Function at 0x429bf0
Capabilities:
Check mutex on windows
Get common file path
Initialize winsock library
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4cdd49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c8
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push 0
lea ecx, [esp + 0x18]
call fcn.00458110
mov ecx, ebp
mov dword [esp + 0x5e0], 0
call fcn.0042aaf0
cmp eax, 0x10
jb 0x429c62
push str.Create_Window_failed_
lea eax, [ebp + 0xa5]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d1fd4]
add esp, 0xc
push 0x274
push str.Initialize__
push ecx
jmp 0x42a383
call fcn.004753b0
test eax, 0x10000
je 0x429cb2
mov edi, dword [esp + 0x34]
lea edx, [esp + 0x14]
neg edi
sbb edi, edi
and edi, edx
jne 0x429cb4
lea eax, [esp + 0x38]
lea ecx, [ebp + 0xa5]
push eax
push str.Creating_security_attributes_failed__ErrorInfo_s_
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d1fd4]
add esp, 0x10
push 0x27e
push str.Initialize__
push edx
jmp 0x429f8c
xor edi, edi
call fcn.004753b0
test eax, 0x10000
je 0x429ce9
mov eax, dword [str.LSAgentMutex]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x148]
push 0x103
push edx
call fcn.00466ca7
add esp, 0x14
jmp 0x429d04
mov eax, dword [str.LSAgentMutex]
push 0x103
lea ecx, [esp + 0x140]
push eax
push ecx
call fcn.00466df0
add esp, 0xc
lea edx, [esp + 0x13c]
push edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp + 0x84], eax
je 0x42a5d0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x42a5d0
mov eax, dword [ebp + 0x84]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x429d6f
push str.LSAgent_has_been_started_
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0xc
push 0x2a2
jmp 0x42a5f4
call fcn.004753b0
test eax, 0x10000
je 0x429da4
mov eax, dword [str.LSAgentExit]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x148]
push 0x103
push edx
call fcn.00466ca7
add esp, 0x14
jmp 0x429dbf
mov eax, dword [str.LSAgentExit]
push 0x104
lea ecx, [esp + 0x140]
push eax
push ecx
call fcn.00466df0
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 0x13c]
push edx
push 0
push 1
push edi
call ebx
test eax, eax
mov dword [ebp + 0x88], eax
jne 0x429e16
call esi
push eax
mov eax, dword [str.LSAgentExit]
push eax
push 0x4e4420
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d1fd4]
add esp, 0x14
push 0x2b3
push str.Initialize__
push edx
jmp 0x429f8c
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call esi
call fcn.004753b0
test eax, 0x10000
je 0x429eea
mov eax, dword [str.AgentHeartBeat]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x148]
push 0x103
push edx
call fcn.00466ca7
add esp, 0x14
lea eax, [esp + 0x13c]
push eax
push 0
push 1
push edi
call ebx
test eax, eax
mov dword [ebp + 0x94], eax
jne 0x429ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [str.AgentHeartBeat]
push eax
push ecx
push 0x4e4420
lea edx, [ebp + 0xa5]
push 0xfff
push edx
call fcn.00466ca7
add esp, 0x14
push 0x2c0
jmp 0x429f81
push eax
call esi
mov ecx, dword [ebp + 0x94]
push ecx
push 0x96
push 1
mov ecx, ebp
call fcn.00429a40
cmp eax, 0x10
jb 0x429eea
push 0x4e15ec
lea edx, [ebp + 0xa5]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd0]
add esp, 0xc
push 0x2c7
push str.Initialize__
jmp 0x429f8b
call fcn.004753b0
test eax, 0x10000
je 0x429f20
mov ecx, dword [str.UninstallPermit]
mov edx, dword [str.Global]
push ecx
push edx
push 0x4df9ac
lea eax, [esp + 0x148]
push 0x103
push eax
call fcn.00466ca7
add esp, 0x14
jmp 0x429f3c
mov ecx, dword [str.UninstallPermit]
push 0x104
lea edx, [esp + 0x140]
push ecx
push edx
call fcn.00466df0
add esp, 0xc
lea eax, [esp + 0x13c]
push eax
push 0
push 1
push edi
call ebx
test eax, eax
mov dword [ebp + 0x8c], eax
jne 0x429fb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [str.UninstallPermit]
push eax
push ecx
push 0x4e4420
lea edx, [ebp + 0xa5]
push 0xfff
push edx
call fcn.00466ca7
add esp, 0x14
push 0x2d9
mov eax, dword [0x4d1fd4]
push str.Initialize__
push eax
mov ecx, ebp
call fcn.0042b1b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
mov eax, 0x23
jmp 0x42a620
push eax
call esi
lea ecx, [esp + 0x448]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42a019
push str.Start_up_Windows_Socket_Application__WSA__failed_
lea edx, [ebp + 0xa5]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd4]
add esp, 0xc
mov ecx, ebp
push 0x2e4
push str.Initialize__
push eax
call fcn.0042b1b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
mov eax, 0x1a
jmp 0x42a620
call fcn.004753b0
push 0x140c
call fcn.00467824
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42a0d9
mov eax, dword [str.SOFTWAREBaosightlsagent]
mov dword [ebx + 0x408], 0
test eax, eax
mov dword [ebx + 0x404], 0x80000002
je 0x42a063
push 0x400
push eax
push ebx
call fcn.00466df0
add esp, 0xc
jmp 0x42a085
mov edi, 0x4f4f94
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x400
xor eax, eax
lea edi, [ebx + 0x40c]
mov byte [ebx + 0x400], 0
rep stosd dword es:[edi], eax
mov edx, dword [str.ECOP_CL_RES_CONFIG]
mov ecx, dword [ebp + 0x6c]
push ebx
push edx
call fcn.0044b380
cmp eax, 0x10
jb 0x42a108
mov eax, dword [str.ECOP_CL_RES_CONFIG]
lea ecx, [ebp + 0xa5]
push eax
push 0x4e43d8
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0x10
push 0x306
jmp 0x42a377
push 0x4e43c8
lea eax, [ebp + 0xa5]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d1fd4]
add esp, 0xc
push 0x300
push str.Initialize__
push ecx
jmp 0x42a2d7
call fcn.004753b0
test eax, 0x10000
je 0x42a201
push 0x140c
call fcn.00467824
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42a1de
mov eax, dword [str.SYSTEMCurrentControlSetServicesLSAgent]
mov dword [ebx + 0x408], 0
test eax, eax
mov dword [ebx + 0x404], 0x80000002
je 0x42a15d
push 0x400
push eax
push ebx
call fcn.00466df0
add esp, 0xc
jmp 0x42a17f
mov edi, 0x4f4f94
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x400
xor eax, eax
lea edi, [ebx + 0x40c]
mov byte [ebx + 0x400], 0
rep stosd dword es:[edi], eax
mov eax, dword [str.ECOP_CL_RES_SERVICE]
mov ecx, dword [ebp + 0x6c]
push ebx
push eax
call fcn.0044b380
cmp eax, 0x10
jb 0x42a201
mov ecx, dword [str.ECOP_CL_RES_SERVICE]
lea edx, [ebp + 0xa5]
push ecx
push 0x4e43d8
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd0]
add esp, 0x10
push 0x316
push str.Initialize__
push eax
jmp 0x42a383
push 0x4e43c8
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0xc
push 0x310
jmp 0x42a2cb
push 8
call fcn.00467824
add esp, 4
mov dword [esp + 0x10], eax
xor esi, esi
mov byte [esp + 0x5e0], 1
cmp eax, esi
je 0x42a226
mov ecx, eax
call fcn.0040f7e0
jmp 0x42a228
xor eax, eax
cmp eax, esi
mov byte [esp + 0x5e0], 0
jne 0x42a254
push 0x4e43c8
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0xc
push 0x31f
jmp 0x42a2cb
mov ecx, dword [ebp + 0x6c]
push eax
mov eax, dword [str.ECOP_CL_RES_WEB_SERVICE]
push eax
call fcn.0044b380
cmp eax, 0x10
jb 0x42a29d
mov ecx, dword [str.ECOP_CL_RES_WEB_SERVICE]
lea edx, [ebp + 0xa5]
push ecx
push 0x4e43d8
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd0]
add esp, 0x10
push 0x326
push str.Initialize__
push eax
jmp 0x42a383
push 0x34
call fcn.00467824
mov edx, eax
add esp, 4
cmp edx, esi
jne 0x42a2fc
push 0x4e43c8
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0xc
push 0x32e
mov edx, dword [0x4d1fd4]
push str.Initialize__
push edx
mov ecx, ebp
call fcn.0042b1b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
mov eax, 0x12
jmp 0x42a620
mov ecx, 0xd
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
mov eax, dword [str.ECOP_CL_RES_HEALTH_LIST]
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.0044b380
cmp eax, 0x10
jb 0x42a34d
mov ecx, dword [str.ECOP_CL_RES_HEALTH_LIST]
lea edx, [ebp + 0xa5]
push ecx
push 0x4e43d8
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd0]
add esp, 0x10
push 0x338
push str.Initialize__
push eax
jmp 0x42a383
mov ecx, ebp
call fcn.0042b220
cmp eax, 0x10
jb 0x42a3a8
push 0x4e43b4
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0xc
push 0x340
mov edx, dword [0x4d1fd0]
push str.Initialize__
push edx
mov ecx, ebp
call fcn.0042b1b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
mov eax, 0x10
jmp 0x42a620
call fcn.0042b130
lea eax, [esp + 0x344]
push 0x104
push eax
push 0x4df7a8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
je 0x42a474
cmp eax, 0x104
jg 0x42a474
mov ecx, dword [str.LSAgent.exe]
lea edx, [esp + 0x344]
push ecx
push edx
push 0x4df9ac
lea eax, [esp + 0x24c]
push 0x103
push eax
call fcn.00466ca7
add esp, 0x14
lea ecx, [esp + 0x240]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [ebp + 0x10a8], eax
jne 0x42a4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x240]
push eax
push edx
push 0x4e4394
lea eax, [ebp + 0xa5]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d1fd0]
add esp, 0x14
push 0x359
push str.Initialize__
push ecx
mov ecx, ebp
call fcn.0042b1b0
mov dword [ebp + 0x10a8], esi
jmp 0x42a4a4
push 0x4e437c
lea edx, [ebp + 0xa5]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d1fd0]
add esp, 0xc
mov ecx, ebp
push 0x34f
push str.Initialize__
push eax
call fcn.0042b1b0
lea ecx, [esp + 0x344]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
je 0x42a560
cmp eax, 0x104
jg 0x42a560
mov edx, dword [str.eCopIP.ini]
lea eax, [esp + 0x344]
push edx
push eax
push 0x4df9ac
lea ecx, [esp + 0x24c]
push 0x103
push ecx
call fcn.00466ca7
add esp, 0x14
lea edx, [esp + 0x240]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push edx
call edi
cmp eax, 0xffffffff
mov dword [ebp + 0x10b0], eax
jne 0x42a591
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x244]
push eax
push 0x4e4394
lea ecx, [ebp + 0xa5]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d1fd0]
add esp, 0x14
mov ecx, ebp
push 0x36d
push str.Initialize__
push edx
call fcn.0042b1b0
mov dword [ebp + 0x10b0], esi
jmp 0x42a591
push 0x4e4364
lea eax, [ebp + 0xa5]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d1fd0]
add esp, 0xc
push 0x363
push str.Initialize__
push ecx
mov ecx, ebp
call fcn.0042b1b0
call fcn.004753b0
test eax, 0x10000
je 0x42a5b8
mov esi, 0x4f7cb8
mov edx, dword [esi]
push edx
call fcn.0043c3a0
add esi, 4
add esp, 4
cmp esi, 0x4f7cd0
jl 0x42a5a2
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
xor eax, eax
jmp 0x42a620
mov eax, dword [str.LSAgentMutex]
lea ecx, [ebp + 0xa5]
push eax
push str.Create_mutex_error_or__s_alredy_existed_
push 0xfff
push ecx
call fcn.00466ca7
add esp, 0x10
push 0x299
mov edx, dword [0x4d1fd4]
push str.Initialize__
push edx
mov ecx, ebp
call fcn.0042b1b0
lea ecx, [esp + 0x14]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00458150
mov eax, 0x43
mov ecx, dword [esp + 0x5d8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5d4
ret