Function at 0x40a670
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Delete file
Download url
Get common file path
Get file version info
Get session user name
Receive data
Reference http user-agent string
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b100
mov eax, dword fs:[0]
push eax
mov eax, 0x8dd8
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0x100
mov dword [ebp - 0x8d84], edi
mov dword [0x50a52c], edi
mov dword [0x50a530], esi
mov dword [ebp - 0x8d80], 0x200
mov dword [ebp - 0x8d7c], 1
mov dword [0x529194], 0
call fcn.004413d0
push 0x1ffe
mov dword [0x529198], eax
lea eax, [ebp - 0x8d60]
push 0
push eax
call fcn.00449240
add esp, 0x10
mov dword [0x50be70], 0
lea ecx, [ebp - 0x8d78]
mov dword [0x50be74], 0
mov dword [0x50a534], 0
mov dword [0x51d27c], 0
push 0x16
push str.ITSSecureECLiteBrowser
mov dword [0x51d280], 0
mov dword [0x553534], 0
mov dword [0x50b61c], 0
mov dword [ebp - 0x8d90], 0
mov dword [0x50be7c], esi
mov dword [ebp - 0x8d78], 0
mov dword [ebp - 0x8d68], 0
mov dword [ebp - 0x8d64], 7
call fcn.0040a4a0
xor esi, esi
push esi
call fcn.00455420
push esi
call fcn.00455420
inc esi
add esp, 8
cmp esi, 0x100
jl 0x40a785
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x40dac1
cmp dword [ebp - 0x8d64], 8
lea eax, [ebp - 0x8d78]
cmovae eax, dword [ebp - 0x8d78]
push eax
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.00456213
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax], 1
jle 0x40b306
mov esi, 1
call fcn.00456213
cmp dword [eax], esi
jle 0x40b306
nop dword [eax]
cmp esi, 1
jne 0x40a823
call fcn.00456219
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x511e80
call fcn.00455534
add esp, 0xc
jmp 0x40a853
push 0x46eaec
push 0x1ffe
push 0x511e80
call fcn.0044c423
call fcn.00456219
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x511e80
call fcn.0044c423
add esp, 0x18
call fcn.00456219
push 4
push 0x46eaf0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40a891
call fcn.00456219
push 4
push 0x46eafc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
jne 0x40aa42
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a8a0
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40aa42
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x800
push 0x50adb8
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x50adb8
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x400
push 0x50a9b8
call fcn.00408300
push 7
push str.http:__
push 0x50a9b8
call fcn.0045522a
add esp, 0x1c
test eax, eax
je 0x40aa33
push 8
push str.https:__
push 0x50a9b8
call fcn.0045522a
add esp, 0xc
test eax, eax
je 0x40aa33
push str.s:__
push 0x50a9b8
call fcn.004565ee
add esp, 8
test eax, eax
je 0x40a991
sub eax, 0x50a9b8
add eax, 4
push eax
push 0x50a9b8
lea eax, [ebp - 0x93c]
push 0x400
push eax
call fcn.004565d1
lea ecx, [ebp - 0x93c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a975
push 0x400
lea eax, [ebp - 0x113c]
push eax
push 8
push str.https:__
jmp 0x40a9f0
push 0x46eb24
push 0x50a9b8
call fcn.004565ee
add esp, 8
test eax, eax
je 0x40aa33
sub eax, 0x50a9b8
add eax, 3
push eax
push 0x50a9b8
lea eax, [ebp - 0x93c]
push 0x400
push eax
call fcn.004565d1
lea ecx, [ebp - 0x93c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9d6
push 0x400
lea eax, [ebp - 0x113c]
push eax
push 7
push str.http:__
sub ecx, edx
lea eax, [ebp - 0x93c]
push ecx
push eax
push 0x400
push 0x50a9b8
mov ecx, 0x553538
call fcn.00442e80
lea eax, [ebp - 0x113c]
push eax
push 0x400
push 0x50a9b8
call fcn.0044c498
lea eax, [ebp - 0x113c]
push eax
call fcn.0044c624
add esp, 0x10
mov dword [0x51d260], 1
jmp 0x40b2f8
call fcn.00456219
push 4
push 0x46eb28
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b27c
call fcn.00456219
push 4
push str._log
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b27c
call fcn.00456219
push 9
push 0x46eb40
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b1fa
call fcn.00456219
push 9
push str._errorlog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b1fa
call fcn.00456219
push 8
push 0x46eb68
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b1eb
call fcn.00456219
push 8
push str._nocheck
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b1eb
call fcn.00456219
push 0x10
push 0x46eb90
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b17c
call fcn.00456219
push 0x10
push str._Institutioncode
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b17c
call fcn.00456219
push 7
push 0x46ebd8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b0bb
call fcn.00456219
push 7
push str._Delete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b0bb
call fcn.00456219
push 0x10
push 0x46ebf8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b03b
call fcn.00456219
push 0x10
push str._testcompletelog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40b03b
call fcn.00456219
push 0xb
push 0x46ec40
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40afc1
call fcn.00456219
push 0xc
push str._adminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40afc1
call fcn.00456219
push 0x14
push 0x46ec78
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40af4b
call fcn.00456219
push 0x14
push str._SBPathForadminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40af4b
call fcn.00456219
push 8
push 0x46ecd0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40aed2
call fcn.00456219
push 8
push str._exitlog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40aed2
call fcn.00456219
push 7
push 0x46ecf8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40ae64
call fcn.00456219
push 7
push str._params
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40ae64
call fcn.00456219
push 0x13
push 0x46ed18
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40adb1
call fcn.00456219
push 0x13
push str._LauncherDeleteOnly
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40adb1
call fcn.00456219
push 0xf
push 0x46edbc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
je 0x40ad56
call fcn.00456219
push 0xf
push str._LauncherDelete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045aedf
add esp, 0xc
test eax, eax
jne 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad63
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x1e
push eax
push 0x104
push 0x54ec10
call fcn.00455534
add esp, 0xc
push 0x54ec10
call ebx
mov dword [0x54ec0c], 0
jmp 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40adc0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x13
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x26
push eax
push 0x104
push 0x54ec10
call fcn.00455534
add esp, 0xc
push 0x54ec10
call ebx
push str.A_shortcut_for_the_Secure_Browser_has_been_created_on_the_desktop
push 0x46edac
mov ecx, 0x51cdc8
mov dword [0x54ec0c], 0
call fcn.0041a630
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40ae5d
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ae53
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
xor eax, eax
jmp 0x40db2d
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae71
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
push 0x1000
push 0x54c43c
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x54c43c
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x1000
push 0x54b43c
call fcn.00408300
jmp 0x40b2f5
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aee0
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x10
push eax
push 0x104
push 0x52b658
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x52b658
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x52b554
call fcn.00408300
mov dword [0x52b550], 1
jmp 0x40b2f5
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40af60
sub ecx, edx
sar ecx, 1
cmp ecx, 0x15
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x2a
push eax
push 0x104
push 0x5073d8
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x5073d8
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x5072d0
call fcn.00408300
jmp 0x40b2f5
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40afd0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x518da8
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x518da8
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x516da8
call fcn.00408300
mov dword [0x516da0], 1
jmp 0x40b2f5
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b050
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x104
push 0x54e540
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x54e540
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x54e43c
call fcn.00408300
mov dword [0x516d9c], 1
jmp 0x40b2f5
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b0d0
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
lea eax, [ebp - 0x744]
push 0x104
push eax
call fcn.00455534
add esp, 0xc
nop word [eax + eax]
lea eax, [ebp - 0x744]
push eax
call fcn.00408e00
add esp, 4
test eax, eax
je 0x40b110
push 0
mov ecx, 0x51cdc8
mov dword [0x52b860], 0
call fcn.0041abc0
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40ae5d
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ae53
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
jmp 0x40ae53
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b190
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x64
push 0x528cc8
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x528cc8
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x64
push 0x521cfc
call fcn.00408300
jmp 0x40b2f5
mov dword [ebp - 0x8d7c], 0
jmp 0x40b2f8
mov dword [0x51d274], 1
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b211
sub ecx, edx
sar ecx, 1
cmp ecx, 9
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x51ef90
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x51ef90
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x51ee8c
call fcn.00408300
mov dword [0x51d268], 1
jmp 0x40b2f5
mov dword [0x51d270], 1
call fcn.00456219
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b293
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40b2f8
call fcn.00456219
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x104
push 0x52049c
call fcn.00455534
add esp, 0xc
mov ecx, 0x51cdc8
push 0x52049c
call fcn.0041ab50
push eax
push 0x46e8f8
push 0x104
push 0x520398
call fcn.00408300
mov dword [0x51d26c], 1
add esp, 0x10
inc esi
call fcn.00456213
cmp esi, dword [eax]
jl 0x40a800
push 0x80
push 0x50b9b8
mov ecx, 0x49a1a8
call fcn.0040fbb0
push 0x104
push 0x529f14
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x529f14
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push 0x104
push 0x5070c0
call fcn.00408300
add esp, 0xc
lea eax, [ebp - 0x8d98]
push eax
push 0x529f14
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x2040
mov dword [ebp - 0x8d80], eax
call edi
mov esi, eax
push esi
push dword [ebp - 0x8d80]
push 0
push 0x529f14
call sub.VERSION.dll_GetFileVersionInfoA
mov edx, 0x46e590
mov ecx, esi
nop word [eax + eax]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40b3b0
test al, al
je 0x40b3ac
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40b3b0
add ecx, 2
add edx, 2
test al, al
jne 0x40b390
xor eax, eax
jmp 0x40b3b5
sbb eax, eax
or eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40b405
push 0x104
push 0x52a018
push dword [ebp - 0x8d84]
call ebx
lea eax, [ebp - 0x8d98]
push eax
push 0x52a018
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
push 0x2040
mov dword [ebp - 0x8d80], eax
call edi
mov esi, eax
push esi
push dword [ebp - 0x8d80]
push 0
push 0x52a018
call sub.VERSION.dll_GetFileVersionInfoW
mov ecx, 0x46e590
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b430
test dl, dl
je 0x40b42c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b430
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b410
xor eax, eax
jmp 0x40b435
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b466
push 0x529f14
push str._filepath_
push str.Failed_to_get_file_version__filepath_
push 0x46edac
mov ecx, 0x51cdc8
call fcn.0041a8c0
mov ecx, 0x51cdc8
call fcn.0041aaa0
jmp 0x40ae1d
lea eax, [ebp - 0x8d80]
push eax
lea eax, [ebp - 0x8d8c]
push eax
push 0x46e850
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x8d8c]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x46ee30
push 0x51fe98
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x8d8c]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push str._d._d._d._d
push 0x50a538
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x8d84]
lea ecx, [ebp - 0x1344]
add esp, 0x30
mov dword [0x50b684], eax
push 0x104
push ecx
push eax
call ebx
lea eax, [ebp - 0x1b64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x1b64]
lea ecx, [ecx + 2]
mov word [ecx + 0x5075de], ax
test ax, ax
jne 0x40b504
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1344]
lea ecx, [ecx + 2]
mov word [ecx + 0x5077e6], ax
test ax, ax
jne 0x40b520
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1344]
lea ecx, [ecx + 2]
mov word [ecx + 0x54e7ce], ax
test ax, ax
jne 0x40b540
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5073d4], 0
nop word [eax + eax]
imul eax, eax, 0x208
mov ecx, 0x51cdb8
add eax, 0x5075e0
push eax
push 0x104
push 0x50a110
call fcn.00411810
mov eax, dword [0x5291b4]
xorps xmm0, xmm0
mov dword [ebp - 0x8dcc], eax
lea eax, [ebp - 0x8dd4]
push eax
movlpd qword [ebp - 0x8db0], xmm0
movlpd qword [ebp - 0x8da8], xmm0
movlpd qword [ebp - 0x8da0], xmm0
mov dword [ebp - 0x8dd4], 0x3c
mov dword [ebp - 0x8dd0], 0x400
mov dword [ebp - 0x8dc8], 0
mov dword [ebp - 0x8dc4], 0x50a110
mov dword [ebp - 0x8dc0], 0x46ea58
mov dword [ebp - 0x8dbc], 0
mov dword [ebp - 0x8db8], 5
mov dword [ebp - 0x8db4], 0
call esi
push 0xffffffffffffffff
push dword [ebp - 0x8d9c]
call edi
push dword [ebp - 0x8d9c]
call ebx
mov ecx, 0x51cdc8
call fcn.0041aaa0
test eax, eax
jne 0x40b6b7
mov eax, dword [0x5073d4]
inc dword [0x5079f0]
inc eax
mov dword [0x5073d4], eax
cmp eax, 1
jle 0x40b580
push str.To_use_this_application__you_must_have_executeand_write_access_to_one_of_the_following_folders:__r_n_r_n_r_n___C:UsersYourUsernameTemp__r_n_r_n___The_current_location_you_are_running_the_Secure_Browser
push str.NoFolderAccess
mov ecx, 0x51cdc8
call fcn.00419e60
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40b6ad
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b6a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, 0xb
jmp 0x40db2d
imul eax, dword [0x5073d4], 0x208
mov edx, 0x54e7d0
lea ecx, [eax + 0x5075e0]
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x40b6d0
push 1
push 0
push 0
push 0x50a110
push 0x46ef2c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x54e7d0
push 0x51fe98
push 0x104
lea eax, [ebp - 0x53c]
mov ecx, 0x51cdb8
push eax
call fcn.00411bd0
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x50a534], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push dword [0x50a534]
call fcn.00442190
push str.Entered_Secure_Browser
push 1
push dword [0x50a534]
call fcn.004429d0
push str._________________________________________________________________________________________________________________________________________________________________
push 1
push dword [0x50a534]
call fcn.004429d0
push str.Security_DLL_Loaded
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x2c
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0x53c]
lea ecx, [ecx + 2]
mov word [ecx + 0x50a316], ax
test ax, ax
jne 0x40b780
mov edi, dword [ebp - 0x8d84]
lea eax, [ebp - 0x53c]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push edi
call esi
lea eax, [ebp - 0x8d98]
push eax
lea eax, [ebp - 0x53c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 0x8d80], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x2040
call eax
mov ebx, eax
lea eax, [ebp - 0x53c]
push ebx
push dword [ebp - 0x8d80]
mov dword [ebp - 0x8d88], ebx
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov edx, 0x46e590
mov ecx, ebx
nop dword [eax]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40b820
test al, al
je 0x40b81c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40b820
add ecx, 2
add edx, 2
test al, al
jne 0x40b800
xor eax, eax
jmp 0x40b825
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b838
mov ecx, 0x51cdc8
call fcn.0041aaa0
jmp 0x40ae1d
lea eax, [ebp - 0x8d80]
push eax
lea eax, [ebp - 0x8d8c]
push eax
push 0x46e850
push ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x8d8c]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push str._d._d._d._d
push 0x5267c8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x195c]
push 0x104
push eax
push edi
call esi
push 0x46ef38
lea eax, [ebp - 0x195c]
mov ecx, 0x51cdc8
push eax
call fcn.00417400
mov dword [0x50a10c], eax
test eax, eax
jne 0x40b8c0
mov ecx, 0x51cdc8
call fcn.0041aaa0
call fcn.00408b10
jmp 0x40ae1d
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x80
push 0x50ba38
mov ecx, 0x4d5094
mov dword [ebp - 0x8d94], eax
call fcn.00407f50
mov ecx, 0x49a1a8
call fcn.0040fcf0
push 0x49a1c8
call fcn.00456114
add esp, 4
mov dword [0x50a528], eax
push 0x5070c0
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x40da9e
push 0x5070c0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 0x49a1a8
call fcn.004100d0
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
nop dword [eax + eax]
push 0
push str.WorkerW
push esi
call ebx
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x40b965
test esi, esi
jne 0x40b940
jmp 0x40b970
test esi, esi
jne 0x40b99e
nop dword [eax]
push 0
push str.Progman
push esi
call ebx
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x40b993
test esi, esi
jne 0x40b970
push 3
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push 0x200
lea eax, [ebp - 0x6560]
mov dword [0x50a524], esi
push eax
push dword [0x50a534]
call fcn.004421b0
mov dword [0x516d90], eax
lea eax, [ebp - 0x6960]
push 0x200
push eax
push dword [0x50a534]
call fcn.00442230
mov dword [0x516d94], eax
lea eax, [ebp - 0x6d60]
push 0x200
push eax
push dword [0x50a534]
call fcn.004421e0
mov ebx, dword [ebp - 0x8d94]
push 0x200
push 0x529284
push ebx
push dword [0x50a534]
mov dword [0x516d98], eax
call fcn.004422e0
add esp, 0x34
mov ecx, 0x553538
call fcn.00443000
push ebx
push str.The_Current_Process_ID_is____d
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x50a538
push str.Secure_Browser_Version____s
push 1
push dword [0x50a534]
call fcn.004429d0
call fcn.00409dd0
push dword [0x50b6f0]
push dword [0x50b6f4]
push dword [0x50b6ec]
push str._u._u._u
push 0x80
push 0x50b6f8
call fcn.00408300
push 0x50b6f8
push str.OS_Version____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x48
push str.Secure_Browser_Type___WINCSECB
push 1
push dword [0x50a534]
call fcn.004429d0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add esp, 0xc
push 0x10
push 0x40
call edi
push eax
push dword [0x50a534]
mov dword [0x50b978], eax
call fcn.004422a0
push str.before_MAC_Address
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x14
lea eax, [ebp - 0x1d64]
push 0
push 0
push 0x200
push eax
mov eax, dword [0x50b978]
push 0xffffffffffffffff
push dword [eax + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [0x50b978]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebx
lea eax, [ebp - 0x1d64]
push eax
push str.MAC_Address____s
push 1
push dword [0x50a534]
call fcn.004429d0
push str.after_MAC_Address
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x200
lea eax, [ebp - 0xd3c]
push eax
push dword [0x50a534]
call fcn.00442210
lea eax, [ebp - 0xd3c]
push eax
push str.Active_MAC_Address____s
push 1
push dword [0x50a534]
call fcn.004429d0
push dword [0x50a534]
call fcn.00442a30
test eax, eax
mov edx, 0x46e590
mov ecx, str._WIFI
push 0x28
cmove ecx, edx
push ecx
push 0x28
push 0x50be38
call fcn.0044c60e
add esp, 0x4c
push 0x50b778
push str.Network_Adapter____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x10
lea eax, [ebp - 0x8d80]
push eax
lea eax, [ebp - 0xb3c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xb3c]
push eax
push str.Network_User____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x10
push dword [ebp - 0x8d88]
call ebx
mov ecx, 0x51cdb8
call fcn.00410c50
mov ecx, 0x5070b8
mov dword [0x51d208], eax
call fcn.004083d0
push 0x54e9dc
mov ecx, 0x51cdc8
mov dword [0x51d1d0], eax
call fcn.00415810
mov ecx, 0x51cdc8
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bc20
sub ecx, edx
jne 0x40bc5e
push 0x400
push 0x51cdc8
push str.UPDATEURL
push 0x94
mov ecx, 0x51cdb8
call fcn.00411420
push str.After_ExtractResourceString___UPDATEURL
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0xc
mov ecx, 0x51cdc8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bc66
mov eax, dword [0x51d21c]
sub ecx, edx
push 0x400
xor edx, edx
test ecx, ecx
push 0x521498
push str.ERRORURL
cmovne eax, edx
mov ecx, 0x51cdb8
push 0xa1
mov dword [0x51d21c], eax
call fcn.00411420
mov ecx, 0x51cdc8
call fcn.004157b0
push eax
push str.programid_s
push 0x64
push 0x521ef0
call fcn.00408300
push 0x521ef0
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x1c
mov ecx, 0x4d5094
push 0x5206a4
call fcn.00407d60
push eax
push str.environmentid_s
push 0x64
push 0x521e8c
call fcn.00408300
push 0x521e8c
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x1c
mov ecx, 0x4d5094
push 0x520708
call fcn.00407d20
push eax
push str.candidateid_s
push 0x64
push 0x521dc4
call fcn.00408300
push 0x521dc4
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x64
push 1
call fcn.0044c619
add esp, 0x24
mov dword [0x4d5094], eax
mov ecx, 0x51cdb8
call fcn.00410910
push str.After_extracting_institution_Id
push 1
push dword [0x50a534]
mov dword [0x5291a0], eax
call fcn.004429d0
push dword [0x5291a0]
push 0x46e7c4
push 0x64
push dword [0x4d5094]
call fcn.00408300
add esp, 0x1c
mov ecx, 0x4d5094
call fcn.00407e40
push eax
push str.institutionid_s
push 0x64
push 0x521e28
call fcn.00408300
add esp, 0x10
mov ecx, 0x4d5094
call fcn.00407e40
push eax
push str.institutionid_s
push 0x64
push 0x520834
call fcn.00408300
add esp, 0x10
mov ecx, 0x4d5094
push 0x5207d0
call fcn.00407ea0
push eax
push str.language_s
push 0x64
push 0x52076c
call fcn.00408300
add esp, 0x10
cmp dword [0x51d21c], 0
je 0x40be3b
push 0x400
push 0x50a5b8
push 0x46f138
push 0x75
mov ecx, 0x51cdb8
call fcn.00411420
push str.local_configuration
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0xc
mov ecx, 0x51cdb8
push 0x400
push 0x51ff98
push str.ALTURL
push 0x7c
call fcn.00411420
mov ecx, 0x49a1a8
call fcn.0040ff00
mov ecx, 0x49a1a8
call fcn.004102e0
push dword [0x50a534]
call fcn.00442550
add esp, 4
test eax, eax
je 0x40be7f
mov ecx, 0x49a1a8
call fcn.0040ff80
mov ecx, 0x49a1a8
call fcn.0040fe70
mov ecx, 0x49a1a8
call fcn.00410370
cmp dword [0x51d21c], 0
mov ecx, 0x51cdc8
jne 0x40bed2
call fcn.00414800
push 0
push 0x50b980
push 0
call sub.urlmon.dll_CoInternetCreateZoneManager
test eax, eax
js 0x40bec6
push 0
push 0x51f598
push 0x51cdc8
mov ecx, 0x553540
call fcn.00445db0
mov ecx, 0x51cdc8
call fcn.00413450
jmp 0x40bed7
mov dword [ebp - 0x8d90], 1
jmp 0x40bed7
call fcn.00418220
push str.True
push 0x5280c8
call fcn.00456418
add esp, 8
test eax, eax
jne 0x40bf13
push dword [0x550a34]
push dword [0x550a30]
push dword [0x550a28]
push dword [0x550a2c]
push dword [0x50a534]
call fcn.004420c0
add esp, 0x14
push str.log_check_0D
push 0
push dword [0x50a534]
call fcn.004429d0
push str.log_check_2W
push 2
push dword [0x50a534]
call fcn.004429d0
push str.log_check_3E
push 3
push dword [0x50a534]
call fcn.004429d0
push str.log_check_5C
push 5
push dword [0x50a534]
call fcn.004429d0
push str.log_check_4S
push 4
push dword [0x50a534]
call fcn.004429d0
mov eax, dword [0x54ec0c]
add esp, 0x3c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40bf8b
push 0x54ec10
call esi
mov dword [0x54ec0c], eax
cmp dword [0x51d264], 0
jne 0x40da45
cmp dword [0x51d1cc], 0
jne 0x40bff1
cmp dword [0x51d1d0], 0
jne 0x40bff1
push str.This_secure_browser_requires_administrative_privileges._Please_run_this_secure_browser_as_an_Administrator.
push str.RequiresAdmin
mov ecx, 0x51cdc8
call fcn.0041a630
push dword [0x529198]
call fcn.00441230
add esp, 4
mov dword [0x52b860], 8
mov ecx, 0x51cdc8
mov dword [0x50b9b4], 1
push 8
call fcn.0041abc0
jmp 0x40d9fc
cmp dword [ebp - 0x8d7c], 0
je 0x40c01b
push 0x51fe18
push 0x51fd98
push 0x50a538
mov ecx, 0x51cdc8
call fcn.004159a0
test eax, eax
jne 0x40d398
cmp dword [0x50a534], 0
mov dword [ebp - 0x8d7c], 0
je 0x40d398
cmp dword [0x51d21c], 0
je 0x40c060
mov ecx, 0x51cdb8
call fcn.00411180
push eax
push str.sBrowserEngineId_from_Local_Config____d
push 1
push dword [0x50a534]
mov dword [0x54e748], eax
call fcn.004429d0
add esp, 0x10
mov eax, dword [0x54e748]
cmp eax, 1
jne 0x40c260
mov ecx, 0x51cdc8
call fcn.0041aaa0
push 0x50be80
push 0x1ffe
push 0x5079f8
call fcn.0044c498
push 0x54e7d0
push dword [0x51d21c]
push 0x104
push 0x5099f8
call fcn.00409490
push 0x5099f8
push str.ExtractSB____s
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x5099f8
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00455534
add esp, 0x38
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x46f1e8
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044c423
push 0x46f1ec
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044c423
add esp, 0x18
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c13e
push 0x54e7d0
push 0x104
lea eax, [ebp - 0x230]
mov ecx, 0x51cdb8
push eax
call fcn.00411810
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x230]
push 1
push 0
push 0
push eax
push 0x46ef2c
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x529a90
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push str.___filePath_
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x529f14
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x46f238
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x5079f8
push 0
push 0xfde9
call edi
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
push eax
push 0xffffffffffffffff
push 0x5079f8
push 0
push 0xfde9
mov dword [0x5079f4], eax
call edi
push 1
push 0
push dword [0x5079f4]
push 0x5099f8
push 0x46ef2c
push 0
call ebx
push 0x5099f8
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x10
cmp dword [0x54ec0c], 0
jne 0x40c251
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54ec10
call eax
mov dword [0x54ec0c], eax
mov ecx, 0x51cdc8
call fcn.00412d30
jmp 0x40c6ea
cmp eax, 4
je 0x40c26e
cmp eax, 5
jne 0x40c734
call fcn.004095f0
test eax, eax
jne 0x40c734
cmp dword [0x54e748], 4
mov ecx, 0x51cdc8
jne 0x40c4d3
push str.Installation_Required__The_Secure_Browser_requires_that_Microsoft_Edge_Runtime_be_installed_on_this_device._This_installation_will_require_administrative_privileges._Click_OK_to_exit_the_Secure_Browser_and_proceed_with_the_installation.
push str.EdgeInstallerRequest
call fcn.0041a280
test eax, eax
je 0x40c443
xor esi, esi
push esi
push esi
push str..MicrosoftEdgeWebview2Setup.exe
push str.https:__go.microsoft.com_fwlink_p__LinkId2124703
push esi
mov dword [ebp - 0x8d7c], esi
call sub.urlmon.dll_URLDownloadToFileA
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
jne 0x40c391
xorps xmm0, xmm0
mov dword [ebp - 0x8dd4], 0x3c
lea eax, [ebp - 0x8dd4]
movlpd qword [ebp - 0x8db0], xmm0
push eax
movlpd qword [ebp - 0x8da8], xmm0
movlpd qword [ebp - 0x8da0], xmm0
mov dword [ebp - 0x8dd0], 0x100
mov dword [ebp - 0x8dcc], esi
mov dword [ebp - 0x8dc8], str.runas
mov dword [ebp - 0x8dc4], str.MicrosoftEdgeWebview2Setup.exe
mov dword [ebp - 0x8dc0], str.__silent__install
mov dword [ebp - 0x8dbc], esi
mov dword [ebp - 0x8db8], esi
mov dword [ebp - 0x8db4], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c391
mov edi, dword [ebp - 0x8d7c]
test edi, edi
je 0x40c368
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x8d7c]
mov dword [ebp - 0x8d7c], 0
push eax
push 0
call fcn.004018da
mov edi, dword [ebp - 0x8d7c]
test edi, edi
je 0x40c368
mov esi, 1
jmp 0x40c397
mov edi, dword [ebp - 0x8d7c]
test edi, edi
je 0x40c3ac
push edi
mov dword [ebp - 4], 1
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x40c734
push str.The_installation_failed._Administrative_privileges_are_required_to_complete_the_installation.
push str.EdgeInstallerFailed
mov ecx, 0x51cdc8
call fcn.0041a630
mov ecx, 0x51cdc8
call fcn.0041aaa0
mov eax, dword [0x49a088]
mov ecx, 0x51cdc8
push eax
mov dword [0x52b860], eax
call fcn.0041abc0
call fcn.00408b10
mov ecx, 0x51cdc8
call fcn.00412d30
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x49a088]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c432
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, esi
jmp 0x40db2d
mov ecx, 0x51cdc8
call fcn.0041aaa0
mov eax, dword [0x49a088]
mov ecx, 0x51cdc8
push eax
mov dword [0x52b860], eax
call fcn.0041abc0
mov ecx, 0x51cdc8
call fcn.00412d30
call fcn.00408b10
cmp dword [0x54ec0c], 0
jne 0x40c486
push 0x54ec10
call esi
mov dword [0x54ec0c], eax
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x49a088]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c4c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, esi
jmp 0x40db2d
call fcn.0041aaa0
push 0x50be80
push 0x1ffe
push 0x5079f8
call fcn.0044c498
push 0x5099f8
push str.BeforeExtractSB____s
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x54e7d0
push dword [0x51d21c]
push 0x104
push 0x5099f8
call fcn.00409490
push 0x5099f8
push str.ExtractSB____s
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x5099f8
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00455534
add esp, 0x48
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x46f1e8
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044c423
push 0x46f1ec
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044c423
add esp, 0x18
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c5b5
push 0x54e7d0
push 0x104
lea eax, [ebp - 0x230]
mov ecx, 0x51cdb8
push eax
call fcn.00411810
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x230]
push 1
push 0
push 0
push eax
push 0x46ef2c
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x529a90
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push str.___filePath_
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x529f14
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
push 0x46f238
push 0x1ffe
push 0x5079f8
call fcn.0044c4f2
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x5079f8
push 0
push 0xfde9
call edi
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
push eax
push 0xffffffffffffffff
push 0x5079f8
push 0
push 0xfde9
mov dword [0x5079f4], eax
call edi
push 1
push 0
push dword [0x5079f4]
push 0x5099f8
push 0x46ef2c
push 0
call ebx
push 1
push 0
push dword [0x5079f4]
push 0x5099f8
push 0x46ef2c
push 0
call ebx
push 0x5099f8
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x10
mov ecx, 0x51cdc8
call fcn.00412d30
cmp dword [0x54ec0c], 0
jne 0x40c6ea
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54ec10
call eax
mov dword [0x54ec0c], eax
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40c72a
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c720
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, 2
jmp 0x40db2d
push 0x54e7d0
mov ecx, 0x51cdb8
call fcn.004119d0
push 0x100
call fcn.004468ab
mov edi, eax
add esp, 4
test edi, edi
je 0x40c787
sub esp, 0x28
mov ecx, esp
push 0
push 0
sub esp, 0x18
mov dword [ecx + 0x24], 0
mov esi, esp
push 0x46f3f4
call fcn.004086e0
add esp, 4
mov ecx, esi
push eax
call fcn.00408540
mov ecx, edi
call fcn.0041ba00
cmp dword [0x51cdac], 0
mov edi, dword [0x5291b4]
jne 0x40c7cd
push str.wtsapi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40c7cd
push str.WTSRegisterSessionNotification
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c7c6
push 0
push edi
call eax
mov dword [0x51cdac], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x8d84]
push eax
push 0x47023c
push dword [0x5291b4]
call dword [sym.imp.SHELL32.dll_SHGetPropertyStoreForWindow]
test eax, eax
js 0x40c823
mov eax, 0xb
lea ecx, [ebp - 0x8de4]
mov word [ebp - 0x8de4], ax
or eax, 0xffffffff
mov word [ebp - 0x8ddc], ax
mov eax, dword [ebp - 0x8d84]
push ecx
push 0x481858
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x8d84]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, 0x49a1a8
call fcn.0040fb40
cmp dword [0x49a394], 1
jne 0x40c8ca
lea eax, [ebp - 0x334]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40c8ca
push str.ITSAutomation.log
lea eax, [ebp - 0x334]
push 0x104
push eax
call fcn.0044c4f2
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x334]
mov ecx, 0x51cdc8
push eax
call fcn.00413210
push 0x46f414
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x8d88]
push eax
call fcn.004562d6
add esp, 0xc
test eax, eax
jne 0x40c8ca
push dword [0x5291b4]
push 0x46f418
push dword [ebp - 0x8d88]
call fcn.0040a5b0
push dword [ebp - 0x8d88]
call fcn.00456394
add esp, 0x10
push str.Before_checking_VM
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x64
push 0x5291bc
push dword [0x50a534]
call fcn.00442520
push str.After_checking_VM
push 1
push dword [0x50a534]
mov dword [0x51d27c], eax
call fcn.004429d0
push dword [0x50a534]
call fcn.004424c0
push str.After_checking_RDP
push 1
push dword [0x50a534]
mov dword [0x51d280], eax
call fcn.004429d0
add esp, 0x34
cmp dword [0x51d27c], 0
je 0x40c949
push str._VM_
push 0x10
push 0x50be60
call fcn.0044c498
add esp, 0xc
jmp 0x40c96f
cmp dword [0x51d280], 0
je 0x40c968
push str._RDPSESSION_
push 0x10
push 0x50be60
call fcn.0044c498
add esp, 0xc
jmp 0x40c96f
mov byte [0x50be60], 0
cmp dword [0x51d254], 0
je 0x40ca4c
cmp dword [0x51d208], 0
je 0x40c999
push str.WINCHSECB
push 0xa
push str.WINCSECB
call fcn.0044c498
add esp, 0xc
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x516d90]
call fcn.00456a47
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x516d94]
call fcn.00456a47
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x516d98]
call fcn.00456a47
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x54e9dc
push 0x5267c8
push 0x50be38
push 0x51ea8c
push str.WINCSECB
push 0x50a538
push str._SecureBrowser__s__s__s_s_TS__s__UUID__s__DKM:_s._s._s
push 0x521898
call ebx
add esp, 0x50
push 0x521898
push str.User_Agent_after_replacement___s
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x51ea8c
push str.WINCSECB
push str._s__s
push 0x521098
call ebx
add esp, 0x20
push dword [0x50b984]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40cb1b
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x516d90]
call fcn.00456a47
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x516d94]
call fcn.00456a47
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x516d98]
call fcn.00456a47
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
add esp, 0x24
cmp dword [0x51d21c], 0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x54e9dc
push 0x5267c8
push 0x50be38
push 0x50be60
jne 0x40caec
push 0x51ea8c
push str.WINCSECB
push 0x50a538
push 0x50ba38
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s__s_s__s__TS__s__UUID__s__DKM:_s._s._s
push 0x521898
call ebx
push 0x51ea8c
push str.WINCSECB
push str._s__s
push 0x521098
call ebx
add esp, 0x44
jmp 0x40cb1b
push str.WINCSECB
push 0x50a538
push 0x50ba38
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s_s__s__TS__s__UUID__s__DKM:_s._s._s
push 0x521898
call ebx
push str.WINCSECB
push 0x46e8f8
push 0x521098
call ebx
add esp, 0x3c
push dword [ebp - 0x8d94]
push str.Current_Process_ID____d
push 1
push dword [0x50a534]
call fcn.004429d0
push 0x50a538
push str.Secure_Browser_Version____s
push 1
push dword [0x50a534]
call fcn.004429d0
call fcn.00409dd0
push dword [0x50b6f0]
push dword [0x50b6f4]
push dword [0x50b6ec]
push str._u._u._u
push 0x80
push 0x50b6f8
call fcn.00408300
push 0x50b6f8
push str.OS_Version____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x48
push str.Secure_Browser_Type___WINCSECB
push 1
push dword [0x50a534]
call fcn.004429d0
lea eax, [ebp - 0xd3c]
push eax
push str.MAC_Address____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x1c
lea eax, [ebp - 0x8d80]
push eax
lea eax, [ebp - 0xb3c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xb3c]
push eax
push str.Network_User____s
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x10
mov ecx, 0x51cdc8
call fcn.00419990
mov ecx, 0x51cdc8
call fcn.00419cc0
mov ecx, 0x51cdc8
call fcn.00419340
mov ecx, 0x51cdc8
call fcn.004194e0
mov ecx, 0x51cdc8
call fcn.00419820
mov ecx, 0x51cdc8
call fcn.00419680
mov ecx, 0x51cdc8
call fcn.00419210
cmp dword [0x51d23c], 0
je 0x40cc57
push dword [0x52a9fc]
push 0x52a22c
push 0
push dword [0x50a534]
call fcn.004425c0
add esp, 0x10
cmp dword [0x51d21c], 0
je 0x40cc6c
mov ecx, 0x51cdb8
call fcn.00410ab0
jmp 0x40cc71
mov eax, dword [0x52919c]
push eax
push dword [0x50a534]
mov dword [0x50b98c], eax
call fcn.00442960
push dword [0x51d1f0]
push dword [0x50a534]
call fcn.00441fd0
push dword [0x51d1e8]
push dword [0x50a534]
call fcn.00442080
push dword [0x51d20c]
push dword [0x50a534]
call fcn.00441fb0
push dword [0x51d1f4]
push dword [0x50a534]
call fcn.00441f70
push dword [0x51d1fc]
push dword [0x50a534]
call fcn.004420f0
push dword [0x51d1f8]
push dword [0x50a534]
call fcn.004420a0
push dword [0x51d218]
push dword [0x50a534]
call fcn.00441f30
add esp, 0x40
push dword [0x51d200]
push dword [0x50a534]
call fcn.00442110
push dword [0x51d220]
push dword [0x50a534]
call fcn.00441f50
push dword [0x51d224]
push dword [0x50a534]
call fcn.00442000
push dword [0x51d228]
push dword [0x50a534]
call fcn.00441f90
push dword [0x51d22c]
push dword [0x50a534]
call fcn.00442170
push dword [0x51d1e4]
push dword [0x50a534]
call fcn.00442060
push dword [0x51d1e0]
push dword [0x50a534]
call fcn.00442040
push dword [0x51d244]
push dword [0x50a534]
call fcn.00442130
add esp, 0x40
push 0x526848
call fcn.00456114
push eax
push dword [0x50a534]
call fcn.00442020
add esp, 0xc
push 0
push 0
push 0x10
push dword [0x50a108]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x5291b4]
test eax, eax
je 0x40d390
cmp dword [0x51d260], 0
mov dword [0x50b990], eax
je 0x40ce17
mov ecx, 0x46e590
mov eax, 0x54b43c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40cdf7
test dl, dl
je 0x40cdf3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40cdf7
add eax, 2
add ecx, 2
test dl, dl
jne 0x40cdd7
xor eax, eax
jmp 0x40cdfc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ce17
push 0x50a9b8
push 0x400
push 0x50a5b8
call fcn.0044c498
add esp, 0xc
push 1
push 0x553540
push 0x50a5b8
mov ecx, 0x553540
call fcn.00445db0
mov ecx, 0x553540
call fcn.004460a0
mov ecx, 0x553540
call fcn.00445ec0
cmp dword [0x51d1c8], 0
je 0x40ce6a
push 4
push 0x5291a8
push 0x51
push 0
mov dword [0x5291a8], 3
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [0x51d284], eax
cmp dword [0x51d22c], 0
je 0x40ceab
push str.SetSBWindowAffinity_called
push 1
push dword [0x50a534]
call fcn.004429d0
push dword [0x5291b4]
push dword [0x50a534]
call fcn.00442940
push str.SetSBWindowAffinity_completed
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x20
push dword [0x5291b4]
push dword [0x50a534]
call fcn.00442260
push 4
push dword [0x50a534]
call fcn.00442900
add esp, 0x10
cmp dword [0x51d1dc], 0
jne 0x40ceec
push 0x64
push 0x5291bc
push dword [0x50a534]
call fcn.00442520
add esp, 0xc
jmp 0x40ceee
xor eax, eax
mov edx, dword [0x51d258]
mov dword [0x51d27c], eax
test edx, edx
jne 0x40cf1a
push dword [0x50a534]
call fcn.004424c0
mov edx, dword [0x51d258]
mov ecx, eax
mov eax, dword [0x51d27c]
add esp, 4
jmp 0x40cf1c
xor ecx, ecx
cmp dword [0x51d204], 0
mov dword [0x51d280], ecx
jne 0x40d112
cmp dword [0x51d1dc], 0
jne 0x40d011
test eax, eax
je 0x40d011
push 0
push 0
push 1
push 2
push 0x5291bc
mov ecx, 0x51cdc8
mov dword [0x54e9d8], 1
call fcn.00416670
push str.This_application_cannot_be_run_inside_of_a_virtual_machine.
push str.NoVirtualMachine
mov ecx, 0x51cdc8
call fcn.0041a630
push dword [0x529198]
call fcn.00441230
add esp, 4
mov ecx, 0x51cdc8
call fcn.0041aaa0
push 7
mov ecx, 0x51cdc8
mov dword [0x52b860], 7
mov dword [0x50b9b4], 1
call fcn.0041abc0
mov ecx, 0x51cdc8
call fcn.00412d30
call fcn.00408b10
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x52b860]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d000
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, esi
jmp 0x40db2d
mov eax, dword [0x50b9b4]
test edx, edx
jne 0x40d0f9
test ecx, ecx
je 0x40d0f9
test eax, eax
jne 0x40d0f9
push eax
push eax
push 1
push 3
push 0x46f68c
mov ecx, 0x51cdc8
mov dword [0x54e9d8], 1
call fcn.00416670
push str.This_application_cannot_be_run_inside_of_a_Remote_Desktop_server_session.
push str.NoRemoteDesktopSession
mov ecx, 0x51cdc8
call fcn.0041a630
push dword [0x529198]
call fcn.00441230
add esp, 4
mov ecx, 0x51cdc8
call fcn.0041aaa0
push 7
mov ecx, 0x51cdc8
mov dword [0x52b860], 7
mov dword [0x50b9b4], 1
call fcn.0041abc0
mov ecx, 0x51cdc8
call fcn.00412d30
call fcn.00408b10
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x52b860]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d0e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, esi
jmp 0x40db2d
cmp dword [0x516da0], 0
jne 0x40d127
test eax, eax
jne 0x40d127
mov ecx, 0x51cdc8
call fcn.00412990
jmp 0x40d127
push str.Default_value_set
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0xc
push 0
push str.ITS_Secure_Browser_AppSwitcher
call dword [sym.imp.USER32.dll_FindWindowA]
push 3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x51d204], 0
jne 0x40d279
cmp dword [0x52a228], 2
je 0x40d16f
mov ecx, 0x51cdc8
call fcn.004145b0
test eax, eax
jne 0x40d279
cmp dword [0x516da0], 0
je 0x40d18a
mov ecx, 0x51cdc8
call fcn.004145b0
test eax, eax
jne 0x40d279
mov ecx, 0x51cdc8
call fcn.0041aaa0
cmp dword [0x52a228], 2
je 0x40d1b1
push str.Unable_to_enable_security._Contact_support_for_further_assistance.
push str.EnableSecurityFailed
mov ecx, 0x51cdc8
call fcn.0041a630
push str.Before_killOnQuit
push 1
push dword [0x50a534]
call fcn.004429d0
push dword [0x5291b4]
push dword [0x50a534]
call fcn.004425f0
push str.After_killOnQuit
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0x20
mov dword [0x52b860], 5
mov ecx, 0x51cdc8
push 5
call fcn.0041abc0
mov ecx, 0x51cdc8
call fcn.00412d30
call fcn.00408b10
cmp dword [0x54ec0c], 0
jne 0x40d228
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54ec10
call eax
mov dword [0x54ec0c], eax
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x52b860]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d268
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, esi
jmp 0x40db2d
push 0
push 0
push 0
push 0x4090a0
push 0
push 0x8005
push 0x8005
mov dword [0x50b61c], 1
call dword [sym.imp.USER32.dll_SetWinEventHook]
push str.Starting_Main_Message_Loop
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0xc
push 0
push 0x409960
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push dword [0x551be4]
push str.webViewCreated_before_runmessagepump__d
push 1
push dword [0x50a534]
call fcn.004429d0
push dword [0x50be78]
push str.startUrlLoaded_before_runmessagepump__d
push 1
push dword [0x50a534]
call fcn.004429d0
call fcn.00409e50
mov eax, dword [0x50b9b4]
mov ecx, 1
cmp dword [0x52b860], 0
cmove eax, ecx
push eax
push str.quitCode__d
push ecx
push dword [0x50a534]
mov dword [0x50b9b4], eax
call fcn.004429d0
add esp, 0x30
cmp dword [0x54ec0c], 0
jne 0x40d343
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54ec10
call eax
mov dword [0x54ec0c], eax
mov ecx, 0x51cdc8
call fcn.00413360
push str.Finished_Logging
push 1
push dword [0x50a534]
call fcn.004429d0
add esp, 0xc
push dword [0x50a534]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x8d90], 0
je 0x40d958
push str.Unable_to_load_the_internet_zone_manager_
push str.InternetZoneError
jmp 0x40d96b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d36e
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x8d7c], 0
je 0x40d374
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x1754]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x51cdc8
push 0x3ff
push 0x400
push 0x51f198
call fcn.004082c0
mov ecx, 0x521ef0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d3e6
push 0x400
push 0x51f198
sub ecx, edx
push ecx
push 0x521ef0
push 0xf
push str.programid_pid_
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
mov ecx, 0x521e8c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d422
push 0x400
push 0x51f198
sub ecx, edx
push ecx
push 0x521e8c
push 0x13
push str.environmentid_eid_
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
mov ecx, 0x521dc4
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d460
push 0x400
push 0x51f198
sub ecx, edx
push ecx
push 0x521dc4
push 0x11
push str.candidateid_cid_
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
mov ecx, 0x521e28
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d4a0
push 0x400
push 0x51f198
sub ecx, edx
push ecx
push 0x521e28
push 0x13
push str.institutionid_iid_
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
mov ecx, 0x52076c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d4e0
push 0x400
push 0x51f198
sub ecx, edx
push ecx
push 0x52076c
push 0x10
push str.language_lcode_
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
push 0x400
push 0x51f198
push 1
push 0x46e590
push 8
push 0x46f878
push 0x400
push 0x51f198
mov ecx, 0x553538
call fcn.00442e80
mov ecx, 0x51f198
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d548
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x51f198
call fcn.0044c4f2
add esp, 0xc
mov ecx, 0x51cdc8
push 0
push 0
push str.cmddownload
push 0x46f894
push 0x51f198
push 0x400
push 0x509d08
call fcn.00414d20
mov ecx, 0x509d08
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d596
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x509d08
call fcn.0044c4f2
add esp, 0xc
push 0x401
push 0x40
call edi
mov esi, eax
mov ecx, 0x51cdc8
push esi
push 0x509d08
call fcn.0041b570
push esi
push str._sy1QM3bQ6VnxkCUm7Uv2zjj1ogux0O0ESsjq4G8fXpdwXkRJOqz
push 0x1ff
lea eax, [ebp - 0x2164]
push 0x200
push eax
call fcn.004082c0
add esp, 0x14
push 0x2a
push 0x40
call edi
push esi
mov dword [0x509d04], eax
call ebx
push dword [0x509d04]
lea eax, [ebp - 0x2164]
mov ecx, 0x51cdc8
push eax
call fcn.00417890
push str.sc
push 0x400
push 0x51f198
call fcn.0044c4f2
push dword [0x509d04]
push 0x400
push 0x51f198
call fcn.0044c4f2
add esp, 0x18
push dword [0x509d04]
call ebx
push 0x51f198
push 0x3ff
push 0x400
push 0x51cdc8
call fcn.004082c0
add esp, 0x10
lea eax, [ebp - 0x8d60]
mov ecx, 0x553538
push 0x1ffe
push eax
push 9
push str._starturl
push 4
push str._url
push 0x1ffe
push 0x50be80
call fcn.00442e80
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x8d60]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call edi
mov edi, eax
lea eax, [ebp - 0x8d60]
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
push 0x46ea58
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.00455534
push edi
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.00455534
push 0x46eaec
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push str._url_
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x51cdc8
push 0
push 0xfde9
call ebx
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x51cdc8
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push str.___exe_
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
lea eax, [ebp - 0x1754]
push eax
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push str.___updateversion_
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x51fd98
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
push 0x51fd98
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push str.___minversion_
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 0x51fe18
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x51fe18
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push str.___exitmessage_
lea eax, [ebp - 0x6160]
mov dword [0x50b9a4], 0x46f94c
push 0x1ffe
push eax
call fcn.0044c423
push dword [0x50b9a4]
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
push 0x46f998
lea eax, [ebp - 0x6160]
push 0x1ffe
push eax
call fcn.0044c423
add esp, 0x30
lea eax, [ebp - 0x154c]
mov ecx, 0x51cdb8
push 0x54e7d0
push 0x51fe98
push 0x104
push eax
call fcn.00411d80
mov ecx, 0x51cdc8
call fcn.0041aaa0
push 0xa
push 0
lea eax, [ebp - 0x6160]
push eax
lea eax, [ebp - 0x154c]
push eax
push 0x46ef2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
call ebx
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40d94e
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d944
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db50
push edx
push ecx
call fcn.0044661e
add esp, 8
mov eax, 3
jmp 0x40db2d
cmp dword [0x50a534], 0
jne 0x40d9a3
push str.Unable_to_load_test_security_
push str.TestSecurityDLL
mov ecx, 0x51cdc8
call fcn.0041a630
push dword [0x529198]
call fcn.00441230
add esp, 4
mov dword [0x52b860], 0xffffffff
mov ecx, 0x51cdc8
mov dword [0x50b9b4], 1
push 0xffffffffffffffff
call fcn.0041abc0
cmp dword [0x50b61c], 0
jne 0x40d9ed
cmp dword [0x50b9b4], 0
jne 0x40d9ed
push str.Unauthorized_Access_
push str.UnauthorizedAccess
mov ecx, 0x51cdc8
call fcn.0041a630
push dword [0x529198]
call fcn.00441230
add esp, 4
mov dword [0x52b860], 0xffffffff
mov ecx, 0x51cdc8
push 0xffffffffffffffff
call fcn.0041abc0
mov ecx, 0x51cdc8
call fcn.0041aaa0
call fcn.00408b10
mov edx, dword [ebp - 0x8d64]
mov esi, dword [0x52b860]
cmp edx, 8
jb 0x40c43c
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c432
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db50
jmp 0x40c432
test eax, eax
jne 0x40da55
push 0x54ec10
call esi
mov dword [0x54ec0c], eax
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40db2d
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40da8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
jmp 0x40db2d
push str.SecureBrowser_is_already_running..._
push str.SecureBrowserIsAlreadyRunning
mov ecx, 0x51cdc8
call fcn.0041a630
mov ecx, 0x51cdc8
call fcn.0041aaa0
jmp 0x40b139
push 0x1000
push 0x46fab4
push str.Cant_open_OLE_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
mov ecx, 0x51cdc8
mov dword [0x52b860], 0xffffffff
call fcn.0041abc0
mov edx, dword [ebp - 0x8d64]
cmp edx, 8
jb 0x40db2a
mov ecx, dword [ebp - 0x8d78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40db20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40db4b
push edx
push ecx
call fcn.0044661e
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004465ed
mov esp, ebp
pop ebp
ret 0x10
call fcn.00451250
call fcn.00451250
int3