Function at 0x413db0
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Read .ini file
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x484a16
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x684], eax
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x698]
mov dword fs:[0], eax
push 0xffffffffffffffff
lea ebp, [ebx + 0x210]
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.TITLE_UPDATE
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x496f3c
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x103
lea ecx, [esp + 0x181]
push 0
push ecx
mov byte [esp + 0x188], 0
call fcn.0043aba0
add esp, 0xc
lea edx, [esp + 0x17c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x494ffb
lea ecx, [esp + 0x14]
call fcn.00401fb0
push 0x494ffb
lea ecx, [esp + 0x18]
mov dword [esp + 0x6a4], 0
call fcn.00401fb0
push 0x207
lea eax, [esp + 0x289]
push 0
mov byte [esp + 0x6a8], 1
push eax
mov byte [esp + 0x290], 0
call fcn.0043aba0
lea eax, [esp + 0x188]
add esp, 0xc
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413ed0
lea edi, [esp + 0x284]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413ee1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x284]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413f00
mov ecx, dword [str.Version.ini]
mov edx, dword [0x4965d8]
mov dword [eax], ecx
mov ecx, dword [0x4965dc]
mov dword [eax + 4], edx
mov dl, byte [0x4965e0]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x413f5a
push 0x38
push str.http:__www.jansh.com.cn_bankremote_lfbank_version_DF.ini
lea ecx, [esp + 0x18]
call fcn.00402410
push 0x41
push str.http:__www.jansh.com.cn_bankremote_lfbank_LFBank_ETOKEY_CK_DF.dat
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x4140e6
cmp eax, 0xd
jne 0x414009
mov esi, dword [0x4c6ba0]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x413f8a
push 0
mov ecx, 0x4c6ba0
call fcn.00402360
mov esi, dword [0x4c6ba0]
test esi, esi
jne 0x413f92
xor eax, eax
jmp 0x413fa0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413f97
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00402410
mov esi, dword [0x4c6b9c]
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
or ecx, eax
jge 0x413fd2
push 0
mov ecx, 0x4c6b9c
call fcn.00402360
mov esi, dword [0x4c6b9c]
test esi, esi
jne 0x413fe8
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x4140e6
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413ff0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402410
jmp 0x4140e6
cmp eax, 0xc
jne 0x414069
mov edx, dword [0x4c6b58]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x414035
push 0
mov ecx, 0x4c6b58
call fcn.00402360
mov edx, dword [0x4c6b58]
push edx
lea ecx, [esp + 0x14]
call fcn.004024e0
mov edx, dword [0x4c6b54]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x414066
push 0
mov ecx, 0x4c6b54
call fcn.00402360
mov edx, dword [0x4c6b54]
push edx
jmp 0x4140dd
cmp eax, 0xe
jne 0x41408b
push 0
mov ecx, 0x4c6b7c
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, 0x4c6b78
jmp 0x4140d5
cmp eax, 0xb
jne 0x4140ad
push 0
mov ecx, 0x4c6b34
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, 0x4c6b30
jmp 0x4140d5
cmp eax, 0xffffffff
jne 0x4140e6
mov ecx, dword [0x4c0610]
push 0
add ecx, 0x14
call fcn.004023b0
push eax
lea ecx, [esp + 0x14]
call fcn.004024e0
mov ecx, dword [0x4c0610]
add ecx, 0x10
push 0
call fcn.004023b0
push eax
lea ecx, [esp + 0x18]
call fcn.004024e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x284]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x414113
lea edx, [esp + 0x284]
push edx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.before_download_ini
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x496f3c
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push eax
call esi
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x28c]
push ecx
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x414239
lea eax, [esp + 0x284]
push eax
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
push str.UPDATE2
mov eax, dword [ebp + 8]
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x49596c
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414205
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x6a0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x414744
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.download_ini_success
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x496f3c
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x103
lea edx, [esp + 0x79]
push 0
push edx
mov byte [esp + 0x80], 0
call fcn.0043aba0
add esp, 0xc
lea eax, [esp + 0x284]
push eax
push 0x104
lea ecx, [esp + 0x7c]
push ecx
push 0
push str.version
push str.version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x414342
lea edx, [esp + 0x284]
push edx
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x49596c
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call esi
mov byte [esp + 0x6a0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4141f9
mov eax, dword [0x4aff94]
cmp eax, 1
jne 0x414358
lea ecx, [esp + 0x74]
push ecx
mov ecx, str.SOFTWAREJANSHETO_KEY_TRFYCZ
jmp 0x4143a6
cmp eax, 0xd
jne 0x414369
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c0e69
jmp 0x4143a6
cmp eax, 0xc
jne 0x414375
mov ecx, 0x4c0739
jmp 0x4143a1
cmp eax, 0xe
jne 0x414386
lea ecx, [esp + 0x74]
push ecx
mov ecx, str.SOFTWAREEnterSafeInterPass3000_JZHYRB
jmp 0x4143a6
cmp eax, 0xb
jne 0x414397
lea edx, [esp + 0x74]
push edx
mov ecx, 0x4c1599
jmp 0x4143a6
cmp eax, 0xffffffff
jne 0x4143af
mov ecx, str.SOFTWAREJANSHNoKey_LF
lea eax, [esp + 0x74]
push eax
call fcn.00407eb0
test eax, eax
je 0x4143d4
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
push str.VERSION0
jmp 0x4141b3
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.before_download_exe
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x496f3c
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
push 0x44
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x24], 0
call fcn.0043aba0
xor eax, eax
push 0x207
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x4a0], al
lea eax, [esp + 0x4a1]
push eax
mov dword [esp + 0x44], 0x44
call fcn.0043aba0
lea eax, [esp + 0x194]
add esp, 0x18
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414474
lea ecx, [esp + 0x48c]
sub eax, esi
dec ecx
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x414485
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x4aff94]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp eax, 0xd
je 0x4144b6
cmp eax, 0xc
je 0x4144b6
cmp eax, 0xe
je 0x4144b6
cmp eax, 0xb
jne 0x4144eb
lea eax, [esp + 0x48c]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4144c0
mov ecx, dword [str.Require.exe]
mov edx, dword [0x49784c]
mov dword [eax], ecx
mov ecx, dword [0x497850]
mov dword [eax + 4], edx
mov dl, byte [0x497854]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x48c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x414516
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x14]
push 0
push 0
lea eax, [esp + 0x494]
push eax
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x414599
lea edx, [esp + 0x48c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.UPDATE2
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x49596c
push eax
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x414321
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418e9d
mov edx, dword [ebp + 8]
push str.before_run_exe
push edx
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x496f3c
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xbba
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x4ac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x414650
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41469d
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call edi
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.00418c1c
mov edx, dword [ebp + 8]
push str.UpdateDriver
push edx
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push str.UPDATE3
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebp + 8]
push 0x49596c
push ecx
mov ecx, ebp
call fcn.00418e9d
mov edx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push edx
jmp 0x414730
cmp dword [esp + 0x18], 4
push 0xffffffffffffffff
mov ecx, ebp
push 0
jne 0x4146ee
call fcn.00418c1c
mov eax, dword [ebp + 8]
push str.UpdateDriver
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebp + 8]
push str.UPDATE3
push ecx
mov ecx, ebp
call fcn.00418e9d
mov edx, dword [ebp + 8]
push 0x49596c
push edx
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push eax
jmp 0x414730
call fcn.00418c1c
mov ecx, dword [ebp + 8]
push str.UpdateDriver
push ecx
mov ecx, ebp
call fcn.00418e9d
mov edx, dword [ebp + 8]
push str.UPDATE0
push edx
mov ecx, ebp
call fcn.00418e9d
mov eax, dword [ebp + 8]
push 0x49596c
push eax
mov ecx, ebp
call fcn.00418e9d
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xbba
push ecx
call esi
lea ecx, [esp + 0x14]
call fcn.00402660
lea ecx, [esp + 0x10]
call fcn.00402660
xor eax, eax
mov ecx, dword [esp + 0x698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x684]
xor ecx, esp
call fcn.0043671a
add esp, 0x694
ret