Function at 0x425840
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4752df
mov eax, dword fs:[0]
push eax
mov eax, 0x63c8
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x63cc], ebx
mov eax, dword [ebp + 0x18]
mov esi, dword [ebx + 0x84]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x63c0], eax
mov eax, dword [ebx + 0x80]
cmp eax, esi
mov dword [ebp - 0x63d0], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x63c4], ecx
mov dword [ebp - 0x63bc], edi
mov dword [ebp - 0x63c8], edx
mov dword [ebp - 0x63d4], eax
je 0x425902
nop dword [eax]
push dword [ebp - 0x63c0]
mov ecx, dword [eax]
push edx
push edi
push esi
mov eax, dword [ecx]
push dword [ebp - 0x63c4]
mov eax, dword [eax]
call eax
test al, al
jne 0x4262f6
mov eax, dword [ebp - 0x63d4]
mov edx, dword [ebp - 0x63c8]
add eax, 4
mov dword [ebp - 0x63d4], eax
cmp eax, dword [ebp - 0x63d0]
jne 0x4258c0
mov ecx, dword [ebp - 0x63c4]
mov dword [0x561100], 1
cmp esi, 0x502
ja 0x426307
je 0x4262fd
cmp esi, 0xf
ja 0x425af1
je 0x425acf
sub esi, 2
je 0x425a19
sub esi, 3
jne case.0x426328.1285
mov eax, dword [0x537df8]
test edx, edx
je 0x42595a
cmp ecx, eax
je 0x42595a
mov ecx, ebx
call fcn.00429900
mov al, 1
jmp 0x4259fb
cmp edi, 1
jne case.0x426328.1285
cmp ecx, eax
jne case.0x426328.1285
push dword [0x514990]
mov dword [0x562ec4], edi
call fcn.00448f10
mov ecx, dword [0x561100]
add esp, 4
mov edx, 2
mov dword [0x55e828], edi
test eax, eax
push 0
cmovne ecx, edx
push edx
push ecx
push 0x10
mov dword [0x561100], ecx
mov ecx, 0x52abf8
push str.Requested_to_Minimize_Window
call fcn.0041c080
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4b
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___106
push str.Secure_Browser
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004186d0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x14
push 0x7f
lea eax, [ebp - 0x90]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, 0x80
jae 0x42738b
mov byte [ebp + eax - 0x90], 0
lea eax, [ebp - 0x90]
push str.ITS_Secure_Web_Browser
push eax
call fcn.0045df08
add esp, 8
test eax, eax
je 0x425a88
lea eax, [ebp - 0x90]
push str.ITS_Secure_Web_Browser_Window
push eax
call fcn.0045df08
add esp, 8
test eax, eax
je 0x425a88
lea eax, [ebp - 0x90]
push str.SBRemoteHandler
push eax
call fcn.0045df08
add esp, 8
test eax, eax
jne case.0x426328.1285
push dword [ebp - 0x63c4]
mov ecx, 0x52abf8
call fcn.0041d370
dec dword [0x55b288]
mov ecx, ebx
cmp dword [0x52aff8], 0
setne al
movzx eax, al
push eax
call fcn.00424900
cmp dword [0x55b288], 0
jne 0x4262f6
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
jmp 0x4259fb
lea eax, [ebp - 0x50]
push eax
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x63c4]
call dword [sym.imp.USER32.dll_EndPaint]
mov al, 1
jmp 0x4259fb
cmp esi, 0x111
ja 0x426109
je 0x425e86
add esi, 0xffffffef
cmp esi, 0xf3
ja case.0x426328.1285
movzx eax, byte [esi + 0x4273c8]
jmp dword [eax*4 + 0x42739c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xa0000
je case.0x426328.1285
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
add esp, 4
mov edx, 2
mov dword [0x55e828], 1
test eax, eax
push 0
cmovne ecx, edx
push edx
push ecx
push 0x10
mov dword [0x561100], ecx
mov ecx, 0x52abf8
push str.Requested_to_Restore_Window
call fcn.0041c080
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4b
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___104
jmp 0x4259e0
add edi, 0xffffffaf
cmp edi, 0x29
ja case.0x426328.1285
movzx eax, byte [edi + 0x4274d8]
jmp dword [eax*4 + 0x4274bc]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x426328.1285
push 0x12
call esi
test ax, ax
jns case.0x426328.1285
push 0x11
call esi
test ax, ax
jns case.0x426328.1285
push str.Shutdown__Main_:_Hotkey
jmp 0x4263d9
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns case.0x426328.1285
mov al, 1
jmp 0x4259fb
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x426328.1285
push 0x12
call esi
test ax, ax
jns case.0x426328.1285
push 0x11
call esi
test ax, ax
jns case.0x426328.1285
push 0x1000
push str.Hot_Key_Press_Notification
push str.Test_Ctrl__Alt_Shft__F11:_Hotkey_Press
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x426328.1285
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [0x53b6b0], 0xa
call esi
test ax, ax
jns case.0x426328.1285
push 0x11
call esi
test ax, ax
jns case.0x426328.1285
push str.Shutdown__Main_:_Hotkey_Ctrl__Shift__q
jmp 0x4263d9
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x426328.1285
push 0x12
call esi
test ax, ax
js case.0x426328.1285
push 0x11
call esi
test ax, ax
jns case.0x426328.1285
push str.Refresh_Window__Main_
jmp 0x4263fa
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jns case.0x426328.1285
push 0x12
call esi
test ax, ax
js case.0x426328.1285
push 0x11
call esi
test ax, ax
jns case.0x426328.1285
push str.Unlock_Window__Main_
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push 1
push dword [ebp - 0x63c4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [0x562d40], 0
jmp case.0x426328.1285
cmp dword [0x52aff8], 0
mov ecx, ebx
setne al
movzx eax, al
push eax
call fcn.00424900
push 0
push 0xffffffffffffffeb
push dword [ebp - 0x63c4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
test ebx, ebx
je 0x425d66
mov ecx, ebx
call fcn.00422c50
push 0x108
push ebx
call fcn.0044d09e
add esp, 8
mov ecx, dword [0x5ca38c]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
add dword [eax + 4], 0xffffffff
jne case.0x426328.1285
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x426328.1285
push 3
push str.__restore
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov eax, dword [ebp - 0x63c0]
mov dword [eax], 1
mov al, 1
jmp 0x4259fb
cmp edi, 1
jne case.0x426328.1285
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
jmp 0x4259fb
test edx, 0x40000000
jne case.0x426328.1285
push edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.00424f50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x425e01
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x38]
call fcn.0040a330
mov al, 1
jmp 0x4259fb
lea ecx, [ebp - 0x38]
call fcn.0040a330
jmp case.0x426328.1285
test edx, 0x40000000
jne case.0x426328.1285
push edi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.00424f50
mov dword [ebp - 4], 1
jmp 0x425de6
cmp dword [0x53b13c], 0
jne case.0x426328.1285
cmp dword [0x53b140], 0
jne case.0x426328.1285
push edx
mov ecx, ebx
call fcn.00424a30
jmp case.0x426328.1285
cmp dword [0x561518], 0
mov dword [0x52b0d8], 1
je case.0x426328.1285
mov ecx, 0x52abf8
mov dword [0x561518], 0
call fcn.00418c60
jmp case.0x426328.1285
cmp dword [ebx + 0x50], 0
jne 0x425eae
movzx ecx, di
movzx eax, cx
add eax, 0xfffffbb0
cmp eax, 0x43
ja case.0x426328.1285
movzx eax, byte [eax + 0x427524]
jmp dword [eax*4 + 0x427504]
movzx eax, di
mov edx, eax
add eax, 0xfffffba4
mov ecx, edx
cmp eax, 0x3b
ja case.0x425ec6.1117
movzx eax, byte [eax + 0x42757c]
jmp dword [eax*4 + 0x427568]
mov ecx, dword [ebx + 0x48]
lea edx, [ebp - 0x63c0]
mov dword [ebp - 0x63c0], 0
push edx
push ecx
mov eax, dword [ecx]
mov dword [ebp - 4], 2
call dword [eax + 0x14]
push str.Browser_version_after_webview_created
push 1
push dword [0x514990]
call fcn.00449450
mov eax, dword [ebp - 0x63c0]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x427384
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x4259fb
push str.IDM_CLOSE_WEBVIEW
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, ebx
push 0
call fcn.00424900
mov al, 1
jmp 0x4259fb
push str.IDM_CLOSE_WEBVIEW_CLEANUP
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, ebx
push 1
call fcn.00424900
mov al, 1
jmp 0x4259fb
push str.IDM_SCENARIO_POST_WEB_MESSAGE
push 1
push dword [0x514990]
call fcn.00449450
push 0x38
call fcn.0044d32b
add esp, 0x10
mov dword [ebp - 0x63bc], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x425fb0
push ebx
mov ecx, eax
call fcn.00437ab0
mov ecx, eax
jmp 0x425fb2
xor ecx, ecx
mov edx, dword [ebx + 0x84]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x63d0], ecx
cmp edx, dword [ebx + 0x88]
je 0x425fdd
mov dword [edx], ecx
mov al, 1
add dword [ebx + 0x84], 4
jmp 0x4259fb
lea ecx, [ebp - 0x63d0]
push ecx
push edx
lea ecx, [ebx + 0x80]
call fcn.004224b0
mov al, 1
jmp 0x4259fb
push 0
push 0x4247f0
push dword [ebx]
push 0x44f
push dword [0x52a674]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, 1
jmp 0x4259fb
lea eax, [ebp - 0x63c0]
mov dword [ebp - 0x63c0], 0
push eax
push 0
call fcn.004018da
mov eax, dword [ebp - 0x63c0]
test eax, eax
je 0x427384
push eax
mov dword [ebp - 4], 7
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x4259fb
cmp dword [0x52aff8], 0
mov ecx, ebx
setne al
movzx eax, al
push eax
call fcn.00424900
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
jmp 0x4259fb
push 0
mov ecx, ebx
call fcn.00427660
mov al, 1
jmp 0x4259fb
cmp byte [ebx + 0xe0], 0
sete al
mov byte [ebx + 0xe0], al
mov al, 1
jmp 0x4259fb
push 0x108
call fcn.0044d32b
mov esi, eax
add esp, 4
mov dword [ebp - 0x63bc], esi
mov dword [ebp - 4], 8
test esi, esi
je 0x427384
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x63d0], esp
mov dword [ecx + 0x24], 0
push 0
push 0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
push 0x478b6c
call fcn.00409900
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.00422770
mov al, 1
jmp 0x4259fb
call fcn.0040afb0
mov al, 1
jmp 0x4259fb
cmp esi, 0x112
je 0x4262de
cmp esi, 0x218
je 0x4262ad
cmp esi, 0x2b1
jne case.0x426328.1285
dec edi
xor esi, esi
cmp edi, 7
ja case.0x426139.5
jmp dword [edi*4 + 0x4275b8]
push str.Detected_WTS_SESSION_LOCK
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
cmp dword [0x4a745c], esi
jne case.0x426139.5
push 0
push 0
push 2
push 4
push str.CTRLALTDEL
mov ecx, 0x52abf8
call fcn.0041c080
jmp case.0x426139.5
push str.Detected_WTS_SESSION_UNLOCK
jmp 0x4261be
push str.Detected_WTS_SESSION_TERMINATE
push 1
push dword [0x514990]
call fcn.00449450
mov esi, 1
jmp 0x4261cb
push str.Detected_WTS_SESSION_CREATE
jmp 0x4261be
push str.Detected_WTS_REMOTE_CONNECT
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov edi, 1
jmp 0x4261d0
push str.Detected_WTS_REMOTE_DISCONNECT
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
xor edi, edi
cmp dword [0x5647dc], 0
je case.0x426328.1285
test esi, esi
je 0x42623f
mov eax, dword [ebx + 0x50]
push str.about:blank
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0
push 2
push 7
push 0x47e5d4
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.0041c080
mov ecx, 0x52abf8
call fcn.00418b70
push str.We_have_detected_another_login_or_attempted_login_has_occurred._This_violation_has_been_logged_and_the_browser_will_now_close.
push str.SessionActivityDetected
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, ebx
call fcn.004248e0
mov ecx, 0x52abf8
call fcn.004186d0
cmp dword [0x52b098], 0
jne case.0x426328.1285
test edi, edi
je case.0x426328.1285
mov eax, dword [ebx + 0x50]
push str.about:blank
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0
push 2
push 3
push 0x479b14
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.0041c080
mov ecx, 0x52abf8
call fcn.00418b70
push str.A_remote_connect_disconnect_detected._Quitting
push str.RemoteConnectDetected
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, ebx
call fcn.004248e0
jmp 0x4259ef
cmp edi, 5
jne 0x4262bc
push str.PBT_APMSTANDBY
jmp 0x4263fa
cmp edi, 7
jne 0x4262cb
push str.PBT_APMRESUMESUSPEND
jmp 0x4263fa
cmp edi, 0x12
jne case.0x426328.1285
push str.PBT_APMRESUMEAUTOMATIC
jmp 0x4263fa
cmp edi, 0xf060
jne case.0x426328.1285
cmp ecx, dword [0x537df8]
jne case.0x426328.1285
mov al, 1
jmp 0x4259fb
call fcn.0040bff0
jmp case.0x426328.1285
cmp esi, 0x8000
ja case.0x426328.1285
je 0x427351
add esi, 0xfffffafd
cmp esi, 0x1f
ja case.0x426328.1285
jmp dword [esi*4 + 0x4275d8]
push 0x800
push 0x40
mov dword [0x562d44], edx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x104
mov esi, eax
push esi
push dword [ebp - 0x63c8]
push dword [0x514990]
call fcn.00448d10
add esp, 0x10
test eax, eax
jne 0x426365
mov word [esi], ax
push 0
push 3
push 2
push 5
push esi
mov ecx, 0x52abf8
call fcn.0041c080
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp case.0x426328.1285
push 0x802
push 0x40
mov dword [0x562d44], edx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x104
mov esi, eax
push esi
push dword [ebp - 0x63c8]
push dword [0x514990]
call fcn.00448d10
add esp, 0x10
test eax, eax
jne 0x4263ba
mov word [esi], ax
push 0
push 2
jmp 0x426369
mov dword [0x53b6b0], 0xa
mov dword [0x5162c8], 1
push str.Shutdown__Popup_:_Hotkey
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, ebx
call fcn.004248e0
jmp 0x4259ef
push str.Refresh_Window__Popup_
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
jmp case.0x426328.1285
push edi
lea eax, [ebp - 0x1ac]
push 0x104
push eax
call fcn.00453332
add esp, 0xc
push dword [ebp - 0x63c8]
lea eax, [ebp - 0x1ac]
mov ecx, ebx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00428790
lea ecx, [ebp - 0x38]
call fcn.0040a330
jmp case.0x426328.1285
push 0x800
push 1
call fcn.004534b1
push edi
mov esi, eax
push 0x800
push esi
call fcn.00453332
add esp, 0x14
mov ecx, ebx
push dword [ebp - 0x63c8]
push esi
call fcn.00428640
jmp case.0x426328.1285
push 0x800
push 1
call fcn.004534b1
push 0x800
push 1
mov edi, eax
call fcn.004534b1
push dword [ebp - 0x63bc]
mov esi, eax
push 0x800
push edi
call fcn.00453332
push dword [ebp - 0x63c8]
push 0x800
push esi
call fcn.00453332
push 0x5637d0
push esi
push edi
call fcn.0040c0f0
add esp, 0x34
jmp case.0x426328.1285
cmp dword [0x562ec0], 0
jne 0x4265e4
push 0x800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [0x539f58]
push 0
push 0xfde9
call esi
push 0
push 0
dec eax
push eax
push edi
push 0xffffffffffffffff
push dword [0x539f58]
push 0
push 0xfde9
call esi
push 0x64
push 0x52e4f4
mov ecx, 0x4e2960
call fcn.00408040
push eax
push 0x64
push 0x52fcdc
call fcn.004534a6
add esp, 0x10
mov ecx, 0x4e2960
push 0x1000
push str.Hot_Key_Press_Notification
push edi
push str.User_Agent__
push 0x47c818
push 0x52e620
call fcn.00408180
push eax
push str.Language__
push 0x47c818
push 0x52fcdc
push str.Environment__
push 0x47c818
push 0x52e558
mov ecx, 0x4e2960
call fcn.00408000
push eax
push str.Candidate_ID__
push 0x47c818
mov ecx, 0x4e2960
call fcn.00408120
push eax
push str.Institution_ID__
push 0x47c818
mov ecx, 0x52abf8
call fcn.0041b140
push eax
push str.Program_ID__
push 0x47c818
push 0x514a18
push str.URL__
push 0x14
push ebx
call fcn.0042a7d0
add esp, 0x58
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp case.0x426328.1285
mov dword [0x562ec0], 0
jmp case.0x426328.1285
cmp dword [0x52b060], 0
mov eax, dword [ebx + 0xfc]
mov ecx, dword [eax]
je 0x426635
push 1
push eax
call dword [ecx + 0x30]
mov eax, dword [ebx + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xcc]
push 1
push dword [0x514990]
call fcn.00448ae0
add esp, 8
mov dword [0x55e850], 1
jmp case.0x426328.1285
push 0
push eax
call dword [ecx + 0x30]
jmp case.0x426328.1285
push str.WM_GO_TO_DEFAULT_URL_call_initiated
push 1
push dword [0x514990]
call fcn.00449450
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_101d48d26269aa53dc0810379c436ded___void___.0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
push 0x28
mov dword [ebp - 4], 0xa
call fcn.0044d32b
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x63bc], esi
mov byte [ebp - 4], 0xb
test esi, esi
je 0x42669f
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xc
test ecx, ecx
je 0x4266a1
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
jmp 0x4266a1
xor esi, esi
push 0
push esi
push 0x8000
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je case.0x426328.1285
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp case.0x426328.1285
mov ebx, dword [ebx + 0x50]
push 0
push 0
push 0xffffffffffffffff
push 0x52dde8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x42671e
push edi
push esi
push 0xffffffffffffffff
push 0x52dde8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x42671e
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
push str.WM_GO_TO_ALTERNATE_URL_completed
jmp 0x4263fa
mov ebx, dword [ebx + 0x50]
push 0
push 0
push 0xffffffffffffffff
push 0x52fda4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x42677b
push edi
push esi
push 0xffffffffffffffff
push 0x52fda4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x42677b
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
push str.WM_GO_TO_DYNAMIC_ALTERNATE_URL_completed
jmp 0x4263fa
push edi
push 0x104
push 0x562db8
call fcn.00453332
mov ebx, dword [ebx + 0x50]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
push 0x562db8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x4267eb
push edi
push esi
push 0xffffffffffffffff
push 0x562db8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x4267eb
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
jmp case.0x426328.1285
mov eax, dword [str.Allow]
mov dword [ebp - 0x63b4], eax
mov ax, word [0x47e3a4]
push 0x1ff8
mov word [ebp - 0x63b0], ax
lea eax, [ebp - 0x63ae]
push 0
push eax
call fcn.004500f0
add esp, 0xc
push 0x539354
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push edi
mov dword [ebp - 0x63bc], eax
lea eax, [ebp - 0x1ac]
push 0x104
push eax
call fcn.00453332
add esp, 0xc
cmp dword [0x52b064], 0
je 0x426424
cmp dword [0x52b000], 0
jne case.0x426328.1285
mov ecx, 0x52abf8
call fcn.00418b70
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
call fcn.00418b70
push dword [ebp - 0x63bc]
lea eax, [ebp - 0x1ac]
mov ecx, ebx
push str._SBName_
push eax
push str._ProcessNames_
push str.The_below_process_could_not_be_terminated_by__SBName_._Click_Ok_to_relaunch__SBName__with_administrative_rights_which_will_allow__SBName__to_pause_the_process_for_you.__n_nProcesses_Running:__ProcessNames_
push str.UnableToKill
call fcn.00429a60
mov dword [0x4a76bc], eax
cmp eax, 1
jne 0x426abc
push 0x539354
lea eax, [ebp - 0x43b4]
push 0x1ffe
push eax
call fcn.00453332
add esp, 0xc
lea eax, [ebp - 0x43b4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x478870
lea eax, [ebp - 0x43b4]
push 0x104
push eax
call fcn.0045338c
push str.ITS_SB_App_Switch.exe
lea eax, [ebp - 0x43b4]
push 0x104
push eax
call fcn.0045338c
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov dword [0x562ecc], eax
lea eax, [ebp - 0x93]
push eax
call fcn.00422720
mov ecx, eax
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x93]
mov dword [ebp - 0x18], 0
add esp, 8
mov byte [ebp - 0x28], 0
mov edx, 0xf
mov dword [ebp - 0x14], edx
cmp ecx, eax
je 0x42696b
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040d950
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x28]
push 1
cmp edx, 0x10
mov dword [ebp - 4], 0xd
push 0
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x43b4]
push eax
push str.open
push 0
call esi
push str.Started_admin_launch
push 1
push dword [0x514990]
call fcn.00449450
push 0x5162e0
lea eax, [ebp - 0x23b4]
push 0x1ffe
push eax
call fcn.00453332
push str.__adminLaunch_
lea eax, [ebp - 0x23b4]
push 0x1ffe
push eax
call fcn.0045338c
lea eax, [ebp - 0x63b4]
push eax
lea eax, [ebp - 0x23b4]
push 0x1ffe
push eax
call fcn.0045338c
push str.___SBPathForadminLaunch_
lea eax, [ebp - 0x23b4]
push 0x1ffe
push eax
call fcn.0045338c
push 0x5204e8
lea eax, [ebp - 0x23b4]
push 0x1ffe
push eax
call fcn.0045338c
add esp, 0x48
lea eax, [ebp - 0x23b4]
push 0x4795c4
push 0x1ffe
push eax
call fcn.0045338c
lea eax, [ebp - 0x23b4]
push eax
push str.admin_launch_cmd__s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x1c
mov dword [0x53b6b0], 2
lea eax, [ebp - 0x23b4]
push 1
push 0
push eax
push 0x539354
push str.runas
push 0
call esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x4263e9
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x426aa6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x427390
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov ecx, ebx
call fcn.004248e0
jmp 0x4259ef
mov ecx, ebx
mov dword [0x53b6b0], 5
call fcn.004248e0
jmp 0x4259ef
push edx
push str.Started_WM_HIDDEN_PROCESS__lu
push 1
push dword [0x514990]
mov dword [0x562d44], edx
call fcn.00449450
add esp, 0x10
jmp case.0x426328.1285
push str.Monitor_process
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
lea eax, [ebp - 0x2b0]
push 0x104
push eax
push 0xffffffffffffffff
push dword [0x53b398]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x53b16c]
mov edx, 0x478530
mov ecx, eax
mov bl, byte [ecx]
mov byte [ebp - 0x63b5], bl
cmp bl, byte [edx]
jne 0x426b61
test bl, bl
je 0x426b5d
mov bl, byte [ecx + 1]
mov byte [ebp - 0x63b5], bl
cmp bl, byte [edx + 1]
jne 0x426b61
add ecx, 2
add edx, 2
test bl, bl
jne 0x426b35
xor ecx, ecx
jmp 0x426b66
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x426b99
mov ecx, 0x47e6f8
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426b90
test dl, dl
je 0x426b8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426b90
add eax, 2
add ecx, 2
test dl, dl
jne 0x426b70
xor eax, eax
jmp 0x426b95
sbb eax, eax
or eax, 1
test eax, eax
jne 0x426ba3
mov dword [0x55e828], 1
push 0
push 0
push 2
push 8
lea eax, [ebp - 0x2b0]
mov ecx, 0x52abf8
push eax
call fcn.0041c080
mov eax, dword [0x53b16c]
mov edx, 0x478530
mov ecx, eax
nop dword [eax + eax]
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x63b5], bl
mov ebx, dword [ebp - 0x63cc]
jne 0x426c12
cmp byte [ebp - 0x63b5], 0
je 0x426c0e
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x63b5], bl
mov ebx, dword [ebp - 0x63cc]
jne 0x426c12
add ecx, 2
add edx, 2
cmp byte [ebp - 0x63b5], 0
jne 0x426bd0
xor ecx, ecx
jmp 0x426c17
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x426c50
push str.Monitor_process___1
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov dword [0x53b6b0], 0x11
mov ecx, ebx
mov dword [0x5162c8], 1
call fcn.004248e0
jmp 0x4259ef
mov edx, 0x47e6f8
mov ecx, eax
nop word [eax + eax]
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x63b5], bl
mov ebx, dword [ebp - 0x63cc]
jne 0x426ca2
cmp byte [ebp - 0x63b5], 0
je 0x426c9e
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x63b5], bl
mov ebx, dword [ebp - 0x63cc]
jne 0x426ca2
add ecx, 2
add edx, 2
cmp byte [ebp - 0x63b5], 0
jne 0x426c60
xor ecx, ecx
jmp 0x426ca7
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x426d12
push str.Monitor_process___2
push 1
push dword [0x514990]
call fcn.00449450
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 0x10
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
call fcn.00418b70
push str.We_have_detected_that_a_required_process_is_no_longer_running._The_Secure_Browser_will_now_close.
push str.RequiredProcessNotRunning
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, ebx
mov dword [0x53b6b0], 0x11
mov dword [0x5162c8], 1
call fcn.004248e0
jmp 0x4259ef
mov ecx, 0x47e7a8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426d37
test dl, dl
je 0x426d33
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426d37
add eax, 2
add ecx, 2
test dl, dl
jne 0x426d17
xor eax, eax
jmp 0x426d3c
sbb eax, eax
or eax, 1
test eax, eax
jne case.0x426328.1285
mov eax, dword [0x53b168]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0x53b158
push 1
push 0x400
push 0x47e17c
push 0
push eax
call dword [ecx + 0x18]
push str.Monitor_process___3
jmp 0x4263fa
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
test eax, eax
push str.WM_WINDOW_AFFINITY
mov edx, 2
push 1
push dword [0x514990]
cmovne ecx, edx
mov dword [0x561100], ecx
call fcn.00449450
add esp, 0x10
mov dword [0x55e828], 1
mov ecx, 0x52abf8
push 0
push 2
push dword [0x561100]
push 0xd
push str.Disabled_Screen_Capture_Blocking
call fcn.0041c080
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4b
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___102
jmp 0x4259e0
cmp dword [0x5647dc], 0
je case.0x425b19.24
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
add esp, 4
test eax, eax
mov dword [0x55e828], 1
mov edx, 2
cmovne ecx, edx
push 0
push 0
push ecx
push 0xc
mov dword [0x561100], ecx
mov ecx, 0x52abf8
push str.Native_Switch_Detected
call fcn.0041c080
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___107
push str.Secure_Browser
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004210d0
push 0x4b
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4b
call fcn.004211f0
jmp 0x4259ef
test edi, edi
jne case.0x426328.1285
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
add esp, 4
mov edx, 2
mov dword [0x55e828], 1
test eax, eax
push edi
cmovne ecx, edx
push edx
push ecx
push 0x10
mov dword [0x561100], ecx
mov ecx, 0x52abf8
push str.Requested_to_Hide_the_Window
call fcn.0041c080
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4b
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___105
jmp 0x4259e0
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
add esp, 4
test eax, eax
mov edx, 2
cmovne ecx, edx
cmp dword [0x561104], 0
mov dword [0x561100], ecx
jne case.0x426328.1285
push 0
push edx
push ecx
push 0x11
push str.Duplicated_display_detected
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.0041c080
mov ecx, 0x47e6f8
mov eax, 0x534698
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426fa6
test dl, dl
je 0x426fa2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426fa6
add eax, 2
add ecx, 2
test dl, dl
jne 0x426f86
xor eax, eax
jmp 0x426fab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x427002
cmp edi, 2
jne 0x427002
mov ecx, 0x52abf8
call fcn.004210d0
mov dword [0x561104], 1
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0xf
call fcn.00418b70
push str.You_are_not_allowed_to_use_duplicated_displays._Turn_off_your_extra_displays_or_update_your_configuration_to_extend_the_desktop_to_the_other_displays._The_Secure_Browser_will_now_close.
push str.DisplayConfigDuplicate
jmp 0x4259e5
mov ecx, 0x47e7a8
mov eax, 0x534698
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x427030
test dl, dl
je 0x42702c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x427030
add eax, 2
add ecx, 2
test dl, dl
jne 0x427010
xor eax, eax
jmp 0x427035
sbb eax, eax
or eax, 1
test eax, eax
jne case.0x426328.1285
mov ecx, 0x52abf8
call fcn.004210d0
mov dword [0x561104], 1
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0xf
call fcn.00418b70
push str.You_are_not_allowed_to_use_mulitple_displays._Turn_off_your_extra_display._The_Secure_Browser_will_now_close.
push str.DisplayConfigExtended
jmp 0x4259e5
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
test eax, eax
push edi
mov edx, 2
lea eax, [ebp - 0x1ac]
cmovne ecx, edx
push 0x104
push eax
mov dword [0x561100], ecx
call fcn.00453332
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1ac]
add esp, 0x10
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x63bc], eax
lea eax, [ebp - 0x1ac]
push eax
push 0
push 0xfde9
call edi
mov ecx, dword [0x55e828]
mov eax, 1
cmp dword [0x561cf0], 0
mov esi, dword [ebp - 0x63bc]
push 0
push 3
push dword [0x561100]
cmove ecx, eax
push 0x13
mov dword [0x55e828], ecx
mov ecx, 0x52abf8
push esi
call fcn.0041c080
push str.WM_UNPAUSED_NETWORK_USING_APPS
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov byte [ebp - 0x1ac], 0
cmp dword [0x52b010], 0
je 0x426378
cmp dword [0x561cf0], 0
jne 0x426378
mov ecx, 0x52abf8
call fcn.004210d0
mov dword [0x561104], 1
mov esi, dword [ebx + 0x50]
push 0x479784
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0xf
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___110
jmp 0x4259e0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x401
push 0x40
mov dword [0x561100], 2
call ebx
push edi
mov esi, eax
push 0x400
push esi
mov dword [ebp - 0x63bc], esi
call fcn.00453332
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call ebx
push esi
mov esi, dword [ebp - 0x63bc]
mov ebx, eax
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call edi
push 0
push 3
push dword [0x561100]
mov ecx, 0x52abf8
push 0x14
push ebx
call fcn.0041c080
push str.WM_PAUSED_NETWORK_USING_APPS
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push ebx
call esi
jmp case.0x426328.1285
push dword [0x514990]
call fcn.00448f10
mov ecx, dword [0x561100]
test eax, eax
push edi
mov edx, 2
lea eax, [ebp - 0x3b4]
cmovne ecx, edx
push 0x104
push eax
mov dword [0x561100], ecx
call fcn.00453332
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x3b4]
add esp, 0x10
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov ebx, eax
lea eax, [ebp - 0x3b4]
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
push 0
push 3
push dword [0x561100]
mov ecx, 0x52abf8
push 0x15
push ebx
call fcn.0041c080
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x52b0d4], 0
je case.0x426328.1285
mov ecx, 0x52abf8
call fcn.004210d0
mov esi, dword [ebp - 0x63cc]
push 0x479784
mov esi, dword [esi + 0x50]
mov edi, dword [esi]
call fcn.0040ac60
add esp, 4
push eax
push esi
call dword [edi + 0x14]
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0xf
call fcn.00418b70
push str.An_error_occurred__contact_support_for_assistance___111
jmp 0x4259e0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x427395
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x427379
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x28
push edi
call fcn.0044d09e
add esp, 8
mov al, 1
jmp 0x4259fb
call fcn.0044d487
call fcn.00458530
call fcn.0044e719
nop
invalid