Function at 0x4096f0
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Delete file
Download url
Get common file path
Get file version info
Get session user name
Receive data
Reference http user-agent string
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468e40
mov eax, dword fs:[0]
push eax
mov eax, 0x64a0
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0x100
mov dword [0x502da8], edi
mov dword [0x502dac], esi
mov dword [ebp - 0x6460], 0x200
mov dword [ebp - 0x645c], 1
mov dword [0x5194c0], 0
call fcn.0043ee40
push 0x1ffe
mov dword [0x5194c4], eax
lea eax, [ebp - 0x6440]
push 0
push eax
call fcn.00446b20
add esp, 0x10
mov dword [0x503fb4], 0
lea ecx, [ebp - 0x6458]
mov dword [0x503fb8], 0
mov dword [0x502db0], 0
mov dword [0x510000], 0
push 0x16
push str.ITSSecureECLiteBrowser
mov dword [0x510004], 0
mov dword [0x53f3fc], 0
mov dword [0x502db4], 0
mov dword [ebp - 0x6468], 0
mov dword [0x503fc0], esi
mov dword [ebp - 0x6458], 0
mov dword [ebp - 0x6448], 0
mov dword [ebp - 0x6444], 7
call fcn.004095e0
xor esi, esi
nop
push esi
call fcn.00452d00
push esi
call fcn.00452d00
inc esi
add esp, 8
cmp esi, 0x100
jl 0x409800
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x40c6b6
cmp dword [ebp - 0x6444], 8
lea eax, [ebp - 0x6458]
cmovae eax, dword [ebp - 0x6458]
push eax
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push str.User32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
call fcn.00453aad
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [eax], 1
jle 0x40a1c6
mov esi, 1
call fcn.00453aad
cmp dword [eax], esi
jle 0x40a1c6
cmp esi, 1
jne 0x409897
call fcn.00453ab3
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x503fc8
call fcn.00449d78
add esp, 0xc
jmp 0x4098c7
push 0x46ca70
push 0x1ffe
push 0x503fc8
call fcn.00449dd2
call fcn.00453ab3
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x503fc8
call fcn.00449dd2
add esp, 0x18
call fcn.00453ab3
push 4
push 0x46ca74
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409905
call fcn.00453ab3
push 4
push 0x46ca7c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
jne 0x409a8d
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409912
sub ecx, edx
cmp ecx, 4
jbe 0x409a8d
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 4
push eax
push 0x800
push 0x503238
call fcn.00449d78
push 7
push 0x46ca84
push 0x503238
call fcn.00452b0a
add esp, 0x18
test eax, eax
je 0x409a7e
push 8
push 0x46ca8c
push 0x503238
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409a7e
push 0x46ca98
push 0x503238
call fcn.00453ccf
add esp, 8
test eax, eax
je 0x4099dc
sub eax, 0x503238
add eax, 4
push eax
push 0x503238
lea eax, [ebp - 0x630]
push 0x400
push eax
call fcn.00453cb2
lea ecx, [ebp - 0x630]
add esp, 0x10
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099c0
push 0x400
lea eax, [ebp - 0x1240]
push eax
push 8
push 0x46ca8c
jmp 0x409a3b
push 0x46caa0
push 0x503238
call fcn.00453ccf
add esp, 8
test eax, eax
je 0x409a7e
sub eax, 0x503238
add eax, 3
push eax
push 0x503238
lea eax, [ebp - 0x630]
push 0x400
push eax
call fcn.00453cb2
lea ecx, [ebp - 0x630]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a21
push 0x400
lea eax, [ebp - 0x1240]
push eax
push 7
push 0x46ca84
sub ecx, edx
lea eax, [ebp - 0x630]
push ecx
push eax
push 0x400
push 0x503238
mov ecx, 0x53f400
call fcn.00440850
lea eax, [ebp - 0x1240]
push eax
push 0x400
push 0x503238
call fcn.00449d78
lea eax, [ebp - 0x1240]
push eax
call fcn.00449f04
add esp, 0x10
mov dword [0x50ffe4], 1
jmp 0x40a1b8
call fcn.00453ab3
push 4
push 0x46caa4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a162
call fcn.00453ab3
push 4
push 0x46caac
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a162
call fcn.00453ab3
push 9
push 0x46cab4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a110
call fcn.00453ab3
push 9
push 0x46cac0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a110
call fcn.00453ab3
push 8
push 0x46cacc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a101
call fcn.00453ab3
push 8
push 0x46cad8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a101
call fcn.00453ab3
push 0x10
push 0x46cae4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a0c0
call fcn.00453ab3
push 0x10
push 0x46caf8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a0c0
call fcn.00453ab3
push 7
push 0x46cb0c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a00e
call fcn.00453ab3
push 7
push 0x46cb14
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x40a00e
call fcn.00453ab3
push 0x10
push 0x46cb1c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409fbf
call fcn.00453ab3
push 0x10
push 0x46cb30
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409fbf
call fcn.00453ab3
push 0xb
push 0x46cb44
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409f74
call fcn.00453ab3
push 0xc
push 0x46cb54
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409f74
call fcn.00453ab3
push 0x14
push 0x46cb64
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409f2f
call fcn.00453ab3
push 0x14
push str._SBPathForadminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409f2f
call fcn.00453ab3
push 8
push 0x46cb94
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409ee4
call fcn.00453ab3
push 8
push 0x46cba0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409ee4
call fcn.00453ab3
push 7
push 0x46cbac
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409ea3
call fcn.00453ab3
push 7
push str._params
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409ea3
call fcn.00453ab3
push 0x13
push 0x46cbbc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409df8
call fcn.00453ab3
push 0x13
push str._LauncherDeleteOnly
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409df8
call fcn.00453ab3
push 0xf
push 0x46cc3c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
je 0x409da1
call fcn.00453ab3
push 0xf
push str._LauncherDelete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00452b0a
add esp, 0xc
test eax, eax
jne 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409db0
sub ecx, edx
cmp ecx, 0xf
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xf
push eax
push 0x104
push 0x53c83c
call fcn.00449d78
add esp, 0xc
push 0x53c83c
call ebx
mov dword [0x53c838], 0
jmp 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409e05
sub ecx, edx
cmp ecx, 0x13
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x13
push eax
push 0x104
push 0x53c83c
call fcn.00449d78
add esp, 0xc
push 0x53c83c
call ebx
push str.A_shortcut_for_the_Secure_Browser_has_been_created_on_the_desktop
push 0x46cc2c
mov ecx, 0x50fb50
mov dword [0x53c838], 0
call fcn.00418dd0
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x409e9c
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409e92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
xor eax, eax
jmp 0x40c722
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409eb0
sub ecx, edx
cmp ecx, 7
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 7
push eax
push 0x1000
push 0x53b374
call fcn.00449d78
jmp 0x40a1b5
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ef1
sub ecx, edx
cmp ecx, 8
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x104
push 0x51b694
call fcn.00449d78
mov dword [0x51b690], 1
jmp 0x40a1b5
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409f40
sub ecx, edx
cmp ecx, 0x15
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x15
push eax
push 0x104
push 0x50cff8
call fcn.00449d78
jmp 0x40a1b5
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409f81
sub ecx, edx
cmp ecx, 0xc
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 9
push eax
push 0x104
push 0x50ade8
call fcn.00449d78
mov dword [0x50ade4], 1
jmp 0x40a1b5
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409fd0
sub ecx, edx
cmp ecx, 0x10
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x10
push eax
push 0x104
push 0x53c374
call fcn.00449d78
mov dword [0x50ade0], 1
jmp 0x40a1b5
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a020
sub ecx, edx
cmp ecx, 7
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 7
push eax
lea eax, [ebp - 0x334]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call fcn.00408630
add esp, 4
test eax, eax
je 0x40a054
push 0
mov ecx, 0x50fb50
mov dword [0x51b798], 0
call fcn.004192f0
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x409e9c
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409e92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
jmp 0x409e92
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a0d0
sub ecx, edx
cmp ecx, 0x10
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x10
push eax
push 0x64
push 0x5145f0
call fcn.00449d78
jmp 0x40a1b5
mov dword [ebp - 0x645c], 0
jmp 0x40a1b8
mov dword [0x50fff8], 1
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a127
sub ecx, edx
cmp ecx, 9
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 9
push eax
push 0x104
push 0x511c10
call fcn.00449d78
mov dword [0x50ffec], 1
jmp 0x40a1b5
mov dword [0x50fff4], 1
call fcn.00453ab3
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a180
sub ecx, edx
cmp ecx, 4
jbe 0x40a1b8
call fcn.00453ab3
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 4
push eax
push 0x104
push 0x512e94
call fcn.00449d78
mov dword [0x50fff0], 1
add esp, 0xc
inc esi
call fcn.00453aad
cmp esi, dword [eax]
jl 0x409874
push 0x80
push 0x503af8
mov ecx, 0x4961a8
call fcn.0040e810
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x104
push 0x51a23c
push edi
call esi
push 0x51a23c
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push 0x104
push 0x50cde8
call fcn.00407d30
add esp, 0xc
lea eax, [ebp - 0x64ac]
push eax
push 0x51a23c
call sub.VERSION.dll_GetFileVersionInfoSizeA
push eax
push 0x2040
mov dword [ebp - 0x6460], eax
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
push ebx
push dword [ebp - 0x6460]
mov dword [ebp - 0x18], ebx
push 0
push 0x51a23c
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x6460]
push eax
lea eax, [ebp - 0x646c]
push eax
push 0x46c7d0
push ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x646c]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x46cc5c
push 0x512a14
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [0x50369c], edi
lea eax, [ebp - 0x734]
push 0x104
push eax
push 0
call esi
lea eax, [ebp - 0x93c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x93c]
lea ecx, [ecx + 1]
mov byte [ecx + 0x50d0ff], al
test al, al
jne 0x40a2c0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x734]
lea ecx, [ecx + 1]
mov byte [ecx + 0x50d203], al
test al, al
jne 0x40a2e0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x734]
lea ecx, [ecx + 1]
mov byte [ecx + 0x53c4ff], al
test al, al
jne 0x40a300
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x50d0fc], 0
nop dword [eax]
nop word [eax + eax]
imul eax, eax, 0x104
mov ecx, 0x50fb40
add eax, 0x50d100
push eax
push 0x104
push 0x50f920
call fcn.004106d0
mov eax, dword [0x5194e0]
xorps xmm0, xmm0
mov dword [ebp - 0x64a0], eax
lea eax, [ebp - 0x64a8]
push eax
movlpd qword [ebp - 0x6484], xmm0
movlpd qword [ebp - 0x647c], xmm0
movlpd qword [ebp - 0x6474], xmm0
mov dword [ebp - 0x64a8], 0x3c
mov dword [ebp - 0x64a4], 0x400
mov dword [ebp - 0x649c], 0
mov dword [ebp - 0x6498], 0x50f920
mov dword [ebp - 0x6494], 0x46c510
mov dword [ebp - 0x6490], 0
mov dword [ebp - 0x648c], 5
mov dword [ebp - 0x6488], 0
call ebx
push 0xffffffffffffffff
push dword [ebp - 0x6470]
call esi
push dword [ebp - 0x6470]
call edi
mov ecx, 0x50fb50
call fcn.00419240
test eax, eax
jne 0x40a485
mov eax, dword [0x50d0fc]
inc dword [0x50d40c]
inc eax
mov dword [0x50d0fc], eax
cmp eax, 3
jl 0x40a340
push 0x51a23c
push str._SBLocation_
push str.To_use_Secure_Browser_you_must_have_write_execute_access_to_one_of_the_following_locations:_r_n_C:UsersYourUserNameAppDataLocalTemp_r_n_or__SBLocation_.
push str.NoFolderAccess
mov ecx, 0x50fb50
call fcn.00418f60
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x40a47b
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a471
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, 0xb
jmp 0x40c722
imul eax, dword [0x50d0fc], 0x104
mov edx, 0x53c500
lea ecx, [eax + 0x50d100]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x40a4a0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push 0
push 0x50f920
push 0x46cd24
push 0
call edi
push 0x53c500
push 0x512a14
push 0x104
lea eax, [ebp - 0x230]
mov ecx, 0x50fb40
push eax
call fcn.00410960
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x502db0], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 1
push dword [0x502db0]
call fcn.0043fba0
push 0x46d8f0
push dword [0x502db0]
call fcn.004403a0
push 0x46d908
push dword [0x502db0]
call fcn.004403a0
push 0x46d9ac
push dword [0x502db0]
call fcn.004403a0
add esp, 0x20
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x230]
lea ecx, [ecx + 1]
mov byte [ecx + 0x50fa27], al
test al, al
jne 0x40a550
push 0x51a23c
mov ecx, 0x50fb50
call fcn.00416000
mov dword [0x50f91c], eax
mov ecx, 0x50fb50
test eax, eax
jne 0x40a590
call fcn.00419240
call fcn.00408310
jmp 0x409e5c
lea eax, [ebp - 0x230]
push eax
call fcn.00416000
mov dword [0x50f91c], eax
mov ecx, 0x50fb50
test eax, eax
jne 0x40a5b9
call fcn.00419240
call fcn.00408310
jmp 0x409e5c
push 0x51ac3c
call fcn.00414660
push 0x51ac3c
mov ecx, 0x50fb50
call fcn.00416000
mov dword [0x50f91c], eax
test eax, eax
jne 0x40a5ef
mov ecx, 0x50fb50
call fcn.00419240
call fcn.00408310
jmp 0x409e5c
push 0x53c500
push 0x104
push 0x51b510
mov ecx, 0x50fb40
call fcn.0040fd70
push 0x51b510
mov ecx, 0x50fb50
call fcn.00416000
mov dword [0x50f91c], eax
test eax, eax
jne 0x40a634
mov ecx, 0x50fb50
call fcn.00419240
call fcn.00408310
jmp 0x409e5c
call sub.KERNEL32.DLL_GetCurrentProcessId
push 0x80
mov ebx, eax
mov ecx, 0x4d0d7c
push 0x503b78
mov dword [ebp - 0x6464], ebx
call fcn.00407980
push 0x50cde8
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
test eax, eax
jne 0x40c693
push 0x50cde8
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov ecx, 0x4961a8
call fcn.0040ed30
push 0x200
lea eax, [ebp - 0x3c40]
push eax
push dword [0x502db0]
call fcn.0043fbc0
mov dword [0x50a1d4], eax
lea eax, [ebp - 0x4040]
push 0x200
push eax
push dword [0x502db0]
call fcn.0043fc40
mov dword [0x50add8], eax
lea eax, [ebp - 0x4440]
push 0x200
push eax
push dword [0x502db0]
call fcn.0043fbf0
push 0x200
push 0x5195ac
push ebx
push dword [0x502db0]
mov dword [0x50addc], eax
call fcn.0043fcf0
add esp, 0x34
mov ecx, 0x53f400
call fcn.004409d0
push ebx
push 0x46cd74
push dword [0x502db0]
call fcn.004403a0
push 0x512a14
push 0x46cd94
push dword [0x502db0]
call fcn.004403a0
call fcn.004090e0
push dword [0x50376c]
push dword [0x503770]
push dword [0x503704]
push 0x46cdb0
push 0x80
push 0x503778
call fcn.00407d30
push 0x503778
push 0x46cdbc
push dword [0x502db0]
call fcn.004403a0
push 0x46cdcc
push dword [0x502db0]
call fcn.004403a0
add esp, 0x44
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push eax
push dword [0x502db0]
mov dword [0x503774], eax
call fcn.0043fcb0
push str.before_MAC_Address
push dword [0x502db0]
call fcn.004403a0
add esp, 0x10
lea eax, [ebp - 0x1440]
push 0
push 0
push 0x200
push eax
mov eax, dword [0x503774]
push 0xffffffffffffffff
push dword [eax + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push dword [0x503774]
mov ebx, dword [sym.imp.KERNEL32.DLL_GlobalFree]
call ebx
lea eax, [ebp - 0x1440]
push eax
push 0x46ce00
push dword [0x502db0]
call fcn.004403a0
push str.after_MAC_Address
push dword [0x502db0]
call fcn.004403a0
push 0x200
lea eax, [ebp - 0xe40]
push eax
push dword [0x502db0]
call fcn.0043fc20
lea eax, [ebp - 0xe40]
push eax
push 0x46ce28
push dword [0x502db0]
call fcn.004403a0
push dword [0x502db0]
call fcn.00440400
test eax, eax
mov edx, 0x46c510
mov ecx, 0x46ce40
push 0x28
cmove ecx, edx
push ecx
push 0x28
push 0x503f78
call fcn.00449eee
add esp, 0x40
push 0x5037f8
push 0x46ce48
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
lea eax, [ebp - 0x6460]
push eax
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xc40]
push eax
push 0x46ce60
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
push dword [ebp - 0x18]
call ebx
mov ecx, 0x50fb40
call fcn.0040f8b0
mov ecx, 0x502da0
mov dword [0x50ff90], eax
call fcn.00407e00
push 0x53c608
mov ecx, 0x50fb50
mov dword [0x50ff58], eax
call fcn.00414540
mov ecx, 0x50fb50
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a8e0
sub ecx, edx
jne 0x40a91c
push 0x400
push 0x50fb50
push str.UPDATEURL
push 0x94
mov ecx, 0x50fb40
call fcn.004102e0
push 0x46ce80
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov ecx, 0x50fb50
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a924
mov eax, dword [0x50ffa4]
sub ecx, edx
push 0x400
xor edx, edx
test ecx, ecx
push 0x513d8c
push str.ERRORURL
cmovne eax, edx
mov ecx, 0x50fb40
push 0xa1
mov dword [0x50ffa4], eax
call fcn.004102e0
mov ecx, 0x50fb50
call fcn.004144e0
push eax
push 0x46ceb4
push 0x64
push 0x5147e4
call fcn.00407d30
push 0x5147e4
push dword [0x502db0]
call fcn.004403a0
add esp, 0x18
mov ecx, 0x4d0d7c
push 0x512f98
call fcn.00407790
push eax
push 0x46cec4
push 0x64
push 0x514780
call fcn.00407d30
push 0x514780
push dword [0x502db0]
call fcn.004403a0
add esp, 0x18
mov ecx, 0x4d0d7c
push 0x512ffc
call fcn.00407750
push eax
push 0x46ced8
push 0x64
push 0x5146b8
call fcn.00407d30
push 0x5146b8
push dword [0x502db0]
call fcn.004403a0
push 0x64
push 1
call fcn.00449ef9
add esp, 0x20
mov dword [0x4d0d7c], eax
mov ecx, 0x50fb40
call fcn.0040f570
push str.After_extracting_institution_Id
push dword [0x502db0]
mov dword [0x5194cc], eax
call fcn.004403a0
push dword [0x5194cc]
push 0x46c744
push 0x64
push dword [0x4d0d7c]
call fcn.00407d30
add esp, 0x18
mov ecx, 0x4d0d7c
call fcn.00407870
push eax
push 0x46cf08
push 0x64
push 0x51471c
call fcn.00407d30
add esp, 0x10
mov ecx, 0x4d0d7c
call fcn.00407870
push eax
push 0x46cf08
push 0x64
push 0x513128
call fcn.00407d30
add esp, 0x10
mov ecx, 0x4d0d7c
push 0x5130c4
call fcn.004078d0
push eax
push 0x46cf1c
push 0x64
push 0x513060
call fcn.00407d30
add esp, 0x10
cmp dword [0x50ffa4], 0
je 0x40aaef
push 0x400
push 0x502e38
push 0x46cf28
push 0x75
mov ecx, 0x50fb40
call fcn.004102e0
push str.local_configuration
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov ecx, 0x50fb40
push 0x400
push 0x512a94
push str.ALTURL
push 0x7c
call fcn.004102e0
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
mov ecx, 0x4961a8
call fcn.0040eb60
mov ecx, 0x4961a8
call fcn.0040ef40
push dword [0x502db0]
call fcn.0043ff40
add esp, 4
test eax, eax
je 0x40ab4a
mov ecx, 0x4961a8
call fcn.0040ebe0
mov ecx, 0x4961a8
call fcn.0040ead0
mov ecx, 0x4961a8
call fcn.0040efd0
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ffa4], 0
jne 0x40abe5
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
mov ecx, 0x50fb50
call fcn.004135e0
push 0
push 0x5039fc
push 0
call sub.urlmon.dll_CoInternetCreateZoneManager
test eax, eax
js 0x40abd9
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
push 0
push 0x512114
push 0x50fb50
mov ecx, 0x53f408
call fcn.00443780
mov ecx, 0x50fb50
call fcn.00411ee0
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
jmp 0x40abef
mov dword [ebp - 0x6468], 1
jmp 0x40abef
mov ecx, 0x50fb50
call fcn.00416dd0
mov eax, dword [0x53c838]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x40ac0a
push 0x53c83c
call esi
mov dword [0x53c838], eax
cmp dword [0x50ffe8], 0
jne 0x40c63a
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff54], 0
jne 0x40ac81
cmp dword [0x50ff58], 0
jne 0x40ac81
push 0x46d848
push 0x46d8b4
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov dword [0x51b798], 8
mov ecx, 0x50fb50
mov dword [0x503fb0], 1
push 8
call fcn.004192f0
jmp 0x40c5e9
cmp dword [ebp - 0x645c], 0
je 0x40acab
push 0x512994
push 0x512914
push 0x512a14
mov ecx, 0x50fb50
call fcn.00414720
test eax, eax
jne 0x40bfc8
cmp dword [0x502db0], 0
mov dword [ebp - 0x645c], 0
je 0x40bfc8
cmp dword [0x50ffa4], 0
je 0x40acee
mov ecx, 0x50fb40
call fcn.00410040
push eax
push str.sBrowserEngineId_from_Local_Config____d
push dword [0x502db0]
mov dword [0x53c478], eax
call fcn.004403a0
add esp, 0xc
mov eax, dword [0x53c478]
cmp eax, 1
jne 0x40aec9
mov ecx, 0x50fb50
call fcn.00419240
push 0x503fc8
push 0x1ffe
push 0x50d410
call fcn.00449d78
push 0x53c500
push dword [0x50ffa4]
push 0x104
push 0x50f410
call fcn.00408850
push 0x50f410
push str.ExtractSB____s
push dword [0x502db0]
call fcn.004403a0
add esp, 0x28
mov ecx, 0x50fb50
push 0x50f410
call fcn.00416000
mov dword [0x50f91c], eax
test eax, eax
jne 0x40ad78
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
jmp 0x409e5c
push 0x50f410
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x46c7d0
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449dd2
push 0x46cf80
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449dd2
add esp, 0x18
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40adf9
push 0x53c500
push 0x104
lea eax, [ebp - 0x12c]
mov ecx, 0x50fb40
push eax
call fcn.004106d0
push 1
push 0
push 0
lea eax, [ebp - 0x12c]
push eax
push 0x46cd24
push 0
call edi
push str.__updateUrl_
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x519db8
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push str.___filePath_
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x51a23c
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x46cfb8
push 0x1ffe
push 0x50d410
call fcn.00449dd2
add esp, 0x3c
push 1
push 0
push 0x50d410
push 0x50f410
push 0x46cd24
push 0
call edi
push 0x50f410
push str.After_shell_execute_SB_lite____s
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
cmp dword [0x53c838], 0
jne 0x40aeba
push 0x53c83c
call esi
mov dword [0x53c838], eax
mov ecx, 0x50fb50
call fcn.00411700
jmp 0x40b316
cmp eax, 4
je 0x40aed7
cmp eax, 5
jne 0x40b360
call fcn.004089b0
test eax, eax
jne 0x40b360
cmp dword [0x53c478], 4
mov ecx, 0x50fb50
jne 0x40b13e
push str.Installation_Required__The_Secure_Browser_requires_that_Microsoft_Edge_Runtime_be_installed_on_this_device._This_installation_will_require_administrative_privileges._Click_OK_to_exit_the_Secure_Browser_and_proceed_with_the_installation.
push str.EdgeInstallerRequest
call fcn.00418a20
test eax, eax
je 0x40b0ae
xor esi, esi
push esi
push esi
push str..MicrosoftEdgeWebview2Setup.exe
push str.https:__go.microsoft.com_fwlink_p__LinkId2124703
push esi
mov dword [ebp - 0x645c], esi
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x40aff8
xorps xmm0, xmm0
mov dword [ebp - 0x64a8], 0x3c
lea eax, [ebp - 0x64a8]
movlpd qword [ebp - 0x6484], xmm0
push eax
movlpd qword [ebp - 0x647c], xmm0
movlpd qword [ebp - 0x6474], xmm0
mov dword [ebp - 0x64a4], 0x100
mov dword [ebp - 0x64a0], esi
mov dword [ebp - 0x649c], 0x46dc6c
mov dword [ebp - 0x6498], str.MicrosoftEdgeWebview2Setup.exe
mov dword [ebp - 0x6494], str.__silent__install
mov dword [ebp - 0x6490], esi
mov dword [ebp - 0x648c], esi
mov dword [ebp - 0x6488], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40aff8
mov edi, dword [ebp - 0x645c]
test edi, edi
je 0x40afcf
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x645c]
mov dword [ebp - 0x645c], 0
push eax
push 0
call fcn.004015e0
mov edi, dword [ebp - 0x645c]
test edi, edi
je 0x40afcf
mov esi, 1
jmp 0x40affe
mov edi, dword [ebp - 0x645c]
test edi, edi
je 0x40b017
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x40b360
push str.The_installation_failed._Administrative_privileges_are_required_to_complete_the_installation.
push str.EdgeInstallerFailed
mov ecx, 0x50fb50
call fcn.00418dd0
mov ecx, 0x50fb50
call fcn.00419240
mov eax, dword [0x4960a0]
mov ecx, 0x50fb50
push eax
mov dword [0x51b798], eax
call fcn.004192f0
call fcn.00408310
mov ecx, 0x50fb50
call fcn.00411700
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x4960a0]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b09d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
mov ecx, 0x50fb50
call fcn.00419240
mov eax, dword [0x4960a0]
mov ecx, 0x50fb50
push eax
mov dword [0x51b798], eax
call fcn.004192f0
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
cmp dword [0x53c838], 0
jne 0x40b0f1
push 0x53c83c
call esi
mov dword [0x53c838], eax
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x4960a0]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b12d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
call fcn.00419240
push 0x503fc8
push 0x1ffe
push 0x50d410
call fcn.00449d78
push 0x50f410
push str.BeforeExtractSB____s
push dword [0x502db0]
call fcn.004403a0
push 0x53c500
push dword [0x50ffa4]
push 0x104
push 0x50f410
call fcn.00408850
push 0x50f410
push str.ExtractSB____s
push dword [0x502db0]
call fcn.004403a0
add esp, 0x34
mov ecx, 0x50fb50
push 0x50f410
call fcn.00416000
mov dword [0x50f91c], eax
test eax, eax
jne 0x40b1ca
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
jmp 0x409e5c
push 0x50f410
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449d78
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x46c7d0
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449dd2
push 0x46cf80
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.00449dd2
add esp, 0x18
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40b24b
push 0x53c500
push 0x104
lea eax, [ebp - 0x12c]
mov ecx, 0x50fb40
push eax
call fcn.004106d0
push 1
push 0
push 0
lea eax, [ebp - 0x12c]
push eax
push 0x46cd24
push 0
call edi
push str.__updateUrl_
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x519db8
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push str.___filePath_
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x51a23c
push 0x1ffe
push 0x50d410
call fcn.00449dd2
push 0x46cfb8
push 0x1ffe
push 0x50d410
call fcn.00449dd2
add esp, 0x3c
push 1
push 0
push 0x50d410
push 0x50f410
push 0x46cd24
push 0
call edi
push 0x50f410
push str.After_shell_execute_SB_lite____s
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
mov ecx, 0x50fb50
call fcn.00411700
cmp dword [0x53c838], 0
jne 0x40b316
push 0x53c83c
call esi
mov dword [0x53c838], eax
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x40b356
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b34c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, 2
jmp 0x40c722
mov ecx, 0x50fb40
call fcn.00410850
push 0x100
call fcn.0044426b
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40b3e8
sub esp, 0x28
mov ecx, esp
push 0
push 0
push 0xffffffffffffffff
push 0x46d174
push 0
push 3
mov dword [ecx + 0x24], 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x40b3d3
push edi
push esi
push 0xffffffffffffffff
push 0x46d174
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, edi
je 0x40b3d3
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
push 0
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00407f70
mov ecx, dword [ebp - 0x18]
call fcn.0041a0b0
cmp dword [0x50fb34], 0
mov edi, dword [0x5194e0]
jne 0x40b432
push 0x46dd80
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40b432
push 0x46dd8c
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40b427
push 0
push edi
call eax
mov dword [0x50fb34], 1
mov edi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push esi
call edi
jmp 0x40b438
mov edi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, 0x4961a8
call fcn.0040e7a0
cmp dword [0x496390], 1
jne 0x40b4e3
lea eax, [ebp - 0x334]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
je 0x40b4e3
push str.ITSAutomation.log
lea eax, [ebp - 0x334]
push 0x104
push eax
call fcn.00449dd2
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x334]
mov ecx, 0x50fb50
push eax
call fcn.00411cc0
push 0x46d194
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x645c]
push eax
call fcn.00453b70
add esp, 0xc
test eax, eax
jne 0x40b4e3
push dword [0x5194e0]
push 0x46d198
push dword [ebp - 0x645c]
call fcn.0040c750
push dword [ebp - 0x645c]
call fcn.00453c2e
add esp, 0x10
push str.Before_checking_VM
push dword [0x502db0]
call fcn.004403a0
add esp, 8
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
push 0x64
push 0x503a00
push dword [0x502db0]
call fcn.0043ff10
push str.After_checking_VM
push dword [0x502db0]
mov dword [0x510000], eax
call fcn.004403a0
push dword [0x502db0]
call fcn.0043feb0
push str.After_checking_RDP
push dword [0x502db0]
mov dword [0x510004], eax
call fcn.004403a0
add esp, 0x20
cmp dword [0x510000], 0
je 0x40b570
push 0x46d1d8
push 0x10
push 0x503fa0
call fcn.00449d78
add esp, 0xc
jmp 0x40b596
cmp dword [0x510004], 0
je 0x40b58f
push 0x46d1e0
push 0x10
push 0x503fa0
call fcn.00449d78
add esp, 0xc
jmp 0x40b596
mov byte [0x503fa0], 0
cmp dword [0x50ffd8], 0
je 0x40b638
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff90], 0
je 0x40b5d1
push 0x46d1f0
push 0xa
push 0x49608c
call fcn.00449d78
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x503f78
push 0x511810
push 0x49608c
push 0x512a14
push str._SecureBrowser__s__s__s_s
push 0x51418c
call esi
push 0x51418c
push 0x46d218
push dword [0x502db0]
call fcn.004403a0
push 0x511810
push 0x49608c
push 0x46d23c
push 0x51398c
call esi
mov esi, dword [sym.imp.KERNEL32.DLL_GlobalFree]
add esp, 0x34
push dword [0x503ac8]
call esi
jmp 0x40b6fd
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x50a1d4]
call fcn.00454128
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x50add8]
call fcn.00454128
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x50addc]
call fcn.00454128
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
add esp, 0x24
cmp dword [0x50ffa4], 0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x503f78
push 0x503fa0
jne 0x40b6ce
push 0x511810
push 0x49608c
push 0x512a14
push 0x503b78
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s__s_s__s__DKM:_s._s._s
push 0x51418c
call esi
push 0x511810
push 0x49608c
push 0x46d23c
push 0x51398c
call esi
add esp, 0x3c
jmp 0x40b6fd
push 0x49608c
push 0x512a14
push 0x503b78
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s_s__s__DKM:_s._s._s
push 0x51418c
call esi
push 0x49608c
push 0x46c878
push 0x51398c
call esi
add esp, 0x34
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
push dword [ebp - 0x6464]
push 0x46d330
push dword [0x502db0]
call fcn.004403a0
push 0x512a14
push 0x46cd94
push dword [0x502db0]
call fcn.004403a0
call fcn.004090e0
push dword [0x50376c]
push dword [0x503770]
push dword [0x503704]
push 0x46cdb0
push 0x80
push 0x503778
call fcn.00407d30
push 0x503778
push 0x46cdbc
push dword [0x502db0]
call fcn.004403a0
push 0x46cdcc
push dword [0x502db0]
call fcn.004403a0
add esp, 0x44
lea eax, [ebp - 0xe40]
push eax
push 0x46ce00
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
lea eax, [ebp - 0x6460]
push eax
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xc40]
push eax
push 0x46ce60
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
mov ecx, 0x50fb50
call fcn.00418120
mov ecx, 0x50fb50
call fcn.004184d0
mov ecx, 0x50fb50
call fcn.00417ad0
mov ecx, 0x50fb50
call fcn.00417c70
mov ecx, 0x50fb50
call fcn.00417fb0
mov ecx, 0x50fb50
call fcn.00417e10
mov ecx, 0x50fb50
call fcn.004179a0
cmp dword [0x50ffc4], 0
je 0x40b840
push dword [0x51ab1c]
mov ecx, 0x50fb50
push 0x51a34c
push 0
push dword [0x50cff4]
call fcn.00411130
cmp dword [0x50ffa4], 0
je 0x40b855
mov ecx, 0x50fb40
call fcn.0040f710
jmp 0x40b85a
mov eax, dword [0x5194c8]
push 0
push 0
push 0x405
push dword [0x503fc4]
mov dword [0x503ad0], eax
call ebx
push dword [0x503ad0]
push dword [0x502db0]
call fcn.00440330
push dword [0x50ff78]
push dword [0x502db0]
call fcn.0043fa40
push dword [0x50ff70]
push dword [0x502db0]
call fcn.0043fac0
push dword [0x50ff94]
push dword [0x502db0]
call fcn.0043fa20
push dword [0x50ff7c]
push dword [0x502db0]
call fcn.0043f9e0
push dword [0x50ff84]
push dword [0x502db0]
call fcn.0043fb00
push dword [0x50ff80]
push dword [0x502db0]
call fcn.0043fae0
push dword [0x50ffa0]
push dword [0x502db0]
call fcn.0043f9a0
add esp, 0x40
push dword [0x50ff88]
push dword [0x502db0]
call fcn.0043fb20
add esp, 8
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
push dword [0x50ffa8]
push dword [0x502db0]
call fcn.0043f9c0
push dword [0x50ffac]
push dword [0x502db0]
call fcn.0043fa60
push dword [0x50ffb0]
push dword [0x502db0]
call fcn.0043fa00
push dword [0x50ffb4]
push dword [0x502db0]
call fcn.0043fb80
push dword [0x50ff6c]
push dword [0x502db0]
call fcn.0043faa0
push dword [0x50ff68]
push dword [0x502db0]
call fcn.0043fa80
push dword [0x50ffcc]
push dword [0x502db0]
call fcn.0043fb40
add esp, 0x38
push 0
push 0
push 0x10
push dword [0x50f918]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x5194e0]
test eax, eax
je 0x40bfc0
push 0
push 0
push 0x405
push dword [0x503fc4]
mov dword [0x503ad4], eax
call ebx
cmp dword [0x50ffe4], 0
je 0x40ba22
mov ecx, 0x46c510
mov eax, 0x53b374
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ba02
test dl, dl
je 0x40b9fe
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ba02
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b9e2
xor eax, eax
jmp 0x40ba07
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ba22
push 0x503238
push 0x400
push 0x502e38
call fcn.00449d78
add esp, 0xc
push 1
push 0x53f408
push 0x502e38
mov ecx, 0x53f408
call fcn.00443780
mov ecx, 0x53f408
call fcn.00443a70
mov ecx, 0x53f408
call fcn.00443890
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff50], 0
je 0x40ba86
push 4
push 0x5194d4
push 0x51
push 0
mov dword [0x5194d4], 3
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [0x510008], eax
cmp dword [0x50ffb4], 0
je 0x40bac3
push 0x46d348
push dword [0x502db0]
call fcn.004403a0
push dword [0x5194e0]
push dword [0x502db0]
call fcn.00440310
push 0x46d364
push dword [0x502db0]
call fcn.004403a0
add esp, 0x18
push dword [0x5194e0]
push dword [0x502db0]
call fcn.0043fc70
push 4
push dword [0x502db0]
call fcn.004402d0
add esp, 0x10
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff64], 0
jne 0x40bb1a
push 0x64
push 0x503a00
push dword [0x502db0]
call fcn.0043ff10
add esp, 0xc
mov dword [0x510000], eax
jmp 0x40bb24
mov dword [0x510000], 0
cmp dword [0x50ffdc], 0
jne 0x40bb42
push dword [0x502db0]
call fcn.0043feb0
add esp, 4
mov dword [0x510004], eax
jmp 0x40bb4c
mov dword [0x510004], 0
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff8c], 0
jne 0x40bd5c
cmp dword [0x50ff64], 0
jne 0x40bc51
cmp dword [0x510000], 0
je 0x40bc51
push 0
push 0
push 1
push 2
push 0x503a00
mov ecx, 0x50fb50
mov dword [0x53c604], 1
call fcn.004153d0
push 0x46d384
push 0x46d3c0
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov ecx, 0x50fb50
call fcn.00419240
push 7
mov ecx, 0x50fb50
mov dword [0x51b798], 7
mov dword [0x503fb0], 1
call fcn.004192f0
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x51b798]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bc40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
cmp dword [0x50ffdc], 0
mov eax, dword [0x503fb0]
jne 0x40bd43
cmp dword [0x510004], 0
je 0x40bd43
test eax, eax
jne 0x40bd43
push eax
push eax
push 1
push 3
push 0x46d3d4
mov ecx, 0x50fb50
mov dword [0x53c604], 1
call fcn.004153d0
push 0x46d3e0
push 0x46d42c
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov ecx, 0x50fb50
call fcn.00419240
push 7
mov ecx, 0x50fb50
mov dword [0x51b798], 7
mov dword [0x503fb0], 1
call fcn.004192f0
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x51b798]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bd32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
cmp dword [0x50ade4], 0
jne 0x40bd79
test eax, eax
jne 0x40bd79
mov ecx, 0x50fb50
call fcn.00411370
jmp 0x40bd79
push str.Default_value_set
push dword [0x502db0]
mov dword [0x51b614], 1
call fcn.004403a0
add esp, 8
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
cmp dword [0x50ff8c], 0
jne 0x40be9a
cmp dword [0x51a348], 2
je 0x40bdb2
mov ecx, 0x50fb50
call fcn.00413230
test eax, eax
jne 0x40be9a
cmp dword [0x50ade4], 0
je 0x40bdcd
mov ecx, 0x50fb50
call fcn.00413230
test eax, eax
jne 0x40be9a
mov ecx, 0x50fb50
call fcn.00419240
push 0x46c850
push dword [0x502db0]
call fcn.004403a0
push dword [0x5194e0]
push dword [0x502db0]
call fcn.0043ffb0
push 0x46c864
push dword [0x502db0]
call fcn.004403a0
add esp, 0x18
mov dword [0x51b798], 5
mov ecx, 0x50fb50
push 5
call fcn.004192f0
mov ecx, 0x50fb50
call fcn.00411700
call fcn.00408310
cmp dword [0x53c838], 0
jne 0x40be49
push 0x53c83c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [0x53c838], eax
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x51b798]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40be89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
push 0
push 0
push 0x405
push dword [0x503fc4]
mov dword [0x502db4], 1
call ebx
push 0
push 0
push 0x405
push dword [0x503fc4]
call ebx
push 0x46d458
push dword [0x502db0]
call fcn.004403a0
add esp, 8
push 0
push 0
push 0x10
push dword [0x503fc4]
call ebx
push 0
push 0x408d10
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov ecx, 0x50fb50
call fcn.00419240
push dword [0x53daec]
push str.webViewCreated_before_runmessagepump__d
push dword [0x502db0]
call fcn.004403a0
push dword [0x503fbc]
push str.startUrlLoaded_before_runmessagepump__d
push dword [0x502db0]
call fcn.004403a0
call fcn.00409160
mov eax, dword [0x503fb0]
mov ecx, 1
cmp dword [0x51b798], 0
cmove eax, ecx
push eax
push str.quitCode__d
push dword [0x502db0]
mov dword [0x503fb0], eax
call fcn.004403a0
add esp, 0x24
cmp dword [0x53c838], 0
jne 0x40bf79
push 0x53c83c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [0x53c838], eax
mov ecx, 0x50fb50
call fcn.00411df0
push 0x46d4d0
push dword [0x502db0]
call fcn.004403a0
add esp, 8
push dword [0x502db0]
call edi
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x6468], 0
je 0x40c4c1
push 0x46d60c
push 0x46d638
jmp 0x40c4d4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x40bf9e
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x645c], 0
je 0x40bfa4
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0xa40]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x50fb50
push 0x3ff
push 0x400
push 0x511d14
call fcn.00407cf0
mov ecx, 0x5147e4
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c016
push 0x400
push 0x511d14
sub ecx, edx
push ecx
push 0x5147e4
push 0xf
push 0x46d4e4
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
mov ecx, 0x514780
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c052
push 0x400
push 0x511d14
sub ecx, edx
push ecx
push 0x514780
push 0x13
push 0x46d4f4
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
mov ecx, 0x5146b8
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c090
push 0x400
push 0x511d14
sub ecx, edx
push ecx
push 0x5146b8
push 0x11
push 0x46d508
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
mov ecx, 0x51471c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c0d0
push 0x400
push 0x511d14
sub ecx, edx
push ecx
push 0x51471c
push 0x13
push 0x46d51c
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
mov ecx, 0x513060
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c110
push 0x400
push 0x511d14
sub ecx, edx
push ecx
push 0x513060
push 0x10
push 0x46d530
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
push 0x400
push 0x511d14
push 1
push 0x46c510
push 8
push 0x46d544
push 0x400
push 0x511d14
mov ecx, 0x53f400
call fcn.00440850
mov ecx, 0x511d14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c178
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x511d14
call fcn.00449dd2
add esp, 0xc
mov ecx, 0x50fb50
push 0
push 0
push str.cmddownload
push 0x46d560
push 0x511d14
push 0x400
push 0x50f518
call fcn.00413b00
mov ecx, 0x50f518
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c1c6
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x50f518
call fcn.00449dd2
mov ebx, dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
add esp, 0xc
push 0x401
push 0x40
call ebx
mov esi, eax
mov ecx, 0x50fb50
push esi
push 0x50f518
call fcn.00419c00
push esi
push 0x46d564
push 0x1ff
lea eax, [ebp - 0x1840]
push 0x200
push eax
call fcn.00407cf0
add esp, 0x14
push 0x2a
push 0x40
call ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [0x50f514], eax
call esi
push dword [0x50f514]
lea eax, [ebp - 0x1840]
mov ecx, 0x50fb50
push eax
call fcn.004164a0
push 0x46d59c
push 0x400
push 0x511d14
call fcn.00449dd2
push dword [0x50f514]
push 0x400
push 0x511d14
call fcn.00449dd2
add esp, 0x18
push dword [0x50f514]
call esi
push 0x511d14
push 0x3ff
push 0x400
push 0x50fb50
call fcn.00407cf0
add esp, 0x10
lea eax, [ebp - 0x6440]
mov ecx, 0x53f400
push 0x1ffe
push eax
push 9
push 0x46d5a4
push 4
push 0x46ca74
push 0x1ffe
push 0x503fc8
call fcn.00440850
lea eax, [ebp - 0x6440]
push eax
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449d78
push 0x46ca70
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push str._url_
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push 0x50fb50
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push str.___exe_
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
add esp, 0x48
lea eax, [ebp - 0x3840]
push str.___updateversion_
push 0x1ffe
push eax
call fcn.00449dd2
push 0x512914
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push str.___minversion_
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push 0x512994
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
push str.___exitmessage_
lea eax, [ebp - 0x3840]
mov dword [0x503ae8], 0x46d5e4
push 0x1ffe
push eax
call fcn.00449dd2
push dword [0x503ae8]
lea eax, [ebp - 0x3840]
push 0x1ffe
push eax
call fcn.00449dd2
add esp, 0x48
lea eax, [ebp - 0x3840]
push 0x46cfb8
push 0x1ffe
push eax
call fcn.00449dd2
add esp, 0xc
lea eax, [ebp - 0x838]
mov ecx, 0x50fb40
push 0x53c500
push 0x502db8
push 0x104
push eax
call fcn.00410aa0
lea eax, [ebp - 0x838]
mov ecx, 0x50fb50
push eax
call fcn.00416000
mov dword [0x50f91c], eax
mov ecx, 0x50fb50
test eax, eax
jne 0x40c452
call fcn.00419240
call fcn.00408310
jmp 0x409e5c
call fcn.00419240
push 0xa
push 0
lea eax, [ebp - 0x3840]
push eax
lea eax, [ebp - 0x838]
push eax
push 0x46cd24
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x40c4b7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c4ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, 3
jmp 0x40c722
cmp dword [0x502db0], 0
jne 0x40c50c
push 0x46d64c
push 0x46d66c
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov dword [0x51b798], 0xffffffff
mov ecx, 0x50fb50
mov dword [0x503fb0], 1
push 0xffffffffffffffff
call fcn.004192f0
cmp dword [0x502db4], 0
je 0x40c599
cmp dword [0x50ff60], 0
je 0x40c55f
push 0x46d680
push 0x46d734
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov dword [0x51b798], 9
mov dword [0x503fb0], 1
push 9
jmp 0x40c5d0
cmp dword [0x50ff74], 0
je 0x40c589
push dword [0x503aec]
mov ecx, 0x4d0d7c
push 0x46d748
push 0x46d758
push str.EaseOfAccess
call fcn.00407ab0
jmp 0x40c536
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
jmp 0x40c5da
cmp dword [0x503fb0], 0
jne 0x40c5da
push 0x46d818
push 0x46d830
mov ecx, 0x50fb50
call fcn.00418dd0
push dword [0x5194c4]
call fcn.0043eca0
add esp, 4
mov dword [0x51b798], 0xffffffff
push 0xffffffffffffffff
mov ecx, 0x50fb50
call fcn.004192f0
mov ecx, 0x50fb50
call fcn.00419240
call fcn.00408310
mov edx, dword [ebp - 0x6444]
mov esi, dword [0x51b798]
cmp edx, 8
jb 0x40b0a7
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c629
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
mov eax, esi
jmp 0x40c722
test eax, eax
jne 0x40c64a
push 0x53c83c
call esi
mov dword [0x53c838], eax
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x40c722
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c684
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
jmp 0x40c722
push str.SecureBrowser_is_already_running..._
push str.SecureBrowserIsAlreadyRunning
mov ecx, 0x50fb50
call fcn.00418dd0
mov ecx, 0x50fb50
call fcn.00419240
jmp 0x40a07d
push 0x1000
push 0x46d8c4
push 0x46d8cc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
mov ecx, 0x50fb50
mov dword [0x51b798], 0xffffffff
call fcn.004192f0
mov edx, dword [ebp - 0x6444]
cmp edx, 8
jb 0x40c71f
mov ecx, dword [ebp - 0x6458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c715
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c740
push edx
push ecx
call fcn.00443fd6
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0x10
call fcn.0044eb30
int3