 0xffffffffffffffff
mov ecx, ebp
push 0
jne 0x41472e
call fcn.00418c48
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebp + 8]
push str.UPDATE3
push ecx
mov ecx, ebp
call fcn.00418ec9
mov edx, dword [ebp + 8]
push 0x49598c
push edx
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
jmp 0x414770
call fcn.00418c48
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418ec9
mov edx, dword [ebp + 8]
push str.UPDATE0
push edx
mov ecx, ebp
call fcn.00418ec9
mov eax, dword [ebp + 8]
push 0x49598c
push eax
mov ecx, ebp
call fcn.00418ec9
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
lea ecx, [esp + 0x14]
call fcn.00402580
lea ecx, [esp + 0x10]
call fcn.00402580
xor eax, eax
mov ecx, dword [esp + 0x698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x684]
xor ecx, esp
call fcn.00436738
add esp, 0x694
ret