Function at 0x40c380
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Create thread
Get common file path
Get file attributes
Get session user name
Query environment variable
Resolve function by parsing pe exports
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x1ff8
call fcn.00416aa0
mov eax, dword [0x435e80]
xor eax, esp
mov dword [esp + 0x1ff4], eax
mov eax, dword [esp + 0x1ffc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2010]
push edi
xor ebx, ebx
push 0x104
lea ecx, [esp + 0x259]
push ebx
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x260], bl
call fcn.00412590
push 0x104
lea edx, [esp + 0x59d]
push ebx
push edx
mov byte [esp + 0x5a4], bl
call fcn.00412590
push 0x117
lea eax, [esp + 0x379]
push ebx
push eax
mov byte [esp + 0x380], bl
call fcn.00412590
push 0x117
lea ecx, [esp + 0x49d]
push ebx
push ecx
mov byte [esp + 0x4a4], bl
call fcn.00412590
push 0x809
lea edx, [esp + 0x182d]
push ebx
push edx
mov byte [esp + 0x1834], bl
call fcn.00412590
xor eax, eax
push 0x200
push ebx
push 0x437d40
mov dword [esp + 0x60], ebx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x58], ebx
mov word [esp + 0x94], bx
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov dword [esp + 0x9e], eax
mov word [esp + 0xa2], ax
mov dword [esp + 0xa4], 0x42b0ac
mov dword [esp + 0xa8], 0x42dd48
mov dword [esp + 0xac], str.KaUpdHlp.exe
mov dword [esp + 0xb0], str.kPrtPng.exe
mov dword [esp + 0xb4], str.psapi.dll
mov dword [esp + 0xb8], str.sporder.dll
mov dword [esp + 0x64], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call fcn.00412590
mov eax, dword [str.Kaseya_Agent]
add esp, 0x48
cmp eax, ebx
je 0x40c528
cmp byte [eax], bl
je 0x40c528
push 0x1f6
push eax
push 0x437d40
call fcn.00413710
mov eax, 0x437d40
add esp, 0xc
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x40c500
mov ecx, dword [str._Setup]
mov dx, word [0x42dd10]
mov dword [eax], ecx
mov cl, byte [0x42dd12]
mov word [eax + 4], dx
mov byte [eax + 6], cl
jmp 0x40c56e
mov edx, dword [0x42dcf8]
mov eax, dword [0x42dcfc]
mov ecx, dword [0x42dd00]
mov dword [0x437d40], edx
mov edx, dword [0x42dd04]
mov dword [0x437d44], eax
mov ax, word [0x42dd08]
mov dword [0x437d48], ecx
mov cl, byte [0x42dd0a]
mov dword [0x437d4c], edx
mov word [0x437d50], ax
mov byte [0x437d52], cl
call fcn.004168a8
cmp eax, 0x3a4
je 0x40c58f
cmp eax, 0x3a8
je 0x40c58f
cmp eax, 0x3b5
je 0x40c58f
cmp eax, 0x3b6
jne 0x40c5b4
push eax
lea edx, [esp + 0x8a8]
push 0x42dcf4
push edx
call fcn.00413e72
lea eax, [esp + 0x8b0]
push eax
push 2
call fcn.00416233
add esp, 0x14
push 0x140
lea ecx, [esp + 0x7c]
push ebx
push ecx
call fcn.00412590
push 0x106
lea edx, [esp + 0x6a4]
push ebx
push edx
call fcn.00412590
add esp, 0x18
push 0x105
lea eax, [esp + 0x698]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x40c632
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_modules_current_location_could_not_be_determined.
push 0x437318
call fcn.00413e72
add esp, 0xc
push 0x50010
push 0x437d40
push 0x437318
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x14]
push edx
jmp 0x40eaf8
lea eax, [esp + 0x694]
push eax
push 0x106
push 0x438150
call fcn.00415476
push 0x5c
push 0x438150
call fcn.00414a50
add esp, 0x14
cmp eax, ebx
push str.kcsSetup.dat
je 0x40c66f
mov ecx, 0x438255
sub ecx, eax
push ecx
add eax, 1
push eax
jmp 0x40c679
push 0x106
push 0x438150
call fcn.00415476
add esp, 0xc
lea edx, [esp + 0x694]
push 0x438150
push edx
call fcn.0040c210
add esp, 8
test eax, eax
jne 0x40c6f7
push 0x438150
lea eax, [esp + 0x698]
push eax
push str.Could_not_access_installation_package_data._Source__s___Data__s_
push 0x437318
call fcn.00413e72
add esp, 0x10
push 0x50010
push 0x437d40
push 0x437318
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x14]
push edx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
add esp, 8
call fcn.00414ab8
mov eax, dword [eax]
jmp 0x40eb0c
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40c700
sub eax, edx
add eax, 0x80a
push eax
call fcn.00412f17
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x40c758
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nof_insufficient_memory.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
lea eax, [ebx + 0xe]
jmp 0x40eb09
push 0x42dbe4
push 0x438150
call fcn.0041349e
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40c830
call fcn.00414ab8
cmp dword [eax], 2
jne 0x40c7ed
call fcn.00406ff0
test eax, eax
je 0x40c7ed
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
je 0x40c7ed
push str.Wow64DisableWow64FsRedirection
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp edi, ebx
mov dword [esp + 0x28], eax
je 0x40c7e6
cmp eax, ebx
je 0x40c7e6
lea edx, [esp + 0x20]
push edx
call edi
test eax, eax
je 0x40c7e6
push 0x42dbe4
push 0x438150
call fcn.0041349e
mov esi, eax
mov eax, dword [esp + 0x28]
add esp, 8
push eax
call dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
jne 0x40c830
call fcn.00414ab8
mov ecx, dword [eax]
push ecx
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0x437318
call fcn.00413e72
add esp, 0xc
push 0x50010
push 0x437d40
push 0x437318
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40c6d9
push ebx
lea ecx, [esp + 0x7c]
push ecx
push esi
call fcn.00411800
lea edx, [esp + 0x84]
push edx
push esi
call fcn.00411880
add esp, 0x14
test eax, eax
jge 0x40c862
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ebx, esi
jmp 0x40c6db
mov eax, dword [esp + 0x1b4]
lea edx, [esp + 0x17f8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x40c872
mov edx, dword [esp + 0x1a8]
push 0x201
add edx, 0x130
push 0x437f48
push esi
mov dword [0x437f44], edx
call fcn.0040b710
push esi
mov ebp, eax
call fcn.0041304c
add esp, 0x10
cmp ebp, ebx
je 0x40c8d5
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_server_address_could_not_be_read_from_the_package.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40eaf8
lea edx, [esp + 0x1c]
push edx
push 0x437f48
call fcn.0040b890
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x1804]
push eax
push str._s__s
push esi
call fcn.00413e72
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.004102c0
mov ebp, eax
add esp, 0x20
cmp ebp, ebx
je 0x40c95e
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_parameters_could_not_be_initialized.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40c957
push eax
call fcn.00412262
add esp, 4
mov eax, ebp
jmp 0x40eb0c
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.KaseyaClientSetupSingleInstance
push 1
push ebx
call esi
mov ebp, eax
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40c98a
cmp eax, 5
je 0x40c98a
cmp ebp, ebx
jne 0x40c9ca
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.KaseyaClientSetupSingleInstance
push 1
push ebx
call esi
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0xb7
je 0x40eacc
cmp ebp, 5
je 0x40eacc
cmp esi, ebx
je 0x40eacc
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [esp + 0xcf8]
push ecx
push ebx
call ebp
lea edx, [esp + 0xcf4]
push edx
lea eax, [esp + 0xffc]
push str.Program_path:___s_
push eax
call fcn.00413e72
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1004]
push ecx
push ebx
push 1
push 3
push edx
call fcn.004120f0
push edi
lea eax, [esp + 0x101c]
push str.Command_line:___s_
push eax
call fcn.00413e72
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x1024]
push ecx
push ebx
push 1
push 3
push edx
call fcn.004120f0
add esp, 0x40
push 0x437f48
lea eax, [esp + 0xffc]
push str.Server_address:__s
push eax
call fcn.00413e72
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1004]
push ecx
push ebx
push 1
push 3
push edx
call fcn.004120f0
mov esi, dword [esp + 0x30]
add esp, 0x20
cmp dword [esi + 0x324], ebx
je 0x40cb18
mov ecx, dword [esi + 0x324]
mov al, byte [ecx]
cmp al, bl
je 0x40cb18
cmp al, 0x22
jne 0x40ca9d
cmp byte [ecx + 2], 0x3a
jne 0x40caa3
cmp al, al
je 0x40cb18
cmp byte [ecx + 1], 0x3a
je 0x40cb18
cmp dword [esi + 0x260], ebx
je 0x40cacd
cmp dword [esi + 0x258], ebx
jne 0x40cacd
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_the_specified_install_path_does_not_contain_a_drive_letter_designator.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x10]
push str.Installation_package_failed_to_install_due_to_missing_drive_letter_specification_in_the_installation_path.
push 0xfffffffffffffff7
push 3
push 1
push esi
call fcn.004120f0
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x28]
push ecx
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.0040b530
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x40cb0e
push eax
call fcn.00412262
add esp, 4
mov eax, 0xfffffff7
jmp 0x40eb0c
cmp dword [esi + 0x31c], ebx
je 0x40cb86
mov edx, dword [esi + 0x31c]
cmp byte [edx], bl
je 0x40cb86
push 0x200
push ebx
push 0x437d40
call fcn.00412590
mov eax, dword [esi + 0x31c]
push 0x1f6
push eax
push 0x437d40
call fcn.00413710
mov eax, 0x437d40
add esp, 0x18
add eax, 0xffffffff
jmp 0x40cb60
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x40cb60
mov ecx, dword [str._Setup]
mov dx, word [0x42dd10]
mov dword [eax], ecx
mov cl, byte [0x42dd12]
mov word [eax + 4], dx
mov byte [eax + 6], cl
mov eax, 0x437d40
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40cb90
sub eax, edx
add eax, 2
push eax
call fcn.00412f17
mov edx, dword [esp + 0x14]
mov dword [edx + 0x320], eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [eax + 0x320], ebx
jne 0x40cc32
cmp dword [eax + 0x260], ebx
je 0x40cbe7
cmp dword [eax + 0x258], ebx
jne 0x40cbe7
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_of_memory_allocation_failure.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.Installation_package_failed_during_memory_allocation.
push 0xfffffffffffffff3
push 3
push 1
push eax
call fcn.004120f0
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x28]
push ecx
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.0040b530
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x40cc28
push eax
call fcn.00412262
add esp, 4
mov eax, 0xfffffff3
jmp 0x40eb0c
mov edx, dword [eax + 0x320]
mov ecx, 0x437d40
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x40cc40
push 0x106
lea edx, [esp + 0x698]
push ebx
push edx
call fcn.00412590
add esp, 0xc
push 0x105
lea eax, [esp + 0x698]
push eax
push ebx
call ebp
test eax, eax
mov edx, dword [esp + 0x10]
jg 0x40cd09
cmp dword [edx + 0x25c], ebx
jne 0x40cd15
cmp dword [edx + 0x260], ebx
je 0x40ccb2
cmp dword [edx + 0x258], ebx
jne 0x40ccb2
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_determine_its_name_or_location.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push str.Installation_package_could_not_determine_its_name_or_location.
mov ebp, eax
push ebp
push 3
push 1
push ecx
call fcn.004120f0
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x28]
push eax
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.0040b530
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x40c957
push eax
call fcn.00412262
add esp, 4
mov eax, ebp
jmp 0x40eb0c
cmp dword [edx + 0x25c], ebx
je 0x40cd9e
lea eax, [esp + 0x694]
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40cd20
sub eax, esi
add eax, 0xffffffff
cmp eax, ebx
jl 0x40cd48
mov cl, byte [esp + eax + 0x694]
cmp cl, 0x5c
je 0x40cd48
cmp cl, 0x3a
je 0x40cd48
sub eax, 1
jns 0x40cd32
cmp dword [edx + 0x258], ebx
jne 0x40cd67
mov ecx, dword [edx + 0x318]
push ecx
lea edx, [esp + eax + 0x699]
push edx
call fcn.0040a5c0
add esp, 8
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40cd94
push eax
call fcn.00412262
add esp, 4
mov eax, 3
jmp 0x40eb0c
cmp byte [edx + 0x328], bl
jne 0x40cdfa
cmp dword [edx + 0x260], ebx
je 0x40cdcc
cmp dword [edx + 0x258], ebx
jne 0x40cdcc
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_doesnt_have_valid_instance_ID.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push str.Installation_package_doesnt_have_valid_instance_ID.
mov ebp, eax
push ebp
push 3
push 1
push edx
call fcn.004120f0
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x28]
push ecx
jmp 0x40ccdb
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x40cec3
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 1
jne 0x40ce51
cmp dword [eax + 0xc], ebx
jne 0x40ce51
cmp dword [eax + 0x258], ebx
jne 0x40ce3a
push 0x50010
push 0x437d40
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator__or_download_WinSock2_for_Windows_95_at_nhttp:__www.microsoft.com_windows95_downloads_contents_wuadmintools_s_wunetworkingtools_w95sockets2_default.asp___nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push eax
push 3
push 1
push edx
jmp 0x40ce84
cmp dword [eax + 0x258], ebx
jne 0x40ce6f
push 0x50010
push 0x437d40
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x18]
push 3
push 1
push eax
call fcn.004120f0
add esp, 0x14
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x14]
push edx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40ceb9
push eax
call fcn.00412262
add esp, 4
mov eax, 0xffffffe6
jmp 0x40eb0c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
cmp ecx, 1
jne 0x40cf24
cmp dword [eax + 0xc], ebx
jne 0x40cf9e
push eax
call fcn.0040b390
add esp, 4
test eax, eax
je 0x40cf9e
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40cf1d
push eax
call fcn.00412262
add esp, 4
xor eax, eax
jmp 0x40eb0c
cmp ecx, 2
je 0x40cf9e
push str.Unknown_operating_system_version.
push 0xffffffffffffffe7
push 2
push 3
push eax
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x24c], ebx
jne 0x40cf9e
cmp dword [eax + 0x258], ebx
jne 0x40cf67
push 0x50010
push 0x437d40
push str.The_Agent_cannot_be_installed_because_this_installation_nprogram_cannot_determine_the_which_OS_is_on_this_system._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40cf94
push eax
call fcn.00412262
add esp, 4
mov eax, 0xffffffe7
jmp 0x40eb0c
push 0x105
lea ecx, [esp + 0x258]
push ebx
push ecx
call fcn.00412590
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
push 0x104
lea edx, [esp + 0x258]
push edx
push 0x42d434
call esi
cmp eax, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jle 0x40d076
cmp eax, 0x104
jae 0x40d076
cmp byte [esp + 0x254], bl
je 0x40d076
lea eax, [esp + 0x254]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40d000
sub eax, edx
cmp byte [esp + eax + 0x253], 0x5c
jne 0x40d032
lea eax, [esp + 0x254]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40d020
sub eax, edx
mov byte [esp + eax + 0x253], bl
lea eax, [esp + 0x254]
push eax
call ebp
cmp eax, 0xffffffff
je 0x40d066
test al, 0x10
je 0x40d066
lea edi, [esp + 0x254]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x40d050
mov cx, word [0x42b064]
mov word [edi], cx
jmp 0x40d08c
push 0x105
push ebx
lea edx, [esp + 0x25c]
push edx
jmp 0x40d084
push 0x105
push ebx
lea eax, [esp + 0x25c]
push eax
call fcn.00412590
add esp, 0xc
cmp byte [esp + 0x254], bl
jne 0x40d160
push 0x104
lea ecx, [esp + 0x258]
push ecx
push 0x42d430
call esi
cmp eax, ebx
jle 0x40d14a
cmp eax, 0x104
jae 0x40d14a
cmp byte [esp + 0x254], bl
je 0x40d14a
lea eax, [esp + 0x254]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40d0d7
sub eax, edx
cmp byte [esp + eax + 0x253], 0x5c
jne 0x40d108
lea eax, [esp + 0x254]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40d0f6
sub eax, edx
mov byte [esp + eax + 0x253], bl
lea edx, [esp + 0x254]
push edx
call ebp
cmp eax, 0xffffffff
je 0x40d13a
test al, 0x10
je 0x40d13a
lea edi, [esp + 0x254]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x40d125
mov ax, word [0x42b064]
mov word [edi], ax
jmp 0x40d160
push 0x105
push ebx
lea ecx, [esp + 0x25c]
push ecx
jmp 0x40d158
push 0x105
push ebx
lea edx, [esp + 0x25c]
push edx
call fcn.00412590
add esp, 0xc
push 0x106
lea eax, [esp + 0x7a0]
push ebx
push eax
call fcn.00412590
mov ecx, dword [esp + 0x1c]
add ecx, 0x328
push ecx
lea edx, [esp + 0x8f4]
push str.SOFTWAREKaseyaAgent_s
push edx
mov dword [esp + 0x38], 0x105
call fcn.00413e72
lea eax, [esp + 0x40]
push eax
push 0x80000002
lea esi, [esp + 0x40]
lea ecx, [esp + 0x7bc]
mov ebx, str.ConfigurationFile
lea eax, [esp + 0x904]
call fcn.0040aae0
add esp, 0x20
test eax, eax
jne 0x40d203
mov ecx, dword [esp + 0x10]
add ecx, 0x328
push ecx
push str.An_Agent_with_same_instance_ID___s__is_already_installed.
push 0x437318
mov dword [esp + 0x38], 1
mov dword [esp + 0x30], eax
call fcn.00413e72
mov edx, dword [esp + 0x1c]
push 0x437318
push 0
push 1
push 3
push edx
call fcn.004120f0
add esp, 0x20
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40d2ae
cmp byte [edi], 0
mov esi, edi
je 0x40d24c
jmp 0x40d220
push str.Legacy
push esi
call fcn.00413d2f
add esp, 8
test eax, eax
je 0x40d284
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d237
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x40d220
mov ebp, 1
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x250], 0
je 0x40d279
push str.An_exisiting_agent_already_connects_to_the_same_server.
push 0
push ebp
push 3
push eax
call fcn.004120f0
add esp, 0x14
mov dword [esp + 0x24], 0
push edi
call fcn.00412262
add esp, 4
jmp 0x40d2b3
mov eax, dword [esp + 0x10]
push str.Legacy_agent_is_installed_and_connects_to_the_same_server.
push 0
mov ebp, 1
push ebp
push 3
push eax
call fcn.004120f0
add esp, 0x14
mov dword [esp + 0x30], ebp
mov dword [esp + 0x24], 0
jmp 0x40d251
mov ebp, 1
cmp dword [esp + 0x24], 0
jne 0x40d422
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x244], 0
jne 0x40d35a
cmp dword [eax + 0x248], 0
je 0x40d5d7
cmp dword [eax + 0x258], 0
jne 0x40d5d7
push 0x50024
push 0x437d40
push str.The_Agent_is_already_installed._nDo_you_want_to_reinstall_the_Agent_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
mov ecx, dword [esp + 0x10]
jne 0x40d354
push str.Re_installation_of_the_Agent_was_stopped_by_the_user.
push 0xffffffffffffffe3
push ebp
push 3
push ecx
call fcn.004120f0
add esp, 0x14
push 0x50040
push 0x437d40
push str.Installation_of_the_Agent_stopped.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
lea eax, [ebx - 0x1d]
jmp 0x40eb09
mov dword [ecx + 0x244], ebp
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x79c]
mov byte [esp + eax + 0xbec], cl
add eax, ebp
test cl, cl
jne 0x40d360
lea ecx, [esp + 0xbec]
push 0x5c
push ecx
call fcn.00414a50
add esp, 8
test eax, eax
je 0x40d38e
mov byte [eax + 1], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebp, ebp
jmp 0x40d3a0
xor eax, eax
mov cl, byte [esp + eax + 0xbec]
mov byte [esp + eax + 0x79c], cl
add eax, 1
test cl, cl
jne 0x40d3a2
mov eax, dword [esp + ebp*4 + 0x5c]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d3c0
lea edi, [esp + 0x79c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x40d3d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x79c]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
je 0x40d415
test al, 3
je 0x40d415
push 0x80
lea eax, [esp + 0x7a0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add ebp, 1
cmp ebp, 6
jl 0x40d3a0
mov ebp, 1
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x258], 0
jne 0x40d4b0
mov edx, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edx
mov eax, dword [ecx + 0x31c]
lea ecx, [esp + 0x74]
push ecx
push 0
lea edx, [esp + 0x44]
push edx
push 0x40b030
push 0
push 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], ebp
call fcn.00414e11
mov edi, eax
add esp, 0x18
test edi, edi
je 0x40d4b0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebx
cmp dword [esp + 0x44], 0
mov esi, 0xc8
je 0x40d4a9
cmp esi, 0x3a98
jge 0x40d4a9
push 0xa
call ebx
add esi, 0xa
cmp dword [esp + 0x44], 0
jne 0x40d493
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x118
lea eax, [esp + 0x360]
push 0
push eax
mov dword [0x437114], 0xf
call fcn.00412590
add esp, 0xc
xor eax, eax
jmp 0x40d4e0
mov cl, byte [esp + eax + 0x254]
mov byte [esp + eax + 0x35c], cl
add eax, ebp
test cl, cl
jne 0x40d4e0
lea eax, [esp + 0x35c]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40d500
mov ecx, dword [str.KAgentSilent.exe]
mov edx, dword [0x42d2cc]
mov dword [eax], ecx
mov ecx, dword [0x42d2d0]
mov dword [eax + 4], edx
mov edx, dword [0x42d2d4]
mov dword [eax + 8], ecx
mov cl, byte [0x42d2d8]
mov dword [eax + 0xc], edx
lea edx, [esp + 0x35c]
push edx
mov byte [eax + 0x10], cl
call fcn.0040bc30
add esp, 4
test eax, eax
jne 0x40d61c
mov eax, dword [0x437110]
test eax, eax
mov dword [0x435888], ebp
mov dword [0x437114], 0x65
je 0x40d57e
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], 0
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push ebp
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x40d5c8
cmp dword [eax + 0x258], 0
jne 0x40d5c8
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40c6d9
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0xffffffffffffffe3
push ebp
push 3
push eax
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x258], 0
jne 0x40d333
cmp dword [eax + 0x250], 0
jne 0x40d333
push 0x50040
push 0x437d40
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
jmp 0x40d32b
push 0xa28
push 0
push 0x437318
call fcn.00412590
add esp, 0xc
xor eax, eax
mov cl, byte [eax + str.KAgentSilent.exe]
mov byte [eax + 0x437318], cl
add eax, ebp
test cl, cl
jne 0x40d632
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x258], ebp
jne 0x40d66a
mov edi, 0x437318
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40d658
mov ecx, dword [0x42d1b8]
mov dword [edi], ecx
mov eax, 0x437318
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d672
sub eax, edx
lea edx, [esi + 0x135]
push edx
add esi, 0x328
push esi
lea eax, [eax + 0x437318]
push str.__a__k__g__s__l___s_
push eax
call fcn.00413e72
mov edx, dword [esp + 0x20]
lea ecx, [edx + 0x3dc]
add esp, 0x10
cmp byte [ecx], 0
je 0x40d6da
mov eax, 0x437318
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40d6b6
push ecx
sub eax, esi
lea ecx, [eax + 0x437318]
push str.__v___s_
push ecx
call fcn.00413e72
mov edx, dword [esp + 0x1c]
add esp, 0xc
cmp byte [edx + 0x33d], 0
lea esi, [edx + 0x33d]
je 0x40d715
mov eax, 0x437318
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d6f1
sub eax, edx
push esi
lea edx, [eax + 0x437318]
push str.__o___s_
push edx
call fcn.00413e72
mov edx, dword [esp + 0x1c]
add esp, 0xc
cmp byte [edx + 0x370], 0
lea esi, [edx + 0x370]
je 0x40d754
mov eax, 0x437318
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d730
sub eax, edx
push esi
lea eax, [eax + 0x437318]
push str.__p___s_
push eax
call fcn.00413e72
mov edx, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x2c], 0
jne 0x40d782
cmp dword [esp + 0x30], 0
je 0x40d782
mov edi, 0x437318
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40d770
mov ecx, dword [0x42d178]
mov dword [edi], ecx
cmp dword [edx + 0x3d8], 0
je 0x40d7a4
mov edi, 0x437318
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40d793
mov eax, dword [0x42d174]
mov dword [edi], eax
cmp dword [edx + 0x3f8], 0
je 0x40d7c7
mov edi, 0x437318
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40d7b5
mov ecx, dword [0x42d170]
mov dword [edi], ecx
cmp dword [edx + 0x504], 0
je 0x40d7eb
push 0x42d16c
push 0xa28
push 0x437318
call fcn.00415405
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x24c], 0x5c3a43
cmp dword [edx + 0x324], 0
je 0x40d890
mov eax, dword [edx + 0x324]
push 0x3a
push eax
call fcn.004134d0
add esp, 8
test eax, eax
je 0x40d835
mov al, byte [eax - 1]
mov dl, al
sub dl, 0x61
cmp dl, 0x19
mov byte [esp + 0x24c], al
ja 0x40d835
and al, 0xdf
mov byte [esp + 0x24c], al
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0x324]
cmp byte [esi], 0x22
mov eax, 0x437318
lea edx, [eax + 1]
je 0x40d870
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d850
push esi
sub eax, edx
push str.__d___s_
lea ecx, [eax + 0x437318]
push ecx
jmp 0x40d888
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d870
push esi
sub eax, edx
push str.__d__s
lea edx, [eax + 0x437318]
push edx
call fcn.00413e72
add esp, 0xc
mov eax, 0x437318
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d898
sub eax, edx
mov edx, eax
lea eax, [esp + 0x35c]
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d8b0
sub eax, esi
add eax, edx
cmp eax, 0x104
jbe 0x40d94c
push 0x42d150
push 0x437318
call fcn.00413590
mov esi, eax
add esp, 8
test esi, esi
je 0x40d94c
mov eax, dword [esp + 0x10]
add eax, 0x3fc
push eax
push 0
push str.kprm
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
mov edx, dword [esp + 0x10]
je 0x40d945
add edx, 0x3fc
push edx
add esi, 4
push esi
call fcn.00401080
add esp, 8
test eax, eax
jne 0x40d938
mov eax, dword [esp + 0x10]
add eax, 0x3fc
push eax
push str._f___s_
push esi
call fcn.00413e72
add esp, 0xc
jmp 0x40d94c
mov ecx, dword [esp + 0x10]
mov byte [ecx + 0x3fc], 0
jmp 0x40d94c
mov byte [edx + 0x3fc], 0
lea eax, [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ea49
test al, 0x10
je 0x40ea49
push 0x42dbe4
push 0x438150
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0x258
call fcn.0041349e
mov ebx, eax
xor edi, edi
add esp, 8
cmp ebx, edi
mov dword [esp + 0x1c], ebx
jne 0x40da9f
call fcn.00414ab8
cmp dword [eax], 2
jne 0x40da17
call fcn.00406ff0
test eax, eax
je 0x40da17
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x40da17
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebp
push str.Wow64RevertWow64FsRedirection
push esi
mov edi, eax
call ebp
test edi, edi
mov ebp, eax
je 0x40da09
test ebp, ebp
je 0x40da09
lea ecx, [esp + 0x34]
push ecx
call edi
test eax, eax
je 0x40da09
push 0x42dbe4
push 0x438150
call fcn.0041349e
mov edx, dword [esp + 0x3c]
add esp, 8
mov ebx, eax
push edx
mov dword [esp + 0x20], ebx
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, 1
xor edi, edi
cmp ebx, edi
jne 0x40da9f
mov eax, dword [0x437110]
cmp eax, edi
mov dword [0x435888], ebp
mov dword [0x437114], 0x65
je 0x40da49
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], edi
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.Installation_package_could_not_be_accessed.
push eax
push 3
push ebp
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], edi
je 0x40da90
cmp dword [eax + 0x258], edi
jne 0x40da90
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40c6d9
mov ecx, dword [0x437f44]
push ecx
lea edx, [esp + 0x7c]
push edx
push ebx
call fcn.00411800
lea eax, [esp + 0x84]
push eax
push ebx
call fcn.00411880
add esp, 0x14
test eax, eax
jge 0x40db4e
mov eax, dword [0x437110]
cmp eax, edi
mov dword [0x435888], ebp
mov dword [0x437114], 0x65
je 0x40daf4
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], edi
call fcn.00414ab8
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebp
push edx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], edi
je 0x40db3b
cmp dword [eax + 0x258], edi
jne 0x40db3b
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40c6db
lea edx, [esp + 0xa0]
push 0x42cfe4
push edx
call fcn.00413d2f
add esp, 8
test eax, eax
je 0x40dbef
mov eax, dword [0x437110]
cmp eax, edi
mov dword [0x435888], ebp
mov dword [0x437114], 0x65
je 0x40db95
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], edi
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.Failed_to_find_configuration_file_from_the_installation_package.
push eax
push 3
push ebp
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], edi
je 0x40dbdc
cmp dword [eax + 0x258], edi
jne 0x40dbdc
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40c6db
xor eax, eax
jmp 0x40dc00
mov cl, byte [esp + eax + 0x254]
mov byte [esp + eax + 0x58c], cl
add eax, ebp
test cl, cl
jne 0x40dc00
lea eax, [esp + 0x58c]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40dc20
mov ecx, dword [0x42cfe4]
mov edx, dword [0x42cfe8]
mov dword [eax], ecx
mov ecx, dword [0x42cfec]
mov dword [eax + 4], edx
lea edx, [esp + 0x58c]
push 0x42cf28
push edx
mov dword [eax + 8], ecx
call fcn.0041349e
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x40dd05
lea eax, [esp + 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40dca8
test al, 3
je 0x40dca8
push 0x80
lea ecx, [esp + 0x590]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x58c]
push 0x42cf28
push edx
call fcn.0041349e
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x40dd05
mov dword [0x435888], ebp
mov dword [0x437114], 0x64
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push ebp
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], edi
je 0x40dbdc
cmp dword [eax + 0x258], edi
jne 0x40dbdc
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x40dbd5
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1b4]
push esi
push ecx
push ebp
push edx
call fcn.00412b8f
push esi
mov edi, eax
call fcn.0041304c
add esp, 0x14
cmp edi, dword [esp + 0x1a8]
je 0x40dd8e
mov dword [0x435888], ebp
mov dword [0x437114], 0x64
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push ebp
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x40dbdc
cmp dword [eax + 0x258], 0
jne 0x40dbdc
push 0x10
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push 0
jmp 0x40dbd6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x58c]
push ecx
push edx
mov dword [0x435888], 0x1f4
mov dword [0x437114], 0x5f
call fcn.004106d0
mov ebp, eax
add esp, 8
cmp ebp, 0xfffffffe
je 0x40de1d
cmp ebp, 0xffffffe9
je 0x40de1d
xor ebx, ebx
cmp ebp, ebx
je 0x40de1f
mov eax, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_accessed.
push ebp
push 3
push 3
push eax
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40de0a
cmp dword [eax + 0x258], ebx
jne 0x40de0a
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_contents_could_not_be_accessed.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x14]
push edx
jmp 0x40eafa
xor ebx, ebx
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 2
jne 0x40dee0
cmp dword [eax + 8], 4
jb 0x40dee0
cmp dword [eax + 0x98], ebx
jne 0x40dee0
push 0x118
lea eax, [esp + 0x360]
push ebx
push eax
call fcn.00412590
push 0x117
lea ecx, [esp + 0x6a4]
push ecx
lea edx, [esp + 0x370]
push edx
call fcn.00413710
push 0xa28
push ebx
push 0x437318
call fcn.00412590
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
push eax
add ecx, 0x135
push ecx
lea edx, [esp + 0x388]
push edx
push str._s__l__s__s
push 0x437318
call fcn.00413e72
mov esi, dword [esp + 0x4c]
add esp, 0x38
cmp esi, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x40e06c
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e06c
cmp dword [esp + 0x24], ebx
jne 0x40def2
cmp dword [eax + 0x240], ebx
je 0x40e062
cmp dword [eax + 0x23c], ebx
je 0x40e062
push ebx
push eax
call fcn.00411c50
mov eax, dword [esp + 0x18]
push eax
call fcn.0040a420
add esp, 0xc
cmp eax, ebx
je 0x40dfd7
cmp eax, 0xffffffff
jne 0x40df98
mov eax, dword [0x437110]
cmp eax, ebx
mov dword [0x437114], 0x65
je 0x40df43
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], ebx
mov ecx, dword [esp + 0x10]
push str.User_canceled_the_installation.
push 0xffffffffffffffff
push 1
push 3
push ecx
call fcn.004120f0
add esp, 0x14
push 0x50040
push 0x437d40
push str.Installation_of_the_Agent_terminated_because_nthe_required_configuration_parameters_were_not_entered.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
add esp, 8
or eax, 0xffffffff
jmp 0x40eb0c
mov ecx, dword [esp + 0x10]
push str.Configuration_parameters_are_missing_and_the__s_switch_was_used.
push eax
push 1
push 3
push ecx
call fcn.004120f0
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.0040b530
add esp, 0x1c
mov eax, 0xffffffed
jmp 0x40eb0c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x58c]
push ecx
push edx
call fcn.00411360
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x40e06c
mov eax, dword [esp + 0x10]
push str.Installation_of_the_Agent_terminated.
push ebp
push 1
push 3
push eax
call fcn.004120f0
mov ecx, dword [esp + 0x24]
add esp, 0x14
cmp dword [ecx + 0x258], ebx
jne 0x40e04f
mov eax, dword [0x437110]
cmp eax, ebx
mov dword [0x437114], 0x65
je 0x40e039
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], ebx
push 0x50040
push 0x437d40
push str.Installation_of_the_Agent_terminated_because_nthe_configuration_could_not_be_updated.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40eafa
push ebx
push eax
call fcn.00411c50
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0x437318
lea eax, [esp + 0x36c]
push eax
push ecx
call fcn.00410a50
mov ebp, eax
add esp, 0x18
cmp ebp, 0xffffffec
jne 0x40e0b1
cmp esi, 4
jge 0x40e0c9
push 0x3e8
call edi
add esi, 1
jmp 0x40e074
cmp ebp, 0xfffffff4
jne 0x40e0c9
mov edx, dword [esp + 0x10]
push edx
call fcn.0040a4b0
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x40e074
mov eax, dword [esp + 0x10]
push str.Installation_process_returned.
push ebp
mov edi, 1
push edi
push 3
push eax
call fcn.004120f0
add esp, 0x14
cmp ebp, ebx
je 0x40e257
mov eax, dword [0x437110]
cmp eax, ebx
mov dword [0x435888], edi
mov dword [0x437114], 0x65
je 0x40e116
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], ebx
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x260], ebx
je 0x40e222
cmp dword [eax + 0x258], ebx
jne 0x40e222
cmp ebp, edi
jne 0x40e1b1
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x58]
movzx ecx, word [esp + 0x5a]
mov eax, 0x3b
sub eax, edx
imul eax, eax, 0x3e8
add eax, ecx
cmp eax, 0x2710
jae 0x40e168
mov eax, 0x2710
jmp 0x40e174
cmp eax, 0xd6d8
jbe 0x40e174
mov eax, 0xd6d8
mov edx, dword [esp + 0x10]
push ebx
push eax
push str.The_Agent_installation_has_been_scheduled._n_nPlease_wait_up_to_one_minute_for_the_installation_to_proceed.
push edx
call fcn.0040a520
mov eax, dword [esp + 0x20]
add esp, 0x10
push str.The_installation_package_is_re_running_under_an_authorized_account
push ebp
push edi
push 3
push eax
call fcn.004120f0
mov ebx, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40eafa
cmp ebp, 0xffffffec
jne 0x40e1da
push 0x50040
push 0x437d40
push str.The_installation_package_containing_the_Agent_failed_to_run_nbecause_the_Windows_NT_Task_Scheduler_is_not_running.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.The_installation_package_containing_the_Agent_failed_to_run.
push ebp
push 3
jmp 0x40e193
cmp ebp, 0xffffffff
jne 0x40e203
push 0x50040
push 0x437d40
push str.Installation_of_the_Agent_terminated_because_nthe_required_credentials_were_missing_or_incorrect._User_cancelled_the_nthe_installation..
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push ebp
push 3
jmp 0x40e193
cmp ebp, 2
je 0x40e222
push 0x50010
push 0x437d40
push str.The_installation_package_containing_the_Agent_failed_to_run.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
cmp ebp, edi
je 0x40e18c
cmp ebp, 2
je 0x40e18c
cmp ebp, 0xffffffed
jne 0x40e245
push str.The_credentials_contained_in_the_installation_package_were_incorrect_or_missing._Agent_failed_to_run.
push ebp
push 3
jmp 0x40e193
cmp ebp, 0xffffffff
jne 0x40e1d0
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push ebp
push 3
jmp 0x40e193
push 0x106
lea edx, [esp + 0x7a0]
push 0
push edx
mov dword [0x435888], 0x64
mov dword [0x437114], 0x63
call fcn.00412590
lea eax, [esp + 0x34]
push eax
push 0x80000002
lea esi, [esp + 0x34]
lea ecx, [esp + 0x7b0]
mov ebx, str.ConfigurationFile
lea eax, [esp + 0x8f8]
mov dword [esp + 0x34], 0x105
call fcn.0040aae0
mov esi, eax
xor ebx, ebx
add esp, 0x14
cmp esi, ebx
jne 0x40e9ba
cmp dword [esp + 0x28], edi
jne 0x40e9ba
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40e9ba
cmp eax, 0x105
jae 0x40e9ba
cmp dword [esp + 0x24], ebx
jne 0x40e2f3
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x240], ebx
je 0x40e3b3
push ebx
lea edx, [esp + 0x7a0]
push edx
lea eax, [esp + 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40e318
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40e31a
xor esi, esi
lea ecx, [esp + 0x58c]
push ecx
call fcn.00414f46
lea edx, [esp + 0x360]
push edx
call fcn.00414f46
add esp, 8
cmp esi, ebx
je 0x40e3b3
mov eax, dword [0x437110]
cmp eax, ebx
mov dword [0x435888], edi
mov dword [0x437114], 0x65
je 0x40e365
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], ebx
call fcn.00414ab8
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_moved_to_the_installation_directory.
push eax
push 3
push edi
push ecx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40dbdc
cmp dword [eax + 0x258], ebx
jne 0x40dbdc
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_moved_to_the_installation_directory.
push ebx
jmp 0x40dbd6
push 0x118
lea ecx, [esp + 0x360]
push ebx
push ecx
call fcn.00412590
lea edx, [esp + 0x34]
push edx
push 0x80000002
lea esi, [esp + 0x34]
lea ecx, [esp + 0x370]
mov ebx, str.Path
lea eax, [esp + 0x8f8]
mov dword [esp + 0x34], 0x117
call fcn.0040aae0
add esp, 0x14
test eax, eax
je 0x40e45f
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x258], 0
jne 0x40e41f
push 0x50010
push 0x437d40
push str.The_installation_path_for_the_Agent_cannot_be_found_n_nThe_Agent_cannot_be_started.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push str.Cannot_launch_the_agent_because_the_path_could_not_be_found.
push 0xffffffffffffffe4
push 3
push 3
push ecx
call fcn.004120f0
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.0040b530
add esp, 0x1c
mov eax, 0xffffffe4
jmp 0x40eb0c
xor eax, eax
jmp 0x40e470
mov cl, byte [esp + eax + 0x35c]
mov byte [esp + eax + 0x254], cl
add eax, edi
test cl, cl
jne 0x40e470
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x78]
push ecx
push edx
call fcn.00411880
add esp, 8
test eax, eax
jne 0x40e6ab
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
lea ebx, [ebx]
push 0x118
lea eax, [esp + 0x478]
push 0
push eax
call fcn.00412590
add esp, 0xc
cmp byte [esp + 0xa0], 0x5c
je 0x40e55c
cmp byte [esp + 0xa1], 0x3a
je 0x40e55c
xor eax, eax
mov cl, byte [esp + eax + 0x254]
mov byte [esp + eax + 0x474], cl
add eax, 1
test cl, cl
jne 0x40e4e1
lea eax, [esp + 0x474]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e500
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x478]
push 0x42b064
push edx
call fcn.004152d0
lea eax, [esp + 0x480]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e532
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x47c]
push eax
call fcn.004152d0
jmp 0x40e576
push 0x117
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x47c]
push edx
call fcn.00413710
lea eax, [esp + 0x480]
add esp, 0xc
push eax
call fcn.0040f060
lea ecx, [esp + 0x478]
push 0x42cf28
push ecx
call fcn.0041349e
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40e5f9
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e5e2
test al, 3
je 0x40e5e2
push 0x80
lea eax, [esp + 0x478]
push eax
call edi
lea ecx, [esp + 0x474]
push 0x42cf28
push ecx
call fcn.0041349e
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e5f9
lea edx, [esp + 0x474]
push edx
push str.WARNING:_Unable_to_open_the_file__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea eax, [esp + 0x9f0]
push eax
jmp 0x40e63a
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1b4]
push esi
push edx
push 1
push eax
call fcn.00412b8f
push esi
mov ebx, eax
call fcn.0041304c
add esp, 0x14
cmp ebx, dword [esp + 0x1a8]
je 0x40e68c
lea ecx, [esp + 0x474]
push ecx
push str.WARNING:_Unable_to_write_the_file_content_to__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea edx, [esp + 0x9f0]
push edx
call fcn.00413e72
call fcn.00414ab8
mov edx, dword [eax]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x9f4]
push ecx
push edx
push 3
push 1
push eax
call fcn.004120f0
mov eax, dword [esp + 0x30]
add esp, 0x20
cmp dword [eax + 0x260], 0
je 0x40e68c
cmp dword [eax + 0x258], 0
jne 0x40e68c
push 0x50010
push 0x437d40
lea ecx, [esp + 0x9f0]
push ecx
push 0
call ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.00411880
add esp, 8
test eax, eax
je 0x40e4b0
mov edi, 1
cmp dword [esp + 0x24], 0
mov dword [0x435888], edi
mov dword [0x437114], 0x64
je 0x40e874
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x264], 0
je 0x40e729
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.EnableRemoteControl
lea eax, [esp + 0x8f4]
push eax
push 0x80000002
mov dword [esp + 0x60], 0
call fcn.0040ee30
add esp, 0x18
test eax, eax
jne 0x40e712
mov ecx, dword [esp + 0x10]
push str.Disabled_remote_control.
push eax
push edi
push 3
push ecx
jmp 0x40e721
mov edx, dword [esp + 0x10]
push str.Failed_to_disable_remote_control.
push eax
push 2
push 3
push edx
call fcn.004120f0
add esp, 0x14
push 0x94
lea eax, [esp + 0x1bc]
push 0
push eax
call fcn.00412590
add esp, 0xc
lea ecx, [esp + 0x1b8]
push ecx
mov dword [esp + 0x1bc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40e874
cmp dword [esp + 0x1c8], 2
jne 0x40e874
push 0x200
lea edx, [esp + 0xdfc]
push 0
push edx
call fcn.00412590
add esp, 0xc
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0xdfc]
push ecx
mov dword [esp + 0x40], 0x1ff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40e874
cmp byte [esp + 0xdf8], 0
je 0x40e874
lea edx, [esp + 0xdf8]
push 0x42c79c
push edx
call fcn.00413d2f
add esp, 8
test eax, eax
je 0x40e874
xor eax, eax
jmp 0x40e7e0
mov cl, byte [esp + eax + 0x35c]
mov byte [esp + eax + 0x254], cl
add eax, edi
test cl, cl
jne 0x40e7e0
lea eax, [esp + 0x35c]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e800
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x360]
push 0x42c78c
push edx
call fcn.004152d0
push 0
lea eax, [esp + 0x36c]
push 0x42dd48
push eax
xor ebx, ebx
call fcn.0040b5b0
add esp, 0x18
test eax, eax
je 0x40e859
mov ecx, dword [esp + 0x10]
push str.Failed_to_launch_the_service_helper_task.
push eax
push 3
push 3
push ecx
call fcn.004120f0
add esp, 0x14
xor eax, eax
jmp 0x40e860
mov cl, byte [esp + eax + 0x254]
mov byte [esp + eax + 0x35c], cl
add eax, edi
test cl, cl
jne 0x40e860
lea edi, [esp + 0x35c]
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40e880
mov dx, word [0x42b064]
lea eax, [esp + 0x35c]
mov word [edi], dx
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40e8a0
mov ecx, dword [0x42b0ac]
mov edx, dword [0x42b0b0]
mov dword [eax], ecx
mov ecx, dword [0x42b0b4]
push 1
mov dword [eax + 4], edx
mov dl, byte [0x42b0b8]
push 0
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
push 0
mov byte [eax + 0xc], dl
push 0x42b0ac
lea eax, [esp + 0x36c]
push eax
push ecx
call fcn.00410a50
add esp, 0x18
test eax, eax
je 0x40e908
mov edx, dword [esp + 0x10]
push str.Cannot_launch_the_agent.
push eax
push 3
push 3
push edx
call fcn.004120f0
add esp, 0x14
mov eax, dword [0x437110]
test eax, eax
mov dword [0x437114], 0x65
je 0x40e932
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], 0
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x260], 0
je 0x40e96c
cmp dword [eax + 0x258], 0
jne 0x40e96c
cmp dword [eax + 0x254], 0
jne 0x40e975
mov ecx, dword [eax + 0x318]
push 1
push 0x7530
push ecx
push eax
call fcn.0040a520
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp dword [eax + 0x254], 0
je 0x40e995
call fcn.0040af30
test eax, eax
je 0x40e995
mov edx, dword [esp + 0x10]
push str.Attempt_to_reboot_the_system_failed.
push eax
push 3
push 1
push edx
call fcn.004120f0
add esp, 0x14
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
add esp, 8
xor eax, eax
jmp 0x40eb0c
mov eax, dword [0x437110]
cmp eax, ebx
mov dword [0x435888], edi
mov dword [0x437114], 0x65
je 0x40e9e4
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x437110], ebx
mov edx, dword [esp + 0x10]
push str.Installation_of_the_Agent_Failed.
push esi
push 3
push edi
push edx
call fcn.004120f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40ea24
cmp dword [eax + 0x258], ebx
jne 0x40ea24
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_Failed
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, 0xfffffffd
jmp 0x40eb09
movsx edx, byte [esp + 0x24c]
push edx
push str.Installation_of_the_Agent_failed_because_nthe_target_installation_drive___c:__could_not_be_found_on_this_computer.
push 0x437318
call fcn.00413e72
add esp, 0xc
push 0x50010
push 0x437d40
push 0x437318
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [esp + 0x24c]
push eax
push str.Cannot_install_agent_on_machine_because_the_target_installation_drive___c:__is_missing.
push 0x437318
call fcn.00413e72
mov ecx, dword [esp + 0x1c]
push 0x437318
push 0xffffffffffffffe2
push 3
push 3
push ecx
call fcn.004120f0
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x34]
push eax
xor ebx, ebx
lea edi, [esp + 0x40]
lea esi, [esp + 0x3c]
call fcn.0040b530
add esp, 0x28
lea eax, [ebx - 0x1e]
jmp 0x40eb0c
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x258], ebx
jne 0x40eaee
push 0x50010
push 0x437d40
push str.Installation_of_the_Agent_failed_because_nanother_instance_of_this_installation_package_is_already_running.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.0040b530
mov eax, ebp
add esp, 8
mov ecx, dword [esp + 0x2004]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00412a21
add esp, 0x1ff8
ret 0x10