Function at 0x407b20
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43386e
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x43fbfc]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43fbfc]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x85]
push ebx
mov dword [esp + 0x1c], ebx
push eax
mov esi, ecx
mov byte [esp + 0x8c], bl
call fcn.0041a540
push str.NInstall::install____0__n
push 1
call fcn.00403ef0
add esp, 0x14
lea ecx, [esp + 0x64]
call fcn.00409d80
lea ecx, [esp + 0x4c]
mov dword [esp + 0x190], ebx
call fcn.0040c030
lea ecx, [esp + 0x34]
mov byte [esp + 0x190], 1
call fcn.0040c030
lea ecx, [esp + 0x40]
mov byte [esp + 0x190], 2
call fcn.0040c030
cmp dword [esi + 0x6c], ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov byte [esp + 0x190], 3
je 0x407cb7
cmp dword [esi + 4], ebx
je 0x407c14
push str.4.x_Agent_Preparing_Uninstall...
lea ecx, [esp + 0x84]
push 0x436e48
push ecx
call ebp
mov eax, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0x80]
push edx
push ebx
push 0x473
push eax
call edi
mov ecx, esi
call fcn.00404cb0
cmp dword [esi + 4], ebx
je 0x407c4b
push str.4.x_Agent_Uninstalling...
lea ecx, [esp + 0x84]
push 0x436e48
push ecx
call ebp
mov eax, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0x80]
push edx
push ebx
push 0x473
push eax
call edi
push str.NcdInstall2.exe
lea ecx, [esp + 0x1c]
lea ebx, [esi + 0xe0]
push ecx
mov ecx, ebx
call fcn.0040c5e0
push 0x436e28
lea edx, [esp + 0x28]
push edx
mov ecx, eax
mov byte [esp + 0x198], 4
call fcn.0040c5e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x190], 6
call fcn.0040c0f0
mov ecx, ebx
call fcn.00419120
push eax
lea ecx, [esp + 0x28]
call fcn.00419120
push eax
call fcn.0040c930
add esp, 8
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
mov ecx, esi
call fcn.00404b80
test eax, eax
jne 0x407d26
push str.NInstall::install____1__writeCabFile___Fail_n
push 1
call fcn.00403ef0
push 2
call fcn.00404730
add esp, 0xc
lea ecx, [esp + 0x40]
mov byte [esp + 0x190], 2
call fcn.0040c0f0
lea ecx, [esp + 0x34]
mov byte [esp + 0x190], 1
call fcn.0040c0f0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x190], 0
call fcn.0040c0f0
lea ecx, [esp + 0x64]
mov dword [esp + 0x190], 0xffffffff
call fcn.00409d90
xor eax, eax
jmp 0x4085b8
mov eax, dword [esi + 4]
test eax, eax
je 0x407d65
push 5
push 0
push 0x46f
push eax
call edi
push str.Extracting...
lea eax, [esp + 0x84]
push 0x436e48
push eax
call ebp
mov edx, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x473
push edx
call edi
push str.NInstall::install____2__n
push 1
call fcn.00403ef0
add esp, 8
mov ecx, esi
call fcn.00404de0
mov ecx, esi
call fcn.004070b0
mov ecx, esi
call fcn.00407240
push str.NInstall::install____3__n
push 1
call fcn.00403ef0
mov eax, dword [esi + 4]
add esp, 8
test eax, eax
je 0x407dd7
push 0xa
push 0
push 0x46f
push eax
call edi
push str.Check_the_status_of_the_installation...
lea eax, [esp + 0x84]
push 0x436e48
push eax
call ebp
mov edx, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x473
push edx
call edi
push str.nckill.exe
lea eax, [esp + 0x28]
lea ebx, [esi + 0xe0]
push eax
mov ecx, ebx
call fcn.0040c5e0
mov ecx, eax
mov byte [esp + 0x190], 7
call fcn.00419120
push eax
lea ecx, [esp + 0x50]
call fcn.0040c3c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
mov ecx, ebx
call fcn.00419120
push eax
lea ecx, [esp + 0x50]
call fcn.00419120
push eax
call fcn.0040c930
mov eax, dword [esi + 4]
add esp, 8
test eax, eax
je 0x407e45
push 0x14
push 0
push 0x46f
push eax
call edi
mov ecx, esi
call fcn.00407040
push str.NInstall::install____4__n
push 1
call fcn.00403ef0
add esp, 8
mov ecx, esi
call fcn.00407470
mov eax, dword [esi + 4]
test eax, eax
je 0x407ea1
push 0x19
push 0
push 0x46f
push eax
call edi
push str.File_Copying...
lea ecx, [esp + 0x84]
push 0x436e48
push ecx
call ebp
mov eax, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0x80]
push edx
push 0
push 0x473
push eax
call edi
mov eax, dword [esi + 0x58]
sub esp, 0xc
sub eax, 2
lea eax, [esi + 0xc8]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
je 0x407ec5
call fcn.0040c500
call fcn.0040d4f0
jmp 0x407ecf
call fcn.0040c500
call fcn.00406650
lea ebx, [esi + 0xc8]
add esp, 0xc
mov ecx, ebx
call fcn.00419120
push eax
push str.NInstall::install____5__path:_s_n
push 1
call fcn.00403ef0
add esp, 0xc
push str.nc5.cab
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esi + 0xe0]
call fcn.0040c5e0
mov ecx, eax
mov byte [esp + 0x190], 8
call fcn.00419120
push eax
lea ecx, [esp + 0x38]
call fcn.0040c3c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
push 0x43a760
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
call fcn.0040c5e0
mov ecx, eax
mov byte [esp + 0x190], 9
call fcn.00419120
push eax
lea ecx, [esp + 0x44]
call fcn.0040c3c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
mov ecx, esi
call fcn.00407870
lea ecx, [esp + 0x40]
call fcn.00419120
push eax
lea ecx, [esp + 0x68]
call fcn.0040a1d0
mov ecx, dword [esi + 0x84]
lea eax, [esi + 0xa4]
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.00419120
push eax
lea ecx, [esp + 0x70]
call fcn.0040a400
test eax, eax
jne 0x4081d8
lea ecx, [esp + 0x40]
call fcn.00419120
push eax
lea ecx, [esp + 0x38]
call fcn.00419120
push eax
push str.NInstall::install____6__extractCabFile___Fail_src:_s_dst:_s__n
push 1
call fcn.00403ef0
add esp, 0x10
cmp dword [esi + 0x84], 0
mov dword [esp + 0x30], 0
je 0x40819a
lea ecx, [esp + 0x18]
call fcn.0040c030
push ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x194], 0xa
call fcn.0040c380
push 0x43a760
lea ecx, [esp + 0x1c]
call fcn.0040c770
call fcn.0040cc20
test eax, eax
push str.n5agent.exe
je 0x408037
lea edx, [esp + 0x5c]
push edx
call section..text
add esp, 8
mov byte [esp + 0x190], 0xb
mov ebx, 1
jmp 0x408050
lea ecx, [esp + 0x28]
call fcn.0040c060
mov dword [esp + 0x190], 0xc
mov ebx, 2
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.0040c730
test bl, 2
mov dword [esp + 0x190], 0xb
je 0x40807e
and ebx, 0xfffffffd
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], ebx
call fcn.0040c0f0
test bl, 1
mov dword [esp + 0x190], 0xa
je 0x408097
lea ecx, [esp + 0x58]
call fcn.0040c0f0
push 0
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0040c500
call fcn.0040d3d0
add esp, 0x10
lea ebx, [esi + 0xc8]
push ebx
lea ecx, [esp + 0x1c]
mov ebp, eax
call fcn.0040c380
push 0x43a760
lea ecx, [esp + 0x1c]
call fcn.0040c770
push str.n5start.exe
lea ecx, [esp + 0x1c]
call fcn.0040c770
push 0
sub esp, 0xc
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.0040c500
call fcn.0040d3d0
add esp, 0x10
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0040c380
push 0x43a760
lea ecx, [esp + 0x1c]
call fcn.0040c770
push str.n5client.exe
lea ecx, [esp + 0x1c]
call fcn.0040c770
push 0
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.0040c500
call fcn.0040d3d0
mov ebx, 1
add esp, 0x10
cmp ebp, ebx
jne 0x40816c
cmp dword [esp + 0x14], ebx
jne 0x40816c
cmp eax, ebx
jne 0x40816c
push str.NInstall::install____7__exist_important_modules_n
push ebx
call fcn.00403ef0
add esp, 8
jmp 0x408185
mov ecx, dword [esp + 0x14]
push eax
push ecx
push ebp
push str.NInstall::install____8__ret_FALSE_n5agent.exe:_d__n5start.exe:_d__n5client.exe:_d_n
push ebx
call fcn.00403ef0
mov ebx, dword [esp + 0x44]
add esp, 0x14
lea ecx, [esp + 0x18]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
test ebx, ebx
jne 0x4081d2
mov eax, dword [esi + 4]
test eax, eax
je 0x4081c3
push 0
push str.NetClient5
push str.An_error_has_occurred_during_Extracting_Process.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi + 4]
push 0x28
push 0
push 0x472
push edx
call edi
push 3
call fcn.00404730
add esp, 4
jmp 0x407cd8
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x412
je 0x40829b
lea eax, [esi + 0xc8]
push eax
lea ecx, [esp + 0x28]
call fcn.0040c500
mov bl, 0xd
push 0x43a760
lea ecx, [esp + 0x28]
mov byte [esp + 0x194], bl
call fcn.0040c770
push str.GULIM.TTC
lea ecx, [esp + 0x28]
call fcn.0040c770
lea eax, [esp + 0x18]
push eax
call fcn.0040ce80
add esp, 4
push str.Fonts_
lea ecx, [esp + 0x1c]
mov byte [esp + 0x194], 0xe
call fcn.0040c770
push str.GULIM.TTC
lea ecx, [esp + 0x1c]
call fcn.0040c770
push 0
lea ecx, [esp + 0x1c]
call fcn.00419120
push eax
lea ecx, [esp + 0x2c]
call fcn.00419120
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x18]
call fcn.00419120
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x190], bl
call fcn.0040c0f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
mov eax, dword [esi + 4]
test eax, eax
je 0x4082ae
push 0x28
push 0
push 0x46f
push eax
call edi
mov ecx, esi
call fcn.00406e70
lea ecx, [esp + 0x34]
call fcn.00419120
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebx
lea ecx, [esp + 0x4c]
call fcn.00419120
push eax
call ebx
mov ecx, dword [esi + 0x98]
push ecx
mov ecx, esi
call fcn.00404740
test eax, eax
mov eax, dword [esi + 4]
jne 0x408317
test eax, eax
je 0x407cd8
push 0
push str.NetClient5
push str.Automatically_remove_the_failed.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi + 4]
push 0x28
push 0
push 0x472
push edx
call edi
jmp 0x407cd8
test eax, eax
je 0x408353
push 0x37
push 0
push 0x46f
push eax
call edi
push str.Shortcut_Creating...
lea eax, [esp + 0x84]
push 0x436e48
push eax
call ebp
mov edx, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x473
push edx
call edi
mov ecx, esi
call fcn.00405480
mov eax, dword [esi + 4]
test eax, eax
je 0x408399
push 0x3c
push 0
push 0x46f
push eax
call edi
push str.Agent_Program_initialization...
lea eax, [esp + 0x84]
push 0x436e48
push eax
call ebp
mov edx, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x473
push edx
call edi
cmp dword [esi + 0x6c], 0
je 0x40841e
cmp dword [esi + 0x70], 0
je 0x40841e
mov eax, dword [esi + 4]
test eax, eax
je 0x4083e4
push 0x63
push 0
push 0x46f
push eax
call edi
push 0x43653f
lea eax, [esp + 0x84]
push 0x436e48
push eax
call ebp
mov edx, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x473
push edx
call edi
push 0x1000
push str.NetClient5
push str.4.x_Agent
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, esi
call fcn.00404b10
mov esi, dword [esi + 4]
test esi, esi
je 0x40856c
push 0
push 0
push 0x471
push esi
call edi
jmp 0x40856c
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x54], 0
jne 0x408435
cmp dword [esi + 0x74], 0
je 0x40848d
mov eax, dword [esi + 4]
push eax
call fcn.0040a7d0
add esp, 4
cmp dword [esi + 0x74], 0
je 0x40848d
mov eax, dword [esi + 4]
test eax, eax
je 0x408486
push 0x5a
push 0
push 0x46f
push eax
call edi
push str.Remote_Control_Program_Installing...
lea ecx, [esp + 0x84]
push 0x436e48
push ecx
call ebp
mov eax, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0x80]
push edx
push 0
push 0x473
push eax
call edi
mov ecx, esi
call fcn.004076c0
mov eax, dword [esi + 4]
test eax, eax
je 0x4084cc
push 0x63
push 0
push 0x46f
push eax
call edi
push 0x43653f
lea ecx, [esp + 0x84]
push 0x436e48
push ecx
call ebp
mov eax, dword [esi + 4]
add esp, 0xc
lea edx, [esp + 0x80]
push edx
push 0
push 0x473
push eax
call edi
cmp dword [esi + 0x54], 0
je 0x40854f
lea ecx, [esp + 0x24]
call fcn.0040c030
push str._n5uinfo.exe
lea ecx, [esp + 0x5c]
push ecx
lea ebp, [esi + 0xc8]
mov bl, 0xf
mov ecx, ebp
mov byte [esp + 0x198], bl
call fcn.0040c5e0
mov ecx, eax
mov byte [esp + 0x190], 0x10
call fcn.00419120
push eax
lea ecx, [esp + 0x28]
call fcn.0040c3c0
lea ecx, [esp + 0x58]
mov byte [esp + 0x190], bl
call fcn.0040c0f0
mov ecx, ebp
call fcn.00419120
push eax
lea ecx, [esp + 0x28]
call fcn.00419120
push eax
call fcn.0040c9e0
add esp, 8
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 3
call fcn.0040c0f0
mov esi, dword [esi + 4]
test esi, esi
je 0x408562
push 0
push 0
push 0x471
push esi
call edi
push 0
call fcn.00404730
add esp, 4
lea ecx, [esp + 0x40]
mov byte [esp + 0x190], 2
call fcn.0040c0f0
lea ecx, [esp + 0x34]
mov byte [esp + 0x190], 1
call fcn.0040c0f0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x190], 0
call fcn.0040c0f0
lea ecx, [esp + 0x64]
mov dword [esp + 0x190], 0xffffffff
call fcn.00409d90
mov eax, 1
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0041a1b8
add esp, 0x180
ret