Function at 0x40a6b0
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Delete file
Download url
Get common file path
Get file version info
Get session user name
Receive data
Reference http user-agent string
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c7c0
mov eax, dword fs:[0]
push eax
mov eax, 0x91d8
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0x100
mov dword [ebp - 0x917c], ebx
mov dword [0x50c760], ebx
mov dword [0x50c764], esi
mov dword [ebp - 0x9180], 0x200
mov dword [ebp - 0x9184], 1
mov dword [0x52b5c4], 0
call fcn.00442a50
push 0x1ffe
mov dword [0x52b5c8], eax
lea eax, [ebp - 0x9160]
push 0
push eax
call fcn.0044a900
add esp, 0x10
mov dword [0x50e0a4], 0
lea ecx, [ebp - 0x9178]
mov dword [0x50e0a8], 0
mov dword [0x50c768], 0
mov dword [0x51f4b4], 0
push 0x16
push str.ITSSecureECLiteBrowser
mov dword [0x51f4b8], 0
mov dword [0x55604c], 0
mov dword [0x50c76c], 0
mov dword [ebp - 0x9190], 0
mov dword [0x50e0b0], esi
mov dword [ebp - 0x9178], 0
mov dword [ebp - 0x9168], 0
mov dword [ebp - 0x9164], 7
call fcn.0040a4c0
xor esi, esi
push esi
call fcn.00456ad0
push esi
call fcn.00456ad0
inc esi
add esp, 8
cmp esi, 0x100
jl 0x40a7c5
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jne 0x40e057
cmp dword [ebp - 0x9164], 8
lea eax, [ebp - 0x9178]
cmovae eax, dword [ebp - 0x9178]
push eax
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.004578c3
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax], 1
jle 0x40b3f3
mov esi, 1
call fcn.004578c3
cmp dword [eax], esi
jle 0x40b3f3
nop dword [eax]
cmp esi, 1
jne 0x40a863
call fcn.004578c9
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x5140b8
call fcn.00456be4
add esp, 0xc
jmp 0x40a893
push 0x470afc
push 0x1ffe
push 0x5140b8
call fcn.0044dad3
call fcn.004578c9
mov eax, dword [eax]
push dword [eax + esi*4]
push 0x1ffe
push 0x5140b8
call fcn.0044dad3
add esp, 0x18
call fcn.004578c9
push 4
push 0x470b00
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40a8d1
call fcn.004578c9
push 4
push 0x470b0c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
jne 0x40aa82
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a8e0
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40aa82
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x800
push 0x50cff0
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x50cff0
call fcn.0041bb40
push eax
push 0x470908
push 0x400
push 0x50cbf0
call fcn.00408300
push 7
push 0x470b18
push 0x50cbf0
call fcn.004568da
add esp, 0x1c
test eax, eax
je 0x40aa73
push 8
push 0x470b20
push 0x50cbf0
call fcn.004568da
add esp, 0xc
test eax, eax
je 0x40aa73
push 0x470b2c
push 0x50cbf0
call fcn.00457c9e
add esp, 8
test eax, eax
je 0x40a9d1
sub eax, 0x50cbf0
add eax, 4
push eax
push 0x50cbf0
lea eax, [ebp - 0x734]
push 0x400
push eax
call fcn.00457c81
lea ecx, [ebp - 0x734]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9b5
push 0x400
lea eax, [ebp - 0x1344]
push eax
push 8
push 0x470b20
jmp 0x40aa30
push 0x470b34
push 0x50cbf0
call fcn.00457c9e
add esp, 8
test eax, eax
je 0x40aa73
sub eax, 0x50cbf0
add eax, 3
push eax
push 0x50cbf0
lea eax, [ebp - 0x734]
push 0x400
push eax
call fcn.00457c81
lea ecx, [ebp - 0x734]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40aa16
push 0x400
lea eax, [ebp - 0x1344]
push eax
push 7
push 0x470b18
sub ecx, edx
lea eax, [ebp - 0x734]
push ecx
push eax
push 0x400
push 0x50cbf0
mov ecx, 0x556050
call fcn.00444540
lea eax, [ebp - 0x1344]
push eax
push 0x400
push 0x50cbf0
call fcn.0044db48
lea eax, [ebp - 0x1344]
push eax
call fcn.0044dcd4
add esp, 0x10
mov dword [0x51f498], 1
jmp 0x40b3e5
call fcn.004578c9
push 4
push 0x470b38
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b369
call fcn.004578c9
push 4
push 0x470b44
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b369
call fcn.004578c9
push 9
push 0x470b50
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b2ea
call fcn.004578c9
push 9
push 0x470b64
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b2ea
call fcn.004578c9
push 8
push 0x470b78
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b2db
call fcn.004578c9
push 8
push 0x470b8c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b2db
call fcn.004578c9
push 0x10
push 0x470ba0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b26c
call fcn.004578c9
push 0x10
push 0x470bc4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b26c
call fcn.004578c9
push 7
push 0x470be8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b1ab
call fcn.004578c9
push 7
push 0x470bf8
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b1ab
call fcn.004578c9
push 0x10
push 0x470c08
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b12b
call fcn.004578c9
push 0x10
push 0x470c2c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b12b
call fcn.004578c9
push 0xb
push 0x470c50
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b0b1
call fcn.004578c9
push 0xc
push 0x470c6c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b0b1
call fcn.004578c9
push 0x14
push 0x470c88
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b03b
call fcn.004578c9
push 0x14
push str._SBPathForadminLaunch
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40b03b
call fcn.004578c9
push 8
push 0x470ce0
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40afc2
call fcn.004578c9
push 8
push 0x470cf4
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40afc2
call fcn.004578c9
push 7
push 0x470d08
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40af54
call fcn.004578c9
push 7
push str._params
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40af54
call fcn.004578c9
push 0x13
push 0x470d28
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40ae9e
call fcn.004578c9
push 0x13
push str._LauncherDeleteOnly
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40ae9e
call fcn.004578c9
push 0xf
push 0x470dcc
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40ae40
call fcn.004578c9
push 0xf
push str._LauncherDelete
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40ae40
call fcn.004578c9
push 5
push 0x470e0c
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
je 0x40add8
call fcn.004578c9
push 5
push str._Guid
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0045c5af
add esp, 0xc
test eax, eax
jne 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ade5
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xa
push eax
push 0x25
push 0x553502
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x553502
call fcn.0041bb40
push eax
push 0x470908
push 0x25
push 0x5534dc
call fcn.00408300
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae50
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x1e
push eax
push 0x104
push 0x551648
call fcn.00456be4
add esp, 0xc
push 0x551648
call edi
mov dword [0x551644], 0
jmp 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aeb0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x13
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x26
push eax
push 0x104
push 0x551648
call fcn.00456be4
add esp, 0xc
push 0x551648
call edi
push str.A_shortcut_for_the_Secure_Browser_has_been_created_on_the_desktop
push 0x470dbc
mov ecx, 0x51eff8
mov dword [0x551644], 0
call fcn.0041b620
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40af4d
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40af43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
xor eax, eax
jmp 0x40e0c3
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40af61
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
push 0x1000
push 0x54ee74
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x54ee74
call fcn.0041bb40
push eax
push 0x470908
push 0x1000
push 0x54de74
call fcn.00408300
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40afd0
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x10
push eax
push 0x104
push 0x52e090
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x52e090
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x52df8c
call fcn.00408300
mov dword [0x52df88], 1
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b050
sub ecx, edx
sar ecx, 1
cmp ecx, 0x15
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x2a
push eax
push 0x104
push 0x509608
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x509608
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x509500
call fcn.00408300
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b0c0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xc
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x51afd8
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x51afd8
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x518fd8
call fcn.00408300
mov dword [0x518fd4], 1
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b140
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x104
push 0x550f78
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x550f78
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x550e74
call fcn.00408300
mov dword [0x518fd0], 1
jmp 0x40b3e2
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b1c0
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0xe
push eax
lea eax, [ebp - 0x53c]
push 0x104
push eax
call fcn.00456be4
add esp, 0xc
nop word [eax + eax]
lea eax, [ebp - 0x53c]
push eax
call fcn.00408e00
add esp, 4
test eax, eax
je 0x40b200
push 0
mov ecx, 0x51eff8
mov dword [0x52e298], 0
call fcn.0041bbb0
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40af4d
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40af43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
jmp 0x40af43
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b280
sub ecx, edx
sar ecx, 1
cmp ecx, 0x10
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x20
push eax
push 0x64
push 0x52b0f8
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x52b0f8
call fcn.0041bb40
push eax
push 0x470908
push 0x64
push 0x523f38
call fcn.00408300
jmp 0x40b3e2
mov dword [ebp - 0x9184], 0
jmp 0x40b3e5
mov dword [0x51f4ac], 1
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b301
sub ecx, edx
sar ecx, 1
cmp ecx, 9
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 0x12
push eax
push 0x104
push 0x5211cc
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x5211cc
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x5210c8
call fcn.00408300
mov dword [0x51f4a0], 1
jmp 0x40b3e2
mov dword [0x51f4a8], 1
call fcn.004578c9
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b380
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40b3e5
call fcn.004578c9
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push 0x104
push 0x5226d8
call fcn.00456be4
add esp, 0xc
mov ecx, 0x51eff8
push 0x5226d8
call fcn.0041bb40
push eax
push 0x470908
push 0x104
push 0x5225d4
call fcn.00408300
mov dword [0x51f4a4], 1
add esp, 0x10
inc esi
call fcn.004578c3
cmp esi, dword [eax]
jl 0x40a840
push 0x80
push 0x50dbe8
mov ecx, 0x49c1a8
call fcn.00410150
push 0x104
push 0x52c344
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x52c344
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push 0x104
push 0x5092f0
call fcn.00408300
add esp, 0xc
lea eax, [ebp - 0x9198]
push eax
push 0x52c344
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x2040
mov dword [ebp - 0x9180], eax
call edi
mov esi, eax
push esi
push dword [ebp - 0x9180]
push 0
push 0x52c344
call sub.VERSION.dll_GetFileVersionInfoA
mov edx, 0x4705a0
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40b497
test al, al
je 0x40b493
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40b497
add ecx, 2
add edx, 2
test al, al
jne 0x40b477
xor eax, eax
jmp 0x40b49c
sbb eax, eax
or eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40b4ec
push 0x104
push 0x52c448
push dword [ebp - 0x917c]
call ebx
lea eax, [ebp - 0x9198]
push eax
push 0x52c448
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
push 0x2040
mov dword [ebp - 0x9180], eax
call edi
mov esi, eax
push esi
push dword [ebp - 0x9180]
push 0
push 0x52c448
call sub.VERSION.dll_GetFileVersionInfoW
mov ecx, 0x4705a0
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b513
test dl, dl
je 0x40b50f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b513
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b4f3
xor eax, eax
jmp 0x40b518
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b549
push 0x52c344
push str._filepath_
push str.Failed_to_get_file_version__filepath_
push 0x470dbc
mov ecx, 0x51eff8
call fcn.0041b8b0
mov ecx, 0x51eff8
call fcn.0041ba90
jmp 0x40af0d
lea eax, [ebp - 0x9180]
push eax
lea eax, [ebp - 0x9188]
push eax
push 0x470860
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x9188]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x470e58
push 0x5220d4
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x9188]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x470e70
push 0x50c770
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x917c]
lea ecx, [ebp - 0xf44]
add esp, 0x30
mov dword [0x50d854], eax
push 0x104
push ecx
push eax
call ebx
lea eax, [ebp - 0x1f64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x1f64]
lea ecx, [ecx + 2]
mov word [ecx + 0x50980e], ax
test ax, ax
jne 0x40b5f0
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0xf44]
lea ecx, [ecx + 2]
mov word [ecx + 0x509a16], ax
test ax, ax
jne 0x40b610
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0xf44]
lea ecx, [ecx + 2]
mov word [ecx + 0x551206], ax
test ax, ax
jne 0x40b630
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x509604], 0
nop word [eax + eax]
imul eax, eax, 0x208
mov ecx, 0x51efe8
add eax, 0x509810
push eax
push 0x104
push 0x50c340
call fcn.00412160
mov eax, dword [0x52b5e4]
xorps xmm0, xmm0
mov dword [ebp - 0x91cc], eax
lea eax, [ebp - 0x91d4]
push eax
movlpd qword [ebp - 0x91b0], xmm0
movlpd qword [ebp - 0x91a8], xmm0
movlpd qword [ebp - 0x91a0], xmm0
mov dword [ebp - 0x91d4], 0x3c
mov dword [ebp - 0x91d0], 0x400
mov dword [ebp - 0x91c8], 0
mov dword [ebp - 0x91c4], 0x50c340
mov dword [ebp - 0x91c0], 0x470a68
mov dword [ebp - 0x91bc], 0
mov dword [ebp - 0x91b8], 5
mov dword [ebp - 0x91b4], 0
call esi
push 0xffffffffffffffff
push dword [ebp - 0x919c]
call edi
push dword [ebp - 0x919c]
call ebx
mov ecx, 0x51eff8
call fcn.0041ba90
test eax, eax
jne 0x40b7a7
mov eax, dword [0x509604]
inc dword [0x509c20]
inc eax
mov dword [0x509604], eax
cmp eax, 1
jle 0x40b670
push str.To_use_this_application__you_must_have_execute_and_write_access_to_one_of_the_following_folders:__r_n_r_n_r_n___C:UsersYourUsernameTemp__r_n_r_n___The_current_location_you_are_running_the_Secure_Browser
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041ae50
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40b79d
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b793
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, 0xb
jmp 0x40e0c3
imul eax, dword [0x509604], 0x208
mov edx, 0x551208
lea ecx, [eax + 0x509810]
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x40b7c0
push 1
push 0
push 0
push 0x50c340
push 0x470f54
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x551208
push 0x5220d4
push 0x104
lea eax, [ebp - 0x93c]
mov ecx, 0x51efe8
push eax
call fcn.00412520
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x50c768], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push dword [0x50c768]
call fcn.00443850
push 0x471c40
push 1
push dword [0x50c768]
call fcn.00444090
push 0x471c58
push 1
push dword [0x50c768]
call fcn.00444090
push 0x471cfc
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x2c
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0x93c]
lea ecx, [ecx + 2]
mov word [ecx + 0x50c546], ax
test ax, ax
jne 0x40b870
mov edi, dword [ebp - 0x917c]
lea eax, [ebp - 0x93c]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push edi
call esi
lea eax, [ebp - 0x9198]
push eax
lea eax, [ebp - 0x93c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 0x9180], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x2040
call eax
mov ebx, eax
lea eax, [ebp - 0x93c]
push ebx
push dword [ebp - 0x9180]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov edx, 0x4705a0
mov ecx, ebx
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40b906
test al, al
je 0x40b902
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40b906
add ecx, 2
add edx, 2
test al, al
jne 0x40b8e6
xor eax, eax
jmp 0x40b90b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b91e
mov ecx, 0x51eff8
call fcn.0041ba90
jmp 0x40af0d
lea eax, [ebp - 0x9180]
push eax
lea eax, [ebp - 0x9188]
push eax
push 0x470860
push ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x9188]
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
push 0x470e70
push 0x528a04
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x1d5c]
push 0x104
push eax
push edi
call esi
push 0x470f60
lea eax, [ebp - 0x1d5c]
mov ecx, 0x51eff8
push eax
call fcn.00418260
mov dword [0x50c33c], eax
test eax, eax
jne 0x40b9a6
mov ecx, 0x51eff8
call fcn.0041ba90
call fcn.00408b10
jmp 0x40af0d
push 0x551208
push 0x104
push 0x52d924
mov ecx, 0x51efe8
call fcn.004110d0
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x80
push 0x50dc68
mov ecx, 0x4d72c4
mov dword [ebp - 0x9194], eax
call fcn.00407f50
mov ecx, 0x49c1a8
call fcn.00410290
push 0x49c1c4
call fcn.004577c4
add esp, 4
mov dword [0x50c758], eax
lea eax, [ebp - 0x917c]
mov dword [ebp - 0x917c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x40ba41
cmp dword [ebp - 0x917c], 0
je 0x40ba41
mov eax, dword [str.Win64]
mov dword [0x553478], eax
mov ax, word [0x470f68]
mov dword [0x50c75c], 1
jmp 0x40ba5b
mov eax, dword [str.Win32]
mov dword [0x553478], eax
mov ax, word [0x470f70]
mov dword [0x50c75c], 0
push 0x5092f0
push 0
push 0x1f0001
mov word [0x55347c], ax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x40e034
push 0x5092f0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 0x49c1a8
call fcn.00410890
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
xor esi, esi
nop dword [eax + eax]
push 0
push str.WorkerW
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x40bac9
test esi, esi
jne 0x40baa0
jmp 0x40bad0
test esi, esi
jne 0x40bb02
nop dword [eax]
push 0
push str.Progman
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 0
push str.SHELLDLL_DefView
mov esi, eax
push 0
push esi
call edi
test eax, eax
jne 0x40baf7
test esi, esi
jne 0x40bad0
push 3
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
push 0x200
lea eax, [ebp - 0x6960]
mov dword [0x50c754], esi
push eax
push dword [0x50c768]
call fcn.00443870
mov dword [0x5183c4], eax
lea eax, [ebp - 0x6d60]
push 0x200
push eax
push dword [0x50c768]
call fcn.004438f0
mov dword [0x518fc8], eax
lea eax, [ebp - 0x7160]
push 0x200
push eax
push dword [0x50c768]
call fcn.004438a0
mov esi, dword [ebp - 0x9194]
push 0x200
push 0x52b6b4
push esi
push dword [0x50c768]
mov dword [0x518fcc], eax
call fcn.004439a0
add esp, 0x34
mov ecx, 0x556050
call fcn.004446c0
push esi
push 0x470fbc
push 1
push dword [0x50c768]
call fcn.00444090
push 0x50c770
push 0x470fdc
push 1
push dword [0x50c768]
call fcn.00444090
call fcn.00409e10
push dword [0x50d924]
push dword [0x50d928]
push dword [0x50d8bc]
push 0x470ff8
push 0x80
push 0x50d930
call fcn.00408300
push 0x50d930
push 0x471004
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x48
push 0x471014
push 1
push dword [0x50c768]
call fcn.00444090
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add esp, 0xc
push 0x10
push 0x40
call edi
push eax
push dword [0x50c768]
mov dword [0x50d92c], eax
call fcn.00443960
push str.before_MAC_Address
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x14
lea eax, [ebp - 0x2164]
push 0
push 0
push 0x200
push eax
mov eax, dword [0x50d92c]
push 0xffffffffffffffff
push dword [eax + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [0x50d92c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
lea eax, [ebp - 0x2164]
push eax
push 0x471048
push 1
push dword [0x50c768]
call fcn.00444090
push str.after_MAC_Address
push 1
push dword [0x50c768]
call fcn.00444090
push 0x200
lea eax, [ebp - 0xd3c]
push eax
push dword [0x50c768]
call fcn.004438d0
lea eax, [ebp - 0xd3c]
push eax
push 0x471070
push 1
push dword [0x50c768]
call fcn.00444090
push dword [0x50c768]
call fcn.004440f0
test eax, eax
mov edx, 0x4705a0
mov ecx, 0x471088
push 0x28
cmove ecx, edx
push ecx
push 0x28
push 0x50e068
call fcn.0044dcbe
add esp, 0x4c
push 0x50d9b0
push 0x471090
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
lea eax, [ebp - 0x9180]
push eax
lea eax, [ebp - 0xb3c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xb3c]
push eax
push 0x4710a8
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
push ebx
call esi
mov ecx, 0x51efe8
call fcn.004115a0
mov ecx, 0x5092e8
mov dword [0x51f438], eax
call fcn.004083d0
push 0x551414
mov ecx, 0x51eff8
mov dword [0x51f400], eax
call fcn.004162f0
mov ecx, 0x51eff8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bd80
sub ecx, edx
jne 0x40bdbe
push 0x400
push 0x51eff8
push str.UPDATEURL
push 0x94
mov ecx, 0x51efe8
call fcn.00411d70
push 0x4710c8
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
mov ecx, 0x51eff8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bdc6
mov eax, dword [0x51f44c]
sub ecx, edx
push 0x400
xor edx, edx
test ecx, ecx
push 0x5236d4
push str.ERRORURL
cmovne eax, edx
mov ecx, 0x51efe8
push 0xa1
mov dword [0x51f44c], eax
call fcn.00411d70
mov ecx, 0x4710fc
mov eax, 0x52b030
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40be28
test dl, dl
je 0x40be24
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40be28
add eax, 2
add ecx, 2
test dl, dl
jne 0x40be08
xor eax, eax
jmp 0x40be2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40be38
mov eax, 0x52b030
jmp 0x40be42
mov ecx, 0x51eff8
call fcn.00416290
push eax
push 0x471100
push 0x64
push 0x52412c
call fcn.00408300
push 0x52412c
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x1c
mov ecx, 0x4705a0
mov eax, 0x52afcc
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40be93
test dl, dl
je 0x40be8f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40be93
add eax, 2
add ecx, 2
test dl, dl
jne 0x40be73
xor eax, eax
jmp 0x40be98
sbb eax, eax
or eax, 1
test eax, eax
je 0x40bea3
mov eax, 0x52afcc
jmp 0x40beb2
push 0x5228e0
mov ecx, 0x4d72c4
call fcn.00407d60
push eax
push 0x471110
push 0x64
push 0x5240c8
call fcn.00408300
push 0x5240c8
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x1c
mov ecx, 0x4d72c4
push 0x522944
call fcn.00407d20
push eax
push 0x471124
push 0x64
push 0x524000
call fcn.00408300
push 0x524000
push 1
push dword [0x50c768]
call fcn.00444090
push 0x64
push 1
call fcn.0044dcc9
add esp, 0x24
mov dword [0x4d72c4], eax
mov ecx, 0x51efe8
call fcn.00411260
push str.After_extracting_institution_Id
push 1
push dword [0x50c768]
mov dword [0x52b5d0], eax
call fcn.00444090
push dword [0x52b5d0]
push 0x4707d4
push 0x64
push dword [0x4d72c4]
call fcn.00408300
add esp, 0x1c
mov ecx, 0x4710fc
mov eax, 0x52af04
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bf83
test dl, dl
je 0x40bf7f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bf83
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bf63
xor eax, eax
jmp 0x40bf88
sbb eax, eax
or eax, 1
test eax, eax
je 0x40bf93
mov eax, 0x52af04
jmp 0x40bf9d
mov ecx, 0x4d72c4
call fcn.00407e40
push eax
push 0x471154
push 0x64
push 0x524064
call fcn.00408300
add esp, 0x10
mov ecx, 0x4710fc
mov eax, 0x52af68
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bfe0
test dl, dl
je 0x40bfdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bfe0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bfc0
xor eax, eax
jmp 0x40bfe5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c035
mov ecx, 0x4705a0
mov eax, 0x523f38
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40c013
test dl, dl
je 0x40c00f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40c013
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bff3
xor eax, eax
jmp 0x40c018
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40c035
push 0x52af68
push 0x470908
push 0x64
push 0x523f38
call fcn.00408300
add esp, 0x10
push 0x522a0c
mov ecx, 0x4d72c4
call fcn.00407ea0
push eax
push 0x471168
push 0x64
push 0x5229a8
call fcn.00408300
add esp, 0x10
cmp dword [0x51f44c], 0
je 0x40c0ad
push 0x400
push 0x50c7f0
push 0x471174
push 0x75
mov ecx, 0x51efe8
call fcn.00411d70
push str.local_configuration
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
mov ecx, 0x51efe8
push 0x400
push 0x5221d4
push str.ALTURL
push 0x7c
call fcn.00411d70
mov ecx, 0x49c1a8
call fcn.004106c0
mov ecx, 0x49c1a8
call fcn.00410aa0
push dword [0x50c768]
call fcn.00443c10
add esp, 4
test eax, eax
je 0x40c0f1
mov ecx, 0x49c1a8
call fcn.00410740
mov ecx, 0x49c1a8
call fcn.00410630
mov ecx, 0x49c1a8
call fcn.00410b30
cmp dword [0x51f44c], 0
mov ecx, 0x51eff8
jne 0x40c268
call fcn.00415290
push 0
push 0x50dbb4
push 0
call sub.urlmon.dll_CoInternetCreateZoneManager
test eax, eax
js 0x40c25c
push 0x470b2c
push 0x51eff8
call fcn.00457c9e
add esp, 8
test eax, eax
je 0x40c166
add eax, 4
push eax
lea eax, [ebp - 0x1744]
push 0x800
push eax
call fcn.0044db48
movq xmm0, qword [0x470b20]
mov al, byte [0x470b28]
movq qword [ebp - 0x734], xmm0
mov byte [ebp - 0x72c], al
jmp 0x40c1a5
push 0x470b34
push 0x51eff8
call fcn.00457c9e
add esp, 8
test eax, eax
je 0x40c1a8
add eax, 3
push eax
lea eax, [ebp - 0x1744]
push 0x800
push eax
call fcn.0044db48
mov dword [ebp - 0x734], 0x70747468
mov dword [ebp - 0x730], 0x2f2f3a
add esp, 0xc
lea eax, [ebp - 0x1744]
push 0x471194
push eax
call fcn.00457c9e
mov edx, 0x52db2c
add esp, 8
mov ebx, eax
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x40c1c5
lea edi, [ebp - 0x734]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c1d5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x40c1f0
lea edi, [ebp - 0x734]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c200
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [0x51eff8], al
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x734]
lea ecx, [ecx + 1]
mov byte [ecx + 0x51eff7], al
test al, al
jne 0x40c220
push 0
push 0x5217d4
push 0x51eff8
mov ecx, 0x556058
call fcn.00447480
mov ecx, 0x51eff8
call fcn.00413ee0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
jmp 0x40c26d
mov dword [ebp - 0x9190], 1
jmp 0x40c26d
call fcn.00419180
push dword [0x50c768]
call fcn.00443810
add esp, 4
test eax, eax
je 0x40c334
push 0
push 0
push 1
push 0x11
push 0x471198
mov ecx, 0x51eff8
call fcn.00417510
cmp dword [0x51f488], 0
je 0x40c334
push str.A_MIRACAST_display_has_been_detected._Check_that_there_are_no_active_MIRACAST_connections_and_try_again.
push str.MiracastDisplayDetected
mov ecx, 0x51eff8
mov dword [0x551410], 1
call fcn.0041b620
mov ecx, 0x51eff8
call fcn.0041ba90
push 0x4c
mov ecx, 0x51eff8
mov dword [0x52e298], 0x4c
call fcn.0041bbb0
call fcn.00408b10
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40c32a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c320
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, 0x4c
jmp 0x40e0c3
push str.True
push 0x52a304
call fcn.00457ac8
add esp, 8
test eax, eax
jne 0x40c370
push dword [0x553470]
push dword [0x55346c]
push dword [0x553464]
push dword [0x553468]
push dword [0x50c768]
call fcn.00443740
add esp, 0x14
push str.log_check_0D
push 0
push dword [0x50c768]
call fcn.00444090
push str.log_check_2W
push 2
push dword [0x50c768]
call fcn.00444090
push str.log_check_3E
push 3
push dword [0x50c768]
call fcn.00444090
push str.log_check_5C
push 5
push dword [0x50c768]
call fcn.00444090
push str.log_check_4S
push 4
push dword [0x50c768]
call fcn.00444090
mov eax, dword [0x551644]
add esp, 0x3c
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40c3e8
push 0x551648
call ebx
mov dword [0x551644], eax
cmp dword [0x51f49c], 0
jne 0x40dfdb
cmp dword [0x51f3fc], 0
jne 0x40c458
cmp dword [0x51f400], 0
jne 0x40c458
push 0x471b98
push 0x471c04
mov ecx, 0x51eff8
call fcn.0041b620
mov ecx, 0x51eff8
call fcn.0041ba90
push dword [0x52b5c8]
call fcn.004428b0
add esp, 4
mov dword [0x52e298], 8
mov ecx, 0x51eff8
mov dword [0x50e0a0], 1
push 8
call fcn.0041bbb0
jmp 0x40df92
mov esi, dword [ebp - 0x9184]
test esi, esi
je 0x40c483
push 0x522054
push 0x521fd4
push 0x50c770
mov ecx, 0x51eff8
call fcn.00416810
test eax, eax
jne 0x40d927
cmp dword [0x50c768], 0
je 0x40d925
cmp dword [0x51f44c], 0
je 0x40c4be
mov ecx, 0x51efe8
call fcn.00411ad0
push eax
push str.sBrowserEngineId_from_Local_Config____d
push 1
push dword [0x50c768]
mov dword [0x551180], eax
call fcn.00444090
add esp, 0x10
mov eax, dword [0x551180]
cmp eax, 1
jne 0x40c6be
mov ecx, 0x51eff8
call fcn.0041ba90
push 0x50e0b8
push 0x1ffe
push 0x509c28
call fcn.0044db48
push 0x551208
push dword [0x51f44c]
push 0x104
push 0x50bc28
call fcn.004094d0
push 0x50bc28
push str.ExtractSB____s
push 1
push dword [0x50c768]
call fcn.00444090
push 0x50bc28
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00456be4
add esp, 0x38
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x4712dc
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044dad3
push 0x4712e0
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x18
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c59c
push 0x551208
push 0x104
lea eax, [ebp - 0x230]
mov ecx, 0x51efe8
push eax
call fcn.00412160
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x230]
push 1
push 0
push 0
push eax
push 0x470f54
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x52bec0
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push str.___filePath_
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x52c344
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x47132c
push 0x1ffe
push 0x509c28
call fcn.0044dba2
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x509c28
push 0
push 0xfde9
call edi
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
push eax
push 0xffffffffffffffff
push 0x509c28
push 0
push 0xfde9
mov dword [0x509c24], eax
call edi
push 1
push 0
push dword [0x509c24]
push 0x50bc28
push 0x470f54
push 0
call ebx
push 0x50bc28
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
cmp dword [0x551644], 0
jne 0x40c6af
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x551648
call eax
mov dword [0x551644], eax
mov ecx, 0x51eff8
call fcn.00413790
jmp 0x40cb48
cmp eax, 4
je 0x40c6cc
cmp eax, 5
jne 0x40cb92
call fcn.00409630
test eax, eax
jne 0x40cb92
cmp dword [0x551180], 4
mov ecx, 0x51eff8
jne 0x40c931
push str.Installation_Required__The_Secure_Browser_requires_that_Microsoft_Edge_Runtime_be_installed_on_this_device._This_installation_will_require_administrative_privileges._Click_OK_to_exit_the_Secure_Browser_and_proceed_with_the_installation.
push str.EdgeInstallerRequest
call fcn.0041b270
test eax, eax
je 0x40c8a1
xor esi, esi
push esi
push esi
push str..MicrosoftEdgeWebview2Setup.exe
push str.https:__go.microsoft.com_fwlink_p__LinkId2124703
push esi
mov dword [ebp - 0x917c], esi
call sub.urlmon.dll_URLDownloadToFileA
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
jne 0x40c7ef
xorps xmm0, xmm0
mov dword [ebp - 0x91d4], 0x3c
lea eax, [ebp - 0x91d4]
movlpd qword [ebp - 0x91b0], xmm0
push eax
movlpd qword [ebp - 0x91a8], xmm0
movlpd qword [ebp - 0x91a0], xmm0
mov dword [ebp - 0x91d0], 0x100
mov dword [ebp - 0x91cc], esi
mov dword [ebp - 0x91c8], 0x4721ec
mov dword [ebp - 0x91c4], str.MicrosoftEdgeWebview2Setup.exe
mov dword [ebp - 0x91c0], str.__silent__install
mov dword [ebp - 0x91bc], esi
mov dword [ebp - 0x91b8], esi
mov dword [ebp - 0x91b4], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c7ef
mov edi, dword [ebp - 0x917c]
test edi, edi
je 0x40c7c6
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x917c]
mov dword [ebp - 0x917c], 0
push eax
push 0
call fcn.004018da
mov edi, dword [ebp - 0x917c]
test edi, edi
je 0x40c7c6
mov esi, 1
jmp 0x40c7f5
mov edi, dword [ebp - 0x917c]
test edi, edi
je 0x40c80a
push edi
mov dword [ebp - 4], 1
call ebx
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x40cb92
push str.The_installation_failed._Administrative_privileges_are_required_to_complete_the_installation.
push str.EdgeInstallerFailed
mov ecx, 0x51eff8
call fcn.0041b620
mov ecx, 0x51eff8
call fcn.0041ba90
mov eax, dword [0x49c088]
mov ecx, 0x51eff8
push eax
mov dword [0x52e298], eax
call fcn.0041bbb0
call fcn.00408b10
mov ecx, 0x51eff8
call fcn.00413790
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x49c088]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c890
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, esi
jmp 0x40e0c3
mov ecx, 0x51eff8
call fcn.0041ba90
mov eax, dword [0x49c088]
mov ecx, 0x51eff8
push eax
mov dword [0x52e298], eax
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.00413790
call fcn.00408b10
cmp dword [0x551644], 0
jne 0x40c8e4
push 0x551648
call ebx
mov dword [0x551644], eax
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x49c088]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c920
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, esi
jmp 0x40e0c3
call fcn.0041ba90
push 0x50e0b8
push 0x1ffe
push 0x509c28
call fcn.0044db48
push 0x50bc28
push str.BeforeExtractSB____s
push 1
push dword [0x50c768]
call fcn.00444090
push 0x551208
push dword [0x51f44c]
push 0x104
push 0x50bc28
call fcn.004094d0
push 0x50bc28
push str.ExtractSB____s
push 1
push dword [0x50c768]
call fcn.00444090
push 0x50bc28
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00456be4
add esp, 0x48
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x4712dc
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044dad3
push 0x4712e0
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x18
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ca13
push 0x551208
push 0x104
lea eax, [ebp - 0x230]
mov ecx, 0x51efe8
push eax
call fcn.00412160
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x230]
push 1
push 0
push 0
push eax
push 0x470f54
push 0
call ebx
push str.__updateUrl_
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x52bec0
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push str.___filePath_
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x52c344
push 0x1ffe
push 0x509c28
call fcn.0044dba2
push 0x47132c
push 0x1ffe
push 0x509c28
call fcn.0044dba2
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x3c
push 0
push 0
push 0xffffffffffffffff
push 0x509c28
push 0
push 0xfde9
call edi
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
push eax
push 0xffffffffffffffff
push 0x509c28
push 0
push 0xfde9
mov dword [0x509c24], eax
call edi
push 1
push 0
push dword [0x509c24]
push 0x50bc28
push 0x470f54
push 0
call ebx
push 1
push 0
push dword [0x509c24]
push 0x50bc28
push 0x470f54
push 0
call ebx
push 0x50bc28
push str.After_shell_execute_SB_lite____s
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
mov ecx, 0x51eff8
call fcn.00413790
cmp dword [0x551644], 0
jne 0x40cb48
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x551648
call eax
mov dword [0x551644], eax
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40cb88
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40cb7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, 2
jmp 0x40e0c3
push 0x551208
mov ecx, 0x51efe8
call fcn.00412320
push 0x100
call fcn.00447f7b
mov edi, eax
add esp, 4
test edi, edi
je 0x40cbe5
sub esp, 0x28
mov ecx, esp
push 0
push 0
sub esp, 0x18
mov dword [ecx + 0x24], 0
mov esi, esp
push 0x4714ec
call fcn.004086e0
add esp, 4
mov ecx, esi
push eax
call fcn.00408540
mov ecx, edi
call fcn.0041ceb0
cmp dword [0x51efdc], 0
mov edi, dword [0x52b5e4]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jne 0x40cc2d
push 0x472300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40cc2d
push 0x47230c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc2a
push 0
push edi
call eax
mov dword [0x51efdc], 1
push esi
call ebx
push 0
push dword [0x52b5e4]
call dword [sym.imp.USER32.dll_RegisterSuspendResumeNotification]
lea eax, [ebp - 0x9184]
push eax
push 0x47239c
push dword [0x52b5e4]
call dword [sym.imp.SHELL32.dll_SHGetPropertyStoreForWindow]
test eax, eax
js 0x40cc91
mov eax, 0xb
lea edx, [ebp - 0x91e4]
mov word [ebp - 0x91e4], ax
or eax, 0xffffffff
mov word [ebp - 0x91dc], ax
mov eax, dword [ebp - 0x9184]
push edx
push 0x483db8
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x9184]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, 0x49c1a8
call fcn.004100e0
cmp dword [0x49c390], 1
jne 0x40cd38
lea eax, [ebp - 0x334]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40cd38
push str.ITSAutomation.log
lea eax, [ebp - 0x334]
push 0x104
push eax
call fcn.0044dba2
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x334]
mov ecx, 0x51eff8
push eax
call fcn.00413ca0
push 0x47150c
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x918c]
push eax
call fcn.00457986
add esp, 0xc
test eax, eax
jne 0x40cd38
push dword [0x52b5e4]
push 0x471510
push dword [ebp - 0x918c]
call fcn.0040a5d0
push dword [ebp - 0x918c]
call fcn.00457a44
add esp, 0x10
push str.Before_checking_VM
push 1
push dword [0x50c768]
call fcn.00444090
push 0x64
push 0x52b5ec
push dword [0x50c768]
call fcn.00443be0
push str.After_checking_VM
push 1
push dword [0x50c768]
mov dword [0x51f4b4], eax
call fcn.00444090
push dword [0x50c768]
call fcn.00443b80
push str.After_checking_RDP
push 1
push dword [0x50c768]
mov dword [0x51f4b8], eax
call fcn.00444090
add esp, 0x34
cmp dword [0x51f4b4], 0
je 0x40cdb7
push 0x471550
push 0x10
push 0x50e090
call fcn.0044db48
add esp, 0xc
jmp 0x40cddd
cmp dword [0x51f4b8], 0
je 0x40cdd6
push 0x471558
push 0x10
push 0x50e090
call fcn.0044db48
add esp, 0xc
jmp 0x40cddd
mov byte [0x50e090], 0
cmp dword [0x51f48c], 0
je 0x40cebc
cmp dword [0x51f438], 0
je 0x40ce07
push 0x471568
push 0xa
push 0x49c094
call fcn.0044db48
add esp, 0xc
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x5183c4]
call fcn.004580f7
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x518fc8]
call fcn.004580f7
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x518fcc]
call fcn.004580f7
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x551414
push 0x528a04
push 0x50e068
push 0x520cc8
push 0x49c094
push 0x50c770
push str._SecureBrowser__s__s__s_s_TS__s__UUID__s__DKM:_s._s._s
push 0x523ad4
call esi
add esp, 0x50
push 0x523ad4
push 0x4715ac
push 1
push dword [0x50c768]
call fcn.00444090
push 0x520cc8
push 0x49c094
push 0x4715d0
push 0x5232d4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x20
push dword [0x50dbb8]
call esi
jmp 0x40cf90
push 5
lea eax, [ebp - 0x28]
push eax
push dword [0x5183c4]
call fcn.004580f7
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x518fc8]
call fcn.004580f7
push 5
lea eax, [ebp - 0x20]
push eax
push dword [0x518fcc]
call fcn.004580f7
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
add esp, 0x24
cmp dword [0x51f44c], 0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x553478
push 0x551414
push 0x528a04
push 0x50e068
push 0x50e090
jne 0x40cf61
push 0x520cc8
push 0x49c094
push 0x50c770
push 0x50dc68
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s
push 0x523ad4
call esi
push 0x520cc8
push 0x49c094
push 0x4715d0
push 0x5232d4
call esi
add esp, 0x48
jmp 0x40cf90
push 0x49c094
push 0x50c770
push 0x50dc68
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg_84.0.522.11__SecureBrowser__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s
push 0x523ad4
call esi
push 0x49c094
push 0x470908
push 0x5232d4
call esi
add esp, 0x40
push dword [ebp - 0x9194]
push 0x4716e4
push 1
push dword [0x50c768]
call fcn.00444090
push 0x50c770
push 0x470fdc
push 1
push dword [0x50c768]
call fcn.00444090
call fcn.00409e10
push dword [0x50d924]
push dword [0x50d928]
push dword [0x50d8bc]
push 0x470ff8
push 0x80
push 0x50d930
call fcn.00408300
push 0x50d930
push 0x471004
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x48
push 0x471014
push 1
push dword [0x50c768]
call fcn.00444090
lea eax, [ebp - 0xd3c]
push eax
push 0x471048
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x1c
lea eax, [ebp - 0x9180]
push eax
lea eax, [ebp - 0xb3c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xb3c]
push eax
push 0x4710a8
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x10
mov ecx, 0x51eff8
call fcn.0041a980
mov ecx, 0x51eff8
call fcn.0041acb0
mov ecx, 0x51eff8
call fcn.0041a330
mov ecx, 0x51eff8
call fcn.0041a4d0
mov ecx, 0x51eff8
call fcn.0041a810
mov ecx, 0x51eff8
call fcn.0041a670
mov ecx, 0x51eff8
call fcn.0041a200
cmp dword [0x51f46c], 0
je 0x40d0cc
push dword [0x52ce2c]
push 0x52c65c
push 0
push dword [0x50c768]
call fcn.00443c80
add esp, 0x10
cmp dword [0x51f44c], 0
je 0x40d0e1
mov ecx, 0x51efe8
call fcn.00411400
jmp 0x40d0e6
mov eax, dword [0x52b5cc]
push eax
push dword [0x50c768]
mov dword [0x50dbc0], eax
call fcn.00444020
push dword [0x51f420]
push dword [0x50c768]
call fcn.00443660
push dword [0x51f418]
push dword [0x50c768]
call fcn.00443700
push dword [0x51f43c]
push dword [0x50c768]
call fcn.00443640
push dword [0x51f424]
push dword [0x50c768]
call fcn.00443600
push dword [0x51f42c]
push dword [0x50c768]
call fcn.00443770
push dword [0x51f428]
push dword [0x50c768]
call fcn.00443720
push dword [0x51f448]
push dword [0x50c768]
call fcn.004435c0
add esp, 0x40
push dword [0x51f430]
push dword [0x50c768]
call fcn.00443790
push dword [0x51f450]
push dword [0x50c768]
call fcn.004435e0
push dword [0x51f454]
push dword [0x50c768]
call fcn.00443680
push dword [0x51f458]
push dword [0x50c768]
call fcn.00443620
push dword [0x51f45c]
push dword [0x50c768]
call fcn.004437f0
push dword [0x51f414]
push dword [0x50c768]
call fcn.004436e0
push dword [0x51f410]
push dword [0x50c768]
call fcn.004436c0
push dword [0x51f474]
push dword [0x50c768]
call fcn.004437b0
add esp, 0x40
cmp dword [0x51f4b8], 0
je 0x40d20e
cmp dword [0x51f4b4], 0
jne 0x40d227
push 0x528a84
call fcn.004577c4
push eax
push dword [0x50c768]
call fcn.004436a0
add esp, 0xc
push 0
push 0
push 0x10
push dword [0x50c338]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x52b5e4]
test eax, eax
je 0x40d91d
cmp dword [0x51f498], 0
mov dword [0x50dbc4], eax
je 0x40d2d5
mov ecx, 0x4705a0
mov eax, 0x54de74
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40d282
test dl, dl
je 0x40d27e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40d282
add eax, 2
add ecx, 2
test dl, dl
jne 0x40d262
xor eax, eax
jmp 0x40d287
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d2be
mov ecx, 0x4705a0
mov eax, 0x5534dc
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40d2b5
test dl, dl
je 0x40d2b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40d2b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x40d295
xor eax, eax
jmp 0x40d2ba
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40d2d5
push 0x50cbf0
push 0x1000
push 0x50c7f0
call fcn.0044db48
add esp, 0xc
push 1
push 0x556058
push 0x50c7f0
mov ecx, 0x556058
call fcn.00447480
mov ecx, 0x556058
call fcn.00447770
mov ecx, 0x556058
call fcn.00447590
cmp dword [0x51f3f8], 0
je 0x40d328
push 4
push 0x52b5d8
push 0x51
push 0
mov dword [0x52b5d8], 3
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [0x51f4bc], eax
cmp dword [0x51f45c], 0
je 0x40d369
push 0x4716fc
push 1
push dword [0x50c768]
call fcn.00444090
push dword [0x52b5e4]
push dword [0x50c768]
call fcn.00444000
push 0x471718
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x20
push dword [0x52b5e4]
push dword [0x50c768]
call fcn.00443920
push 4
push dword [0x50c768]
call fcn.00443fc0
add esp, 0x10
cmp dword [0x51f40c], 0
jne 0x40d3aa
push 0x64
push 0x52b5ec
push dword [0x50c768]
call fcn.00443be0
add esp, 0xc
jmp 0x40d3ac
xor eax, eax
mov edx, dword [0x51f490]
mov dword [0x51f4b4], eax
test edx, edx
jne 0x40d3d8
push dword [0x50c768]
call fcn.00443b80
mov edx, dword [0x51f490]
mov ecx, eax
mov eax, dword [0x51f4b4]
add esp, 4
jmp 0x40d3da
xor ecx, ecx
cmp dword [0x51f434], 0
mov dword [0x51f4b8], ecx
jne 0x40d5d0
cmp dword [0x51f40c], 0
jne 0x40d4cf
test eax, eax
je 0x40d4cf
push 0
push 0
push 1
push 2
push 0x52b5ec
mov ecx, 0x51eff8
mov dword [0x551410], 1
call fcn.00417510
push 0x471738
push 0x471774
mov ecx, 0x51eff8
call fcn.0041b620
push dword [0x52b5c8]
call fcn.004428b0
add esp, 4
mov ecx, 0x51eff8
call fcn.0041ba90
push 7
mov ecx, 0x51eff8
mov dword [0x52e298], 7
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.00413790
call fcn.00408b10
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x52e298]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d4be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, esi
jmp 0x40e0c3
mov eax, dword [0x50e0a0]
test edx, edx
jne 0x40d5b7
test ecx, ecx
je 0x40d5b7
test eax, eax
jne 0x40d5b7
push eax
push eax
push 1
push 3
push 0x471788
mov ecx, 0x51eff8
mov dword [0x551410], 1
call fcn.00417510
push 0x471790
push 0x4717dc
mov ecx, 0x51eff8
call fcn.0041b620
push dword [0x52b5c8]
call fcn.004428b0
add esp, 4
mov ecx, 0x51eff8
call fcn.0041ba90
push 7
mov ecx, 0x51eff8
mov dword [0x52e298], 7
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.00413790
call fcn.00408b10
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x52e298]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d5a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, esi
jmp 0x40e0c3
cmp dword [0x518fd4], 0
jne 0x40d5e5
test eax, eax
jne 0x40d5e5
mov ecx, 0x51eff8
call fcn.004133f0
jmp 0x40d5e5
push str.Default_value_set
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
push 0
push 0x471808
call dword [sym.imp.USER32.dll_FindWindowA]
push 3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0x49c1a8
call fcn.004103b0
cmp dword [0x50e0a0], 0
jne 0x40d6d8
mov ecx, 0x51eff8
call fcn.00416420
cmp dword [0x51f484], 0
je 0x40d6d8
test eax, eax
jle 0x40d6d8
push 0
push 0
push 1
push 0x12
push str.Library_Failed_to_Load
mov ecx, 0x51eff8
call fcn.00417510
mov ecx, 0x51eff8
mov dword [0x551410], 1
call fcn.0041ba90
push str.An_error_occurred__contact_support_for_assistance___109
push 0x4708bc
mov ecx, 0x51eff8
call fcn.0041b620
mov edx, dword [ebp - 0x9164]
mov dword [0x52e298], 0x4b
mov dword [0x50e0a0], 1
cmp edx, 8
jb 0x40d6ce
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d6c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, 0x4b
jmp 0x40e0c3
cmp dword [0x51f434], 0
jne 0x40d80a
cmp dword [0x52c658], 2
je 0x40d700
mov ecx, 0x51eff8
call fcn.00415040
test eax, eax
jne 0x40d80a
cmp dword [0x518fd4], 0
je 0x40d71b
mov ecx, 0x51eff8
call fcn.00415040
test eax, eax
jne 0x40d80a
mov ecx, 0x51eff8
call fcn.0041ba90
cmp dword [0x52c658], 2
je 0x40d742
push str.Unable_to_enable_security._Contact_support_for_further_assistance.
push str.EnableSecurityFailed
mov ecx, 0x51eff8
call fcn.0041b620
push 0x4708e0
push 1
push dword [0x50c768]
call fcn.00444090
push dword [0x52b5e4]
push dword [0x50c768]
call fcn.00443cb0
push 0x4708f4
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0x20
mov dword [0x52e298], 5
mov ecx, 0x51eff8
push 5
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.00413790
call fcn.00408b10
cmp dword [0x551644], 0
jne 0x40d7b9
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x551648
call eax
mov dword [0x551644], eax
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x52e298]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d7f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, esi
jmp 0x40e0c3
push 0
push 0
push 0
push 0x4090a0
push 0
push 0x8005
push 0x8005
mov dword [0x50c76c], 1
call dword [sym.imp.USER32.dll_SetWinEventHook]
push 0x4718ec
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
push 0
push 0x4099a0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push dword [0x5546fc]
push str.webViewCreated_before_runmessagepump__d
push 1
push dword [0x50c768]
call fcn.00444090
push dword [0x50e0ac]
push str.startUrlLoaded_before_runmessagepump__d
push 1
push dword [0x50c768]
call fcn.00444090
call fcn.00409e90
mov eax, dword [0x50e0a0]
mov ecx, 1
cmp dword [0x52e298], 0
cmove eax, ecx
push eax
push str.quitCode__d
push ecx
push dword [0x50c768]
mov dword [0x50e0a0], eax
call fcn.00444090
add esp, 0x30
cmp dword [0x551644], 0
jne 0x40d8d4
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x551648
call eax
mov dword [0x551644], eax
mov ecx, 0x51eff8
call fcn.00413df0
push 0x471964
push 1
push dword [0x50c768]
call fcn.00444090
add esp, 0xc
push dword [0x50c768]
call ebx
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x9190], 0
je 0x40deee
push 0x471afc
push 0x471b28
jmp 0x40df01
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d8fb
xor esi, esi
call dword [sym.imp.ole32.dll_OleUninitialize]
test esi, esi
je 0x40d901
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x1b54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x51eff8
push 0x3ff
push 0x400
push 0x5213d4
call fcn.004082c0
mov ecx, 0x52412c
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d970
push 0x400
push 0x5213d4
sub ecx, edx
push ecx
push 0x52412c
push 0xf
push 0x471978
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
mov ecx, 0x5240c8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d9b0
push 0x400
push 0x5213d4
sub ecx, edx
push ecx
push 0x5240c8
push 0x13
push 0x471988
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
mov ecx, 0x524000
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d9f0
push 0x400
push 0x5213d4
sub ecx, edx
push ecx
push 0x524000
push 0x11
push 0x47199c
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
mov ecx, 0x524064
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40da30
push 0x400
push 0x5213d4
sub ecx, edx
push ecx
push 0x524064
push 0x13
push 0x4719b0
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
mov ecx, 0x5229a8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40da70
push 0x400
push 0x5213d4
sub ecx, edx
push ecx
push 0x5229a8
push 0x10
push 0x4719c4
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
push 0x400
push 0x5213d4
push 1
push 0x4705a0
push 8
push 0x4719d8
push 0x400
push 0x5213d4
mov ecx, 0x556050
call fcn.00444540
mov ecx, 0x5213d4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dad8
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x5213d4
call fcn.0044dba2
add esp, 0xc
mov ecx, 0x51eff8
push 0
push 0
push str.cmddownload
push 0x4719f4
push 0x5213d4
push 0x400
push 0x50bf38
call fcn.00415800
mov ecx, 0x50bf38
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40db26
sub ecx, edx
push str.cmddownload
lea eax, [ecx + 0xe]
push eax
push 0x50bf38
call fcn.0044dba2
add esp, 0xc
push 0x401
push 0x40
call edi
mov esi, eax
mov ecx, 0x51eff8
push esi
push 0x50bf38
call fcn.0041ca20
push esi
push 0x4719f8
push 0x1ff
lea eax, [ebp - 0x2564]
push 0x200
push eax
call fcn.004082c0
add esp, 0x14
push 0x2a
push 0x40
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x50bf34], eax
call esi
push dword [0x50bf34]
lea eax, [ebp - 0x2564]
mov ecx, 0x51eff8
push eax
call fcn.004187f0
push 0x471a30
push 0x400
push 0x5213d4
call fcn.0044dba2
push dword [0x50bf34]
push 0x400
push 0x5213d4
call fcn.0044dba2
add esp, 0x18
push dword [0x50bf34]
call esi
push 0x5213d4
push 0x3ff
push 0x400
push 0x51eff8
call fcn.004082c0
add esp, 0x10
lea eax, [ebp - 0x9160]
mov ecx, 0x556050
push 0x1ffe
push eax
push 9
push str._starturl
push 4
push 0x471a44
push 0x1ffe
push 0x50e0b8
call fcn.00444540
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x9160]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call edi
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x9160]
push eax
push 0
push 0xfde9
call ebx
push 0x470a68
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.00456be4
push edi
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.00456be4
push 0x470afc
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push str._url_
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x51eff8
push 0
push 0xfde9
call ebx
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call eax
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x51eff8
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push str.___exe_
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
lea eax, [ebp - 0x1b54]
push eax
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push str.___updateversion_
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
add esp, 0x30
push 0
push 0
push 0xffffffffffffffff
push 0x521fd4
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x521fd4
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push str.___minversion_
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
push 0x522054
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x522054
push 0
push 0xfde9
call ebx
push edi
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push str.___exitmessage_
lea eax, [ebp - 0x6560]
mov dword [0x50dbd8], 0x471aac
push 0x1ffe
push eax
call fcn.0044dad3
push dword [0x50dbd8]
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
push 0x471af8
lea eax, [ebp - 0x6560]
push 0x1ffe
push eax
call fcn.0044dad3
add esp, 0x30
lea eax, [ebp - 0x194c]
mov ecx, 0x51efe8
push 0x551208
push 0x5220d4
push 0x104
push eax
call fcn.004126d0
mov ecx, 0x51eff8
call fcn.0041ba90
push 0xa
push 0
lea eax, [ebp - 0x6560]
push eax
lea eax, [ebp - 0x194c]
push eax
push 0x470f54
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
call ebx
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40dee4
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40deda
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e6
push edx
push ecx
call fcn.00447cee
add esp, 8
mov eax, 3
jmp 0x40e0c3
cmp dword [0x50c768], 0
jne 0x40df39
push 0x471b3c
push 0x471b5c
mov ecx, 0x51eff8
call fcn.0041b620
push dword [0x52b5c8]
call fcn.004428b0
add esp, 4
mov dword [0x52e298], 0xffffffff
mov ecx, 0x51eff8
mov dword [0x50e0a0], 1
push 0xffffffffffffffff
call fcn.0041bbb0
cmp dword [0x50c76c], 0
jne 0x40df83
cmp dword [0x50e0a0], 0
jne 0x40df83
push 0x471b6c
push 0x471b84
mov ecx, 0x51eff8
call fcn.0041b620
push dword [0x52b5c8]
call fcn.004428b0
add esp, 4
mov dword [0x52e298], 0xffffffff
mov ecx, 0x51eff8
push 0xffffffffffffffff
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.0041ba90
call fcn.00408b10
mov edx, dword [ebp - 0x9164]
mov esi, dword [0x52e298]
cmp edx, 8
jb 0x40c89a
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c890
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e6
jmp 0x40c890
test eax, eax
jne 0x40dfeb
push 0x551648
call ebx
mov dword [0x551644], eax
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40e0c3
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e025
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
jmp 0x40e0c3
push str.SecureBrowser_is_already_running..._
push str.SecureBrowserIsAlreadyRunning
mov ecx, 0x51eff8
call fcn.0041b620
mov ecx, 0x51eff8
call fcn.0041ba90
jmp 0x40b229
push 0x1000
push 0x471c14
push 0x471c1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
mov ecx, 0x51eff8
mov dword [0x52e298], 0xffffffff
call fcn.0041bbb0
mov edx, dword [ebp - 0x9164]
cmp edx, 8
jb 0x40e0c0
mov ecx, dword [ebp - 0x9178]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e0b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0e1
push edx
push ecx
call fcn.00447cee
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
call fcn.00452900
call fcn.00452900
int3