Function at 0x406d21
Capabilities:
Contain obfuscated stackstrings
Get graphical window text
Hide graphical window
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x485b18
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x4a0ee0]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push esi
push edi
mov eax, dword [0x4a0ee0]
xor eax, esp
push eax
lea eax, [esp + 0x328]
mov dword fs:[0], eax
and dword [esp + 0x20], 0
mov ebx, dword [0x4a5b20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 5
pop esi
push esi
push 0x66
push 0x8d2
push dword [0x4a5874]
mov dword [esp + 0x34], ebx
call edi
lea ecx, [esp + 0x164]
call fcn.0040df7c
lea ecx, [esp + 0x17c]
cmp dword [esp + 0x164], esi
jne 0x406efe
call fcn.0042523a
xor esi, esi
cmp dword [0x4a5b18], esi
jne 0x406e6b
push str.MSG_TIPS
lea eax, [esp + 0x70]
push eax
call fcn.00424e0d
push str.MSG_MUST_OS_NOT_SUPPORT
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x338], esi
call fcn.00424e0d
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x148]
push eax
mov byte [esp + 0x338], 1
call fcn.004040fc
mov ebx, eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x340], 2
call fcn.004040fc
add esp, 0x10
mov ecx, eax
push esi
mov eax, ebx
call fcn.00425210
push eax
mov eax, ecx
call fcn.00425210
push eax
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x9c]
call fcn.0042523a
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
or dword [esp + 0x330], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.0042523a
push 0
push 0
push 0x10
push dword [0x4a5874]
call edi
push str.os_not_support
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
push 3
pop edi
push 0x288
lea eax, [esp + 0x70]
mov ebx, 0x4a5bc8
push eax
mov ecx, str.._thread_install.cpp
mov edx, ebx
mov dword [esp + 0x338], edi
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 4
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
mov ecx, dword [esp + 0x328]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0045fbf1
mov esp, ebp
pop ebp
ret
call fcn.0042523a
call fcn.0040e171
test al, al
je 0x406dae
lea edi, [esp + 0x1e4]
call fcn.0040e035
push str.UniAccessAgent_Net_Installer
lea eax, [esp + 0x1c8]
push eax
mov dword [esp + 0x338], esi
call fcn.00424e0d
mov byte [esp + 0x330], 6
cmp dword [esp + 0x1e0], 8
mov ecx, dword [esp + 0x1cc]
jae 0x406f55
lea ecx, [esp + 0x1cc]
cmp dword [esp + 0x200], 8
mov eax, dword [esp + 0x1ec]
jae 0x406f6d
lea eax, [esp + 0x1ec]
push ecx
push eax
call fcn.004011fd
pop ecx
pop ecx
test eax, eax
je 0x407023
push 0xa
push eax
lea esi, [esp + 0x16c]
call fcn.00424b5b
push str.FirewallOpen_res
lea eax, [esp + 0x148]
push eax
mov byte [esp + 0x338], 7
call fcn.00424e0d
push 0x292
lea eax, [esp + 0x2c]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, 0x4a5bc8
mov byte [esp + 0x338], 8
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x144]
mov byte [esp + 0x330], 9
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
push eax
mov esi, 0x4a5bc8
call fcn.00410fba
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x164]
mov byte [esp + 0x330], 6
call fcn.0042523a
lea eax, [ebx + 0x270]
push eax
lea eax, [ebx + 0x250]
push eax
call fcn.0041ba7a
pop ecx
pop ecx
lea ecx, [esp + 0x28]
call fcn.0040de46
lea esi, [ebx + 0x290]
mov byte [esp + 0x330], 0xa
call fcn.00424f31
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 6
call fcn.0042523a
lea esi, [ebx + 0x2b0]
lea edi, [esp + 0x16]
mov ecx, esi
mov byte [esp + 0x16], 0
call fcn.00406ab6
cmp byte [esp + 0x16], 0
jne 0x407089
mov eax, esi
call fcn.00426ace
lea edi, [esp + 0x28]
call fcn.0040e035
lea esi, [ebx + 0xc]
mov byte [esp + 0x330], 0xb
call fcn.00424f31
mov ecx, edi
mov byte [esp + 0x330], 6
call fcn.0042523a
lea ebx, [esp + 0x28]
call fcn.0040e55a
mov edi, dword [esp + 0x24]
lea esi, [edi + 0x2c]
mov byte [esp + 0x330], 0xc
call fcn.00424f31
mov ecx, ebx
mov byte [esp + 0x330], 6
call fcn.0042523a
push str.08A6D228_353A_4AB0_B89F_0B1C04351B6E_VIP
lea eax, [esp + 0x148]
push eax
call fcn.00424e0d
lea esi, [edi + 0x14c]
lea eax, [esp + 0x144]
mov byte [esp + 0x330], 0xd
call fcn.00424f31
lea ecx, [esp + 0x144]
mov byte [esp + 0x330], 6
call fcn.0042523a
lea eax, [esp + 0x28]
push eax
call fcn.004271a4
pop ecx
lea esi, [edi + 0x230]
mov byte [esp + 0x330], 0xe
call fcn.00424f31
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 6
call fcn.0042523a
push 0xf
push 0x66
push 0x8d2
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
mov byte [esp + 0x16], 0
call fcn.00404f6a
test eax, eax
je 0x40722e
push 0xa
push eax
lea esi, [esp + 0x16c]
call fcn.00424b5b
push str.prepare_cust_ini_from_section_failed_iRet
lea eax, [esp + 0x148]
push eax
mov byte [esp + 0x338], 0xf
call fcn.00424e0d
push 0x2ac
lea eax, [esp + 0x2c]
push eax
push 3
mov ebx, 0x4a5bc8
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x10
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x144]
mov byte [esp + 0x330], 0x11
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x164]
call fcn.0042523a
call fcn.004064af
lea ecx, [esp + 0x1c4]
call fcn.0042523a
lea ecx, [esp + 0x1e4]
jmp 0x406ed5
push 0x14
push 0x66
push 0x8d2
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, edi
call fcn.004064e4
lea eax, [esp + 0xbc]
push eax
call fcn.00438f90
lea eax, [esp + 0xd4]
push eax
mov byte [esp + 0x334], 0x12
call fcn.00438f90
lea eax, [esp + 0xec]
push eax
mov byte [esp + 0x334], 0x13
call fcn.00438f90
xor ebx, ebx
mov byte [esp + 0x330], 0x14
cmp dword [edi + 0x104], ebx
je 0x4072a6
lea eax, [edi + 0xec]
push eax
lea eax, [esp + 0xd8]
call fcn.00408928
push 0x48b584
lea eax, [esp + 0x148]
push eax
call fcn.00424e0d
lea eax, [esp + 0xec]
push eax
lea ecx, [edi + 0xcc]
lea edx, [esp + 0x148]
mov byte [esp + 0x334], 0x15
call fcn.00426dea
lea ecx, [esp + 0x144]
mov byte [esp + 0x330], 0x14
call fcn.0042523a
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.0040a04c
pop ecx
pop ecx
lea esi, [esp + 0x1a4]
call fcn.00424973
mov byte [esp + 0x330], 0x16
cmp dword [edi + 0x1a4], ebx
je 0x4073c5
cmp dword [edi + 0x1c4], ebx
je 0x4073c5
lea eax, [edi + 0x18c]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00424e57
mov byte [esp + 0x330], 0x1f
call fcn.0040e4ab
test al, al
je 0x407368
lea eax, [edi + 0x1ac]
lea esi, [esp + 0x164]
call fcn.00424f31
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0xc0]
call fcn.00408928
cmp dword [esp + 0x1bc], ebx
jne 0x4073b4
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00425921
lea esi, [esp + 0x1a4]
mov byte [esp + 0x330], 0x20
call fcn.00424f31
lea ecx, [esp + 0x28]
call fcn.0042523a
mov byte [esp + 0x16], 1
lea ecx, [esp + 0x164]
jmp 0x4075de
push str.lva_setup_
lea eax, [esp + 0x148]
push eax
call fcn.00424e0d
mov byte [esp + 0x330], 0x17
call fcn.0040e4ab
test al, al
je 0x407425
push str.lva_setup64_
lea eax, [esp + 0x168]
push eax
call fcn.00424e0d
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x154]
mov byte [esp + 0x33c], 0x18
call fcn.00409901
lea ecx, [esp + 0x164]
call fcn.0042523a
mov eax, dword [esp + 0xe4]
sub eax, dword [esp + 0xe0]
mov dword [esp + 0x18], ebx
sar eax, 5
test eax, eax
jbe 0x4075d7
lea esi, [esp + 0x164]
call fcn.00424973
push str..exe
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x19
call fcn.00424e0d
push 0x48b7d8
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x338], 0x1a
call fcn.00424e0d
push 0x48b7d4
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x338], 0x1b
call fcn.00424e0d
push str.http:__
lea eax, [esp + 0xa0]
push eax
mov byte [esp + 0x338], 0x1c
call fcn.00424e0d
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x174]
mov byte [esp + 0x33c], 0x1d
call fcn.0041fd9f
push dword [esp + 0x18]
lea esi, [esp + 0xd8]
call fcn.00408907
lea esi, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x6c]
call fcn.0042735a
mov esi, eax
lea eax, [edi + 0x12c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x144]
call fcn.0042735a
mov esi, eax
lea eax, [edi + 0x8c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x28]
call fcn.0042735a
lea ecx, [esp + 0x9c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 0x19
call fcn.0042523a
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0xc0]
call fcn.00408928
cmp dword [esp + 0x1bc], ebx
jne 0x4075ac
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00425921
lea esi, [esp + 0x1a4]
mov byte [esp + 0x330], 0x1e
call fcn.00424f31
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x164]
call fcn.0042523a
mov eax, dword [esp + 0xe4]
sub eax, dword [esp + 0xe0]
inc dword [esp + 0x18]
sar eax, 5
cmp dword [esp + 0x18], eax
jb 0x407442
lea ecx, [esp + 0x144]
mov byte [esp + 0x330], 0x16
call fcn.0042523a
push str..msi
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
push ebx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x1a8]
call fcn.004264e7
lea ecx, [esp + 0x28]
mov byte [esp + 0x17], al
call fcn.0042523a
xor eax, eax
cmp byte [esp + 0x17], bl
sete al
dec eax
and eax, 0xffffffee
add eax, 0x62
push eax
push 0x66
push 0x8d2
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [esp + 0x4c]
call fcn.0040e55a
lea ecx, [esp + 0x1a4]
push ecx
push eax
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x33c], 0x21
call fcn.004273c5
add esp, 0xc
mov ecx, ebx
mov byte [esp + 0x330], 0x23
call fcn.0042523a
xor ebx, ebx
cmp dword [edi + 0x1e4], ebx
je 0x407782
cmp dword [edi + 0x204], ebx
je 0x407782
push str.LVASetupTmp_
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
lea ecx, [esp + 0x6c]
mov byte [esp + 0x330], 0x24
call fcn.00420a8e
lea ecx, [esp + 0x28]
push ecx
push eax
lea eax, [esp + 0x16c]
push eax
mov byte [esp + 0x33c], 0x25
call fcn.004273c5
add esp, 0xc
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 0x28
call fcn.0042523a
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.00425921
lea esi, [esp + 0x164]
mov byte [esp + 0x330], 0x29
call fcn.0042735a
lea ecx, [esp + 0x4c]
mov byte [esp + 0x330], 0x28
call fcn.0042523a
push ebx
lea eax, [esp + 0x128]
mov edx, esi
call fcn.00426993
test eax, eax
je 0x407776
push ebx
mov eax, esi
push eax
lea ebx, [esp + 0x54]
call fcn.00425a23
push eax
mov byte [esp + 0x334], 0x2a
call fcn.0040eea7
pop ecx
mov ecx, ebx
mov byte [esp + 0x330], 0x28
call fcn.0042523a
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x134]
call fcn.00409901
xor ebx, ebx
lea ecx, [esp + 0x164]
call fcn.0042523a
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov byte [esp + 0x98], 1
mov byte [esp + 0x99], 0
mov dword [esp + 0x8c], 0x48bb7c
push 1
mov ecx, edi
mov byte [esp + 0x334], 0x2b
call fcn.004067e7
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xc8]
mov dword [esp + 0x18], 0xffffff9c
sar eax, 5
mov dword [esp + 0x48], ebx
test eax, eax
jbe 0x407fbd
push dword [esp + 0x48]
lea esi, [esp + 0xc0]
call fcn.00408907
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00424e57
push str._to
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x338], 0x2c
call fcn.00424e0d
push str.try_to_download
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x2d
call fcn.00424e0d
push 0x307
lea eax, [esp + 0x70]
push eax
push 3
mov ebx, 0x4a5bc8
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x2e
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x2f
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
mov byte [esp + 0x330], 0x2c
call fcn.0042523a
and dword [esp + 0x1c], 0
cmp dword [esp + 0x180], 8
mov eax, dword [esp + 0x16c]
jae 0x4078d5
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [esp + 0x124]
push eax
call fcn.0040f833
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x2d0]
pop ecx
cmp eax, 1
je 0x4078fe
cmp eax, 3
jne 0x407979
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x16c]
call fcn.00449bb8
inc dword [esp + 0x24]
pop ecx
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40794f
cmp byte [esp + 0x16], al
jne 0x407ec4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
call fcn.00406c04
mov dword [esp + 0x18], eax
test eax, eax
je 0x407ec4
cmp dword [esp + 0x1c], 5
jg 0x407e85
cmp dword [esp + 0x18], 0xfffffc15
je 0x4078bd
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x2d0], 3
je 0x4078bd
push 0xa
push dword [esp + 0x1c]
lea esi, [esp + 0xa4]
call fcn.00424b5b
push str._ret
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x338], 0x30
call fcn.00424e0d
push str._to
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x338], 0x31
call fcn.00424e0d
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x32
call fcn.00424e0d
push 0x32e
lea eax, [esp + 0x148]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x33
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x34
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x6c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x9c]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x9c]
mov byte [esp + 0x330], 0x2c
call fcn.0042523a
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x16c]
push eax
call fcn.004223a7
add esp, 0xc
inc dword [esp + 0x1c]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x407add
cmp byte [esp + 0x16], al
jne 0x407ec4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
call fcn.00406c04
mov dword [esp + 0x18], eax
test eax, eax
je 0x407ec4
cmp dword [esp + 0x1c], 5
jg 0x407e85
push str._to
lea eax, [esp + 0x50]
push eax
call fcn.00424e0d
push str.ZDownloadWithIE_Failed_Try_WinHttp_
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x35
call fcn.00424e0d
push 0x33b
lea eax, [esp + 0x70]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x36
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x37
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
mov byte [esp + 0x330], 0x2c
call fcn.0042523a
lea eax, [esp + 0x124]
push eax
call fcn.0040f833
pop ecx
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00406b42
inc dword [esp + 0x1c]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x407bea
cmp byte [esp + 0x16], al
jne 0x407ec4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
call fcn.00406c04
mov dword [esp + 0x18], eax
test eax, eax
je 0x407ec4
cmp dword [esp + 0x1c], 5
jg 0x407e85
push str._to
lea eax, [esp + 0x50]
push eax
call fcn.00424e0d
push str.WinHttp_Failed_Try_WinINet_
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x38
call fcn.00424e0d
push 0x349
lea eax, [esp + 0x70]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x39
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x3a
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
mov byte [esp + 0x330], 0x2c
call fcn.0042523a
lea eax, [esp + 0x124]
push eax
call fcn.0040f833
pop ecx
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.00406b42
inc dword [esp + 0x1c]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x407cf7
cmp byte [esp + 0x16], al
jne 0x407ec4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
call fcn.00406c04
mov dword [esp + 0x18], eax
test eax, eax
je 0x407ec4
cmp dword [esp + 0x1c], 5
jg 0x407e85
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x2d0], 2
jne 0x4078bd
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x16c]
call fcn.00449bb8
inc dword [esp + 0x24]
pop ecx
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
jne 0x407d64
cmp byte [esp + 0x16], al
jne 0x407ec4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
call fcn.00406c04
mov dword [esp + 0x18], eax
test eax, eax
je 0x407ec4
cmp dword [esp + 0x1c], 5
jg 0x407e85
push 0xa
push dword [esp + 0x1c]
lea esi, [esp + 0xa4]
call fcn.00424b5b
push str._ret
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x338], 0x3b
call fcn.00424e0d
push str._to
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x338], 0x3c
call fcn.00424e0d
push str.BeeDownload_Failed_Try_ZDownloadWithIE_
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x3d
call fcn.00424e0d
push 0x364
lea eax, [esp + 0x148]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x3e
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x3f
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x6c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x9c]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x9c]
mov byte [esp + 0x330], 0x2c
call fcn.0042523a
jmp 0x4078bd
cmp dword [esp + 0x18], 0
je 0x407ec4
lea ecx, [esp + 0x164]
mov byte [esp + 0x330], 0x2b
call fcn.0042523a
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xc8]
inc dword [esp + 0x48]
sar eax, 5
cmp dword [esp + 0x48], eax
jb 0x4077e1
jmp 0x407fad
push str._OK.
lea eax, [esp + 0x70]
push eax
call fcn.00424e0d
push str._to
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x338], 0x40
call fcn.00424e0d
push str.download
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x41
call fcn.00424e0d
push 0x36d
lea eax, [esp + 0xa0]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x42
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x43
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x164]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x6c]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x9c]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x164]
mov byte [esp + 0x330], 0x2b
call fcn.0042523a
mov edi, dword [esp + 0x24]
xor esi, esi
cmp dword [esp + 0x18], esi
je 0x408125
push 3
mov ecx, edi
call fcn.004067e7
lea ecx, [esp + 0xbc]
lea ebx, [esp + 0x9c]
call fcn.00424a64
push str._vt_all_url_to_down
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x338], 0x44
call fcn.00424e0d
push 0xa
push dword [esp + 0x1c]
lea esi, [esp + 0x54]
mov byte [esp + 0x338], 0x45
call fcn.00424b5b
push str.get_down_url_failed
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x46
call fcn.00424e0d
push 0x378
lea eax, [esp + 0x148]
push eax
push 3
mov ebx, 0x4a5bc8
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x47
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x48
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x6c]
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x9c]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x144]
call fcn.0042523a
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x9c]
call fcn.0042523a
call fcn.004064af
lea ecx, [esp + 0x124]
mov dword [esp + 0x8c], vtable.HProcess::HFileDownloadCallBack.0
call fcn.0042523a
lea ecx, [esp + 0x1a4]
call fcn.0042523a
lea eax, [esp + 0xec]
push eax
mov byte [esp + 0x334], 0x13
call fcn.004088df
lea eax, [esp + 0xd4]
push eax
mov byte [esp + 0x334], 0x12
call fcn.004088df
lea eax, [esp + 0xbc]
push eax
mov byte [esp + 0x334], 6
call fcn.004088df
jmp 0x407216
push 2
mov ecx, edi
call fcn.004067e7
push str..msi
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
push esi
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x128]
call fcn.004264e7
lea ecx, [esp + 0x28]
mov bl, al
call fcn.0042523a
test bl, bl
je 0x408302
lea eax, [esp + 0x204]
push eax
call fcn.00421523
push str.MsiExec.exe__qn__i
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x49
call fcn.00424e0d
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x128]
push eax
mov byte [esp + 0x338], 0x4d
call fcn.004252f0
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x33c], 0x4e
call fcn.004273c5
add esp, 0xc
lea esi, [esp + 0x204]
mov byte [esp + 0x330], 0x4f
call fcn.00424f31
lea ecx, [esp + 0x4c]
call fcn.0042523a
lea ecx, [esp + 0x6c]
call fcn.0042523a
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 0x49
call fcn.0042523a
lea ecx, [esp + 0x9c]
call fcn.0040e3b4
lea esi, [esp + 0x22c]
mov byte [esp + 0x330], 0x50
call fcn.00424f31
lea ecx, [esp + 0x9c]
mov byte [esp + 0x330], 0x49
call fcn.0042523a
or dword [esp + 0x228], 0xffffffff
lea eax, [edi + 0x1cc]
lea esi, [esp + 0x2a0]
mov dword [esp + 0x224], 5
call fcn.00424f31
lea eax, [edi + 0x1ec]
lea esi, [esp + 0x2c0]
call fcn.00424f31
lea eax, [edi + 0x20c]
lea esi, [esp + 0x2e0]
call fcn.00424f31
lea ebx, [esp + 0x204]
call fcn.00421dc2
lea ebx, [esp + 0x144]
lea ecx, [esp + 0x204]
mov dword [esp + 0x48], eax
call fcn.00421589
mov esi, eax
push 0x38f
lea eax, [esp + 0x2c]
push eax
push 3
mov ebx, 0x4a5bc8
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x51
call fcn.0041110d
mov ecx, eax
mov eax, esi
mov esi, ecx
mov byte [esp + 0x330], 0x52
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x144]
call fcn.0042523a
lea esi, [esp + 0x204]
mov byte [esp + 0x330], 0x2b
call fcn.0040882e
jmp 0x408600
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.004252f0
mov ebx, 0x48ba18
push ebx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x53
call fcn.00424e0d
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x174]
mov byte [esp + 0x33c], 0x54
call fcn.0041fd9f
lea eax, [edi + 0x4c]
lea esi, [esp + 0x164]
call fcn.0042735a
lea ecx, [esp + 0x28]
mov byte [esp + 0x330], 0x53
call fcn.0042523a
mov esi, 0x48ba1c
push esi
lea eax, [esp + 0x50]
push eax
call fcn.00424e0d
push 0
lea eax, [esp + 0x50]
push eax
lea ecx, [edi + 0x4c]
mov byte [esp + 0x338], 0x55
call fcn.0042690e
cmp eax, 0xffffffff
lea ecx, [esp + 0x4c]
sete byte [esp + 0x17]
mov byte [esp + 0x330], 0x53
call fcn.0042523a
cmp byte [esp + 0x17], 0
je 0x40841c
push esi
lea eax, [esp + 0x70]
push eax
call fcn.00424e0d
push ebx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x338], 0x56
call fcn.00424e0d
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x174]
mov byte [esp + 0x33c], 0x57
call fcn.0041fd9f
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x174]
call fcn.0041fd9f
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x6c]
mov byte [esp + 0x330], 0x53
call fcn.0042523a
cmp dword [0x4a5b18], 0
je 0x40846b
push str.__q__s
lea eax, [esp + 0xa0]
push eax
call fcn.00424e0d
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x174]
mov byte [esp + 0x33c], 0x58
call fcn.0041fd9f
lea ecx, [esp + 0x9c]
mov byte [esp + 0x330], 0x53
call fcn.0042523a
xor esi, esi
push esi
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push 0x64
push 0x8d2
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x204]
push eax
call fcn.00421523
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x214]
mov byte [esp + 0x33c], 0x59
call fcn.00409901
push esi
lea eax, [esp + 0x128]
push eax
lea ebx, [esp + 0x14c]
call fcn.00425a23
lea esi, [esp + 0x22c]
mov byte [esp + 0x330], 0x5a
call fcn.00424f31
mov ecx, ebx
mov byte [esp + 0x330], 0x59
call fcn.0042523a
and dword [esp + 0x228], 0
lea eax, [edi + 0x1cc]
lea esi, [esp + 0x2a0]
mov dword [esp + 0x224], 5
call fcn.00424f31
lea eax, [edi + 0x1ec]
lea esi, [esp + 0x2c0]
call fcn.00424f31
lea eax, [edi + 0x20c]
lea esi, [esp + 0x2e0]
call fcn.00424f31
lea ebx, [esp + 0x204]
call fcn.00421dc2
lea ebx, [esp + 0x104]
lea ecx, [esp + 0x204]
mov dword [esp + 0x48], eax
call fcn.00421589
mov esi, eax
push 0x3a9
lea eax, [esp + 0x2c]
push eax
push 3
mov ebx, 0x4a5bc8
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x5b
call fcn.0041110d
mov ecx, eax
mov eax, esi
mov esi, ecx
mov byte [esp + 0x330], 0x5c
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x28]
call fcn.0042523a
lea ecx, [esp + 0x104]
mov byte [esp + 0x330], 0x59
call fcn.0042523a
cmp dword [esp + 0x300], 0
jne 0x4085d6
mov ecx, dword [esp + 0x24]
push 4
call fcn.004067e7
jmp 0x4085db
or dword [esp + 0x48], 0xffffffff
lea esi, [esp + 0x204]
call fcn.0040882e
lea ecx, [esp + 0x164]
mov byte [esp + 0x330], 0x2b
call fcn.0042523a
mov ebx, 0x4a5bc8
cmp dword [esp + 0x48], 0
je 0x408683
mov ecx, dword [esp + 0x24]
push 5
call fcn.004067e7
push str.insatll_failed
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
push 0x3b8
lea eax, [esp + 0x108]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x5d
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x330], 0x5e
call fcn.0042735a
mov esi, eax
lea eax, [esp + 0x124]
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x104]
call fcn.0042523a
lea ecx, [esp + 0x28]
jmp 0x4080b4
push str..msi
lea eax, [esp + 0x2c]
push eax
call fcn.00424e0d
push 0
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x128]
call fcn.004264e7
lea ecx, [esp + 0x28]
mov byte [esp + 0x17], al
call fcn.0042523a
cmp byte [esp + 0x17], 0
je 0x4087b4
push 0x5f
push 0x66
push 0x8d2
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push str.UaaClient.exe
lea eax, [esp + 0x70]
push eax
call fcn.00424e0d
lea eax, [esp + 0x6c]
mov byte [esp + 0x330], 0x5f
or dword [esp + 0x20], 1
push eax
call fcn.00406725
pop ecx
test eax, eax
jne 0x408735
push str.UniAccessAgent.exe
lea eax, [esp + 0x50]
push eax
call fcn.00424e0d
lea eax, [esp + 0x4c]
mov dword [esp + 0x330], 0x60
or dword [esp + 0x20], 2
push eax
call fcn.00406725
pop ecx
mov byte [esp + 0x16], 0
test eax, eax
je 0x40873a
mov byte [esp + 0x16], 1
test byte [esp + 0x20], 2
je 0x40874f
and dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x4c]
call fcn.0042523a
mov dword [esp + 0x330], 0x2b
test byte [esp + 0x20], 1
je 0x40876f
and dword [esp + 0x20], 0xfffffffe
lea ecx, [esp + 0x6c]
call fcn.0042523a
cmp byte [esp + 0x16], 0
jne 0x408782
push 0x1f4
call esi
jmp 0x4086d7
push 0x2710
call esi
lea eax, [esp + 0x124]
push eax
call fcn.0040f42d
pop ecx
test al, al
je 0x4087a9
lea eax, [esp + 0x124]
push eax
call fcn.0040f833
pop ecx
mov ecx, dword [esp + 0x24]
push 4
call fcn.004067e7
push 0
push 0
push 0x10
push dword [0x4a5874]
call dword [sym.imp.USER32.dll_SendMessageW]
push str.insalled_end
lea eax, [esp + 0x50]
push eax
call fcn.00424e0d
push 0x3d7
lea eax, [esp + 0x108]
push eax
push 3
mov ecx, str.._thread_install.cpp
pop edi
mov edx, ebx
mov byte [esp + 0x338], 0x61
call fcn.0041110d
mov esi, eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x330], 0x62
call fcn.0042735a
push eax
mov esi, ebx
call fcn.00410fba
lea ecx, [esp + 0x104]
call fcn.0042523a
lea ecx, [esp + 0x4c]
call fcn.0042523a
jmp 0x4080be