Function at 0x40ea50
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Delete file
Download url
Get common file path
Get file version info
Get session user name
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474d70
mov eax, dword fs:[0]
push eax
mov eax, 0x8cec
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0x100
mov dword [ebp - 0x8cd8], edi
mov dword [0x52a674], edi
mov dword [0x52a678], esi
mov dword [ebp - 0x8ccc], 0x200
mov dword [ebp - 0x8ce8], 1
mov dword [0x537dd8], 0
call fcn.00447b80
push 0x1ffe
mov dword [0x537ddc], eax
lea eax, [ebp - 0x4c9c]
push 0
push eax
call fcn.004500f0
push str.False
push 6
push 0x561108
mov dword [0x5162d0], 0
mov dword [0x5162d4], 0
mov dword [0x514990], 0
mov dword [0x52b0bc], 0
mov dword [0x52b0c0], 0
mov dword [0x5647dc], 0
mov dword [0x514994], 0
mov dword [ebp - 0x8ce0], 0
call fcn.00453332
push str.False
push 6
push 0x56110e
call fcn.00453332
add esp, 0x28
mov dword [0x5162dc], esi
lea ecx, [ebp - 0x8cc8]
mov dword [ebp - 0x8cc8], 0
mov dword [ebp - 0x8cb8], 0
mov dword [ebp - 0x8cb4], 7
push 0x16
push str.ITSSecureECLiteBrowser
call fcn.0040da40
xor esi, esi
push esi
call fcn.0045e280
push esi
call fcn.0045e280
inc esi
add esp, 8
cmp esi, 0x100
jl 0x40eb87
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x412add
cmp dword [ebp - 0x8cb4], 8
lea eax, [ebp - 0x8cc8]
cmovae eax, dword [ebp - 0x8cc8]
push eax
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0045f1f2
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax], 1
jle 0x40f863
mov esi, 1
call fcn.0045f1f2
cmp dword [eax], esi
jle 0x40f863
nop dword [eax + eax]
cmp esi, 1
jne 0x40ec23
call fcn.0045f1f8
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x51c2e0
call fcn.0045e4b4
add esp, 0xc
jmp 0x40ec53
push 0x478d10
push 0x1ffe
push 0x51c2e0
call fcn.004532c3
call fcn.0045f1f8
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x51c2e0
call fcn.004532c3
add esp, 0x18
call fcn.0045f1f8
push 4
push 0x478d14
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40ec91
call fcn.0045f1f8
push 4
push 0x478d20
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
jne 0x40eeef
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40eca0
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40eeef
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x800
push 0x515218
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x515218
call fcn.00421180
push eax
push 0x478918
push 0x400
push 0x514e18
call fcn.004085e0
push 7
push str.http:__
push 0x514e18
call fcn.0045e09a
add esp, 0x1c
test eax, eax
je 0x40eee0
push 8
push str.https:__
push 0x514e18
call fcn.0045e09a
add esp, 0xc
test eax, eax
je 0x40eee0
push str.s:__
push 0x514e18
call fcn.0045f721
add esp, 8
test eax, eax
je 0x40edec
sub eax, 0x514e18
add eax, 4
push eax
push 0x514e18
lea eax, [ebp - 0x107c]
push 0x400
push eax
call fcn.0045f704
lea ecx, [ebp - 0x107c]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ed80
push 0x400
lea eax, [ebp - 0x66c]
sub ecx, edx
push eax
push 8
push str.https:__
push ecx
lea eax, [ebp - 0x107c]
mov ecx, 0x5647e0
push eax
push 0x400
push 0x514e18
call fcn.00449900
lea eax, [ebp - 0x66c]
push eax
push 0x400
push 0x514e18
call fcn.00453332
lea eax, [ebp - 0x66c]
push eax
call fcn.004534bc
add esp, 0x10
mov dword [0x52b0a0], 1
jmp 0x40f855
push 0x478d48
push 0x514e18
call fcn.0045f721
add esp, 8
test eax, eax
je 0x40ee9d
sub eax, 0x514e18
add eax, 3
push eax
push 0x514e18
lea eax, [ebp - 0x107c]
push 0x400
push eax
call fcn.0045f704
lea ecx, [ebp - 0x107c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ee31
push 0x400
lea eax, [ebp - 0x66c]
sub ecx, edx
push eax
push 7
push str.http:__
push ecx
lea eax, [ebp - 0x107c]
mov ecx, 0x5647e0
push eax
push 0x400
push 0x514e18
call fcn.00449900
lea eax, [ebp - 0x66c]
push eax
push 0x400
push 0x514e18
call fcn.00453332
lea eax, [ebp - 0x66c]
push eax
call fcn.004534bc
add esp, 0x10
mov dword [0x52b0a0], 1
jmp 0x40f855
push 0x514e18
lea eax, [ebp - 0x66c]
push 0x400
push eax
call fcn.00453332
push str.https:__
push 0x400
push 0x514e18
call fcn.00453332
lea eax, [ebp - 0x66c]
push eax
push 0x400
push 0x514e18
call fcn.0045338c
add esp, 0x24
mov dword [0x52b0a0], 1
jmp 0x40f855
call fcn.0045f1f8
push 4
push 0x478d4c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f7d9
call fcn.0045f1f8
push 4
push str._log
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f7d9
call fcn.0045f1f8
push 9
push 0x478d64
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f75a
call fcn.0045f1f8
push 9
push str._errorlog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f75a
call fcn.0045f1f8
push 8
push 0x478d8c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f74b
call fcn.0045f1f8
push 8
push str._nocheck
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f74b
call fcn.0045f1f8
push 0x10
push 0x478db4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f6dc
call fcn.0045f1f8
push 0x10
push str._Institutioncode
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f6dc
call fcn.0045f1f8
push 7
push 0x478dfc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f61b
call fcn.0045f1f8
push 7
push str._Delete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f61b
call fcn.0045f1f8
push 0x10
push 0x478e1c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f59b
call fcn.0045f1f8
push 0x10
push str._testcompletelog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f59b
call fcn.0045f1f8
push 0xb
push 0x478e64
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f521
call fcn.0045f1f8
push 0xc
push str._adminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f521
call fcn.0045f1f8
push 0x14
push 0x478e9c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f4ab
call fcn.0045f1f8
push 0x14
push str._SBPathForadminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f4ab
call fcn.0045f1f8
push 8
push 0x478ef4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f432
call fcn.0045f1f8
push 8
push str._exitlog
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f432
call fcn.0045f1f8
push 7
push 0x478f1c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f3c4
call fcn.0045f1f8
push 7
push str._params
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f3c4
call fcn.0045f1f8
push 0x13
push 0x478f3c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f30e
call fcn.0045f1f8
push 0x13
push str._LauncherDeleteOnly
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f30e
call fcn.0045f1f8
push 0xf
push 0x478fe4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f2ad
call fcn.0045f1f8
push 0xf
push str._LauncherDelete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f2ad
call fcn.0045f1f8
push 5
push 0x479024
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
je 0x40f245
call fcn.0045f1f8
push 5
push str._Guid
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.00464092
add esp, 0xc
test eax, eax
jne 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f252
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xa
push eax
push 0x25
push 0x56091a
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x56091a
call fcn.00421180
push eax
push 0x478918
push 0x25
push 0x5608f4
call fcn.004085e0
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f2c0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x1e
push eax
push 0x104
push 0x55ea60
call fcn.0045e4b4
add esp, 0xc
push 0x55ea60
call ebx
mov dword [0x55ea5c], 0
jmp 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f320
sub ecx, edx
sar ecx, 1
cmp ecx, 0x13
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x26
push eax
push 0x104
push 0x55ea60
call fcn.0045e4b4
add esp, 0xc
push 0x55ea60
call ebx
push str.A_shortcut_for_the_Secure_Browser_has_been_created_on_the_desktop
push 0x478fd4
mov ecx, 0x52abf8
mov dword [0x55ea5c], 0
call fcn.00420960
mov edx, dword [ebp - 0x8cb4]
cmp edx, 8
jb 0x40f3bd
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f3b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
xor eax, eax
jmp 0x412b49
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f3d1
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
push 0x1000
push 0x55c28c
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x55c28c
call fcn.00421180
push eax
push 0x478918
push 0x1000
push 0x55b28c
call fcn.004085e0
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f440
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x10
push eax
push 0x104
push 0x53b4a8
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x53b4a8
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x53b3a4
call fcn.004085e0
mov dword [0x53b3a0], 1
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f4c0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x15
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x2a
push eax
push 0x104
push 0x527520
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x527520
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x527418
call fcn.004085e0
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f530
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x523208
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x523208
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x521208
call fcn.004085e0
mov dword [0x521200], 1
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f5b0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x104
push 0x55e390
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x55e390
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x55e28c
call fcn.004085e0
mov dword [0x5211fc], 1
jmp 0x40f852
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f630
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
lea eax, [ebp - 0x474]
push 0x104
push eax
call fcn.0045e4b4
add esp, 0xc
nop word [eax + eax]
lea eax, [ebp - 0x474]
push eax
call fcn.0040b340
add esp, 4
test eax, eax
je 0x40f670
push 0
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0
call fcn.004211f0
mov edx, dword [ebp - 0x8cb4]
cmp edx, 8
jb 0x40f3bd
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40f3b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
jmp 0x40f3b3
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f6f0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x64
push 0x53790c
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x53790c
call fcn.00421180
push eax
push 0x478918
push 0x64
push 0x52fb4c
call fcn.004085e0
jmp 0x40f852
mov dword [ebp - 0x8ce8], 0
jmp 0x40f855
mov dword [0x52b0b4], 1
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f771
sub ecx, edx
sar ecx, 1
cmp ecx, 9
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x52cde0
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x52cde0
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x52ccdc
call fcn.004085e0
mov dword [0x52b0a8], 1
jmp 0x40f852
mov dword [0x52b0b0], 1
call fcn.0045f1f8
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f7f0
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40f855
call fcn.0045f1f8
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x104
push 0x52e2ec
call fcn.0045e4b4
add esp, 0xc
mov ecx, 0x52abf8
push 0x52e2ec
call fcn.00421180
push eax
push 0x478918
push 0x104
push 0x52e1e8
call fcn.004085e0
mov dword [0x52b0ac], 1
add esp, 0x10
inc esi
call fcn.0045f1f2
cmp esi, dword [eax]
jl 0x40ec00
push 0x80
push 0x515e10
mov ecx, 0x4a7278
call fcn.00414bd0
push 0x104
push 0x539354
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x539354
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push 0x104
push 0x527208
call fcn.004085e0
add esp, 0xc
lea eax, [ebp - 0x8ce4]
push eax
push 0x539354
call sub.VERSION.dll_GetFileVersionInfoSizeA
push eax
push 0x2040
mov dword [ebp - 0x8ccc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
push dword [ebp - 0x8ccc]
push 0
push 0x539354
call sub.VERSION.dll_GetFileVersionInfoA
mov edx, 0x478714
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40f905
test al, al
je 0x40f901
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40f905
add ecx, 2
add edx, 2
test al, al
jne 0x40f8e5
xor eax, eax
jmp 0x40f90a
sbb eax, eax
or eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40f959
push 0x104
push 0x539458
push edi
call ebx
lea eax, [ebp - 0x8ce4]
push eax
push 0x539458
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
push 0x2040
mov dword [ebp - 0x8ccc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
push dword [ebp - 0x8ccc]
push 0
push 0x539458
call sub.VERSION.dll_GetFileVersionInfoW
mov ecx, 0x478714
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f980
test dl, dl
je 0x40f97c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f980
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f960
xor eax, eax
jmp 0x40f985
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40f9b6
push 0x539354
push str._filepath_
push str.Failed_to_get_file_version__filepath_
push 0x478fd4
mov ecx, 0x52abf8
call fcn.00420c10
mov ecx, 0x52abf8
call fcn.004210d0
jmp 0x40f37d
lea eax, [ebp - 0x8ccc]
push eax
lea eax, [ebp - 0x8cdc]
push eax
push 0x478870
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x8cdc]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x479070
push 0x52dce8
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x8cdc]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push str._d._d._d._d
push 0x514998
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x30
mov dword [0x515a7c], edi
lea eax, [ebp - 0xc7c]
push 0x104
push eax
push edi
call ebx
lea eax, [ebp - 0x1684]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
nop
movzx eax, word [ebp + ecx - 0x1684]
lea ecx, [ecx + 2]
mov word [ecx + 0x527726], ax
test ax, ax
jne 0x40fa50
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0xc7c]
lea ecx, [ecx + 2]
mov word [ecx + 0x52792e], ax
test ax, ax
jne 0x40fa70
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0xc7c]
lea ecx, [ecx + 2]
mov word [ecx + 0x55e61e], ax
test ax, ax
jne 0x40fa90
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x52730c], 0
nop word [eax + eax]
imul eax, eax, 0x208
mov ecx, 0x52a6a0
add eax, 0x527728
push eax
push 0x104
push 0x52a250
call fcn.00416a50
mov eax, dword [0x537df8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x64]
push eax
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x400
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x52a250
mov dword [ebp - 0x50], 0x478b6c
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x44], 0
call esi
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call edi
push dword [ebp - 0x2c]
call ebx
mov ecx, 0x52abf8
call fcn.004210d0
test eax, eax
jne 0x40fbda
mov eax, dword [0x52730c]
inc dword [0x527414]
inc eax
mov dword [0x52730c], eax
cmp eax, 1
jle 0x40fad0
push str.To_use_this_application__you_must_have_execute_and_write_access_to_one_of_the_following_folders:__r_n_r_n_r_n___C:UsersYourUsernameTemp__r_n_r_n___The_current_location_you_are_running_the_Secure_Browser
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420170
mov edx, dword [ebp - 0x8cb4]
cmp edx, 8
jb 0x40fbd0
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fbc6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov eax, 0xb
jmp 0x412b49
imul eax, dword [0x52730c], 0x208
mov edx, 0x55e620
lea ecx, [eax + 0x527728]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40fbf1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea esi, [ebp - 0x2a]
mov dword [0x52a670], ecx
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x40fc12
xor eax, eax
lea edx, [ebp - 0x2a]
mov dword [ebp - 0x8cb0], eax
mov ecx, 7
mov dword [ebp - 0x8ca0], eax
mov dword [ebp - 0x8c9c], ecx
cmp esi, edx
je 0x40fc71
mov eax, edx
lea ecx, [ebp - 0x8cb0]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0040da40
mov ecx, dword [ebp - 0x8c9c]
mov eax, dword [ebp - 0x8cb0]
push 1
cmp ecx, 8
lea edx, [ebp - 0x8cb0]
push 0
cmovae edx, eax
push edx
push 0x52a250
push 0x47916c
push 0
mov dword [ebp - 0x8cd4], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x55e620
push 0x52dce8
push 0x104
lea eax, [ebp - 0x874]
mov ecx, 0x52a6a0
push eax
call fcn.00416e10
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x514990], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push dword [0x514990]
call fcn.00448ba0
push str.Entered_Secure_Browser
push 1
push dword [0x514990]
call fcn.00449450
push str._________________________________________________________________________________________________________________________________________________________________
push 1
push dword [0x514990]
call fcn.00449450
push str.Security_DLL_Loaded
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x2c
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x874]
lea ecx, [ecx + 2]
mov word [ecx + 0x52a456], ax
test ax, ax
jne 0x40fd20
mov edi, dword [ebp - 0x8cd8]
lea eax, [ebp - 0x874]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push edi
call esi
lea eax, [ebp - 0x8ce4]
push eax
lea eax, [ebp - 0x874]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
push 0x2040
mov dword [ebp - 0x8ccc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
lea eax, [ebp - 0x874]
push ebx
push dword [ebp - 0x8ccc]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov edx, 0x478714
mov ecx, ebx
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40fdb5
test al, al
je 0x40fdb1
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40fdb5
add ecx, 2
add edx, 2
test al, al
jne 0x40fd95
xor eax, eax
jmp 0x40fdba
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40fe2a
mov ecx, 0x52abf8
call fcn.004210d0
mov edx, dword [ebp - 0x8c9c]
cmp edx, 8
jb 0x40fe08
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fdfe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
jmp 0x40f37d
lea eax, [ebp - 0x8ccc]
push eax
lea eax, [ebp - 0x8cdc]
push eax
push 0x478870
push ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x8cdc]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push str._d._d._d._d
push 0x534618
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x188c]
push 0x104
push eax
push edi
call esi
push 0x479178
lea eax, [ebp - 0x188c]
mov ecx, 0x52abf8
push eax
call fcn.0041ce70
mov dword [0x52a24c], eax
test eax, eax
jne 0x40ff13
mov ecx, 0x52abf8
call fcn.004210d0
call fcn.0040b0b0
mov edx, dword [ebp - 0x8c9c]
cmp edx, 8
jb 0x40fe08
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fee7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov dword [ebp - 0x8ca0], 0
xor eax, eax
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
jmp 0x40f37d
push 0x55e620
push 0x104
push 0x53ab34
mov ecx, 0x52a6a0
call fcn.004159c0
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x80
push 0x515e90
mov ecx, 0x4e2960
mov dword [ebp - 0x8cd8], eax
call fcn.00408230
mov ecx, 0x4a7278
call fcn.00414d10
push 0x4a7294
call fcn.0045f0c2
add esp, 4
mov dword [0x52a668], eax
lea eax, [ebp - 0x8cd0]
mov dword [ebp - 0x8cd0], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x40ffae
cmp dword [ebp - 0x8cd0], 0
je 0x40ffae
mov eax, dword [str.Win64]
mov dword [0x560890], eax
mov ax, word [0x479180]
mov dword [0x52a66c], 1
jmp 0x40ffc8
mov eax, dword [str.Win32]
mov dword [0x560890], eax
mov ax, word [0x479188]
mov dword [0x52a66c], 0
push 0x527208
push 0
push 0x1f0001
mov word [0x560894], ax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x412a5d
push 0x527208
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 0x4a7278
call fcn.00415260
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
xor esi, esi
push 0
push str.WorkerW
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x410031
test esi, esi
jne 0x410008
jmp 0x410035
test esi, esi
jne 0x410067
push 0
push str.Progman
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x41005c
test esi, esi
jne 0x410035
push 3
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push 0x200
lea eax, [ebp - 0x249c]
mov dword [0x52a664], esi
push eax
push dword [0x514990]
call fcn.00448bc0
mov dword [0x5211f0], eax
lea eax, [ebp - 0x289c]
push 0x200
push eax
push dword [0x514990]
call fcn.00448c60
mov dword [0x5211f4], eax
lea eax, [ebp - 0x2c9c]
push 0x200
push eax
push dword [0x514990]
call fcn.00448c10
mov esi, dword [ebp - 0x8cd8]
push 0x200
push 0x537ec8
push esi
push dword [0x514990]
mov dword [0x5211f8], eax
call fcn.00448d10
add esp, 0x34
mov ecx, 0x5647e0
call fcn.00449a80
push esi
push str.The_Current_Process_ID_is____d
push 1
push dword [0x514990]
call fcn.00449450
push 0x514998
push str.Secure_Browser_Version____s
push 1
push dword [0x514990]
call fcn.00449450
call fcn.0040c380
push dword [0x515b4c]
push dword [0x515b50]
push dword [0x515ae4]
push str._u._u._u
push 0x80
push 0x515b58
call fcn.004085e0
push 0x515b58
push str.OS_Version____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x48
push str.Secure_Browser_Type___WINCSECB
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push dword [0x514990]
mov dword [0x515b54], eax
call fcn.00448cd0
push str.before_MAC_Address
push 1
push dword [0x514990]
call fcn.00449450
mov eax, dword [0x515b54]
add esp, 0x14
push 0
push 0
push 0x200
push 0x561314
push 0xffffffffffffffff
push dword [eax + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [0x515b54]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call edi
push 0x561314
push str.MAC_Address____s
push 1
push dword [0x514990]
call fcn.00449450
push str.after_MAC_Address
push 1
push dword [0x514990]
call fcn.00449450
push 0x200
push 0x539f5c
push dword [0x514990]
call fcn.00448c40
push 0x539f5c
push str.Active_MAC_Address____s
push 1
push dword [0x514990]
call fcn.00449450
push 0x200
push 0x561114
push dword [0x514990]
call fcn.00448bf0
add esp, 0x44
push 0x561114
push str.Active_IP_Address____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
mov ecx, 0x4a7278
call fcn.00414fa0
push dword [0x514990]
call fcn.004494b0
test eax, eax
mov edx, 0x478714
mov ecx, str._WIFI
push 0x28
cmove ecx, edx
push ecx
push 0x28
push 0x516290
call fcn.004534a6
push 0x515bd8
push str.Network_Adapter____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x24
lea eax, [ebp - 0x8ccc]
push eax
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xa74]
push eax
push str.Network_User____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
push ebx
call edi
mov ecx, 0x52a6a0
call fcn.00415e90
mov ecx, 0x514988
mov dword [0x52b038], eax
call fcn.004086b0
push 0x55e82c
mov ecx, 0x52abf8
mov dword [0x52b000], eax
call fcn.0041b1a0
mov ecx, 0x52abf8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410310
sub ecx, edx
jne 0x41034e
push 0x400
push 0x52abf8
push str.UPDATEURL
push 0x94
mov ecx, 0x52a6a0
call fcn.00416660
push str.After_ExtractResourceString___UPDATEURL
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, 0x52abf8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410356
mov eax, dword [0x52b04c]
sub ecx, edx
push 0x400
xor edx, edx
test ecx, ecx
push 0x52f2e8
push str.ERRORURL
cmovne eax, edx
mov ecx, 0x52a6a0
push 0xa1
mov dword [0x52b04c], eax
call fcn.00416660
mov ecx, 0x47932c
mov eax, 0x536c44
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4103b8
test dl, dl
je 0x4103b4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4103b8
add eax, 2
add ecx, 2
test dl, dl
jne 0x410398
xor eax, eax
jmp 0x4103bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x4103c8
mov eax, 0x536c44
jmp 0x4103d2
mov ecx, 0x52abf8
call fcn.0041b140
push eax
push str.programid_s
push 0x64
push 0x52fd40
call fcn.004085e0
push 0x52fd40
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x1c
mov ecx, 0x478714
mov eax, 0x536be0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410423
test dl, dl
je 0x41041f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410423
add eax, 2
add ecx, 2
test dl, dl
jne 0x410403
xor eax, eax
jmp 0x410428
sbb eax, eax
or eax, 1
test eax, eax
je 0x410433
mov eax, 0x536be0
jmp 0x410442
push 0x52e4f4
mov ecx, 0x4e2960
call fcn.00408040
push eax
push str.environmentid_s
push 0x64
push 0x52fcdc
call fcn.004085e0
push 0x52fcdc
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x1c
mov ecx, 0x4e2960
push 0x52e558
call fcn.00408000
push eax
push str.candidateid_s
push 0x64
push 0x52fc14
call fcn.004085e0
push 0x52fc14
push 1
push dword [0x514990]
call fcn.00449450
push 0x64
push 1
call fcn.004534b1
add esp, 0x24
mov dword [0x4e2960], eax
mov ecx, 0x52a6a0
call fcn.00415b50
push str.After_extracting_institution_Id
push 1
push dword [0x514990]
mov dword [0x537de4], eax
call fcn.00449450
push dword [0x537de4]
push 0x4787e4
push 0x64
push dword [0x4e2960]
call fcn.004085e0
add esp, 0x1c
mov ecx, 0x47932c
mov eax, 0x536b18
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410513
test dl, dl
je 0x41050f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410513
add eax, 2
add ecx, 2
test dl, dl
jne 0x4104f3
xor eax, eax
jmp 0x410518
sbb eax, eax
or eax, 1
test eax, eax
je 0x410523
mov eax, 0x536b18
jmp 0x41052d
mov ecx, 0x4e2960
call fcn.00408120
push eax
push str.institutionid_s
push 0x64
push 0x52fc78
call fcn.004085e0
add esp, 0x10
mov ecx, 0x47932c
mov eax, 0x536b7c
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410570
test dl, dl
je 0x41056c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410570
add eax, 2
add ecx, 2
test dl, dl
jne 0x410550
xor eax, eax
jmp 0x410575
sbb eax, eax
or eax, 1
test eax, eax
je 0x4105f3
mov ecx, 0x478714
mov eax, 0x52fb4c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4105a7
test dl, dl
je 0x4105a3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4105a7
add eax, 2
add ecx, 2
test dl, dl
jne 0x410587
xor eax, eax
jmp 0x4105ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4105f3
mov al, byte [0x536b7c]
xor ecx, ecx
test al, al
je 0x4105d3
mov edx, 0x536b7c
cmp al, 0x20
je 0x4105cb
mov byte [ecx + 0x536b7c], al
inc ecx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x4105c0
push 0x536b7c
push 0x478918
push 0x64
push 0x52fb4c
mov byte [ecx + 0x536b7c], 0
call fcn.004085e0
add esp, 0x10
push 0x52e620
mov ecx, 0x4e2960
call fcn.00408180
push eax
push str.language_s
push 0x64
push 0x52e5bc
call fcn.004085e0
add esp, 0x10
cmp dword [0x52b04c], 0
je 0x41066b
push 0x400
push 0x514a18
push 0x4793a4
push 0x75
mov ecx, 0x52a6a0
call fcn.00416660
push str.local_configuration
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, 0x52a6a0
push 0x400
push 0x52dde8
push 0x4793bc
push 0x7c
call fcn.00416660
mov ecx, 0x478714
mov eax, 0x536ca8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410695
test dl, dl
je 0x410691
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410695
add eax, 2
add ecx, 2
test dl, dl
jne 0x410675
xor eax, eax
jmp 0x41069a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4106b3
xor ecx, ecx
mov al, byte [ecx + 0x536ca8]
lea ecx, [ecx + 1]
mov byte [ecx + str.:WINCSECB], al
test al, al
jne 0x4106a0
mov ecx, 0x4a7278
call fcn.00415090
push dword [0x514990]
call fcn.00448f80
add esp, 4
test eax, eax
je 0x4106ed
mov ecx, 0x4a7278
call fcn.00415110
mov ecx, 0x4a7278
call fcn.00415000
mov ecx, 0x4a7278
call fcn.00415420
cmp dword [0x52b04c], 0
mov ecx, 0x52abf8
jne 0x410898
call fcn.0041a130
push 0
push 0x515ddc
push 0
call sub.urlmon.dll_CoInternetCreateZoneManager
test eax, eax
js 0x41088c
mov ecx, 0x478714
mov eax, 0x53ad3c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410744
test dl, dl
je 0x410740
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410744
add eax, 2
add ecx, 2
test dl, dl
jne 0x410724
xor eax, eax
jmp 0x410749
sbb eax, eax
or eax, 1
test eax, eax
je 0x41086a
push str.s:__
push 0x52abf8
call fcn.0045f721
add esp, 8
test eax, eax
je 0x410799
add eax, 4
push eax
lea eax, [ebp - 0x147c]
push 0x800
push eax
call fcn.00453332
movq xmm0, qword [str.https:__]
mov al, byte [0x478d3c]
movq qword [ebp - 0x66c], xmm0
mov byte [ebp - 0x664], al
jmp 0x4107d8
push 0x478d48
push 0x52abf8
call fcn.0045f721
add esp, 8
test eax, eax
je 0x4107db
add eax, 3
push eax
lea eax, [ebp - 0x147c]
push 0x800
push eax
call fcn.00453332
mov dword [ebp - 0x66c], 0x70747468
mov dword [ebp - 0x668], 0x2f2f3a
add esp, 0xc
lea eax, [ebp - 0x147c]
push 0x4793c4
push eax
call fcn.0045f721
mov edx, 0x53ad3c
add esp, 8
mov ebx, eax
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4107f8
lea edi, [ebp - 0x66c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410808
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x410820
lea edi, [ebp - 0x66c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410830
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [0x52abf8], al
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x66c]
lea ecx, [ecx + 1]
mov byte [ecx + 0x52abf7], al
test al, al
jne 0x410850
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0x52d3e8
push 0x52abf8
mov ecx, 0x5647e8
call fcn.0044c830
mov ecx, 0x52abf8
call fcn.00418d40
jmp 0x41089d
mov dword [ebp - 0x8ce0], 1
jmp 0x41089d
call fcn.0041ddc0
mov ecx, str.Windows_NT_10.0
mov eax, 0x515e90
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4108c7
test dl, dl
je 0x4108c3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4108c7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4108a7
xor eax, eax
jmp 0x4108cc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x410913
push str.User32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x410913
push str.SetThreadDpiAwarenessContext
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410913
push 0xfffffffffffffffe
call eax
test eax, eax
je 0x4108fe
push str.dpi_set_successfully
jmp 0x410903
push str.dpi_not_set
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push dword [0x514990]
call fcn.00448b20
add esp, 4
test eax, eax
je 0x410a37
push 0
push 0
push 1
push 0x11
push str.MIRACAST_Display_Detected
mov ecx, 0x52abf8
call fcn.0041c080
cmp dword [0x52b088], 0
je 0x410a37
push str.A_MIRACAST_display_has_been_detected._Check_that_there_are_no_active_MIRACAST_connections_and_try_again.
push str.MiracastDisplayDetected
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004210d0
push 0x4c
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0x4c
call fcn.004211f0
call fcn.0040b0b0
mov edx, dword [ebp - 0x8c9c]
cmp edx, 8
jb 0x4109d0
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4109c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov edx, dword [ebp - 0x8cb4]
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
cmp edx, 8
jb 0x410a2d
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410a23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov eax, 0x4c
jmp 0x412b49
push str.True
push 0x535f18
call fcn.0045f54b
add esp, 8
test eax, eax
jne 0x410a73
push dword [0x560888]
push dword [0x560884]
push dword [0x56087c]
push dword [0x560880]
push dword [0x514990]
call fcn.00448a10
add esp, 0x14
push str.log_check_0D
push 0
push dword [0x514990]
call fcn.00449450
push str.log_check_2W
push 2
push dword [0x514990]
call fcn.00449450
push str.log_check_3E
push 3
push dword [0x514990]
call fcn.00449450
push str.log_check_5C
push 5
push dword [0x514990]
call fcn.00449450
push str.log_check_4S
push 4
push dword [0x514990]
call fcn.00449450
mov eax, dword [0x55ea5c]
add esp, 0x3c
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410aeb
push 0x55ea60
call ebx
mov dword [0x55ea5c], eax
cmp dword [0x52b0a4], 0
jne 0x412a08
cmp dword [0x52affc], 0
jne 0x410b5b
cmp dword [0x52b000], 0
jne 0x410b5b
push str.This_secure_browser_requires_administrative_privileges._Please_run_this_secure_browser_as_an_Administrator.
push str.RequiresAdmin
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004210d0
push dword [0x537ddc]
call fcn.004479e0
add esp, 4
mov dword [0x53b6b0], 8
mov ecx, 0x52abf8
mov dword [0x5162c8], 1
push 8
call fcn.004211f0
jmp 0x41299e
mov esi, dword [ebp - 0x8ce8]
test esi, esi
je 0x410b86
push 0x52dc68
push 0x52dbe8
push 0x514998
mov ecx, 0x52abf8
call fcn.0041b290
test eax, eax
jne 0x412317
cmp dword [0x514990], 0
je 0x412315
cmp dword [0x52b04c], 0
je 0x410bc1
mov ecx, 0x52a6a0
call fcn.004163c0
push eax
push str.sBrowserEngineId_from_Local_Config____d
push 1
push dword [0x514990]
mov dword [0x55e598], eax
call fcn.00449450
add esp, 0x10
mov eax, dword [0x55e598]
cmp eax, 1
jne 0x410dc4
mov ecx, 0x52abf8
call fcn.004210d0
push 0x5162e0
push 0x1ffe
push 0x527b38
call fcn.00453332
push 0x55e620
push dword [0x52b04c]
push 0x104
push 0x529b38
call fcn.0040b9e0
push 0x529b38
push str.ExtractSB____s
push 1
push dword [0x514990]
call fcn.00449450
push 0x529b38
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.0045e4b4
add esp, 0x38
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x479574
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.004532c3
push 0x479578
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410c9f
push 0x55e620
push 0x104
lea eax, [ebp - 0x26c]
mov ecx, 0x52a6a0
push eax
call fcn.00416a50
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x26c]
push 1
push 0
push dword [ebp - 0x8cd4]
push eax
push 0x47916c
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x538ed0
push 0x1ffe
push 0x527b38
call fcn.0045338c
push str.___filePath_
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x539354
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x4795c4
push 0x1ffe
push 0x527b38
call fcn.0045338c
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x527b38
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push eax
push 0xffffffffffffffff
push 0x527b38
push 0
push 0xfde9
mov dword [0x52751c], eax
call edi
push 1
push 0
push dword [0x52751c]
push 0x529b38
push 0x47916c
push 0
call ebx
push 0x529b38
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
cmp dword [0x55ea5c], 0
jne 0x410db5
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55ea60
call eax
mov dword [0x55ea5c], eax
mov ecx, 0x52abf8
call fcn.00418490
jmp 0x4112e3
cmp eax, 4
je 0x410dd2
cmp eax, 5
jne 0x411386
call fcn.0040bb40
test eax, eax
jne 0x411386
cmp dword [0x55e598], 4
mov ecx, 0x52abf8
jne 0x4110c9
push str.Installation_Required__The_Secure_Browser_requires_that_Microsoft_Edge_Runtime_be_installed_on_this_device._This_installation_will_require_administrative_privileges._Click_OK_to_exit_the_Secure_Browser_and_proceed_with_the_installation.
push str.EdgeInstallerRequest
call fcn.004205a0
test eax, eax
je 0x410fd8
xor esi, esi
push esi
push esi
push str..MicrosoftEdgeWebview2Setup.exe
push str.https:__go.microsoft.com_fwlink_p__LinkId2124703
push esi
mov dword [ebp - 0x8cd0], esi
call sub.urlmon.dll_URLDownloadToFileA
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
jne 0x410ec9
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0x3c
lea eax, [ebp - 0x64]
movlpd qword [ebp - 0x5c], xmm0
push eax
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x54], str.MicrosoftEdgeWebview2Setup.exe
mov dword [ebp - 0x50], str._AllUsers__S
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x410ec9
mov edi, dword [ebp - 0x8cd0]
test edi, edi
je 0x410ea0
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x8cd0]
mov dword [ebp - 0x8cd0], 0
push eax
push 0
call fcn.004018da
mov edi, dword [ebp - 0x8cd0]
test edi, edi
je 0x410ea0
mov esi, 1
jmp 0x410ecf
mov edi, dword [ebp - 0x8cd0]
test edi, edi
je 0x410ee4
push edi
mov dword [ebp - 4], 1
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x411386
push str.The_installation_failed._Administrative_privileges_are_required_to_complete_the_installation.
push str.EdgeInstallerFailed
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004210d0
mov eax, dword [0x4a709c]
mov ecx, 0x52abf8
push eax
mov dword [0x53b6b0], eax
call fcn.004211f0
call fcn.0040b0b0
mov ecx, 0x52abf8
call fcn.00418490
mov edx, dword [ebp - 0x8c9c]
mov esi, dword [0x4a709c]
cmp edx, 8
jb 0x410f74
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410f6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov edx, dword [ebp - 0x8cb4]
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
cmp edx, 8
jb 0x410fd1
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410fc7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov eax, esi
jmp 0x412b49
mov ecx, 0x52abf8
call fcn.004210d0
mov eax, dword [0x4a709c]
mov ecx, 0x52abf8
push eax
mov dword [0x53b6b0], eax
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.00418490
call fcn.0040b0b0
cmp dword [0x55ea5c], 0
jne 0x41101b
push 0x55ea60
call ebx
mov dword [0x55ea5c], eax
mov edx, dword [ebp - 0x8c9c]
mov esi, dword [0x4a709c]
cmp edx, 8
jb 0x411061
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411057
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov edx, dword [ebp - 0x8cb4]
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
cmp edx, 8
jb 0x410fd1
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4110b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov eax, esi
jmp 0x412b49
call fcn.004210d0
push 0x5162e0
push 0x1ffe
push 0x527b38
call fcn.00453332
push 0x529b38
push str.BeforeExtractSB____s
push 1
push dword [0x514990]
call fcn.00449450
push 0x55e620
push dword [0x52b04c]
push 0x104
push 0x529b38
call fcn.0040b9e0
push 0x529b38
push str.ExtractSB____s
push 1
push dword [0x514990]
call fcn.00449450
push 0x529b38
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.0045e4b4
add esp, 0x48
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x479574
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.004532c3
push 0x479578
lea eax, [ebp - 0x26c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4111ab
push 0x55e620
push 0x104
lea eax, [ebp - 0x26c]
mov ecx, 0x52a6a0
push eax
call fcn.00416a50
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x26c]
push 1
push 0
push dword [ebp - 0x8cd4]
push eax
push 0x47916c
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x538ed0
push 0x1ffe
push 0x527b38
call fcn.0045338c
push str.___filePath_
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x539354
push 0x1ffe
push 0x527b38
call fcn.0045338c
push 0x4795c4
push 0x1ffe
push 0x527b38
call fcn.0045338c
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x527b38
push 0
push 0xfde9
call edi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push eax
push 0xffffffffffffffff
push 0x527b38
push 0
push 0xfde9
mov dword [0x52751c], eax
call edi
push 1
push 0
push dword [0x52751c]
push 0x529b38
push 0x47916c
push 0
call ebx
push 1
push 0
push dword [0x52751c]
push 0x529b38
push 0x47916c
push 0
call ebx
push 0x529b38
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
mov ecx, 0x52abf8
call fcn.00418490
cmp dword [0x55ea5c], 0
jne 0x4112e3
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55ea60
call eax
mov dword [0x55ea5c], eax
mov edx, dword [ebp - 0x8c9c]
cmp edx, 8
jb 0x411323
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411319
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov edx, dword [ebp - 0x8cb4]
xor eax, eax
mov word [ebp - 0x8cb0], ax
mov dword [ebp - 0x8c9c], 7
mov dword [ebp - 0x8ca0], eax
cmp edx, 8
jb 0x41137c
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411372
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov eax, 2
jmp 0x412b49
push 0x55e620
mov ecx, 0x52a6a0
call fcn.00416c10
push 0x108
call fcn.0044d32b
mov edi, eax
add esp, 4
test edi, edi
je 0x4113d9
sub esp, 0x28
mov ecx, esp
push 0
push 0
sub esp, 0x18
mov dword [ecx + 0x24], 0
mov esi, esp
push 0x479784
call fcn.0040ac60
add esp, 4
mov ecx, esi
push eax
call fcn.00409900
mov ecx, edi
call fcn.00422770
push 0
push dword [0x537df8]
call dword [sym.imp.USER32.dll_RegisterSuspendResumeNotification]
mov ecx, 0x4a7278
call fcn.00414b60
cmp dword [0x4a7460], 1
jne 0x411492
lea eax, [ebp - 0x370]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x411492
push str.ITSAutomation.log
lea eax, [ebp - 0x370]
push 0x104
push eax
call fcn.0045338c
add esp, 0xc
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x370]
mov ecx, 0x52abf8
push eax
call fcn.00418a20
push 0x4797a4
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x8cd4]
push eax
call fcn.0045f2b5
add esp, 0xc
test eax, eax
jne 0x411492
push dword [0x537df8]
push 0x4797a8
push dword [ebp - 0x8cd4]
call fcn.0040e9b0
push dword [ebp - 0x8cd4]
call fcn.0045f421
add esp, 0x10
push 0x5162cc
push dword [0x514990]
call fcn.00448b60
push 0x64
push 0x537e00
push dword [0x514990]
mov dword [0x52b0d0], eax
call fcn.00448f50
push str.After_checking_VM
push 1
push dword [0x514990]
mov dword [0x52b0bc], eax
call fcn.00449450
push dword [0x514990]
call fcn.00448ef0
push str.After_checking_RDP
push 1
push dword [0x514990]
mov dword [0x52b0c0], eax
call fcn.00449450
add esp, 0x30
cmp dword [0x52b0bc], 0
je 0x411525
push str._VM_
push 0x10
push 0x5162b8
call fcn.00453332
push str.True
push 6
push 0x561108
call fcn.00453332
add esp, 0x18
jmp 0x41155c
cmp dword [0x52b0c0], 0
je 0x411555
push str._RDPSESSION_
push 0x10
push 0x5162b8
call fcn.00453332
push str.True
push 6
push 0x56110e
call fcn.00453332
add esp, 0x18
jmp 0x41155c
mov byte [0x5162b8], 0
cmp dword [0x52b094], 0
je 0x411643
cmp dword [0x52b038], 0
je 0x411586
push str.WINCHSECB
push 0xa
push 0x4a7088
call fcn.00453332
add esp, 0xc
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x5211f0]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x5211f4]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x5211f8]
call fcn.0045fbb9
push 0x4a735c
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x55e82c
push 0x534618
push 0x516290
push 0x5162b8
push 0x52c8dc
push 0x4a7088
push 0x514998
push str._SecureBrowser__s__s__s_s__s__TS__s__UUID__s__DKM:_s._s._s__FP__s_
push 0x52f6e8
call ebx
add esp, 0x58
push 0x52f6e8
push str.User_Agent_after_replacement___s
push 1
push dword [0x514990]
call fcn.00449450
push 0x52c8dc
push 0x4a7088
push str._s__s
push 0x52eee8
call ebx
add esp, 0x20
push dword [0x515de0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x411726
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x5211f0]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x5211f4]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x5211f8]
call fcn.0045fbb9
add esp, 0x24
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp dword [0x52b04c], 0
lea eax, [ebp - 0x18]
push 0x4a735c
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x560890
push 0x55e82c
push 0x534618
push 0x516290
push 0x5162b8
jne 0x4116f2
push 0x52c8dc
push 0x4a7088
push 0x514998
push 0x539f44
push 0x515e90
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg__s__SecureBrowser__s__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s__FP__s_
push 0x52f6e8
call ebx
push 0x52c8dc
push 0x4a7088
push str._s__s
push 0x52eee8
call ebx
add esp, 0x50
jmp 0x411726
push 0x4a7088
push 0x514998
push 0x539f44
push 0x515e90
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg__s__SecureBrowser__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s__FP__s_
push 0x52f6e8
call ebx
push 0x4a7088
push 0x478918
push 0x52eee8
call ebx
add esp, 0x48
mov ecx, 0x52abf8
call fcn.0041ef60
push dword [ebp - 0x8cd8]
push str.Current_Process_ID____d
push 1
push dword [0x514990]
call fcn.00449450
push 0x514998
push str.Secure_Browser_Version____s
push 1
push dword [0x514990]
call fcn.00449450
call fcn.0040c380
push dword [0x515b4c]
push dword [0x515b50]
push dword [0x515ae4]
push str._u._u._u
push 0x80
push 0x515b58
call fcn.004085e0
push 0x515b58
push str.OS_Version____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x48
push str.Secure_Browser_Type___WINCSECB
push 1
push dword [0x514990]
call fcn.00449450
push 0x539f5c
push str.MAC_Address____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x1c
lea eax, [ebp - 0x8ccc]
push eax
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xa74]
push eax
push str.Network_User____s
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
mov ecx, 0x52abf8
call fcn.0041fbb0
mov ecx, 0x52abf8
call fcn.0041ffd0
mov ecx, 0x52abf8
call fcn.0041f560
mov ecx, 0x52abf8
call fcn.0041f700
mov ecx, 0x52abf8
call fcn.0041fa40
mov ecx, 0x52abf8
call fcn.0041f8a0
mov ecx, 0x52abf8
call fcn.0041f430
mov ecx, 0x52abf8
call fcn.0041f1c0
cmp dword [0x52b06c], 0
je 0x411874
push dword [0x539e3c]
push 0x53966c
push 0
push dword [0x514990]
call fcn.00449000
add esp, 0x10
cmp dword [0x52b04c], 0
je 0x411889
mov ecx, 0x52a6a0
call fcn.00415cf0
jmp 0x41188e
mov eax, dword [0x537de0]
push eax
push dword [0x514990]
mov dword [0x515de8], eax
call fcn.004493e0
push dword [0x52b020]
push dword [0x514990]
call fcn.00448890
push dword [0x52b018]
push dword [0x514990]
call fcn.004489b0
push dword [0x52b03c]
push dword [0x514990]
call fcn.00448870
push dword [0x52b024]
push dword [0x514990]
call fcn.00448830
push dword [0x52b02c]
push dword [0x514990]
call fcn.00448a40
push dword [0x52b028]
push dword [0x514990]
call fcn.004489d0
push dword [0x52b048]
push dword [0x514990]
call fcn.004487f0
add esp, 0x40
push dword [0x52b030]
push dword [0x514990]
call fcn.00448a60
push dword [0x52b050]
push dword [0x514990]
call fcn.00448810
push dword [0x52b054]
push dword [0x514990]
call fcn.004488b0
push dword [0x52b058]
push dword [0x514990]
call fcn.00448850
push dword [0x52b05c]
push dword [0x514990]
call fcn.00448b00
push dword [0x52b014]
push dword [0x514990]
call fcn.00448990
push dword [0x52b010]
push dword [0x514990]
call fcn.00448970
push dword [0x52b074]
push dword [0x514990]
call fcn.00448ac0
add esp, 0x40
push dword [0x52b08c]
push dword [0x514990]
call fcn.00448950
push dword [0x52b090]
push dword [0x514990]
call fcn.00448aa0
push 0x53b190
push dword [0x514990]
call fcn.00448a80
push dword [0x561cf0]
push dword [0x514990]
call fcn.004488d0
add esp, 0x20
cmp dword [0x52b0c0], 0
je 0x4119fc
cmp dword [0x52b0bc], 0
jne 0x411a15
push 0x534698
call fcn.0045f0c2
push eax
push dword [0x514990]
call fcn.00448930
add esp, 0xc
push 0x53b294
call fcn.0045f0c2
push eax
push dword [0x514990]
call fcn.00448910
push dword [0x52b060]
push dword [0x514990]
call fcn.004488f0
add esp, 0x14
push 0
push 0
push 0x10
push dword [0x52a248]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x537df8]
test eax, eax
je 0x41230d
cmp dword [0x52b0a0], 0
mov dword [0x515dec], eax
je 0x411af3
mov ecx, 0x478714
mov eax, 0x55b28c
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411aa0
test dl, dl
je 0x411a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x411a80
xor eax, eax
jmp 0x411aa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x411adc
mov ecx, 0x478714
mov eax, 0x5608f4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411ad3
test dl, dl
je 0x411acf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411ad3
add eax, 2
add ecx, 2
test dl, dl
jne 0x411ab3
xor eax, eax
jmp 0x411ad8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x411af3
push 0x514e18
push 0x1000
push 0x514a18
call fcn.00453332
add esp, 0xc
push 1
push 0x5647e8
push 0x514a18
mov ecx, 0x5647e8
call fcn.0044c830
mov ecx, 0x5647e8
call fcn.0044cb20
mov ecx, 0x5647e8
call fcn.0044c940
cmp dword [0x52aff8], 0
je 0x411b46
push 4
push 0x537dec
push 0x51
push 0
mov dword [0x537dec], 3
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [0x52b0c4], eax
cmp dword [0x52b05c], 0
je 0x411b87
push str.SetSBWindowAffinity_called
push 1
push dword [0x514990]
call fcn.00449450
push dword [0x537df8]
push dword [0x514990]
call fcn.004493c0
push str.SetSBWindowAffinity_completed
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x20
push dword [0x537df8]
push dword [0x514990]
call fcn.00448c90
push 4
push dword [0x514990]
call fcn.00449380
add esp, 0x10
cmp dword [0x52b00c], 0
jne 0x411bcd
push 0x64
push 0x537e00
push dword [0x514990]
call fcn.00448f50
add esp, 0xc
mov dword [0x52b0bc], eax
jmp 0x411bd7
mov dword [0x52b0bc], 0
cmp dword [0x52b098], 0
jne 0x411bf5
push dword [0x514990]
call fcn.00448ef0
add esp, 4
mov dword [0x52b0c0], eax
jmp 0x411bff
mov dword [0x52b0c0], 0
cmp dword [0x52b034], 0
jne 0x411f9e
cmp dword [0x52b070], 0
je 0x411ee8
cmp dword [0x52b0d0], 0
je 0x411ee8
mov eax, dword [0x4a70d0]
push 0
push 8
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x4a70e4]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x4a70e4], eax
lea eax, [ebp - 0x8cf8]
push eax
call fcn.0044ec57
mov ecx, dword [0x4a70d0]
push dword [eax + 0xc]
mov ecx, dword [ecx + 4]
push dword [eax + 8]
mov eax, dword [eax]
add ecx, 0x4a70d0
push ecx
call eax
mov eax, dword [0x4a70d0]
add esp, 0x18
mov ecx, 0x4a70d0
mov eax, dword [eax + 4]
mov byte [eax + 0x4a7110], 0x30
push dword [0x5162cc]
call fcn.0040a5e0
mov edx, dword [0x4a7114]
xorps xmm0, xmm0
mov eax, edx
mov dword [ebp - 0x40], 0
and al, 0x22
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
movq qword [ebp - 0x8cf4], xmm0
mov dword [ebp - 0x8cec], 0
cmp al, 2
je 0x411ceb
mov eax, dword [0x4a70f8]
mov ecx, dword [eax]
test ecx, ecx
je 0x411ceb
mov eax, dword [0x4a70e8]
cmp ecx, dword [0x4a7110]
cmovb ecx, dword [0x4a7110]
mov edx, dword [eax]
sub ecx, edx
jmp 0x411d19
test dl, 4
jne 0x411d0d
mov eax, dword [0x4a70f4]
mov ecx, dword [eax]
test ecx, ecx
je 0x411d0d
mov eax, dword [0x4a70e4]
mov edx, dword [eax]
sub ecx, edx
mov eax, dword [0x4a7104]
add ecx, dword [eax]
jmp 0x411d19
mov ecx, dword [ebp - 0x8cf0]
mov edx, dword [ebp - 0x8cf4]
test edx, edx
je 0x411d27
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.0040d950
lea eax, [ebp - 0x40]
mov ecx, 0x4a70a4
push eax
call fcn.0040a560
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x411d69
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x411d5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov ebx, dword [0x561cf8]
mov edi, dword [0x561cf4]
cmp edi, ebx
je 0x411e13
nop dword [eax]
cmp dword [0x4a70b8], 0x10
mov ecx, 0x4a70a4
mov edx, edi
cmovae ecx, dword [0x4a70a4]
cmp dword [edi + 0x14], 0x10
jb 0x411d9d
mov edx, dword [edi]
mov esi, dword [edi + 0x10]
cmp esi, dword [0x4a70b4]
jne 0x411e00
sub esi, 4
jb 0x411dc1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x411dc6
add edx, 4
add ecx, 4
sub esi, 4
jae 0x411db0
cmp esi, 0xfffffffc
je 0x411dfa
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x411df3
cmp esi, 0xfffffffd
je 0x411dfa
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x411df3
cmp esi, 0xfffffffe
je 0x411dfa
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x411df3
cmp esi, 0xffffffff
je 0x411dfa
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x411dfa
sbb eax, eax
or eax, 1
jmp 0x411dfc
xor eax, eax
test eax, eax
je 0x411e0b
add edi, 0x18
cmp edi, ebx
jne 0x411d80
cmp edi, ebx
jne 0x411ee1
push str.Advanced_VM_detected
push 1
push dword [0x514990]
call fcn.00449450
push dword [0x5162cc]
push str.Advance_VM_Check_4___08x_
push 0xc8
push 0x560f70
call fcn.0040ea20
add esp, 0x1c
mov ecx, 0x52abf8
push 0
push 0
push 1
push 2
push 0x560f70
call fcn.0041c080
mov dword [0x55e828], 1
push str.This_application_cannot_be_run_inside_of_a_virtual_machine
push str.NoVirtualMachine
mov ecx, 0x52abf8
call fcn.00420960
push dword [0x537ddc]
call fcn.004479e0
add esp, 4
mov ecx, 0x52abf8
call fcn.004210d0
push 7
mov ecx, 0x52abf8
mov dword [0x53b6b0], 7
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.00418490
call fcn.0040b0b0
mov esi, dword [0x53b6b0]
lea ecx, [ebp - 0x8cb0]
call fcn.0040a200
lea ecx, [ebp - 0x8cc8]
call fcn.0040a200
mov eax, esi
jmp 0x412b49
push str.Advanced_VM_check_is_Enabled_but_the_code_doesnt_exit_in_advancedVMExitCodes
jmp 0x411eed
push str.Advanced_VM_check_is_Disabled
push 1
push dword [0x514990]
call fcn.00449450
mov eax, dword [0x5162c8]
add esp, 0xc
cmp dword [0x52b00c], 0
jne 0x411f41
cmp dword [0x52b0bc], 0
je 0x411f41
test eax, eax
jne 0x411f41
push eax
push eax
push 1
push 2
push 0x537e00
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.0041c080
push str.This_application_cannot_be_run_inside_of_a_virtual_machine.
jmp 0x411e68
cmp dword [0x52b098], 0
jne 0x411f85
cmp dword [0x52b0c0], 0
je 0x411f85
test eax, eax
jne 0x411f85
push eax
push eax
push 1
push 3
push 0x479b14
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.0041c080
push str.This_application_cannot_be_run_inside_of_a_Remote_Desktop_server_session.
push str.NoRemoteDesktopSession
jmp 0x411e6d
cmp dword [0x521200], 0
jne 0x411fb3
test eax, eax
jne 0x411fb3
mov ecx, 0x52abf8
call fcn.004180f0
jmp 0x411fb3
push str.Default_value_set
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push 0
push str.ITS_Secure_Browser_AppSwitcher
call dword [sym.imp.USER32.dll_FindWindowA]
push 3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0x4a7278
call fcn.00414e30
test eax, eax
je 0x41202e
mov ecx, 0x478714
mov eax, 0x4a7530
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412010
test dl, dl
je 0x41200c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412010
add eax, 2
add ecx, 2
test dl, dl
jne 0x411ff0
xor eax, eax
jmp 0x412015
sbb eax, eax
or eax, 1
test eax, eax
je 0x41202e
push str.found_appinit_dll_value_modified
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
cmp dword [0x5162c8], 0
jne 0x412130
push 0x560968
push 0x52a458
push 0x53ab34
push dword [0x514990]
call fcn.00448dd0
add esp, 0x10
mov dword [ebp - 0x8cd8], eax
test eax, eax
jle 0x4120bf
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push 0x560968
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x560968
push 0
push 0xfde9
call ebx
push 0
push 0
push 1
push 0x12
push edi
mov ecx, 0x52abf8
call fcn.0041c080
mov eax, dword [ebp - 0x8cd8]
cmp dword [0x52b084], 0
je 0x412130
test eax, eax
jle 0x412130
mov ecx, 0x52abf8
mov dword [0x55e828], 1
call fcn.004210d0
push str.An_error_occurred__contact_support_for_assistance___109
push str.Secure_Browser
mov ecx, 0x52abf8
call fcn.00420960
lea ecx, [ebp - 0x8cb0]
mov dword [0x53b6b0], 0x4b
mov dword [0x5162c8], 1
call fcn.0040a200
lea ecx, [ebp - 0x8cc8]
call fcn.0040a200
mov eax, 0x4b
jmp 0x412b49
cmp dword [0x52b034], 0
jne 0x4121f6
cmp dword [0x539668], 2
je 0x412158
mov ecx, 0x52abf8
call fcn.00419ea0
test eax, eax
jne 0x4121f6
cmp dword [0x521200], 0
je 0x412173
mov ecx, 0x52abf8
call fcn.00419ea0
test eax, eax
jne 0x4121f6
mov ecx, 0x52abf8
call fcn.004210d0
cmp dword [0x539668], 2
je 0x41219a
push str.Unable_to_enable_security._Contact_support_for_further_assistance.
push str.EnableSecurityFailed
mov ecx, 0x52abf8
call fcn.00420960
push dword [0x537df8]
push dword [0x514990]
call fcn.00449030
add esp, 8
mov dword [0x53b6b0], 5
mov ecx, 0x52abf8
push 5
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.00418490
call fcn.0040b0b0
cmp dword [0x55ea5c], 0
jne 0x411ebe
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55ea60
call eax
mov dword [0x55ea5c], eax
jmp 0x411ebe
push 0
push 0
push 0
push 0x40b5e0
push 0
push 0x8005
push 0x8005
mov dword [0x514994], 1
call dword [sym.imp.USER32.dll_SetWinEventHook]
push str.Starting_Main_Message_Loop
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push 0
push 0x40bef0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push dword [0x562ebc]
push str.webViewCreated_before_runmessagepump__d
push 1
push dword [0x514990]
call fcn.00449450
push dword [0x5162d8]
push str.startUrlLoaded_before_runmessagepump__d
push 1
push dword [0x514990]
call fcn.00449450
call fcn.0040c400
mov eax, dword [0x5162c8]
mov ecx, 1
cmp dword [0x53b6b0], 0
cmove eax, ecx
push eax
push str.quitCode__d
push ecx
push dword [0x514990]
mov dword [0x5162c8], eax
call fcn.00449450
add esp, 0x30
cmp dword [0x55ea5c], 0
jne 0x4122c0
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55ea60
call eax
mov dword [0x55ea5c], eax
mov ecx, 0x52abf8
call fcn.00418b70
push str.Finished_Logging
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push dword [0x514990]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x8ce0], 0
je 0x4128fa
push str.Unable_to_load_the_internet_zone_manager_
push str.InternetZoneError
jmp 0x41290d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4122eb
xor esi, esi
call dword [sym.imp.ole32.dll_OleUninitialize]
test esi, esi
je 0x4122f1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x1a94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x52abf8
push 0x3ff
push 0x400
push 0x52cfe8
call fcn.004085a0
mov ecx, 0x52fd40
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412360
push 0x400
push 0x52cfe8
sub ecx, edx
push ecx
push 0x52fd40
push 0xf
push str.programid_pid_
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, 0x52fcdc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4123a0
push 0x400
push 0x52cfe8
sub ecx, edx
push ecx
push 0x52fcdc
push 0x13
push str.environmentid_eid_
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, 0x52fc14
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4123e0
push 0x400
push 0x52cfe8
sub ecx, edx
push ecx
push 0x52fc14
push 0x11
push str.candidateid_cid_
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, 0x52fc78
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412420
push 0x400
push 0x52cfe8
sub ecx, edx
push ecx
push 0x52fc78
push 0x13
push str.institutionid_iid_
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, 0x52e5bc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412460
push 0x400
push 0x52cfe8
sub ecx, edx
push ecx
push 0x52e5bc
push 0x10
push str.language_lcode_
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
push 0x400
push 0x52cfe8
push 1
push 0x478714
push 8
push 0x479d60
push 0x400
push 0x52cfe8
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, 0x52cfe8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4124c8
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x52cfe8
call fcn.0045338c
add esp, 0xc
mov ecx, 0x52abf8
push 0
push 0
push str.cmddownload
push 0x479d7c
push 0x52cfe8
push 0x400
push 0x529e48
call fcn.0041a6a0
mov ecx, 0x529e48
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412516
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x529e48
call fcn.0045338c
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add esp, 0xc
push 0x401
push 0x40
call ebx
mov esi, eax
mov ecx, 0x52abf8
push esi
push 0x529e48
call fcn.00422290
push esi
push str._sy1QM3bQ6VnxkCUm7Uv2zjj1ogux0O0ESsjq4G8fXpdwXkRJOqz
push 0x1ff
lea eax, [ebp - 0x209c]
push 0x200
push eax
call fcn.004085a0
add esp, 0x14
push 0x2a
push 0x40
call ebx
push esi
mov dword [0x529e44], eax
call edi
push dword [0x529e44]
lea eax, [ebp - 0x209c]
mov ecx, 0x52abf8
push eax
call fcn.0041d410
push str.sc
push 0x400
push 0x52cfe8
call fcn.0045338c
push dword [0x529e44]
push 0x400
push 0x52cfe8
call fcn.0045338c
add esp, 0x18
push dword [0x529e44]
call edi
push 0x52cfe8
push 0x3ff
push 0x400
push 0x52abf8
call fcn.004085a0
add esp, 0x10
lea eax, [ebp - 0x4c9c]
mov ecx, 0x5647e0
push 0x1ffe
push eax
push 9
push str._starturl
push 4
push str._url
push 0x1ffe
push 0x5162e0
call fcn.00449900
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x4c9c]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x4c9c]
push eax
push 0
push 0xfde9
call ebx
push 0x478b6c
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.0045e4b4
push edi
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.0045e4b4
push 0x478d10
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push str._url_
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x52abf8
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x52abf8
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push str.___exe_
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
lea eax, [ebp - 0x1a94]
push eax
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push str.___updateversion_
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x52dbe8
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push esi
push edi
push 0xffffffffffffffff
push 0x52dbe8
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push str.___minversion_
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 0x52dc68
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x52dc68
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push str.___exitmessage_
lea eax, [ebp - 0x8c98]
mov dword [0x515e00], 0x479e34
push 0x1ffe
push eax
call fcn.004532c3
push dword [0x515e00]
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
push 0x479e80
lea eax, [ebp - 0x8c98]
push 0x1ffe
push eax
call fcn.004532c3
add esp, 0x30
lea eax, [ebp - 0x1c9c]
mov ecx, 0x52a6a0
push 0x55e620
push 0x52dce8
push 0x104
push eax
call fcn.00416fc0
mov ecx, 0x52abf8
call fcn.004210d0
push 0xa
push 0
lea eax, [ebp - 0x8c98]
push eax
lea eax, [ebp - 0x1c9c]
push eax
push 0x47916c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
call ebx
mov eax, dword [ebp - 0x8c9c]
cmp eax, 8
jb 0x4128b5
inc eax
lea ecx, [ebp - 0x8cb0]
push eax
push dword [ebp - 0x8cb0]
call fcn.0040dc10
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov word [ebp - 0x8cb0], ax
mov eax, dword [ebp - 0x8cb4]
mov dword [ebp - 0x8c9c], 7
cmp eax, 8
jb 0x4128f0
inc eax
lea ecx, [ebp - 0x8cc8]
push eax
push dword [ebp - 0x8cc8]
call fcn.0040dc10
mov eax, 3
jmp 0x412b49
cmp dword [0x514990], 0
jne 0x412945
push str.Unable_to_load_test_security_
push str.TestSecurityDLL
mov ecx, 0x52abf8
call fcn.00420960
push dword [0x537ddc]
call fcn.004479e0
add esp, 4
mov dword [0x53b6b0], 0xffffffff
mov ecx, 0x52abf8
mov dword [0x5162c8], 1
push 0xffffffffffffffff
call fcn.004211f0
cmp dword [0x514994], 0
jne 0x41298f
cmp dword [0x5162c8], 0
jne 0x41298f
push str.Unauthorized_Access_
push str.UnauthorizedAccess
mov ecx, 0x52abf8
call fcn.00420960
push dword [0x537ddc]
call fcn.004479e0
add esp, 4
mov dword [0x53b6b0], 0xffffffff
mov ecx, 0x52abf8
push 0xffffffffffffffff
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004210d0
call fcn.0040b0b0
mov eax, dword [ebp - 0x8c9c]
mov esi, dword [0x53b6b0]
cmp eax, 8
jb 0x4129c2
inc eax
lea ecx, [ebp - 0x8cb0]
push eax
push dword [ebp - 0x8cb0]
call fcn.0040dc10
mov ecx, dword [ebp - 0x8cb4]
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
cmp ecx, 8
jb 0x410fd1
inc ecx
push ecx
push dword [ebp - 0x8cc8]
lea ecx, [ebp - 0x8cc8]
call fcn.0040dc10
mov eax, esi
jmp 0x412b49
test eax, eax
jne 0x412a18
push 0x55ea60
call ebx
mov dword [0x55ea5c], eax
mov eax, dword [ebp - 0x8c9c]
cmp eax, 8
jb 0x412a36
inc eax
lea ecx, [ebp - 0x8cb0]
push eax
push dword [ebp - 0x8cb0]
call fcn.0040dc10
mov eax, dword [ebp - 0x8cb4]
cmp eax, 8
jb 0x412b49
inc eax
lea ecx, [ebp - 0x8cc8]
push eax
push dword [ebp - 0x8cc8]
call fcn.0040dc10
jmp 0x412b49
push str.SecureBrowser_is_already_running..._
push str.SecureBrowserIsAlreadyRunning
mov ecx, 0x52abf8
call fcn.00420960
mov ecx, 0x52abf8
call fcn.004210d0
mov edx, dword [ebp - 0x8c9c]
cmp edx, 8
jb 0x412abb
mov ecx, dword [ebp - 0x8cb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412ab1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
xor eax, eax
mov dword [ebp - 0x8ca0], 0
mov dword [ebp - 0x8c9c], 7
mov word [ebp - 0x8cb0], ax
jmp 0x40f699
push 0x1000
push 0x479f9c
push str.Cant_open_OLE_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
mov ecx, 0x52abf8
mov dword [0x53b6b0], 0xffffffff
call fcn.004211f0
mov edx, dword [ebp - 0x8cb4]
cmp edx, 8
jb 0x412b46
mov ecx, dword [ebp - 0x8cc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412b3c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412b67
push edx
push ecx
call fcn.0044d09e
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
call fcn.00458530
int3