Function at 0x4b459f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2f4
mov eax, 0x4fd5cf
call fcn.004cb654
push 5
push 0x66
xor eax, eax
mov dword [ebp - 0x2c0], eax
mov edi, dword [0x541500]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x8d2
push dword [0x541440]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2bc], edi
call ebx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x278]
call fcn.004297e1
cmp dword [ebp - 0x278], 5
lea ecx, [ebp - 0x260]
je 0x4b5d6f
call fcn.00440d86
lea ecx, [ebp - 0x2b4]
call fcn.004297e1
cmp dword [ebp - 0x2a8], 5
lea ecx, [ebp - 0x29c]
jl 0x4b5d6f
call fcn.00440d86
lea ecx, [ebp - 0x144]
call fcn.00429879
push str.UniAccessAgent_Net_Installer
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 4
call fcn.004408e0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x124]
cmp dword [ebp - 0x110], 8
lea ecx, [ebp - 0x140]
cmovae edx, dword [ebp - 0x124]
cmp dword [ebp - 0x12c], 8
cmovae ecx, dword [ebp - 0x140]
call fcn.004ada4a
mov ebx, 0x541580
test eax, eax
je 0x4b46fa
push 0xa
push eax
lea ecx, [ebp - 0x64]
call fcn.00440507
push str.FirewallOpen_res
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 6
call fcn.004408e0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0xd4]
mov ecx, ebx
push eax
push 0x336
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d86
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.00440d86
lea edx, [edi + 0x224]
lea ecx, [edi + 0x208]
call fcn.00436ce4
lea ecx, [ebp - 0x2c]
call fcn.004296b7
push eax
lea ecx, [edi + 0x240]
mov byte [ebp - 4], 8
call fcn.00440a86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d86
lea esi, [edi + 0x25c]
mov byte [ebp - 0x2b5], 0
lea edx, [ebp - 0x2b5]
mov ecx, esi
call fcn.004b41a1
cmp byte [ebp - 0x2b5], 0
jne 0x4b4759
mov ecx, esi
call fcn.0044282f
lea ecx, [ebp - 0x2c]
call fcn.00429879
push eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 9
call fcn.00440a86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d86
lea ecx, [ebp - 0x2c]
call fcn.00429dc2
push eax
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 0xa
call fcn.00440a86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d86
push str.8393F74D_EF95_4C53_82D3_FF96241DC028_VIP
lea ecx, [ebp - 0xd4]
call fcn.004408e0
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [edi + 0x128]
call fcn.0044341f
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00440d86
lea ecx, [ebp - 0x2c]
call fcn.00442f29
push eax
lea ecx, [edi + 0x1ec]
mov byte [ebp - 4], 0xc
call fcn.00440a86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d86
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xf
push 0x66
push 0x8d2
push dword [0x541440]
call esi
mov ecx, edi
mov byte [ebp - 0x2b5], 0
call fcn.004b29ef
test eax, eax
je 0x4b4895
push 0xa
push eax
lea ecx, [ebp - 0x64]
call fcn.00440507
push str.prepare_cust_ini_from_section_failed_iRet
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xd
call fcn.004408e0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xd4]
mov ecx, ebx
push eax
push 0x354
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d86
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.00440d86
call fcn.004b3cc9
jmp 0x4b5d59
push 0x14
push 0x66
push 0x8d2
push dword [0x541440]
call esi
mov ecx, edi
call fcn.004b3cfe
xor ebx, ebx
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2fc], 0x1c
cmp dword [edi + 0xe4], ebx
je 0x4b4971
push 0x5291e8
lea ecx, [ebp - 0xd4]
call fcn.004408e0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [edi + 0xd0]
call fcn.00442b41
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x11
call fcn.00440d86
mov esi, dword [ebp - 0x2dc]
cmp esi, dword [ebp - 0x2d8]
je 0x4b4971
push 0x1c
pop edi
push esi
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.004b6014
add esi, edi
cmp esi, dword [ebp - 0x2d8]
jne 0x4b4948
mov edi, dword [ebp - 0x2bc]
push 0x5291e8
lea ecx, [ebp - 0xd4]
call fcn.004408e0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [edi + 0xb4]
call fcn.00442b41
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x11
call fcn.00440d86
mov esi, dword [ebp - 0x2dc]
cmp esi, dword [ebp - 0x2d8]
je 0x4b49e7
push 0x1c
pop edi
push esi
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.004b6014
add esi, edi
cmp esi, dword [ebp - 0x2d8]
jne 0x4b49be
mov edi, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x10c]
call fcn.004402d1
mov byte [ebp - 4], 0x14
cmp dword [edi + 0x170], ebx
je 0x4b4a89
lea esi, [edi + 0x17c]
cmp dword [esi + 0x10], ebx
je 0x4b4a89
lea eax, [edi + 0x15c]
push eax
lea ecx, [ebp - 0x64]
call fcn.0044093d
mov byte [ebp - 4], 0x22
call fcn.00429d08
test al, al
je 0x4b4a32
push esi
lea ecx, [ebp - 0x60]
call fcn.0044341f
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
cmp dword [ebp - 0xf8], 0
jne 0x4b4a71
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call fcn.00441459
add eax, 4
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x108]
call fcn.0044341f
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x2b5], 1
mov byte [ebp - 4], 0x14
call fcn.00440d86
jmp 0x4b4da6
push str.lva_setup_
lea ecx, [ebp - 0xd4]
call fcn.004408e0
mov byte [ebp - 4], 0x15
call fcn.00429d08
test al, al
je 0x4b4ace
push str.lva_setup64_
lea ecx, [ebp - 0x64]
call fcn.004408e0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xd0]
call fcn.0044341f
lea ecx, [ebp - 0x64]
call fcn.00440d86
mov eax, dword [ebp - 0x2cc]
sub eax, dword [ebp - 0x2d0]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4b4d95
lea eax, [edi + 0x10c]
mov dword [ebp - 0x2c4], eax
lea eax, [edi + 0x80]
mov dword [ebp - 0x2c0], eax
xor edi, edi
lea ecx, [ebp - 0x64]
call fcn.004402d1
push str..exe
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.004408e0
push str._uai_download_downloadAgent.htm_filedownload_uai_
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.004408e0
push 0x51f4f4
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x19
call fcn.004408e0
push str.http:__
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x1a
call fcn.004408e0
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0x1b
mov esi, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x60]
push eax
call fcn.0042cfc8
lea eax, [esi + 4]
add eax, edi
lea ecx, [ebp - 0x60]
push eax
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0xf0]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.00440d86
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
lea ecx, [ebp - 0x9c]
call fcn.004402d1
push 0x1c
pop eax
push str..exe
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], al
call fcn.004408e0
mov byte [ebp - 4], 0x1d
push str._uai_download_downloadAgent.htm_filedownload_uai_
lea ecx, [ebp - 0xb8]
call fcn.004408e0
push 0x51f4f4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1e
call fcn.004408e0
push str.https:__
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
call fcn.004408e0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
mov esi, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x98]
push eax
call fcn.0042cfc8
lea eax, [esi + 4]
add eax, edi
lea ecx, [ebp - 0x98]
push eax
call fcn.0042cfc8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
push 0x1c
pop eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], al
call fcn.00440d86
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
cmp dword [ebp - 0xf8], 0
jne 0x4b4d5f
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00441459
add eax, 4
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x108]
call fcn.0044341f
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x9c]
call fcn.00440d86
lea ecx, [ebp - 0x64]
call fcn.00440d86
mov eax, dword [ebp - 0x2cc]
inc ebx
sub eax, dword [ebp - 0x2d0]
push 0x1c
pop ecx
cdq
add edi, ecx
idiv ecx
cmp ebx, eax
jb 0x4b4b02
mov edi, dword [ebp - 0x2bc]
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x14
call fcn.00440d86
xor ebx, ebx
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408e0
lea ecx, [ebp - 0x2c]
call fcn.00440d86
push 0x64
push 0x66
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x48]
call fcn.00429dc2
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x24
push ecx
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.0044310b
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.00440d86
cmp dword [edi + 0x1a8], ebx
je 0x4b4ec9
cmp dword [edi + 0x1c4], ebx
je 0x4b4ec9
push str.LVASetupTmp_
lea ecx, [ebp - 0x2c]
call fcn.004408e0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x27
call fcn.00429c86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x28
push ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.0044310b
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2b
call fcn.00440d86
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.00441459
add eax, 4
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2b
call fcn.00440d86
push ebx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x64]
call fcn.004426f7
test eax, eax
je 0x4b4ec1
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0044150e
mov ecx, eax
mov byte [ebp - 4], 0x2d
call fcn.0042a6dd
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2b
call fcn.00440d86
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0044341f
lea ecx, [ebp - 0x64]
call fcn.00440d86
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x2f0], ebx
mov word [ebp - 0x2ec], 1
mov dword [ebp - 0x2f8], 0x529734
push 1
mov ecx, edi
mov byte [ebp - 4], 0x2e
call fcn.004b3f9c
mov eax, dword [ebp - 0x2e4]
mov ecx, dword [ebp - 0x2e8]
sub eax, ecx
push 0xffffffffffffff9c
pop ebx
push 0x1c
cdq
pop esi
idiv esi
and dword [ebp - 0x2c0], 0
test eax, eax
je 0x4b5c3b
xor eax, eax
mov dword [ebp - 0x2c4], eax
add eax, ecx
lea ecx, [ebp - 0x9c]
push eax
call fcn.0044093d
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.004408e0
push str.try_to_download
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x30
call fcn.004408e0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0x48]
mov esi, 0x541580
push eax
lea eax, [ebp - 0x9c]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3be
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d86
xor esi, esi
cmp dword [ebp - 0x84], 8
lea eax, [ebp - 0x98]
cmovae eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
mov eax, dword [edi + 0x278]
cmp eax, 1
je 0x4b4fef
cmp eax, 3
jne 0x4b5067
push dword [edi + 0x27c]
lea eax, [ebp - 0x2f8]
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.004a9974
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
pop ecx
test ebx, ebx
jne 0x4b5045
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5596
cmp ebx, 0xfffffc15
je 0x4b4fbc
cmp dword [edi + 0x278], 3
je 0x4b4fbc
push 0xa
push ebx
lea ecx, [ebp - 0xf0]
call fcn.00440507
push str._ret
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x32
call fcn.004408e0
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x33
call fcn.004408e0
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x34
call fcn.004408e0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0xb8]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3e4
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2f
call fcn.00440d86
test ebx, ebx
je 0x4b5168
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x2f8]
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.0043d746
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
test ebx, ebx
jne 0x4b51b7
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5596
push str._to
lea ecx, [ebp - 0x48]
call fcn.004408e0
push str.ZDownloadWithIE_Failed_Try_WinHttp_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x36
call fcn.004408e0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x48]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3f5
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d86
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
test ebx, ebx
je 0x4b5271
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
push ecx
call fcn.004b4238
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b52bb
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5596
push str._to
lea ecx, [ebp - 0x48]
call fcn.004408e0
push str.WinHttp_Failed_Try_WinINet_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x38
call fcn.004408e0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0x48]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x408
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d86
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
test ebx, ebx
je 0x4b5375
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
push ecx
call fcn.004b4238
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b53bf
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5596
cmp dword [edi + 0x278], 2
jne 0x4b5529
test ebx, ebx
je 0x4b53ed
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x2f8]
push 0x9914
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.004a9974
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
pop ecx
test ebx, ebx
jne 0x4b5442
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5596
push 0xa
push ebx
lea ecx, [ebp - 0xf0]
call fcn.00440507
push str._ret
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3a
call fcn.004408e0
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x3b
call fcn.004408e0
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3c
call fcn.004408e0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0xb8]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x42d
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2f
call fcn.00440d86
test ebx, ebx
je 0x4b554c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.004b5ead
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b558d
cmp byte [ebp - 0x2b5], al
jne 0x4b5596
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4334
mov ebx, eax
test ebx, ebx
je 0x4b55ec
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jle 0x4b4fbc
test ebx, ebx
je 0x4b55ec
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x2e
call fcn.00440d86
mov ecx, dword [ebp - 0x2e8]
push 0x1c
pop eax
add dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2e4]
sub eax, ecx
mov esi, dword [ebp - 0x2c0]
cdq
inc esi
idiv dword [ebp - 0x2fc]
mov dword [ebp - 0x2c0], esi
cmp esi, eax
mov eax, dword [ebp - 0x2c4]
jb 0x4b4f23
mov esi, 0x541580
jmp 0x4b56a9
push str._OK.
lea ecx, [ebp - 0xb8]
call fcn.004408e0
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x3e
call fcn.004408e0
push str.download
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3f
call fcn.004408e0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x80]
mov esi, 0x541580
push eax
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x445
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x2e
call fcn.00440d86
test ebx, ebx
jne 0x4b5c3b
push 2
mov ecx, edi
call fcn.004b3f9c
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408e0
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00441ffb
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00440d86
test bl, bl
je 0x4b5832
lea ecx, [ebp - 0x23c]
call fcn.0043c87e
push str.MsiExec.exe__qn__i
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x48
call fcn.004408e0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0x80]
call fcn.00440e44
push eax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x48]
call fcn.0044310b
pop ecx
add eax, 4
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x238]
call fcn.0044341f
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x48
call fcn.00440d86
lea ecx, [ebp - 0xf0]
call fcn.00429b90
add eax, 4
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x214]
call fcn.0044341f
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x48
call fcn.00440d86
or dword [ebp - 0x21c], 0xffffffff
lea eax, [edi + 0x198]
push eax
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x220], 5
call fcn.0044341f
lea eax, [edi + 0x1b4]
push eax
lea ecx, [ebp - 0x190]
call fcn.0044341f
lea eax, [edi + 0x1d0]
push eax
lea ecx, [ebp - 0x174]
call fcn.0044341f
lea ecx, [ebp - 0x23c]
call fcn.0043d12d
mov ebx, eax
lea eax, [ebp - 0xd4]
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0043c8e4
push eax
push 0x467
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
mov ecx, esi
mov byte [ebp - 4], 0x50
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d86
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x2e
call fcn.00437a28
jmp 0x4b5a7d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x80]
call fcn.00440e44
push 0x51f8b8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x51
call fcn.004408e0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [edi + 0x48]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x51
call fcn.00440d86
push str._NoQueryBox
lea ecx, [ebp - 0x48]
call fcn.004408e0
xor ebx, ebx
mov byte [ebp - 4], 0x53
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x44]
call fcn.00442689
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x51
mov esi, eax
call fcn.00440d86
cmp esi, 0xffffffff
jne 0x4b5901
push str._NoQueryBox
lea ecx, [ebp - 0xb8]
call fcn.004408e0
push 0x51f8b8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x54
call fcn.004408e0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x51
call fcn.00440d86
cmp dword [0x54146c], 0
je 0x4b593c
push str.__q__s
lea ecx, [ebp - 0xf0]
call fcn.004408e0
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x51
call fcn.00440d86
push ebx
push dword [0x541440]
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push 0x64
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x23c]
call fcn.0043c87e
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x238]
call fcn.0044341f
push ebx
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x80]
call fcn.0044150e
add eax, 4
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x214]
call fcn.0044341f
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x57
call fcn.00440d86
lea eax, [edi + 0x198]
mov dword [ebp - 0x220], 5
push eax
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x21c], ebx
call fcn.0044341f
lea eax, [edi + 0x1b4]
push eax
lea ecx, [ebp - 0x190]
call fcn.0044341f
lea eax, [edi + 0x1d0]
push eax
lea ecx, [ebp - 0x174]
call fcn.0044341f
lea ecx, [ebp - 0x23c]
call fcn.0043d12d
mov ebx, eax
lea eax, [ebp - 0x9c]
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0043c8e4
push eax
push 0x481
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
mov esi, 0x541580
mov byte [ebp - 4], 0x59
push 3
mov ecx, esi
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x57
call fcn.00440d86
cmp dword [ebp - 0x15c], 4
jne 0x4b5a63
push 4
mov ecx, edi
call fcn.004b3f9c
jmp 0x4b5a66
or ebx, 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.00437a28
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x2e
call fcn.00440d86
test ebx, ebx
je 0x4b5ad4
push 5
mov ecx, edi
call fcn.004b3f9c
push str.insatll_failed
lea ecx, [ebp - 0x2c]
call fcn.004408e0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
push 0x490
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
jmp 0x4b5d01
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408e0
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00441ffb
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00440d86
test bl, bl
je 0x4b5be5
push 0x5f
push 0x66
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0x300]
push str.UaaClient.exe
lea ecx, [ebp - 0xb8]
call fcn.004408e0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0xb8]
or ebx, 1
mov dword [ebp - 0x2c0], ebx
call fcn.004b3ede
test eax, eax
jne 0x4b5b78
push str.UniAccessNID.exe
lea ecx, [ebp - 0x48]
call fcn.004408e0
mov dword [ebp - 4], 0x5f
lea ecx, [ebp - 0x48]
or ebx, 2
mov dword [ebp - 0x2c0], ebx
call fcn.004b3ede
mov byte [ebp - 0x2b5], 0
test eax, eax
je 0x4b5b7f
mov byte [ebp - 0x2b5], 1
test bl, 2
je 0x4b5b8f
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffd
call fcn.00440d86
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0x2e
and ebx, 0xfffffffe
call fcn.00440d86
cmp byte [ebp - 0x2b5], 0
jne 0x4b5bbd
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5b1c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x80]
call fcn.0042ac91
test al, al
je 0x4b5bdc
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
push 4
mov ecx, edi
call fcn.004b3f9c
push 0
push 0
push 0x10
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
push str.insalled_end
lea ecx, [ebp - 0x48]
call fcn.004408e0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x60
push eax
push 0x4b4
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
mov ecx, esi
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x48]
call fcn.00440d86
jmp 0x4b5d0f
push 3
mov ecx, edi
call fcn.004b3f9c
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004403fc
push str._vt_all_url_to_down
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x41
call fcn.004408e0
push 0xa
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x42
call fcn.00440507
push str.get_down_url_failed
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x43
call fcn.004408e0
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xb8]
mov ebx, 0x541580
push eax
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x450
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
lea ecx, [ebp - 0xb8]
call fcn.00440d86
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2e
call fcn.00440d86
call fcn.004b3cc9
lea ecx, [ebp - 0x80]
mov dword [ebp - method.std::_Facet_base.virtual_4], vtable.HProcess::HFileDownloadCallBack.0
call fcn.00440d86
lea ecx, [ebp - 0x10c]
call fcn.00440d86
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x61
call fcn.00428daf
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x62
call fcn.00428daf
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x63
call fcn.00428daf
lea ecx, [ebp - 0x128]
call fcn.00440d86
lea ecx, [ebp - 0x144]
jmp 0x4b5e6c
call fcn.00440d86
cmp dword [0x54146c], 0
jne 0x4b5e1e
push 0x528298
lea ecx, [ebp - 0xb8]
call fcn.004408e0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push str.MSG_MUST_OS_NOT_SUPPORT
call fcn.004408e0
lea edx, [ebp - 0xb8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd4]
call fcn.004b161e
mov esi, eax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.004b161e
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x4b5dd6
mov esi, dword [esi]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x4b5de1
mov eax, dword [eax]
push 0
push esi
push eax
push dword [0x541440]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0xf0]
call fcn.00440d86
lea ecx, [ebp - 0xd4]
call fcn.00440d86
lea ecx, [ebp - 0x2c]
call fcn.00440d86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.00440d86
push 0
push 0
push 0x10
push dword [0x541440]
call ebx
push str.os_not_support
lea ecx, [ebp - 0x2c]
call fcn.004408e0
push 3
pop eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
push ecx
push 0x32c
push str.e:works10820_niduniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
mov ebx, 0x541580
push eax
mov ecx, ebx
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d86
call fcn.004cb5fe
ret