Function at 0x436ec0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5437cb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
xor ebx, ebx
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x228], ebx
call fcn.00441420
test al, al
je 0x436f8f
call fcn.004414b0
test al, al
jne 0x436f8f
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea edi, [esi + 0x208]
push 0x104
push edi
call fcn.0052c361
push str.CloudAgentInstaller.log
push 0x104
push edi
call fcn.0052c2ec
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x18
push str.Installer_log_path_is:
call esi
push edi
call esi
mov edi, dword [ebp - 0x228]
test edi, edi
je 0x436f71
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
xor edi, edi
lea eax, [ebp - 0x224]
mov ecx, 0xc
nop dword [eax]
mov byte [eax], bl
lea eax, [eax + 1]
sub ecx, 1
jne 0x436fa0
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], 0xc
push eax
push 1
push str.O:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x436fef
call ebx
push str.O:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
mov edi, eax
push str.Failed_to_create_security_descriptor___s_
push edi
push 0x58ba20
call fcn.00437520
add esp, 0x10
test edi, edi
je 0x43700d
push str.Failed_to_create_required_security_descriptor
push edi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, edi
jmp 0x436f73
mov ecx, str.Shell32.dll
call fcn.0040a280
mov edi, eax
mov dword [ebp - 0x228], edi
test edi, edi
jne 0x437041
call ebx
mov esi, eax
push str.Failed_to_load_shell_api_dll
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, esi
jmp 0x436f73
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x43706d
call ebx
mov ebx, eax
push str.Failed_to_retrieve_shell_api_address
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x23
push 0
call eax
mov ebx, eax
test ebx, ebx
jns 0x43709c
push str.Failed_to_get_path_of_the_ProgramData_directory
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66
push str.Qualys_
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052c2ec
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
call ebx
cmp eax, 0xffffffff
je 0x4370f2
and eax, 0x410
cmp eax, 0x410
jne 0x4370f2
push str.Qualys_directory_links_to_somewhere_else
mov ebx, 0x139f
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66
push str.QualysAgent
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052c2ec
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call ebx
cmp eax, 0xffffffff
je 0x43712c
and eax, 0x410
cmp eax, 0x410
jne 0x43712c
push str.QualysAgent_directory_links_to_somewhere_else
jmp 0x4370da
mov edx, str.O:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
lea ecx, [ebp - 0x218]
call fcn.0044b820
mov ebx, eax
test ebx, ebx
je 0x437164
cmp ebx, 2
je 0x437164
cmp ebx, 3
je 0x437164
push str.Failed_to_give_write_permissions_to_agent_data_directory
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
call fcn.0052c361
push 0x565aa8
push 0x104
push esi
call fcn.0052c2ec
push str.InstallerLogs
push 0x104
push esi
call fcn.0052c2ec
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4371bb
and eax, 0x410
cmp eax, 0x410
jne 0x4371bb
push str.Log_folder_directory_links_to_somewhere_else
jmp 0x4370da
xor eax, eax
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
cmp word [esi], ax
jne 0x4371e1
xor ecx, ecx
jmp 0x4371f5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4371e6
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x240]
call fcn.00403fe0
lea edx, [ebp - 0x224]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.00437b60
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
cmp eax, 8
jb 0x437241
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.00403300
xor eax, eax
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
test ebx, ebx
je 0x43727b
push esi
push str.Failed_to_create_access___s__folder
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0x10
jmp 0x436f66
mov edx, str.O:SYG:BAD:PAI_A_OICI_GA___SY__A_OICI_0x1200a9___BA_
lea ecx, [ebp - 0x218]
call fcn.0044b820
mov ebx, eax
test ebx, ebx
je 0x4372a9
push str.Failed_to_set_restricted_permissions_to_agent_data_directory
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66
mov edx, str.O:BAG:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
mov ecx, esi
call fcn.0044b820
mov ebx, eax
test ebx, ebx
je 0x436f2b
push str.Failed_to_give_write_permissions_to_installer_log_files_directory
push ebx
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x436f66