Function at 0x40d5c0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get file attributes
Query environment variable
Resolve function by parsing pe exports
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x5c54
call fcn.004116a0
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x871]
mov byte [esp + 0x870], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x769]
mov byte [esp + 0x768], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x259]
mov byte [esp + 0x258], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x1b21]
mov byte [esp + 0x1b20], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x1c28], bl
mov ecx, 0x31f
lea edi, [esp + 0x1c29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov byte [esp + 0x1410], bl
mov ecx, 0x3f
lea edi, [esp + 0x1411]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1718], bl
mov ecx, 0x3f
lea edi, [esp + 0x1719]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1918], bl
mov ecx, 0x3f
lea edi, [esp + 0x1919]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xe0], bl
mov ecx, 9
lea edi, [esp + 0xe1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or edx, 0xffffffff
stosb byte es:[edi], al
mov byte [esp + 0x978], bl
xor eax, eax
mov ecx, 0x103
lea edi, [esp + 0x979]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x64], 0x12c
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], edx
stosb byte es:[edi], al
mov byte [esp + 0x360], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x361]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1100], bl
mov ecx, 0x3f
lea edi, [esp + 0x1101]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2cb8], bl
mov ecx, 9
lea edi, [esp + 0x2cb9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x1de
lea edi, [esp + 0x2ce0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x3c60], bl
mov ecx, 0x3ff
lea edi, [esp + 0x3c61]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x81], ecx
mov dword [esp + 0x85], ecx
mov dword [esp + 0x89], ecx
mov dword [esp + 0x8d], ecx
mov dword [esp + 0x91], ecx
mov dword [esp + 0x95], ecx
stosw word es:[edi], ax
mov dword [esp + 0x99], ecx
mov word [esp + 0x9d], cx
stosb byte es:[edi], al
mov byte [esp + 0x9f], cl
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1309]
mov byte [esp + 0x1308], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x151]
mov byte [esp + 0x150], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x1201]
mov byte [esp + 0x1200], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x1510], bl
mov ecx, 0x81
lea edi, [esp + 0x1511]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x80], bl
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xb8], 0xfffffffe
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x44], ebx
stosb byte es:[edi], al
mov byte [esp + 0xdf0], bl
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xdf1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x4c60], bl
mov ecx, 0x3ff
lea edi, [esp + 0x4c61]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xef0], bl
mov ecx, 0x40
lea edi, [esp + 0xef1]
rep stosd dword es:[edi], eax
mov byte [esp + 0xff8], bl
mov ecx, 0x40
lea edi, [esp + 0xff9]
rep stosd dword es:[edi], eax
mov byte [esp + 0xd88], bl
mov ecx, 0x19
lea edi, [esp + 0xd89]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1818], bl
mov ecx, 0x3f
lea edi, [esp + 0x1819]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1a18], bl
mov ecx, 0x41
lea edi, [esp + 0x1a19]
rep stosd dword es:[edi], eax
mov byte [esp + 0x3860], bl
mov ecx, 0xff
lea edi, [esp + 0x3861]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x6c], ebx
stosb byte es:[edi], al
call fcn.0040afb0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x768]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x76c]
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jle 0x40dd27
lea eax, [esp + 0x768]
push 0x41e2ec
push eax
call fcn.00411686
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x48], esi
je 0x40dd27
push 2
push 0xfffff85e
push esi
call fcn.0041241e
push esi
push 0x7a2
lea ecx, [esp + 0x2ccc]
push 1
push ecx
call fcn.00411541
add esp, 0x1c
cmp eax, 0x7a2
jne 0x40dd1a
mov edi, str.Kaseya_Remote_Control_Data_Table
lea esi, [esp + 0x2cb8]
mov ecx, 0x21
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40da05
mov edi, str.Kaseya_Remote_Control_Relay_Table
lea esi, [esp + 0x2cb8]
mov ecx, 0x22
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40dd1a
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
lea ecx, [esp + 0x25c]
push ecx
push str.TEMP
call esi
cmp eax, ebx
jle 0x40da89
cmp eax, 0x104
jae 0x40da89
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40da34
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
je 0x40da62
lea edi, [esp + 0x258]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da50
mov dx, word [0x41e840]
mov word [edi], dx
cmp byte [esp + 0x258], bl
je 0x40daee
xor eax, eax
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x1a18], cl
inc eax
cmp cl, bl
jne 0x40da71
jmp 0x40db09
push 0x104
lea eax, [esp + 0x25c]
push eax
push 0x41eff0
call esi
cmp eax, ebx
jle 0x40dae7
cmp eax, 0x104
jae 0x40dae7
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dab2
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
je 0x40da62
lea edi, [esp + 0x258]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dad0
mov cx, word [0x41e840]
mov word [edi], cx
jmp 0x40da62
mov byte [esp + 0x258], bl
mov dx, word [0x41e76c]
mov al, byte [0x41e76e]
mov word [esp + 0x1a18], dx
mov byte [esp + 0x1a1a], al
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x258]
push ecx
lea edx, [esp + 0x2cbc]
push edx
push eax
call fcn.00407460
add esp, 0xc
cmp eax, 0xfffffffd
je 0x40db89
cmp eax, 0xfffffffe
je 0x40db4a
cmp eax, 0xffffffff
jne 0x40dba9
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409380
push str.The_viewer_package_is_corrupted._The_table_header_is_invalid._Download_this_package_again._r_n
jmp 0x40db9c
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409380
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x46c]
push str.Unable_to_extract_viewer_files_to_the_directory__s._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x474]
push edx
push eax
call fcn.0040b0a0
add esp, 0x1c
jmp 0x40dba9
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409380
push str.The_viewer_package_is_corrupted._Unable_to_read_viewer_files._Download_this_package_again._r_n
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040b0a0
add esp, 0x10
cmp byte [esp + 0x2ce0], bl
je 0x40dd1a
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x38]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x182c]
push edx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0x1000
lea edx, [esp + 0x3c84]
push edx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x80]
push ecx
push ebx
push ebx
lea edx, [esp + 0x84]
push edx
push 0x68
lea eax, [esp + 0xdc8]
push eax
push 0x101
lea ecx, [esp + 0x1040]
push ecx
push 0x101
lea edx, [esp + 0xf40]
push edx
push 0x1000
lea eax, [esp + 0x4cb8]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0xe50]
push ecx
push 0x208
lea edx, [esp + 0x1578]
push edx
push pe_nt_image_headers32
lea eax, [esp + 0x3d0]
push eax
push 0x410
lea ecx, [esp + 0x9f0]
push ecx
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0xe4]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0x19a0]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x17a8]
push edx
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0x14ac]
push pe_nt_image_headers32
push edx
lea eax, [esp + 0x2d84]
call fcn.0040c4e0
mov al, byte [esp + 0xa1c]
add esp, 0xa4
cmp al, bl
je 0x40dd1a
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x2cbc]
push ecx
lea edx, [esp + 0x980]
push 0x410
push edx
call fcn.00407740
add esp, 0x10
test eax, eax
je 0x40dd1a
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00409380
mov edx, dword [esp + 0x18]
push str.Unexpected_error_occurred_while_creating_path_to_components_in_temp_directory._r_n
push edx
call fcn.0040b0a0
add esp, 0x10
mov eax, dword [esp + 0x48]
push eax
call fcn.004115d9
add esp, 4
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x38]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x182c]
push edx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0x1000
lea edx, [esp + 0x3c84]
push edx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x80]
push ecx
push 0x105
lea edx, [esp + 0x28c]
push edx
lea eax, [esp + 0x84]
push eax
push 0x68
lea ecx, [esp + 0xdc8]
push ecx
push 0x101
lea edx, [esp + 0x1040]
push edx
push 0x101
lea eax, [esp + 0xf40]
push eax
push 0x1000
lea ecx, [esp + 0x4cb8]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0xe50]
push edx
push 0x208
lea eax, [esp + 0x1578]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0x3d0]
push ecx
push 0x410
lea edx, [esp + 0x9f0]
push edx
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xe4]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x19a0]
push edx
push pe_nt_image_headers32
lea eax, [esp + 0x17a8]
push eax
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x14ac]
push pe_nt_image_headers32
push eax
mov eax, dword [ebp + 0x10]
call fcn.0040c4e0
mov edi, dword [esp + 0x104]
add esp, 0xa4
cmp edi, ebx
je 0x40deae
lea ecx, [esp + 0x258]
push ecx
lea edx, [esp + 0x464]
push str._smstsc.exe
push edx
call fcn.00411276
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x460]
push eax
call esi
test eax, eax
jne 0x40deae
lea ecx, [esp + 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40deae
test al, 1
je 0x40deae
push 0x80
lea edx, [esp + 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x460]
push eax
call esi
lea eax, [esp + 0x1410]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40deb8
sub eax, edx
cmp eax, 1
jb 0x40ded2
cmp dword [esp + 0x14], ebx
jl 0x40ded2
cmp dword [esp + 0x24], ebx
jge 0x40def5
cmp dword [esp + 0x58], ebx
jne 0x40deff
cmp dword [esp + 0x10], ebx
je 0x40dee9
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x58], ebx
je 0x40e354
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x768]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x76c]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x768]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df30
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40df54
mov edi, edi
mov cl, byte [esp + eax + 0x768]
cmp cl, 0x5c
je 0x40df54
cmp cl, 0x3a
je 0x40df54
dec eax
jns 0x40df40
inc eax
lea edx, [esp + eax + 0x768]
push edx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c2c]
push str._s__s_ipAddr__p_portNumber__c_portNumber__i_sessionID__w_waitTimeSeconds___k_cryptoKey__n___________l_ipAddr____g_ipAddr____a_OR__b__app_cmd_string_____o_appIpOptionStr__n___________x__exit_cmd_string_____y_exitOptionStr____r____e____t___Opt1_r_nOpt2_r_n..._r_nOptX____n___________f____mw____d____j____v____h_____n
push eax
call fcn.00411276
lea edi, [esp + 0x1c34]
add esp, 0xc
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40df80
mov ecx, 0xb
mov esi, str._s_ipAddr__relay_server_IP_address_or_name_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dfa0
mov ecx, 0xc
mov esi, str._p_portNumber__relay_server_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dfc0
mov ecx, 0x11
mov esi, str._c_portNumber__local_host_port_to_open_and_listen_for_connections_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dfe0
mov ecx, 0x15
mov esi, str._g_ipAddr__gateway_IP_address_or_name_for_direct_connection_to_remote_control_app_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e000
mov ecx, 0x14
mov esi, str._l_ipAddr__LAN_IP_address_or_name_for_direct_connection_to_remote_control_app_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e020
mov ecx, 8
mov esi, str._i_sessionID__relay_session_ID_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e040
mov ecx, 0x16
mov esi, str._w_waitTime__seconds_to_wait_for_response_from_connector_relay_client_via_relay_server_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e060
mov ecx, 0x16
mov esi, str._k_cryptoKey__optional_crypto_key_for_this_session__maximum_of_128_bytes_of_hex_data__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e080
mov ecx, 0x12
mov esi, str._a__app_cmd_string___optional_application_command_line_string_to_run_OR_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1c28]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e0a0
mov ecx, 0x17
mov esi, str._b__app_cmd_string___same_as__a_but_prepend_App_Paths_directory_location_to_application_name_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e0c0
mov ecx, 0x1c
mov esi, str._o__appIpOptionStr___IP_option_string_to_prepend_to_IP_address_passed_as_command_line_option_to_app__e.g.__ip__n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e0e0
mov ecx, 0x18
mov esi, str._x__exit_cmd_string___optional_application_command_line_string_to_run_when_relay_client_exits_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e100
mov ecx, 0x11
mov esi, str._y__exitOptionStr___command_line_option_string_passed_to_exit_cmd_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e120
mov ecx, 0x12
mov esi, str._z__exitMsgStr___display_a_message_in_a_timed_dialog_box_for_2_minutes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e140
mov ecx, 0x12
mov esi, str._zt__exitDlgTitleStr___title_shown_in_window_frame_of_timed_dialog_box_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e160
mov ecx, 0x14
mov esi, str.________if_none_specified__Agent_Title_attribute_value_in_KaseyaD.ini_is_used._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e180
mov ecx, 0x13
mov esi, str._r__generate_automatic_window_events_specific_to_RAdmin_login_dialog_boxes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e1a0
mov ecx, 0x16
mov esi, str._e__run_pcAnywhere_remote_viewer__Awrem32__with_the_Network.chf_file_on_the_command_line_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e1c0
mov ecx, 0x15
mov esi, str._t___Opt1_r_nOpt2_r_n..._r_nOptX____run_MS_terminal_server_remote_viewer__mstsc.exe._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e1e0
mov ecx, 0x17
mov esi, str.____Creates_.rdp_config_file_with_port_number_and_puts_config_filename_on_the_command_line._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e200
mov ecx, 0x15
mov esi, str.____Options_are_in_the_form_of___disable_wallpaper:i:1_r_nredirectprinters:i:1_r_n_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e220
mov ecx, 6
mov esi, str._f__FTP_client_support_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e240
mov ecx, 0xc
mov esi, str._mw__manual_remote_control_support_for_WinVNC_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e260
mov ecx, 0x12
mov esi, str._mk_licenseKey__manual_remote_control_support_for_K_VNC_with_license_key_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e280
mov ecx, 0x19
mov esi, str._d_exitDelayMinutes__minutes_to_delay_before_destroying_this_relay_clients_status_display_on_exit_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e2a0
mov ecx, 0x13
mov esi, str._j__Enable_Ctl_Alt_Del_and_Software_Secure_Attention_Sequence_policy_helper_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1c28]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e2c0
mov ecx, 0xa
mov esi, str._v__verbose_output_into_status_dialog_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e2e0
mov ecx, 8
mov esi, str._h__display_this_help_message_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c28]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40e300
mov ecx, 8
mov esi, str.____display_this_help_message_n
lea eax, [esp + 0x1c28]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e320
push 0x40
sub eax, edx
lea ecx, [esp + 0x76c]
push ecx
lea edx, [esp + 0x1c30]
push edx
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x5c], ebx
je 0x40e371
cmp dword [esp + 0x10], ebx
jne 0x40e371
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00409380
add esp, 8
lea edx, [esp + 0xd4]
push edx
call fcn.00412697
lea eax, [esp + 0xd8]
push eax
call fcn.0041267e
mov ecx, dword [esp + 0x28]
add eax, 4
push eax
push ecx
lea edx, [esp + 0x470]
push str.Processing_for_session_ID__d_started_on__.15s._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x478]
push eax
push ecx
call fcn.0040b0a0
lea edx, [esp + 0x998]
push str.radmin
push edx
call fcn.0040b280
mov esi, dword [esp + 0x7c]
add esp, 0x28
test eax, eax
jne 0x40eb50
cmp dword [esp + 0x4c], ebx
jne 0x40eb50
lea eax, [esp + 0x978]
push str.mstsc
push eax
call fcn.0040b280
add esp, 8
test eax, eax
jne 0x40eb1b
cmp edi, ebx
jne 0x40eb1b
lea ecx, [esp + 0x978]
push str.awrem32
push ecx
call fcn.0040b280
add esp, 8
test eax, eax
jne 0x40e963
cmp esi, ebx
jne 0x40e963
lea edx, [esp + 0x978]
push str.winvnc
push edx
call fcn.0040b280
add esp, 8
test eax, eax
jne 0x40e71e
cmp dword [esp + 0x50], ebx
jne 0x40e71e
lea eax, [esp + 0x978]
push str.uvncviewer
push eax
call fcn.0040b280
add esp, 8
test eax, eax
je 0x40e4bc
mov ecx, dword [str.uvncviewer.exe]
mov edx, dword [0x420400]
mov eax, dword [0x420404]
mov dword [esp + 0x150], ecx
mov cx, word [0x420408]
mov dword [esp + 0x154], edx
mov dl, byte [0x42040a]
mov dword [esp + 0x18], 0xe
mov dword [esp + 0x158], eax
mov word [esp + 0x15c], cx
mov byte [esp + 0x15e], dl
jmp 0x40e64e
lea eax, [esp + 0x978]
push str.kvncviewer
push eax
call fcn.0040b280
add esp, 8
test eax, eax
je 0x40e524
mov ecx, dword [str.kVNCviewer.exe]
mov edx, dword [0x4203e4]
mov eax, dword [0x4203e8]
mov dword [esp + 0x150], ecx
mov cx, word [0x4203ec]
mov dword [esp + 0x154], edx
mov dl, byte [0x4203ee]
mov dword [esp + 0x18], 5
mov dword [esp + 0x158], eax
mov word [esp + 0x15c], cx
mov byte [esp + 0x15e], dl
jmp 0x40e64e
lea eax, [esp + 0x978]
push str.vncviewer
push eax
call fcn.0040b280
add esp, 8
test eax, eax
je 0x40e57f
mov ecx, dword [str.VNCviewer.exe]
mov edx, dword [0x4203c8]
mov eax, dword [0x4203cc]
mov dword [esp + 0x150], ecx
mov cx, word [0x4203d0]
mov dword [esp + 0x18], 5
mov dword [esp + 0x154], edx
mov dword [esp + 0x158], eax
mov word [esp + 0x15c], cx
jmp 0x40e64e
lea edx, [esp + 0x978]
push str.iexplore
push edx
call fcn.0040b280
add esp, 8
test eax, eax
je 0x40e5b1
lea eax, [esp + 0x360]
push str.ftp:__
push eax
call fcn.0040b280
add esp, 8
test eax, eax
jne 0x40e5bb
cmp dword [esp + 0x40], ebx
je 0x40e6eb
push 0x104
lea ecx, [esp + 0x97c]
push ecx
lea edx, [esp + 0x158]
push edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x50], 0x1c20
call fcn.00410bf0
mov ax, word [0x4203b8]
mov cl, byte [0x4203ba]
mov word [esp + 0x46c], ax
lea eax, [esp + 0x46c]
add esp, 0xc
mov byte [esp + 0x462], cl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e610
sub eax, edx
push eax
lea edx, [esp + 0x464]
push edx
push 1
push str.Use_PASV
push str.SoftwareMicrosoftFtp
push reloc.WSOCK32.dll_accept
call fcn.0040a560
push 0x410
lea ebx, [esp + 0x994]
call fcn.0040bed0
add esp, 0x1c
xor ebx, ebx
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x464]
push str.This_relay_client_has_been_tasked_to_run__s_on_this_machine._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x46c]
push eax
push ecx
call fcn.0040b0a0
lea edx, [esp + 0x1424]
push edx
call fcn.004079d0
mov esi, eax
add esp, 0x18
cmp esi, ebx
mov dword [esp + 0x40], esi
jne 0x40ecfe
lea eax, [esp + 0x1410]
push eax
lea ecx, [esp + 0x464]
push str.Failed_to_resolve_the_VSA_server_IP___s._r_nExiting..._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x46c]
push edx
push eax
call fcn.0040b0a0
add esp, 0x14
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040ae20
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x104
lea eax, [esp + 0x97c]
push eax
lea ecx, [esp + 0x158]
push ecx
call fcn.00410bf0
push 0x410
lea ebx, [esp + 0x988]
call fcn.0040bed0
add esp, 0x10
jmp 0x40e64c
push str.vncviewer.exe
mov dword [esp + 0x1c], 4
call fcn.00406fc0
add esp, 4
test eax, eax
mov edi, 8
jne 0x40e77e
mov dword [esp + 0x1c], edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xfa
call esi
mov ecx, dword [esp + 0x1c]
dec ecx
push str.vncviewer.exe
mov dword [esp + 0x20], ecx
call fcn.00407130
add esp, 4
cmp eax, ebx
je 0x40e784
push str.vncviewer.exe
call fcn.00406fc0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
jge 0x40e740
jmp 0x40e784
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push str.kvncviewer.exe
call fcn.00406fc0
add esp, 4
test eax, eax
jne 0x40e7d6
mov dword [esp + 0x1c], edi
lea esp, [esp]
push 0xfa
call esi
mov eax, dword [esp + 0x1c]
dec eax
push str.kvncviewer.exe
mov dword [esp + 0x20], eax
call fcn.00407130
add esp, 4
cmp eax, ebx
je 0x40e7d6
push str.kvncviewer.exe
call fcn.00406fc0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
jge 0x40e7a0
call fcn.00406060
test eax, eax
jge 0x40e806
lea edx, [esp + 0x460]
push str.Failed_to_reset_default_WinVNC_password._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x468]
push eax
push ecx
call fcn.0040b0a0
add esp, 0x10
cmp dword [esp + 0x50], 2
jne 0x40e938
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x768]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x76c]
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x768]
push 0x5c
push eax
call fcn.00410d80
add esp, 8
cmp eax, ebx
jne 0x40e86a
mov cx, word [0x41e76c]
mov dl, byte [0x41e76e]
mov word [esp + 0x768], cx
mov byte [esp + 0x76a], dl
jmp 0x40e86c
mov byte [eax], bl
mov eax, dword [esp + 0x10]
push str.logMessages.dll
push str.kvnc_
push eax
lea eax, [esp + 0x774]
call fcn.0040c130
mov ecx, dword [esp + 0x1c]
push str.wm_hooks.dll
push str.kvnc_
push ecx
lea eax, [esp + 0x780]
call fcn.0040c130
mov edx, dword [esp + 0x28]
push str.vncclipboard.exe
push str.kvnc_
push edx
lea eax, [esp + 0x78c]
call fcn.0040c130
mov eax, dword [esp + 0x34]
push str.vncconfig.exe
push str.kvnc_
push eax
lea eax, [esp + 0x798]
call fcn.0040c130
mov ecx, dword [esp + 0x40]
push str.WinVNC4.exe
push str.kvnc_
push ecx
lea eax, [esp + 0x7a4]
call fcn.0040c130
mov al, byte [esp + 0x1854]
add esp, 0x3c
cmp al, bl
je 0x40e938
lea edx, [esp + 0x1818]
push edx
lea eax, [esp + 0x76c]
push eax
lea ecx, [esp + 0x468]
push str.__s_vncconfig.exe___license__s
push ecx
call fcn.00411276
push 0xf
push 1
lea edx, [esp + 0x478]
push edx
push ebx
call fcn.0040a140
add esp, 0x20
mov eax, dword [str.WinVNC4.exe]
mov ecx, dword [0x42027c]
mov edx, dword [0x420280]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
jmp 0x40e64e
mov eax, dword [str.Awrem32.exe]
mov ecx, dword [0x420250]
mov edx, dword [0x420254]
mov dword [esp + 0x18], 6
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
cmp esi, ebx
je 0x40e64e
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x25c]
mov eax, 0x105
push edx
lea edx, [esp + 0x24]
lea ebx, [esp + 0x1310]
mov dword [esp + 0x24], eax
mov dword [esp + 0xb8], eax
call fcn.0040b9a0
add esp, 8
test eax, eax
jne 0x40ecd3
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e9e0
sub eax, edx
mov dword [esp + 0x48], eax
je 0x40ecd3
lea eax, [esp + 0x258]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea00
sub eax, edx
mov dword [esp + 0x48], eax
je 0x40ecd3
lea eax, [esp + 0x1308]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea20
mov si, word [0x41e840]
sub eax, edx
mov cl, byte [esp + eax + 0x1307]
mov bl, 0x5c
cmp cl, bl
je 0x40ea50
lea edi, [esp + 0x1308]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ea45
mov word [edi], si
lea eax, [esp + 0x258]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ea60
sub eax, edx
cmp byte [esp + eax + 0x257], bl
je 0x40ea8b
lea edi, [esp + 0x258]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ea80
mov word [edi], si
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x1204]
push str._sNetwork.chf
push ecx
call fcn.00411276
lea edx, [esp + 0x120c]
push 0x41e2ec
push edx
call fcn.00411686
add esp, 0x14
test eax, eax
jne 0x40ec8e
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x1204]
push str._sNetwork__cable__dsl.chf
push ecx
call fcn.00411276
lea edx, [esp + 0x120c]
push 0x41e2ec
push edx
call fcn.00411686
add esp, 0x14
test eax, eax
jne 0x40ec8e
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x1204]
push str._sRemotesNetwork__cable__dsl.chf
push ecx
call fcn.00411276
add esp, 0xc
jmp 0x40ec97
mov eax, dword [str.mstsc.exe]
mov ecx, dword [0x41f02c]
mov dx, word [0x41f030]
mov dword [esp + 0x18], 0xb
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov word [esp + 0x158], dx
jmp 0x40e991
mov eax, dword [str.RAdmin.exe]
mov ecx, dword [0x4201f4]
mov dx, word [0x4201f8]
mov dword [esp + 0x150], eax
mov al, byte [0x4201fa]
mov byte [esp + 0x15a], al
cmp dword [esp + 0x4c], ebx
mov dword [esp + 0x18], 2
mov dword [esp + 0x154], ecx
mov word [esp + 0x158], dx
je 0x40e991
lea eax, [esp + 0x258]
mov byte [esp + 0x80], 0x3d
mov byte [esp + 0x81], 0x2d
mov byte [esp + 0x82], 0x30
mov byte [esp + 0x83], 0x39
mov byte [esp + 0x84], 0x38
mov byte [esp + 0x85], 0x5b
mov byte [esp + 0x86], 0x70
mov byte [esp + 0x87], 0x6f
mov byte [esp + 0x88], 0x69
mov byte [esp + 0x89], 0x75
mov byte [esp + 0x8a], 0x3b
mov byte [esp + 0x8b], 0x6c
mov byte [esp + 0x8c], 0x6b
mov byte [esp + 0x8d], 0x6a
mov byte [esp + 0x8e], 0x68
mov byte [esp + 0x8f], 0x2e
mov byte [esp + 0x90], 0x2c
mov byte [esp + 0x91], 0x6d
mov byte [esp + 0x92], 0x6e
mov byte [esp + 0x93], 0x62
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ec40
sub eax, edx
mov dword [esp + 0x48], eax
je 0x40e64e
push 0x41e834
lea ecx, [esp + 0x25c]
push ecx
lea edx, [esp + 0x1b28]
push str._s_s
push edx
call fcn.00411276
lea eax, [esp + 0x268]
push eax
call fcn.00406700
add esp, 0x14
mov dword [esp + 0xa8], eax
jmp 0x40e64e
push eax
call fcn.004115d9
add esp, 4
lea edx, [esp + 0x1200]
push edx
lea eax, [esp + 0x364]
push str.__s___c
push eax
call fcn.00411276
lea ecx, [esp + 0x1314]
push ecx
lea edx, [esp + 0x988]
push str.__sAwrem32.exe_
push edx
call fcn.00411276
add esp, 0x18
jmp 0x40e64c
mov eax, dword [esp + 0x10]
push str.Failed_to_get_the_installation_directory_for_pcAnywhere._r_nExiting..._r_n
push eax
call fcn.0040b0a0
add esp, 8
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x1918], bl
je 0x40ed45
lea edx, [esp + 0x1918]
push edx
call fcn.004079d0
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x46c]
push str.The_specified_direct_connection_LAN_address_is__s:_d._r_n
push edx
mov dword [esp + 0x4c], eax
call fcn.00411276
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x474]
push eax
push ecx
call fcn.0040b0a0
add esp, 0x1c
cmp byte [esp + 0x1718], bl
je 0x40ed8c
lea edx, [esp + 0x1718]
push edx
call fcn.004079d0
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x46c]
push str.The_specified_direct_connection_gateway_address_is__s:_d._r_n
push edx
mov dword [esp + 0x50], eax
call fcn.00411276
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x474]
push eax
push ecx
call fcn.0040b0a0
add esp, 0x1c
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
push 0x3c
push eax
push esi
call fcn.00407bc0
add esp, 0x10
test eax, eax
jne 0x40fff5
mov ecx, dword [esp + 0x24]
push ecx
push esi
lea edx, [esp + 0x468]
push str.Successfully_connected_to_the_VSA_server_at__s:_d._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x470]
push eax
push ecx
call fcn.0040b0a0
mov eax, dword [esp + 0x7c]
add esp, 0x18
cmp eax, 0x1c20
jl 0x40ee0a
lea ecx, [eax + 0x708]
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_hour_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea ecx, [esp + 0x468]
push ecx
jmp 0x40ee43
cmp eax, 0x78
jl 0x40ee35
lea ecx, [eax + 0x1e]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_minute_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea ecx, [esp + 0x468]
push ecx
jmp 0x40ee43
push eax
push str.Starting_a__d_second_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea edx, [esp + 0x468]
push edx
call fcn.00411276
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x460]
push eax
push ecx
call fcn.0040b0a0
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
call fcn.00407dd0
add esp, 0x14
cmp eax, ebx
jne 0x40ff68
mov edx, dword [esp + 0x10]
push str.Done._r_n
push edx
call fcn.0040b0a0
mov edi, dword [esp + 0x40]
xor esi, esi
add esp, 8
cmp edi, ebx
mov dword [esp + 0x34], esi
je 0x40eef2
mov eax, dword [esp + 0x14]
push 0xf
push eax
push edi
call fcn.00407f80
add esp, 0xc
test eax, eax
jle 0x40eec5
mov ecx, dword [esp + 0x14]
push ecx
push edi
mov dword [esp + 0x3c], 1
push str.Direct_connection_detected_to_remote_control_application_at_LAN_address__s:_d._r_n
jmp 0x40ef29
mov edx, dword [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x468]
push str.Direct_connection_is_unavailable_to_remote_control_application_at_LAN_address__s:_d._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x470]
push ecx
push edx
call fcn.0040b0a0
add esp, 0x18
mov edi, dword [esp + 0x3c]
cmp edi, ebx
je 0x40f08f
mov eax, dword [esp + 0x14]
push 0xf
push eax
push edi
call fcn.00407f80
add esp, 0xc
test eax, eax
jle 0x40f08f
mov ecx, dword [esp + 0x14]
push ecx
push edi
mov dword [esp + 0x3c], 2
push str.Direct_connection_is_unavailable_to_remote_control_application_at_gateway_address__s:_d._r_n
lea edx, [esp + 0x46c]
push edx
call fcn.00411276
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x470]
push eax
push ecx
call fcn.0040b0a0
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
add esp, 0x18
push ebx
push 0x1000f
push edx
push eax
call fcn.00408110
mov ecx, dword [esp + 0x20]
push str.Direct_connection_will_be_used_for_this_remote_control_session._r_nThe_command_has_been_sent_to_quit_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push ecx
call fcn.0040b0a0
mov esi, dword [esp + 0x4c]
add esp, 0x18
mov al, byte [esp + 0x978]
cmp al, bl
je 0x40f96c
cmp al, 0x22
je 0x40f023
lea edx, [esp + 0x978]
push str..exe
push edx
call fcn.0040b280
add esp, 8
cmp eax, ebx
je 0x40f023
add eax, 4
lea edx, [esp + 0x978]
cmp edx, eax
mov byte [esp + 0x3460], 0x22
mov ecx, 1
je 0x40efeb
mov ecx, eax
sub ecx, edx
mov dword [esp + 0x44], ecx
mov esi, edx
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0x3461]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
mov ecx, edx
inc ecx
mov byte [esp + ecx + 0x3460], 0x22
sub ecx, eax
lea edx, [esp + ecx + 0x3461]
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x40f000
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x3460]
mov byte [esp + eax + 0x978], cl
inc eax
cmp cl, bl
jne 0x40f010
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
mov eax, 1
mov dword [esp + 0xc4], eax
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x18]
mov ecx, 0xc
add eax, 0xfffffffe
cmp eax, ecx
mov dword [esp + 0x108], 0x44
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xcc], ebx
ja case.0x40f088.3
movzx eax, byte [eax + 0x410664]
jmp dword [eax*4 + 0x410650]
mov edx, dword [esp + 0x10]
push str.This_remote_control_session_will_use_the_VSA_as_the_relay_server._r_nSending_command_to_start_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push edx
call fcn.0040b0a0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push eax
push 0x10001
push ecx
push edx
call fcn.00408110
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x48]
push eax
push ecx
call fcn.004081a0
add esp, 0x20
cmp eax, 0xfffffff9
jne 0x40f155
mov eax, 0x2327
lea edx, [esp + 0x30]
inc eax
push edx
push eax
mov dword [esp + 0x1c], eax
call fcn.004081a0
add esp, 8
cmp eax, 0xfffffff9
jne 0x40f155
mov eax, dword [esp + 0x14]
cmp eax, 0x23ef
jl 0x40f0d7
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x464]
push str.Failed_to_open_a_port_on_this_machine_to_relay_data_from__s._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x46c]
push eax
push ecx
call fcn.0040b0a0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
add esp, 0x14
push ebx
push 0x1000f
push ecx
push edx
call fcn.00408110
mov eax, dword [esp + 0x20]
push str.Sent_command_to_quit_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push eax
call fcn.0040b0a0
add esp, 0x18
jmp 0x41013c
cmp eax, ebx
jne 0x40f0fa
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x150]
push eax
push ecx
lea edx, [esp + 0x468]
push str.Port__d_opened_on_this_machine_to_relay_data_from__s._r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x470]
push eax
push ecx
call fcn.0040b0a0
mov eax, dword [esp + 0x6c]
add esp, 0x18
cmp eax, ebx
je 0x40ef76
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0xa8]
call fcn.0040b810
add esp, 4
cmp eax, ebx
mov dword [esp + 0xb8], eax
jg 0x40ef76
mov eax, dword [esp + 0x10]
push str.ERROR:_Failed_to_disable_use_of_UDP_in_pcAnywhere__r_nThis_relay_session_may_fail._r_n
push eax
call fcn.0040b0a0
add esp, 8
jmp 0x40ef76
mov eax, esi
sub eax, ebx
je 0x40f275
dec eax
je 0x40f22f
dec eax
lea eax, [esp + 0x978]
lea edx, [eax + 1]
je 0x40f220
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f1f0
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0x364]
push edx
lea eax, [esp + eax + 0x980]
push str.__s127.0.0.1:_d
push eax
call fcn.00411276
add esp, 0x10
jmp 0x40f796
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f220
sub eax, edx
mov edx, dword [esp + 0x3c]
jmp 0x40f24d
lea eax, [esp + 0x978]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f240
sub eax, edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x368]
push ecx
lea edx, [esp + eax + 0x984]
push str.__s_s:_d
push edx
call fcn.00411276
add esp, 0x14
jmp 0x40f796
lea eax, [esp + 0x978]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f280
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0x364]
push edx
lea eax, [esp + eax + 0x980]
push str.__s127.0.0.1:_d
push eax
call fcn.00411276
add esp, 0x10
jmp 0x40f796
mov edx, dword [esp + 0x20]
lea ebx, [esp + 0x3860]
call fcn.0040d4c0
test eax, eax
jne 0x40f2d6
mov ecx, ebx
push ecx
push str._password__s
lea edx, [esp + 0x1108]
push edx
jmp 0x40f2e8
mov eax, dword [esp + 0x20]
push eax
push str._password__d
lea ecx, [esp + 0x1108]
push ecx
call fcn.00411276
mov al, byte [esp + 0x36c]
add esp, 0xc
test al, al
je 0x40f330
lea eax, [esp + 0x360]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f305
sub eax, edx
inc eax
push eax
lea edx, [esp + 0x364]
push edx
lea eax, [esp + 0x369]
push eax
call fcn.00411790
add esp, 0xc
mov byte [esp + 0x360], 0x20
mov eax, dword [esp + 0x34]
sub eax, 0
je 0x40f41f
dec eax
je 0x40f3cf
dec eax
lea eax, [esp + 0x978]
lea edx, [eax + 1]
je 0x40f390
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f351
sub eax, edx
lea ecx, [esp + 0x1100]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x364]
push edx
push ecx
lea edx, [esp + eax + 0x984]
push str.__127.0.0.1:_d_s__s
push edx
call fcn.00411276
add esp, 0x14
xor ebx, ebx
jmp 0x40f796
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f390
sub eax, edx
lea ecx, [esp + 0x1100]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x364]
push edx
mov edx, dword [esp + 0x44]
push ecx
push edx
lea eax, [esp + eax + 0x988]
push str.__s:_d_s__s
push eax
call fcn.00411276
add esp, 0x18
xor ebx, ebx
jmp 0x40f796
lea eax, [esp + 0x978]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f3e0
sub eax, edx
lea ecx, [esp + 0x1100]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x364]
push edx
mov edx, dword [esp + 0x40]
push ecx
push edx
lea eax, [esp + eax + 0x988]
push str.__s:_d_s__s
push eax
call fcn.00411276
add esp, 0x18
xor ebx, ebx
jmp 0x40f796
lea eax, [esp + 0x978]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f430
sub eax, edx
lea ecx, [esp + 0x1100]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x364]
push edx
push ecx
lea edx, [esp + eax + 0x984]
push str._127.0.0.1:_d_s__s
push edx
call fcn.00411276
add esp, 0x14
xor ebx, ebx
jmp 0x40f796
mov eax, esi
sub eax, ebx
je 0x40f4f0
dec eax
je 0x40f4b4
dec eax
lea eax, [esp + 0x978]
lea edx, [eax + 1]
je 0x40f4a7
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f484
lea ecx, [esp + 0x360]
push ecx
sub eax, edx
push str.__s127.0.0.1
lea edx, [esp + eax + 0x980]
push edx
jmp 0x40f78e
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f4a7
mov ecx, dword [esp + 0x3c]
jmp 0x40f4cb
lea eax, [esp + 0x978]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f4c0
mov ecx, dword [esp + 0x38]
sub eax, edx
push ecx
lea edx, [esp + 0x364]
push edx
lea eax, [esp + eax + 0x980]
push str.__s_s
push eax
call fcn.00411276
add esp, 0x10
jmp 0x40f796
lea eax, [esp + 0x978]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f500
lea ecx, [esp + 0x360]
push ecx
sub eax, edx
push str.__s127.0.0.1
lea edx, [esp + eax + 0x980]
push edx
jmp 0x40f78e
cmp dword [esp + 0x60], ebx
je 0x40f796
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x870]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x874]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x40f574
mov cx, word [0x41e76c]
mov dl, byte [0x41e76e]
mov word [esp + 0x870], cx
mov byte [esp + 0x872], dl
jmp 0x40f5b0
lea eax, [esp + 0x870]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f580
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40f5a4
mov edi, edi
mov cl, byte [esp + eax + 0x870]
cmp cl, 0x5c
je 0x40f5a4
cmp cl, 0x3a
je 0x40f5a4
dec eax
jns 0x40f590
inc eax
mov dword [esp + 0x1c], eax
mov byte [esp + eax + 0x870], bl
cmp byte [esp + 0xd88], bl
lea eax, [esp + 0x870]
lea edx, [eax + 1]
je 0x40f5f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f5c3
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0xd8c]
push edx
lea eax, [esp + eax + 0x878]
push str._s._d.rdp
push eax
call fcn.00411276
add esp, 0x10
jmp 0x40f613
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f5f0
mov ecx, dword [esp + 0x14]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x874]
push str.ts_d.rdp
push edx
call fcn.00411276
add esp, 0xc
lea eax, [esp + 0x3c60]
push eax
call fcn.0040d370
mov edi, eax
mov eax, esi
add esp, 4
sub eax, ebx
lea esi, [esp + 0x3c60]
je 0x40f657
dec eax
je 0x40f64b
dec eax
je 0x40f63f
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x40f65c
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
push edx
push eax
jmp 0x40f661
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x38]
push ecx
push edx
jmp 0x40f661
mov eax, dword [esp + 0x14]
push eax
push str.127.0.0.1
lea eax, [esp + 0x878]
call fcn.0040b4c0
lea eax, [esp + 0x980]
add esp, 8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f680
lea ecx, [esp + 0x870]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x97c]
push str.___s_
push edx
call fcn.00411276
add esp, 0xc
cmp edi, ebx
je 0x40f796
lea edi, [esp + 0x978]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f6b6
mov eax, dword [str.__admin]
mov ecx, dword [0x41fac8]
mov dword [edi], eax
mov dword [edi + 4], ecx
jmp 0x40f796
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0xe4]
push 0x41e89c
push eax
call fcn.00411276
mov eax, esi
add esp, 0xc
sub eax, ebx
je 0x40f73f
dec eax
lea edx, [esp + 0x360]
je 0x40f72a
dec eax
je 0x40f715
lea ecx, [esp + 0xe0]
push ecx
push str.127.0.0.1
push pe_nt_image_headers32
push edx
jmp 0x40f759
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xe0]
push eax
push ecx
push pe_nt_image_headers32
push edx
jmp 0x40f759
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xe0]
push eax
push ecx
push pe_nt_image_headers32
push edx
jmp 0x40f759
lea eax, [esp + 0xe0]
push eax
push str.127.0.0.1
push pe_nt_image_headers32
lea ecx, [esp + 0x36c]
push ecx
call fcn.0040c290
lea eax, [esp + 0x988]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x40f770
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f770
sub eax, edx
lea edx, [esp + 0x360]
push edx
push 0x41fac0
lea eax, [esp + eax + 0x980]
push eax
call fcn.00411276
add esp, 0xc
lea ecx, [esp + 0x978]
push 0x25
push ecx
call fcn.00411ea0
add esp, 8
test eax, eax
je 0x40f7f3
push 0xc80
lea edx, [esp + 0x1c2c]
push edx
lea eax, [esp + 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40f7f3
cmp eax, 0x208
ja 0x40f7f3
xor eax, eax
jmp 0x40f7e0
mov cl, byte [esp + eax + 0x1c28]
mov byte [esp + eax + 0x978], cl
inc eax
cmp cl, bl
jne 0x40f7e0
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x10c]
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x998]
push edx
push ebx
mov dword [esp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
mov dword [esp + 0x48], eax
jne 0x40f839
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x978]
push str.ftp:__
push eax
mov byte [esp + 0x28b0], bl
call fcn.00411c10
add esp, 8
cmp eax, ebx
je 0x40f8ab
push 0x40
push eax
lea esi, [eax + 6]
call fcn.00411ea0
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40f8ab
lea edx, [esp + 0x978]
mov ecx, esi
sub ecx, edx
push ecx
mov eax, edx
push eax
lea ecx, [esp + 0x28b0]
push ecx
call fcn.00410bf0
lea eax, [edi + 1]
lea edx, [esp + 0x984]
sub esi, eax
add esp, 0xc
sub esi, edx
lea edx, [esp + esi + 0x28a8]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x40f8a1
cmp byte [esp + 0x28a8], bl
jne 0x40f8d3
xor eax, eax
jmp 0x40f8c0
mov cl, byte [esp + eax + 0x978]
mov byte [esp + eax + 0x28a8], cl
inc eax
cmp cl, bl
jne 0x40f8c0
cmp dword [esp + 0x48], ebx
jne 0x40f90f
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x28ac]
push ecx
lea edx, [esp + 0x468]
push str.Failed_to_create_the_process_to_run__s.__Code:__d___r_n
push edx
call fcn.00411276
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x470]
push eax
push ecx
call fcn.0040b0a0
add esp, 0x18
jmp 0x40f93e
lea edx, [esp + 0x28a8]
push edx
lea eax, [esp + 0x464]
push str.Successfully_created_the_process_to_run__s._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x46c]
push ecx
push edx
call fcn.0040b0a0
add esp, 0x14
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x40f94d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x74]
cmp eax, ebx
je 0x40f96c
cmp dword [esp + 0x18], 7
jne 0x40f965
mov dword [esp + 0xb4], eax
jmp 0x40f96c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x50]
cmp esi, ebx
je 0x40f994
mov eax, dword [esp + 0x10]
push str.Configuring_WinVNC_service._r_n
push eax
call fcn.0040b0a0
lea ecx, [esp + 0x1a20]
push ecx
push esi
call fcn.00405a00
add esp, 0x10
mov esi, dword [esp + 0x4c]
cmp esi, ebx
je 0x40f9e1
mov edx, dword [esp + 0x78]
push edx
call fcn.0040baf0
add esp, 4
cmp eax, ebx
jne 0x40f9b9
mov eax, dword [esp + 0x10]
push str.Successfully_generated_input_for_the_RAdmin_splash_screen._r_n
push eax
jmp 0x40f9d9
cmp eax, 0xffffffff
jne 0x40f9ca
mov ecx, dword [esp + 0x10]
push str.The_RAdmin_splash_screen_was_not_found._It_may_be_have_been_disabled._r_n
push ecx
jmp 0x40f9d9
cmp eax, 0xfffffffe
jne 0x40f9e1
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_on_the_RAdmin_splash_screen._r_n
push edx
call fcn.0040b0a0
add esp, 8
cmp dword [esp + 0x34], ebx
jne 0x40fed3
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x68]
push eax
push 0x3c
push ecx
call fcn.004081c0
add esp, 0xc
test eax, eax
jle 0x40fe97
lea edx, [esp + 0xd4]
push edx
call fcn.00412697
lea eax, [esp + 0xd8]
push eax
call fcn.0041267e
add eax, 0xb
push eax
lea ecx, [esp + 0x46c]
push str.Starting_the_relay_at__.8s_for_this
push ecx
call fcn.00411276
lea eax, [esp + 0x100c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40fa44
sub eax, edx
cmp eax, 2
jl 0x40fa8c
lea edi, [esp + 0x460]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40fa60
mov edx, dword [str.encrypted]
mov eax, dword [0x41f940]
mov cx, word [0x41f944]
mov dword [edi], edx
mov dl, byte [0x41f946]
mov dword [edi + 4], eax
mov word [edi + 8], cx
mov byte [edi + 0xa], dl
lea edi, [esp + 0x460]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40fa94
mov ecx, 7
mov esi, str.remote_control_session..._r_n
lea eax, [esp + 0x460]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0040b0a0
mov eax, dword [esp + 0x74]
add esp, 8
cmp eax, ebx
je 0x40fb08
push 1
call fcn.00409b80
add esp, 4
cmp eax, 0xfffffffe
je 0x40faf6
cmp eax, 1
je 0x40faea
cmp eax, 2
jne 0x40fb08
mov edx, dword [esp + 0x10]
push str.SoftwareSASGeneration_policy_setting_already_enabled._r_n
push edx
jmp 0x40fb00
mov eax, dword [esp + 0x10]
push str.Policy_setting_does_not_require_Ctl_Alt_Del._r_n
push eax
jmp 0x40fb00
mov ecx, dword [esp + 0x10]
push str.Failed_to_enable_SoftwareSASGeneration_policy._May_not_be_able_to_send_Ctl_Alt_Del._r_n
push ecx
call fcn.0040b0a0
add esp, 8
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0xffc]
push eax
mov eax, dword [esp + 0x30]
push edi
push ecx
mov ecx, dword [esp + 0x34]
push ebx
push 1
push edx
mov edx, dword [esp + 0x3c]
push eax
push ecx
push esi
push edx
call fcn.00409260
mov eax, dword [esp + 0x78]
add esp, 0x2c
cmp eax, ebx
je 0x40fbf8
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0x80]
push eax
push str.A1F62E73_C423_481f_8966_AC79B8AE4A7B
push ecx
call fcn.0040bc50
add esp, 0xc
cmp eax, ebx
jne 0x40fbbf
mov edx, dword [esp + 0x10]
push str.Successfully_generated_input_to_the_RAdmin_password_dialog_box._r_n
push edx
call fcn.0040b0a0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 0xc
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1000]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push esi
push ecx
push edx
call fcn.00401b00
add esp, 0x20
mov dword [esp + 0xa0], eax
jmp 0x40fbf8
cmp eax, 0xffffffff
jne 0x40fbd0
mov eax, dword [esp + 0x10]
push str.Failed_to_locate_the_RAdmin_password_dialog_box._r_n
push eax
jmp 0x40fbf0
cmp eax, 0xfffffffe
jne 0x40fbe1
mov ecx, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_in_the_RAdmin_password_dialog_box._r_n
push ecx
jmp 0x40fbf0
cmp eax, 0xfffffffd
jne 0x40fbf8
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_password_text_field_in_the_RAdmin_password_dialog_box._r_n
push edx
call fcn.0040b0a0
add esp, 8
cmp edi, 7
jne 0x40fc35
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 0xa
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1000]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push esi
push ecx
push edx
call fcn.00401b00
add esp, 0x20
mov dword [esp + 0xa0], eax
jmp 0x40fd42
cmp edi, 4
jne 0x40fd42
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x150]
push eax
push ecx
lea edx, [esp + 0x468]
push str.Port__d_will_now_be_closed_after_accepting_a_relay_connection_from__s._r_n
push edx
call fcn.00411276
lea edi, [esp + 0x470]
add esp, 0x10
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40fc68
mov eax, dword [str.Continuing_to_relay]
mov ecx, dword [0x41f6c4]
mov edx, dword [0x41f6c8]
mov dword [edi], eax
mov eax, dword [0x41f6cc]
mov dword [edi + 4], ecx
mov ecx, dword [0x41f6d0]
mov dword [edi + 8], edx
mov dl, byte [0x41f6d4]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
lea eax, [esp + 0xff8]
mov byte [edi + 0x14], dl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40fcb0
sub eax, edx
cmp eax, 2
jl 0x40fcf1
lea edi, [esp + 0x460]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40fcc6
mov eax, dword [str.encrypted]
mov ecx, dword [0x41f940]
mov dx, word [0x41f944]
mov dword [edi], eax
mov al, byte [0x41f946]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
lea edi, [esp + 0x460]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40fd00
mov edx, dword [esp + 0x10]
mov ecx, 6
mov esi, str.remote_control_data..._r_n
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x460]
push ecx
push edx
movsb byte es:[edi], byte [esi]
call fcn.0040b0a0
mov eax, dword [esp + 0x38]
push 1
push eax
call fcn.004051d0
mov edi, dword [esp + 0x28]
add esp, 0x10
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040ae40
mov edx, dword [esp + 0x24]
push edx
call fcn.00407aa0
add esp, 8
cmp edi, 7
jne 0x40fddc
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xa0]
push eax
push ecx
call fcn.00401ba0
add esp, 8
cmp eax, 1
jne 0x40fda8
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x464]
push str.The_relay_session_has_timed_out_because__s_has_been_idle._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x46c]
push ecx
push edx
jmp 0x40fdd4
cmp eax, 2
jne 0x40fddc
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x464]
push str._s_has_terminated._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x46c]
push edx
push eax
call fcn.0040b0a0
add esp, 0x14
cmp dword [esp + 0x6c], ebx
je case.0x40fdf4.2
push 2
call fcn.00409b80
add eax, 5
add esp, 4
cmp eax, 9
ja case.0x40fdf4.2
jmp dword [eax*4 + 0x410674]
mov ecx, dword [esp + 0x10]
push str.Successfully_removed_SoftwareSASGeneration_policy_setting._r_n
push ecx
jmp 0x40fe30
push str.Successfully_restored_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40fe2b
mov eax, dword [esp + 0x10]
push str.Failed_to_remove_SoftwareSASGeneration_policy_setting._r_n
push eax
jmp 0x40fe30
mov ecx, dword [esp + 0x10]
push str.Failed_to_restore_SoftwareSASGeneration_policy_setting._r_n
push ecx
jmp 0x40fe30
push str.SoftwareSASGeneration_policy_setting_has_not_been_restored_because_it_has_changed_since_this_session_started._r_n
mov edx, dword [esp + 0x14]
push edx
call fcn.0040b0a0
add esp, 8
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ae70
lea ecx, [esp + 0xd8]
push ecx
call fcn.00412697
lea edx, [esp + 0xdc]
push edx
call fcn.0041267e
add eax, 0xb
push eax
lea eax, [esp + 0x470]
push str.The_relay_session_has_terminated_at__.8s._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x478]
push ecx
push edx
call fcn.0040b0a0
add esp, 0x20
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41013c
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x464]
push str.No_connection_was_made_by__s_to_this_relay_client._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x46c]
push edx
push eax
call fcn.0040b0a0
add esp, 0x14
mov dword [esp + 0x68], 0xffffffff
jmp 0x41013c
cmp esi, ebx
je 0x41013c
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x80]
push ecx
push str.A1F62E73_C423_481f_8966_AC79B8AE4A7B
push edx
call fcn.0040bc50
add esp, 0xc
cmp eax, ebx
jne 0x40ff10
mov eax, dword [esp + 0x10]
push str.Successfully_generated_input_to_the_RAdmin_password_dialog_box._r_n
push eax
call fcn.0040b0a0
add esp, 8
jmp 0x41013c
cmp eax, 0xffffffff
jne 0x40ff2c
mov ecx, dword [esp + 0x10]
push str.Failed_to_locate_the_RAdmin_password_dialog_box._r_n
push ecx
call fcn.0040b0a0
add esp, 8
jmp 0x41013c
cmp eax, 0xfffffffe
jne 0x40ff48
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_in_the_RAdmin_password_dialog_box._r_n
push edx
call fcn.0040b0a0
add esp, 8
jmp 0x41013c
cmp eax, 0xfffffffd
jne 0x41013c
mov eax, dword [esp + 0x10]
push str.Failed_to_locate_the_password_text_field_in_the_RAdmin_password_dialog_box._r_n
push eax
call fcn.0040b0a0
add esp, 8
jmp 0x41013c
cmp eax, 0x2bad2bad
jne 0x40ffde
push 1
lea ecx, [esp + 0x464]
push str.Failed._r_n_r_n____ERROR:_This_viewer_package_version___d__is_obsolete._r_n___________Please_restart_the_remote_control_session_by_first_selecting_a_machine_from_the_Kaseya_Virtual_System_r_n___________Administrator_remote_control_web_page_and_then_run_download_the_viewer_package_again._r_n_r_nThis_package_will_exit_now..._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x40ffac
push 0x10
lea edx, [esp + 0x76c]
push edx
lea eax, [esp + 0x468]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41013c
lea ecx, [esp + 0x460]
push ecx
push eax
call fcn.0040b0a0
add esp, 8
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
push edx
call fcn.0040ae20
add esp, 4
mov dword [esp + 0x10], ebx
jmp 0x41013c
mov eax, dword [esp + 0x10]
push str.Failed._r_nRelay_for_remote_control_session_failed_to_establish_a_connection_with_the_other_relay_client._r_n
push eax
call fcn.0040b0a0
add esp, 8
jmp 0x41013c
lea ecx, [esp + 0x460]
push 0x41eef4
push ecx
call fcn.00411276
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x468]
push edx
push eax
call fcn.0040b0a0
mov ecx, dword [esp + 0x34]
push ecx
push esi
lea edx, [esp + 0x478]
push str.ERROR:__Unable_to_connect_to_the_KServer_at__s_on_port__d._r_n_r_n
push edx
call fcn.00411276
lea edi, [esp + 0x480]
add esp, 0x20
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x410040
mov ecx, 0x10
mov esi, str.Please_check_that_your_firewall__router__and_or_proxy_server_is_r_n
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x460]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410060
mov ecx, dword [esp + 0x24]
sub eax, edx
mov edx, dword [esp + 0x40]
push ecx
push edx
lea eax, [esp + eax + 0x468]
push str.allowing_outbound_TCP_connections_to__s_on_port__d._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x470]
push ecx
push edx
call fcn.0040b0a0
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x28]
add esp, 0x18
cmp eax, ebx
je 0x4100aa
cmp esi, ebx
jne 0x4100d3
mov eax, dword [esp + 0x18]
cmp eax, 0xe
je 0x4100d3
cmp eax, 5
je 0x4100d3
cmp eax, 2
je 0x4100d3
cmp eax, 0xb
je 0x4100d3
cmp eax, 6
je 0x4100d3
cmp eax, 7
je 0x4100d3
push 0x7530
jmp 0x41012e
lea eax, [esp + 0x768]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4100e0
sub eax, edx
dec eax
cmp eax, ebx
jl 0x410104
mov edi, edi
mov cl, byte [esp + eax + 0x768]
cmp cl, 0x5c
je 0x410104
cmp cl, 0x3a
je 0x410104
dec eax
jns 0x4100f0
inc eax
push 0x78
mov dword [esp + 0x20], eax
push 0x50010
lea eax, [esp + eax + 0x770]
push eax
lea ecx, [esp + 0x46c]
push ecx
push esi
call fcn.0040aed0
add esp, 0x14
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x28], 0xffffffff
cmp byte [esp + 0x870], bl
je 0x41018d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x870]
push edx
call esi
test eax, eax
jne 0x41018d
lea eax, [esp + 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41018d
test al, 1
je 0x41018d
push 0x80
lea ecx, [esp + 0x874]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x870]
push edx
call esi
cmp dword [esp + 0xb8], ebx
jle 0x4101c3
mov eax, dword [esp + 0xac]
push eax
mov eax, dword [esp + 0xa8]
call fcn.0040b910
add esp, 4
test eax, eax
jge 0x4101c3
mov ecx, dword [esp + 0x10]
push str.ERROR:_Failed_to_restore_of_UDP_registry_setting_for_pcAnywhere__r_n
push ecx
call fcn.0040b0a0
add esp, 8
mov eax, dword [esp + 0xa8]
cmp eax, ebx
je 0x4101d5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x40]
push edx
call fcn.00411acd
mov eax, dword [esp + 0x3c]
add esp, 4
cmp eax, ebx
je 0x4101f3
push eax
call fcn.00411acd
add esp, 4
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x410204
push eax
call fcn.00411acd
add esp, 4
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x410217
push ebx
push eax
call fcn.004051d0
add esp, 8
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
je 0x41023f
push 1
push eax
call fcn.004051d0
mov eax, dword [esp + 0x20]
add esp, 8
cmp eax, 7
jne 0x41023f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x410253
push 1
push eax
call fcn.004051d0
add esp, 8
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ae70
mov esi, dword [esp + 0x54]
add esp, 4
cmp esi, ebx
je 0x41029b
mov ecx, dword [esp + 0x10]
push str.Removing_WinVNC_service._r_n
push ecx
call fcn.0040b0a0
push esi
call fcn.00405f10
mov edx, dword [esp + 0x1c]
push 0x1e
push 0x50040
push str.Virtual_System_Administrator
push str.Remote_control_session_with_your_administrator_has_ended.
push edx
call fcn.0040aed0
add esp, 0x20
cmp byte [esp + 0x4c60], bl
je 0x41033d
lea eax, [esp + 0x4c60]
push eax
push 0x41eef4
mov ecx, eax
push str._r_n
push ecx
call fcn.0040b3a0
mov al, byte [esp + 0xf00]
add esp, 0x10
cmp al, bl
jne 0x410309
lea edx, [esp + 0xef0]
push edx
push str.Agent_Title
push str._SERVER_COMMUNICATIONS_
call fcn.00409a00
mov al, byte [esp + 0xefc]
add esp, 0xc
cmp al, bl
jne 0x410309
mov ecx, 7
mov esi, str.Virtual_System_Administrator
lea edi, [esp + 0xef0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x4c60]
push eax
call fcn.00409de0
add esp, 4
test eax, eax
jne 0x41033d
push 0x78
push 0x50040
lea ecx, [esp + 0xef8]
push ecx
lea edx, [esp + 0x4c6c]
push edx
push ebx
call fcn.0040aed0
add esp, 0x14
cmp byte [esp + 0x1510], bl
je 0x410510
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
mov eax, 0xfffff830
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov eax, 0xc
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc8], eax
xor eax, eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
cmp byte [esp + 0xdf0], bl
mov ecx, 1
mov dword [esp + 0x108], 0x44
mov dword [esp + 0x134], 5
mov word [esp + 0x138], bx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ecx
je 0x41040a
lea eax, [esp + 0x1510]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4103e4
lea ecx, [esp + 0xdf0]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x1514]
push 0x41fac0
push edx
call fcn.00411276
add esp, 0xc
lea eax, [esp + 0x1510]
push 0x25
push eax
call fcn.00411ea0
add esp, 8
test eax, eax
je 0x410463
push 0xc80
lea ecx, [esp + 0x1c2c]
push ecx
lea edx, [esp + 0x1518]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x410463
cmp eax, 0x208
ja 0x410463
xor eax, eax
jmp 0x410450
mov cl, byte [esp + eax + 0x1c28]
mov byte [esp + eax + 0x1510], cl
inc eax
cmp cl, bl
jne 0x410450
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x10c]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x1530]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4104c0
lea edx, [esp + 0x1510]
push edx
lea eax, [esp + 0x464]
push str.Failed_to_start_the_cleanup_process__s._r_n
push eax
call fcn.00411276
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x46c]
push ecx
push edx
jmp 0x4104e7
lea eax, [esp + 0x1510]
push eax
lea ecx, [esp + 0x464]
push str.Successfully_started_the_cleanup_process__s._r_n
push ecx
call fcn.00411276
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x46c]
push edx
push eax
call fcn.0040b0a0
mov eax, dword [esp + 0x84]
add esp, 0x14
cmp eax, ebx
je 0x410501
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x74]
cmp eax, ebx
je 0x410510
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jne 0x410525
mov dword [esp + 0xdf0], 0x776f6e
jmp 0x410568
cmp eax, 1
jne 0x410552
mov ecx, dword [str.in_1_minute]
mov edx, dword [0x41f0cc]
mov eax, dword [0x41f0d0]
mov dword [esp + 0xdf0], ecx
mov dword [esp + 0xdf4], edx
mov dword [esp + 0xdf8], eax
jmp 0x410568
push eax
lea ecx, [esp + 0xdf4]
push str.in__d_minutes
push ecx
call fcn.00411276
add esp, 0xc
mov esi, dword [esp + 0x34]
cmp esi, ebx
jle 0x410587
lea edx, [esp + 0xdf0]
push edx
push str.This_relay_helper_will_exit__s_because_a_direct_connection_has_been_established..._r_n
lea eax, [esp + 0x468]
push eax
jmp 0x41059c
lea ecx, [esp + 0xdf0]
push ecx
push str.This_relay_client_will_exit__s..._r_n
lea edx, [esp + 0x468]
push edx
call fcn.00411276
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x460]
push eax
push ecx
call fcn.0040b0a0
add esp, 8
cmp esi, ebx
jne 0x4105c4
push 0x2710
jmp 0x4105c9
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x10], ebx
je 0x410638
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jbe 0x410638
cmp eax, 0x1179e
jbe 0x4105ee
mov dword [esp + 0x2c], 0xffffffff
jmp 0x4105fc
imul eax, eax, 0xea60
cmp eax, ebx
mov dword [esp + 0x2c], eax
je 0x410638
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xea60
jmp 0x410610
mov edx, dword [esp + 0x10]
push 0x41f038
push edx
call fcn.0040b0a0
mov eax, dword [esp + 0x34]
add esp, 8
cmp eax, edi
jbe 0x410635
push edi
call esi
sub dword [esp + 0x2c], edi
jne 0x410610
jmp 0x410638
push eax
call esi
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ae20
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10