Function at 0x4b457e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2f4
mov eax, 0x4fd5c2
call fcn.004cb630
push 5
push 0x66
xor eax, eax
mov dword [ebp - 0x2c0], eax
mov edi, dword [0x541500]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x8d2
push dword [0x541440]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2bc], edi
call ebx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x278]
call fcn.004297e1
cmp dword [ebp - 0x278], 5
lea ecx, [ebp - 0x260]
je 0x4b5d4e
call fcn.00440d6c
lea ecx, [ebp - 0x2b4]
call fcn.004297e1
cmp dword [ebp - 0x2a8], 5
lea ecx, [ebp - 0x29c]
jl 0x4b5d4e
call fcn.00440d6c
lea ecx, [ebp - 0x144]
call fcn.00429879
push str.UniAccessAgent_Net_Installer
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 4
call fcn.004408c6
mov byte [ebp - 4], 5
lea edx, [ebp - 0x124]
cmp dword [ebp - 0x110], 8
lea ecx, [ebp - 0x140]
cmovae edx, dword [ebp - 0x124]
cmp dword [ebp - 0x12c], 8
cmovae ecx, dword [ebp - 0x140]
call fcn.004ada2c
mov ebx, 0x541580
test eax, eax
je 0x4b46d9
push 0xa
push eax
lea ecx, [ebp - 0x64]
call fcn.004404ed
push str.FirewallOpen_res
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 6
call fcn.004408c6
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0xd4]
mov ecx, ebx
push eax
push 0x336
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d6c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.00440d6c
lea edx, [edi + 0x224]
lea ecx, [edi + 0x208]
call fcn.00436ccf
lea ecx, [ebp - 0x2c]
call fcn.004296b7
push eax
lea ecx, [edi + 0x240]
mov byte [ebp - 4], 8
call fcn.00440a6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d6c
lea esi, [edi + 0x25c]
mov byte [ebp - 0x2b5], 0
lea edx, [ebp - 0x2b5]
mov ecx, esi
call fcn.004b4180
cmp byte [ebp - 0x2b5], 0
jne 0x4b4738
mov ecx, esi
call fcn.00442815
lea ecx, [ebp - 0x2c]
call fcn.00429879
push eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 9
call fcn.00440a6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
call fcn.00429dc2
push eax
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 0xa
call fcn.00440a6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d6c
push str.08A6D228_353A_4AB0_B89F_0B1C04351B6E_VIP
lea ecx, [ebp - 0xd4]
call fcn.004408c6
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [edi + 0x128]
call fcn.00443405
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
call fcn.00442f0f
push eax
lea ecx, [edi + 0x1ec]
mov byte [ebp - 4], 0xc
call fcn.00440a6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00440d6c
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xf
push 0x66
push 0x8d2
push dword [0x541440]
call esi
mov ecx, edi
mov byte [ebp - 0x2b5], 0
call fcn.004b29ce
test eax, eax
je 0x4b4874
push 0xa
push eax
lea ecx, [ebp - 0x64]
call fcn.004404ed
push str.prepare_cust_ini_from_section_failed_iRet
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xd
call fcn.004408c6
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xd4]
mov ecx, ebx
push eax
push 0x354
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d6c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.00440d6c
call fcn.004b3ca8
jmp 0x4b5d38
push 0x14
push 0x66
push 0x8d2
push dword [0x541440]
call esi
mov ecx, edi
call fcn.004b3cdd
xor ebx, ebx
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2fc], 0x1c
cmp dword [edi + 0xe4], ebx
je 0x4b4950
push 0x529108
lea ecx, [ebp - 0xd4]
call fcn.004408c6
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [edi + 0xd0]
call fcn.00442b27
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x11
call fcn.00440d6c
mov esi, dword [ebp - 0x2dc]
cmp esi, dword [ebp - 0x2d8]
je 0x4b4950
push 0x1c
pop edi
push esi
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.004b5ff3
add esi, edi
cmp esi, dword [ebp - 0x2d8]
jne 0x4b4927
mov edi, dword [ebp - 0x2bc]
push 0x529108
lea ecx, [ebp - 0xd4]
call fcn.004408c6
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [edi + 0xb4]
call fcn.00442b27
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x11
call fcn.00440d6c
mov esi, dword [ebp - 0x2dc]
cmp esi, dword [ebp - 0x2d8]
je 0x4b49c6
push 0x1c
pop edi
push esi
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.004b5ff3
add esi, edi
cmp esi, dword [ebp - 0x2d8]
jne 0x4b499d
mov edi, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x10c]
call fcn.004402b7
mov byte [ebp - 4], 0x14
cmp dword [edi + 0x170], ebx
je 0x4b4a68
lea esi, [edi + 0x17c]
cmp dword [esi + 0x10], ebx
je 0x4b4a68
lea eax, [edi + 0x15c]
push eax
lea ecx, [ebp - 0x64]
call fcn.00440923
mov byte [ebp - 4], 0x22
call fcn.00429d08
test al, al
je 0x4b4a11
push esi
lea ecx, [ebp - 0x60]
call fcn.00443405
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
cmp dword [ebp - 0xf8], 0
jne 0x4b4a50
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call fcn.0044143f
add eax, 4
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x108]
call fcn.00443405
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x2b5], 1
mov byte [ebp - 4], 0x14
call fcn.00440d6c
jmp 0x4b4d85
push str.lva_setup_
lea ecx, [ebp - 0xd4]
call fcn.004408c6
mov byte [ebp - 4], 0x15
call fcn.00429d08
test al, al
je 0x4b4aad
push str.lva_setup64_
lea ecx, [ebp - 0x64]
call fcn.004408c6
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xd0]
call fcn.00443405
lea ecx, [ebp - 0x64]
call fcn.00440d6c
mov eax, dword [ebp - 0x2cc]
sub eax, dword [ebp - 0x2d0]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4b4d74
lea eax, [edi + 0x10c]
mov dword [ebp - 0x2c4], eax
lea eax, [edi + 0x80]
mov dword [ebp - 0x2c0], eax
xor edi, edi
lea ecx, [ebp - 0x64]
call fcn.004402b7
push str..exe
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.004408c6
push str._uai_download_downloadAgent.htm_filedownload_uai_
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.004408c6
push 0x51f4f4
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x19
call fcn.004408c6
push str.http:__
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x1a
call fcn.004408c6
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0x1b
mov esi, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x60]
push eax
call fcn.0042cfc8
lea eax, [esi + 4]
add eax, edi
lea ecx, [ebp - 0x60]
push eax
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0xf0]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.00440d6c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
lea ecx, [ebp - 0x9c]
call fcn.004402b7
push 0x1c
pop eax
push str..exe
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], al
call fcn.004408c6
mov byte [ebp - 4], 0x1d
push str._uai_download_downloadAgent.htm_filedownload_uai_
lea ecx, [ebp - 0xb8]
call fcn.004408c6
push 0x51f4f4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1e
call fcn.004408c6
push str.https:__
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
call fcn.004408c6
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
mov esi, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x98]
push eax
call fcn.0042cfc8
lea eax, [esi + 4]
add eax, edi
lea ecx, [ebp - 0x98]
push eax
call fcn.0042cfc8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
push dword [ebp - 0x2c0]
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x98]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
push 0x1c
pop eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], al
call fcn.00440d6c
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00428d2d
cmp dword [ebp - 0xf8], 0
jne 0x4b4d3e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0044143f
add eax, 4
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x108]
call fcn.00443405
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x9c]
call fcn.00440d6c
lea ecx, [ebp - 0x64]
call fcn.00440d6c
mov eax, dword [ebp - 0x2cc]
inc ebx
sub eax, dword [ebp - 0x2d0]
push 0x1c
pop ecx
cdq
add edi, ecx
idiv ecx
cmp ebx, eax
jb 0x4b4ae1
mov edi, dword [ebp - 0x2bc]
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x14
call fcn.00440d6c
xor ebx, ebx
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408c6
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
push 0x64
push 0x66
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x48]
call fcn.00429dc2
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x24
push ecx
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.004430f1
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.00440d6c
cmp dword [edi + 0x1a8], ebx
je 0x4b4ea8
cmp dword [edi + 0x1c4], ebx
je 0x4b4ea8
push str.LVASetupTmp_
lea ecx, [ebp - 0x2c]
call fcn.004408c6
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x27
call fcn.00429c86
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x28
push ecx
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.004430f1
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2b
call fcn.00440d6c
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.0044143f
add eax, 4
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2b
call fcn.00440d6c
push ebx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x64]
call fcn.004426dd
test eax, eax
je 0x4b4ea0
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.004414f4
mov ecx, eax
mov byte [ebp - 4], 0x2d
call fcn.0042a6dd
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2b
call fcn.00440d6c
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00443405
lea ecx, [ebp - 0x64]
call fcn.00440d6c
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x2f0], ebx
mov word [ebp - 0x2ec], 1
mov dword [ebp - 0x2f8], 0x529654
push 1
mov ecx, edi
mov byte [ebp - 4], 0x2e
call fcn.004b3f7b
mov eax, dword [ebp - 0x2e4]
mov ecx, dword [ebp - 0x2e8]
sub eax, ecx
push 0xffffffffffffff9c
pop ebx
push 0x1c
cdq
pop esi
idiv esi
and dword [ebp - 0x2c0], 0
test eax, eax
je 0x4b5c1a
xor eax, eax
mov dword [ebp - 0x2c4], eax
add eax, ecx
lea ecx, [ebp - 0x9c]
push eax
call fcn.00440923
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.004408c6
push str.try_to_download
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x30
call fcn.004408c6
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0x48]
mov esi, 0x541580
push eax
lea eax, [ebp - 0x9c]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3be
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d6c
xor esi, esi
cmp dword [ebp - 0x84], 8
lea eax, [ebp - 0x98]
cmovae eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
mov eax, dword [edi + 0x278]
cmp eax, 1
je 0x4b4fce
cmp eax, 3
jne 0x4b5046
push dword [edi + 0x27c]
lea eax, [ebp - 0x2f8]
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.004a9956
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
pop ecx
test ebx, ebx
jne 0x4b5024
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5575
cmp ebx, 0xfffffc15
je 0x4b4f9b
cmp dword [edi + 0x278], 3
je 0x4b4f9b
push 0xa
push ebx
lea ecx, [ebp - 0xf0]
call fcn.004404ed
push str._ret
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x32
call fcn.004408c6
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x33
call fcn.004408c6
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x34
call fcn.004408c6
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0xb8]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3e4
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2f
call fcn.00440d6c
test ebx, ebx
je 0x4b5147
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x2f8]
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.0043d72c
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
test ebx, ebx
jne 0x4b5196
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5575
push str._to
lea ecx, [ebp - 0x48]
call fcn.004408c6
push str.ZDownloadWithIE_Failed_Try_WinHttp_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x36
call fcn.004408c6
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x48]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x3f5
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d6c
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
test ebx, ebx
je 0x4b5250
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
push ecx
call fcn.004b4217
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b529a
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5575
push str._to
lea ecx, [ebp - 0x48]
call fcn.004408c6
push str.WinHttp_Failed_Try_WinINet_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x38
call fcn.004408c6
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0x48]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x408
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x2f
call fcn.00440d6c
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
test ebx, ebx
je 0x4b5354
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
push ecx
call fcn.004b4217
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b539e
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5575
cmp dword [edi + 0x278], 2
jne 0x4b5508
test ebx, ebx
je 0x4b53cc
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x2f8]
push 0x9914
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.004a9956
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
pop ecx
pop ecx
test ebx, ebx
jne 0x4b5421
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jg 0x4b5575
push 0xa
push ebx
lea ecx, [ebp - 0xf0]
call fcn.004404ed
push str._ret
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x3a
call fcn.004408c6
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x3b
call fcn.004408c6
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3c
call fcn.004408c6
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0xb8]
mov ecx, 0x541580
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x42d
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, 0x541580
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2f
call fcn.00440d6c
test ebx, ebx
je 0x4b552b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0x68
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.004b5e8c
mov ebx, eax
inc esi
mov dword [ebp - 0x2bc], esi
test ebx, ebx
jne 0x4b556c
cmp byte [ebp - 0x2b5], al
jne 0x4b5575
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004b4313
mov ebx, eax
test ebx, ebx
je 0x4b55cb
mov esi, dword [ebp - 0x2bc]
cmp esi, 6
jle 0x4b4f9b
test ebx, ebx
je 0x4b55cb
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x2e
call fcn.00440d6c
mov ecx, dword [ebp - 0x2e8]
push 0x1c
pop eax
add dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2e4]
sub eax, ecx
mov esi, dword [ebp - 0x2c0]
cdq
inc esi
idiv dword [ebp - 0x2fc]
mov dword [ebp - 0x2c0], esi
cmp esi, eax
mov eax, dword [ebp - 0x2c4]
jb 0x4b4f02
mov esi, 0x541580
jmp 0x4b5688
push str._OK.
lea ecx, [ebp - 0xb8]
call fcn.004408c6
push str._to
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x3e
call fcn.004408c6
push str.download
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3f
call fcn.004408c6
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x80]
mov esi, 0x541580
push eax
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x445
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x2e
call fcn.00440d6c
test ebx, ebx
jne 0x4b5c1a
push 2
mov ecx, edi
call fcn.004b3f7b
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408c6
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00441fe1
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00440d6c
test bl, bl
je 0x4b5811
lea ecx, [ebp - 0x23c]
call fcn.0043c867
push str.MsiExec.exe__qn__i
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x48
call fcn.004408c6
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0x80]
call fcn.00440e2a
push eax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x48]
call fcn.004430f1
pop ecx
add eax, 4
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x238]
call fcn.00443405
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x48
call fcn.00440d6c
lea ecx, [ebp - 0xf0]
call fcn.00429b90
add eax, 4
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x214]
call fcn.00443405
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x48
call fcn.00440d6c
or dword [ebp - 0x21c], 0xffffffff
lea eax, [edi + 0x198]
push eax
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x220], 5
call fcn.00443405
lea eax, [edi + 0x1b4]
push eax
lea ecx, [ebp - 0x190]
call fcn.00443405
lea eax, [edi + 0x1d0]
push eax
lea ecx, [ebp - 0x174]
call fcn.00443405
lea ecx, [ebp - 0x23c]
call fcn.0043d113
mov ebx, eax
lea eax, [ebp - 0xd4]
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0043c8cd
push eax
push 0x467
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
mov ecx, esi
mov byte [ebp - 4], 0x50
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0xd4]
call fcn.00440d6c
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x2e
call fcn.00437a13
jmp 0x4b5a5c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x80]
call fcn.00440e2a
push 0x51f8b8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x51
call fcn.004408c6
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [edi + 0x48]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x51
call fcn.00440d6c
push str._NoQueryBox
lea ecx, [ebp - 0x48]
call fcn.004408c6
xor ebx, ebx
mov byte [ebp - 4], 0x53
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x44]
call fcn.0044266f
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x51
mov esi, eax
call fcn.00440d6c
cmp esi, 0xffffffff
jne 0x4b58e0
push str._NoQueryBox
lea ecx, [ebp - 0xb8]
call fcn.004408c6
push 0x51f8b8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x54
call fcn.004408c6
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x51
call fcn.00440d6c
cmp dword [0x54146c], 0
je 0x4b591b
push str.__q__s
lea ecx, [ebp - 0xf0]
call fcn.004408c6
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x60]
call fcn.0042cfc8
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x51
call fcn.00440d6c
push ebx
push dword [0x541440]
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push 0x64
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x23c]
call fcn.0043c867
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x238]
call fcn.00443405
push ebx
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x80]
call fcn.004414f4
add eax, 4
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x214]
call fcn.00443405
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x57
call fcn.00440d6c
lea eax, [edi + 0x198]
mov dword [ebp - 0x220], 5
push eax
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x21c], ebx
call fcn.00443405
lea eax, [edi + 0x1b4]
push eax
lea ecx, [ebp - 0x190]
call fcn.00443405
lea eax, [edi + 0x1d0]
push eax
lea ecx, [ebp - 0x174]
call fcn.00443405
lea ecx, [ebp - 0x23c]
call fcn.0043d113
mov ebx, eax
lea eax, [ebp - 0x9c]
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0043c8cd
push eax
push 0x481
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
mov esi, 0x541580
mov byte [ebp - 4], 0x59
push 3
mov ecx, esi
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x57
call fcn.00440d6c
cmp dword [ebp - 0x15c], 4
jne 0x4b5a42
push 4
mov ecx, edi
call fcn.004b3f7b
jmp 0x4b5a45
or ebx, 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.00437a13
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x2e
call fcn.00440d6c
test ebx, ebx
je 0x4b5ab3
push 5
mov ecx, edi
call fcn.004b3f7b
push str.insatll_failed
lea ecx, [ebp - 0x2c]
call fcn.004408c6
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
push 0x490
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
jmp 0x4b5ce0
push str..msi
lea ecx, [ebp - 0x2c]
call fcn.004408c6
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00441fe1
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.00440d6c
test bl, bl
je 0x4b5bc4
push 0x5f
push 0x66
push 0x8d2
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0x300]
push str.UaaClient.exe
lea ecx, [ebp - 0xb8]
call fcn.004408c6
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0xb8]
or ebx, 1
mov dword [ebp - 0x2c0], ebx
call fcn.004b3ebd
test eax, eax
jne 0x4b5b57
push str.UniAccessAgent.exe
lea ecx, [ebp - 0x48]
call fcn.004408c6
mov dword [ebp - 4], 0x5f
lea ecx, [ebp - 0x48]
or ebx, 2
mov dword [ebp - 0x2c0], ebx
call fcn.004b3ebd
mov byte [ebp - 0x2b5], 0
test eax, eax
je 0x4b5b5e
mov byte [ebp - 0x2b5], 1
test bl, 2
je 0x4b5b6e
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffd
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0x2e
and ebx, 0xfffffffe
call fcn.00440d6c
cmp byte [ebp - 0x2b5], 0
jne 0x4b5b9c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5afb
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x80]
call fcn.0042ac91
test al, al
je 0x4b5bbb
lea ecx, [ebp - 0x80]
call fcn.0042b0b7
push 4
mov ecx, edi
call fcn.004b3f7b
push 0
push 0
push 0x10
push dword [0x541440]
call dword [sym.imp.USER32.dll_SendMessageW]
push str.insalled_end
lea ecx, [ebp - 0x48]
call fcn.004408c6
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x60
push eax
push 0x4b4
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
mov ecx, esi
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, esi
call fcn.0042cc64
lea ecx, [ebp - 0x48]
call fcn.00440d6c
jmp 0x4b5cee
push 3
mov ecx, edi
call fcn.004b3f7b
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004403e2
push str._vt_all_url_to_down
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x41
call fcn.004408c6
push 0xa
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x42
call fcn.004404ed
push str.get_down_url_failed
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x43
call fcn.004408c6
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xb8]
mov ebx, 0x541580
push eax
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x450
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
push 3
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
lea ecx, [ebp - 0x48]
call fcn.00440d6c
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2e
call fcn.00440d6c
call fcn.004b3ca8
lea ecx, [ebp - 0x80]
mov dword [ebp - method.std::_Facet_base.virtual_4], vtable.HProcess::HFileDownloadCallBack.0
call fcn.00440d6c
lea ecx, [ebp - 0x10c]
call fcn.00440d6c
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x61
call fcn.00428daf
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x62
call fcn.00428daf
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x63
call fcn.00428daf
lea ecx, [ebp - 0x128]
call fcn.00440d6c
lea ecx, [ebp - 0x144]
jmp 0x4b5e4b
call fcn.00440d6c
cmp dword [0x54146c], 0
jne 0x4b5dfd
push 0x5281c0
lea ecx, [ebp - 0xb8]
call fcn.004408c6
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push str.MSG_MUST_OS_NOT_SUPPORT
call fcn.004408c6
lea edx, [ebp - 0xb8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd4]
call fcn.004b15fd
mov esi, eax
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.004b15fd
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x4b5db5
mov esi, dword [esi]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x4b5dc0
mov eax, dword [eax]
push 0
push esi
push eax
push dword [0x541440]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0xf0]
call fcn.00440d6c
lea ecx, [ebp - 0xd4]
call fcn.00440d6c
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.00440d6c
push 0
push 0
push 0x10
push dword [0x541440]
call ebx
push str.os_not_support
lea ecx, [ebp - 0x2c]
call fcn.004408c6
push 3
pop eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
push ecx
push 0x32c
push str.e:works10820uniaccess3_1_srcuniaccessagentprometheus2lva_setup_net_thread_install.cpp
mov ebx, 0x541580
push eax
mov ecx, ebx
call fcn.0042cd55
mov ecx, eax
call fcn.0042bd3a
push eax
mov ecx, ebx
call fcn.0042cc64
lea ecx, [ebp - 0x2c]
call fcn.00440d6c
call fcn.004cb5da
ret