Function at 0x413f50
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Read .ini file
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x484a66
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x684], eax
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x698]
mov dword fs:[0], eax
push 0xffffffffffffffff
lea ebp, [ebx + 0x210]
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.TITLE_UPDATE
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x496fa0
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x103
lea ecx, [esp + 0x181]
push 0
push ecx
mov byte [esp + 0x188], 0
call fcn.0043abe0
add esp, 0xc
lea edx, [esp + 0x17c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x49500b
lea ecx, [esp + 0x14]
call fcn.00401fa0
push 0x49500b
lea ecx, [esp + 0x18]
mov dword [esp + 0x6a4], 0
call fcn.00401fa0
push 0x207
lea eax, [esp + 0x289]
push 0
mov byte [esp + 0x6a8], 1
push eax
mov byte [esp + 0x290], 0
call fcn.0043abe0
lea eax, [esp + 0x188]
add esp, 0xc
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414070
lea edi, [esp + 0x284]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x414081
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x284]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4140a0
mov ecx, dword [str.Version.ini]
mov edx, dword [0x496640]
mov dword [eax], ecx
mov ecx, dword [0x496644]
mov dword [eax + 4], edx
mov dl, byte [0x496648]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x4140fa
push 0x38
push str.http:__www.jansh.com.cn_bankremote_lfbank_version_DF.ini
lea ecx, [esp + 0x18]
call fcn.00402400
push 0x41
push str.http:__www.jansh.com.cn_bankremote_lfbank_LFBank_ETOKEY_CK_DF.dat
lea ecx, [esp + 0x1c]
call fcn.00402400
jmp 0x414286
cmp eax, 0xd
jne 0x4141a9
mov esi, dword [0x4c8680]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x41412a
push 0
mov ecx, 0x4c8680
call fcn.00402350
mov esi, dword [0x4c8680]
test esi, esi
jne 0x414132
xor eax, eax
jmp 0x414140
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414137
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00402400
mov esi, dword [0x4c867c]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x414172
push 0
mov ecx, 0x4c867c
call fcn.00402350
mov esi, dword [0x4c867c]
test esi, esi
jne 0x414188
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402400
jmp 0x414286
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414190
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402400
jmp 0x414286
cmp eax, 0xc
jne 0x414209
mov edx, dword [0x4c865c]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4141d5
push 0
mov ecx, 0x4c865c
call fcn.00402350
mov edx, dword [0x4c865c]
push edx
lea ecx, [esp + 0x14]
call fcn.004024d0
mov edx, dword [0x4c8658]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x414206
push 0
mov ecx, 0x4c8658
call fcn.00402350
mov edx, dword [0x4c8658]
push edx
jmp 0x41427d
cmp eax, 0xe
jne 0x41422b
push 0
mov ecx, 0x4c8638
call fcn.004023a0
push eax
lea ecx, [esp + 0x14]
call fcn.004024d0
mov ecx, 0x4c8634
jmp 0x414275
cmp eax, 0xb
jne 0x41424d
push 0
mov ecx, 0x4c8614
call fcn.004023a0
push eax
lea ecx, [esp + 0x14]
call fcn.004024d0
mov ecx, 0x4c8610
jmp 0x414275
cmp eax, 0xffffffff
jne 0x414286
mov ecx, dword [0x4c2610]
push 0
add ecx, 0x14
call fcn.004023a0
push eax
lea ecx, [esp + 0x14]
call fcn.004024d0
mov ecx, dword [0x4c2610]
add ecx, 0x10
push 0
call fcn.004023a0
push eax
lea ecx, [esp + 0x18]
call fcn.004024d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x284]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4142b3
lea edx, [esp + 0x284]
push edx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.before_download_ini
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x496fa0
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push eax
call esi
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x28c]
push ecx
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x4143d9
lea eax, [esp + 0x284]
push eax
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
push str.UPDATE2
mov eax, dword [ebp + 8]
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x495984
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4143a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x6a0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4148e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4148e4
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.download_ini_success
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x496fa0
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x103
lea edx, [esp + 0x79]
push 0
push edx
mov byte [esp + 0x80], 0
call fcn.0043abe0
add esp, 0xc
lea eax, [esp + 0x284]
push eax
push 0x104
lea ecx, [esp + 0x7c]
push ecx
push 0
push str.version
push str.version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4144e2
lea edx, [esp + 0x284]
push edx
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x495984
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x414399
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x4144f8
lea ecx, [esp + 0x74]
push ecx
mov ecx, str.SOFTWAREJANSHETO_KEY_TRFYCZ
jmp 0x414546
cmp eax, 0xd
jne 0x414509
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c2e69
jmp 0x414546
cmp eax, 0xc
jne 0x414515
mov ecx, str.SOFTWAREJANSHETO_KEY_YCFZBANK
jmp 0x414541
cmp eax, 0xe
jne 0x414526
lea ecx, [esp + 0x74]
push ecx
mov ecx, 0x4c2739
jmp 0x414546
cmp eax, 0xb
jne 0x414537
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c3599
jmp 0x414546
cmp eax, 0xffffffff
jne 0x41454f
mov ecx, str.SOFTWAREJANSHNoKey_LF
lea eax, [esp + 0x74]
push eax
call fcn.00407fe0
test eax, eax
je 0x414574
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
push str.VERSION0
jmp 0x414353
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.before_download_exe
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x496fa0
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x44
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x24], 0
call fcn.0043abe0
xor eax, eax
push 0x207
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x4a0], al
lea eax, [esp + 0x4a1]
push eax
mov dword [esp + 0x44], 0x44
call fcn.0043abe0
lea eax, [esp + 0x194]
add esp, 0x18
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414614
lea ecx, [esp + 0x48c]
sub eax, esi
dec ecx
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x414625
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x4aff94]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp eax, 0xd
je 0x414656
cmp eax, 0xc
je 0x414656
cmp eax, 0xe
je 0x414656
cmp eax, 0xb
jne 0x41468b
lea eax, [esp + 0x48c]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x414660
mov ecx, dword [str.Require.exe]
mov edx, dword [0x49787c]
mov dword [eax], ecx
mov ecx, dword [0x497880]
mov dword [eax + 4], edx
mov dl, byte [0x497884]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x48c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4146b6
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x14]
push 0
push 0
lea eax, [esp + 0x494]
push eax
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x414739
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x495984
push eax
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4144c1
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418edd
mov edx, dword [ebp + 8]
push str.before_run_exe
push edx
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x496fa0
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4ac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4147f0
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41483d
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c5c
mov edx, dword [ebp + 8]
push str.UpdateDriver
push edx
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push str.UPDATE3
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebp + 8]
push 0x495984
push ecx
mov ecx, ebp
call fcn.00418edd
mov edx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push edx
jmp 0x4148d0
cmp dword [esp + 0x18], 4
push 0xffffffffffffffff
mov ecx, ebp
push 0
jne 0x41488e
call fcn.00418c5c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebp + 8]
push str.UPDATE3
push ecx
mov ecx, ebp
call fcn.00418edd
mov edx, dword [ebp + 8]
push 0x495984
push edx
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
jmp 0x4148d0
call fcn.00418c5c
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418edd
mov edx, dword [ebp + 8]
push str.UPDATE0
push edx
mov ecx, ebp
call fcn.00418edd
mov eax, dword [ebp + 8]
push 0x495984
push eax
mov ecx, ebp
call fcn.00418edd
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
lea ecx, [esp + 0x14]
call fcn.00402630
lea ecx, [esp + 0x10]
call fcn.00402630
xor eax, eax
mov ecx, dword [esp + 0x698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x684]
xor ecx, esp
call fcn.0043675a
add esp, 0x694
ret