Function at 0x429370
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x279c
call fcn.00459eb0
xor eax, eax
mov byte [esp + 0xd4], al
push ebx
push esi
push edi
mov byte [esp + 0x330], 0
mov ecx, 0x19
lea edi, [esp + 0x331]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0xe1], eax
mov dword [esp + 0xb9], ecx
mov dword [esp + 0xe5], eax
mov dword [esp + 0xbd], ecx
mov dword [esp + 0xe9], eax
mov dword [esp + 0xc1], ecx
mov dword [esp + 0xed], eax
mov word [esp + 0xf1], ax
mov dword [esp + 0xc5], ecx
mov word [esp + 0xc9], cx
mov byte [esp + 0x400], cl
mov edx, dword [ebp + 0x10]
mov byte [esp + 0xcb], cl
mov byte [esp + 0xf3], al
mov byte [esp + 0xb8], al
xor esi, esi
mov ecx, 0x10
lea edi, [esp + 0x401]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x8e8], 0
mov ecx, 0x66
lea edi, [esp + 0x8e9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x4b0], 0
mov ecx, 0x14
lea edi, [esp + 0x4b1]
mov dword [esp + 0x98], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xd0], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x94], esi
rep stosd dword es:[edi], eax
mov dword [esp + 0xac], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0x24], esi
mov dword [edx], esi
call fcn.00415a60
mov ebx, 1
cmp eax, ebx
mov dword [esp + 0x14], eax
jge 0x42950c
mov eax, dword [0x4cc444]
cmp eax, dword [0x4cc440]
jge 0x429505
push 0x4cc444
call fcn.0045a1c9
add esp, 4
call fcn.004417a0
jmp 0x429519
push 0x4cc440
call fcn.0045a1c9
add esp, 4
push ebx
call fcn.00415a70
mov al, byte [0x4869c0]
add esp, 4
test al, 3
jne 0x42955f
push esi
call fcn.0045a1c9
mov ecx, dword [0x4cc430]
add esp, 4
cmp ecx, esi
je 0x429615
sub eax, ecx
cmp eax, 0xe10
jl 0x429615
mov dword [0x4869c0], 3
mov dword [0x4cc430], esi
mov eax, 0x4cbee0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429567
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x42959d
mov eax, 0x4cbfe0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429580
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x42959d
cmp word [0x4cc0e0], si
jne 0x42959d
call fcn.00427930
mov eax, 0x4cbad0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4295a5
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x429621
mov eax, 0x4cbbd0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4295c0
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x429621
mov eax, 0x4cbcd8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4295d7
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x429621
mov eax, 0x4cbdd8
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4295f0
sub eax, edx
mov dword [esp + 0x28], eax
jne 0x429621
push 5
call fcn.00415aa0
add esp, 4
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa88]
push ecx
call fcn.00421d70
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0xa90]
push eax
call fcn.00431b40
add esp, 0xc
test eax, eax
je 0x429660
push 7
call fcn.00415aa0
add esp, 4
mov eax, 0xfffffff2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4865b4]
cmp eax, 0xb4
mov edi, 0xb4
jl 0x429673
mov edi, eax
cmp dword [0x4cc44c], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], 0xffffffff
je 0x4298b8
lea ecx, [esp + 0xb0]
push ecx
push 0xc0000017
mov dword [esp + 0xb8], esi
call fcn.00439e70
mov eax, dword [0x486af4]
add esp, 8
cmp eax, esi
jl 0x4296c9
push 0x20
push 0x4cb818
lea edx, [esp + 0xb8]
push 4
push edx
call fcn.00431d40
add esp, 0x10
mov ecx, dword [0x4cc450]
push 4
lea eax, [esp + 0xb4]
push eax
push ecx
call fcn.004394c0
add esp, 0xc
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x429820
cmp dword [0x4cc4b0], esi
jbe 0x42978f
cmp dword [0x4cc458], esi
jne 0x42978f
xor ecx, ecx
mov eax, 0x486b60
lea ecx, [ecx]
mov edx, dword [eax]
add eax, 4
add ecx, edx
cmp eax, 0x486b6c
jl 0x429710
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea edi, [edx + eax + 2]
mov eax, dword [0x486508]
cmp eax, esi
jg 0x42973c
mov eax, 0x78
cdq
sub eax, edx
sar eax, 1
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jle 0x42974c
mov edi, eax
cmp edi, 5
jge 0x429756
mov edi, 5
mov eax, dword [0x4cc4a4]
cmp eax, ebx
jge 0x42978f
push edi
lea ecx, [esp + 0x130]
inc eax
push str.An_attempt_to_read_data_from_an_existing_connection_returned_an_unexpected_status._Reducing_timeout_to__d_seconds._A_security_program_may_be_incorrectly_blocking_urgent_TCP_IP_packets._n
push ecx
mov dword [0x4cc4a4], eax
call fcn.00458ee7
lea edx, [esp + 0x134]
push edx
mov dword [esp + 0x138], ebx
call fcn.0043e010
add esp, 0x10
mov eax, dword [0x486af4]
mov edx, dword [0x4cc450]
cmp eax, esi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
lea eax, [esp + 0x18]
jl 0x4297b3
push 0x20
push 0x4cb818
jmp 0x4297b5
push esi
push esi
push eax
push ecx
push edi
push edx
call fcn.00427790
mov edi, dword [esp + 0x28]
add esp, 0x18
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x429801
cmp dword [esp + 0x18], 4
jb 0x429801
push edi
call fcn.00439e40
add esp, 4
cmp eax, 0x5000000a
jne 0x4297f4
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, esi
setne al
mov dword [esp + 0x1c], eax
jmp 0x42980d
cmp eax, 0x50000009
jne 0x429807
mov dword [esp + 0x1c], ebx
jmp 0x42980d
inc dword [0x4cc4b0]
mov dword [0x4cc44c], esi
cmp edi, esi
je 0x429826
push edi
call fcn.0045932f
add esp, 4
mov dword [esp + 0x10], esi
jmp 0x429826
mov dword [0x4cc44c], esi
cmp dword [0x4cbcd0], esi
jne 0x429836
cmp dword [0x4cbac8], esi
je 0x42983e
mov dword [0x4cc44c], esi
jmp 0x429846
cmp dword [0x4cc44c], esi
jne 0x4298b8
lea ecx, [esp + 0x30]
push ecx
push 0xc00000ff
call fcn.00439e70
mov eax, dword [0x486af4]
add esp, 8
cmp eax, esi
jl 0x429877
push 0x20
push 0x4cb818
lea edx, [esp + 0x38]
push 4
push edx
call fcn.00431d40
add esp, 0x10
mov ecx, dword [0x4cc450]
push 4
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.004394c0
mov edx, dword [0x4cc450]
push ebx
push edx
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 0x14
push 0xa
mov dword [0x4cc450], esi
mov dword [0x486af4], 0xfffffff0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4cc44c], esi
mov dword [0x4cbcd0], esi
mov dword [0x4cbac8], esi
jne 0x4299e5
mov eax, dword [0x48650c]
push 0x4cc450
push eax
push esi
mov ebx, eax
push 1
push 2
mov dword [esp + 0x30], 1
mov dword [esp + 0x74], ebx
call fcn.00439120
mov edi, eax
add esp, 0x14
cmp edi, esi
je 0x429948
mov eax, dword [0x4cc498]
cmp eax, 5
jge 0x429d2a
push edi
push 0x4cbbd0
mov ebx, eax
push 0x4cbad0
lea eax, [esp + 0x138]
inc ebx
push str.Unable_to_get_a_WinSock_connection_to_communicate_with_primary_server___s_s_._kascInit___error___d._n
push eax
mov dword [0x4cc498], ebx
call fcn.00458ee7
lea ecx, [esp + 0x13c]
mov dword [esp + 0x13c], 1
push ecx
jmp 0x429d22
mov eax, 0x4cbad0
mov dword [0x4cc498], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429956
sub eax, edx
mov dword [esp + 0x28], eax
je 0x42998b
mov edx, dword [0x4865b0]
mov eax, dword [0x4cc450]
push esi
push ebx
push esi
push 0x4cbad0
push edx
push eax
push 2
call fcn.00439260
mov dword [esp + 0x54], 0x4cbad0
jmp 0x4299cb
mov eax, 0x4cbbd0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429993
sub eax, edx
mov dword [esp + 0x28], eax
je 0x429a7e
mov ecx, dword [0x4865b0]
mov edx, dword [0x4cc450]
push esi
push ebx
push 0x4cbbd0
push esi
push ecx
push edx
push 2
call fcn.00439260
mov dword [esp + 0x54], 0x4cbbd0
add esp, 0x1c
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x429a7e
mov dword [esp + 0x94], 1
test byte [0x4869c0], 2
je 0x429a0d
push 0xe
push str.NewKaseyaAgent
push str.password
call fcn.0045b6d0
add esp, 0xc
test eax, eax
je 0x429a0d
and dword [0x4869c0], 0xfffffffd
mov eax, dword [0x4869c0]
test al, 2
je 0x42a2c5
mov edx, dword [0x4cc450]
and eax, 0xfffffffd
push edx
mov dword [0x4869c0], eax
call fcn.00426ef0
push 0x801
call fcn.00459619
mov ebx, eax
add esp, 8
cmp ebx, esi
mov dword [esp + 0xa4], ebx
jne 0x429df5
lea eax, [esp + 0x12c]
push str.Unable_to_allocate_memory_for_the_template_account_name._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x130]
push ecx
mov dword [esp + 0x134], 1
call fcn.0043e010
add esp, 0xc
jmp 0x42a264
mov eax, dword [0x4cc450]
push 1
push eax
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 8
push 0xa
mov dword [0x4cc450], esi
mov dword [0x486af4], 0xfffffff0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x4cbed8]
cmp bx, si
jne 0x429abd
mov ebx, dword [0x48650c]
push 0x4cc450
push ebx
push esi
push 1
push 2
mov dword [esp + 0x74], ebx
call fcn.00439120
mov edi, eax
add esp, 0x14
cmp edi, esi
je 0x429b07
mov eax, dword [0x4cc49c]
mov esi, 1
cmp eax, esi
jge 0x429d2a
push edi
push 0x4cbdd8
inc eax
push 0x4cbcd8
mov dword [0x4cc49c], eax
push str.Unable_to_get_a_WinSock_connection_to_communicate_with_secondary_server___s_s_._kascInit___error___d._n
jmp 0x429d06
mov eax, 0x4cbcd8
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429b10
sub eax, edx
mov dword [esp + 0x28], eax
je 0x429b60
mov eax, dword [0x4865b0]
mov ecx, dword [0x4cc450]
push esi
push ebx
push esi
push 0x4cbcd8
push eax
push ecx
push 2
call fcn.00439260
mov edi, eax
add esp, 0x1c
mov dword [esp + 0x14], edi
mov dword [esp + 0x38], 0x4cbcd8
cmp edi, esi
jne 0x429bab
mov dword [esp + 0x94], 2
jmp 0x4299e5
mov eax, 0x4cbdd8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429b68
sub eax, edx
mov dword [esp + 0x28], eax
je 0x429ba6
mov edx, dword [0x4865b0]
mov eax, dword [0x4cc450]
push esi
push ebx
push 0x4cbdd8
push esi
push edx
push eax
push 2
call fcn.00439260
mov edi, eax
add esp, 0x1c
mov dword [esp + 0x14], edi
mov dword [esp + 0x38], 0x4cbdd8
jmp 0x429b4c
mov edi, 0xfffffffb
push 1
call fcn.00415aa0
add esp, 4
cmp edi, 0xfffffffa
jne 0x429bbf
mov edi, 2
mov ecx, dword [0x4cc450]
push 1
push ecx
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 8
cmp word [0x4cc0e0], si
mov dword [0x4cc450], esi
mov dword [0x4cc44c], esi
mov dword [0x486af4], 0xfffffff0
je 0x429dec
mov al, byte [0x4cbee0]
test al, al
je 0x429c55
push 0x4cbad0
push 0x4cbee0
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x429c2c
mov dx, word [0x4cc0e0]
cmp dx, word [0x48650c]
je 0x429dec
push 0x4cbcd8
push 0x4cbee0
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x429c55
mov ax, word [0x4cc0e0]
cmp ax, word [0x4cbed8]
je 0x429dec
mov al, byte [0x4cbfe0]
test al, al
je 0x429cb2
push 0x4cbbd0
push 0x4cbfe0
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x429c88
mov cx, word [0x4cc0e0]
cmp cx, word [0x48650c]
je 0x429dec
push 0x4cbdd8
push 0x4cbfe0
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x429cb2
mov dx, word [0x4cc0e0]
cmp dx, word [0x4cbed8]
je 0x429dec
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x4cc0e0]
xor eax, eax
mov ax, bx
push 0x4cc450
mov dword [esp + 0x64], ebx
push eax
push esi
push 1
push 2
call fcn.00439120
mov edi, eax
add esp, 0x14
cmp edi, esi
je 0x429d3d
mov eax, dword [0x4cc4a0]
mov esi, 1
cmp eax, esi
jge 0x429d2a
push edi
push 0x4cbfe0
inc eax
push 0x4cbee0
mov dword [0x4cc4a0], eax
push str.Unable_to_get_a_WinSock_connection_to_communicate_with_last_known_server___s_s_._kascInit___error___d._n
lea ecx, [esp + 0x13c]
push ecx
call fcn.00458ee7
lea edx, [esp + 0x13c]
mov dword [esp + 0x13c], esi
push edx
call fcn.0043e010
add esp, 0x18
push 4
call fcn.00415aa0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x4cbee0]
test al, al
push esi
push ebx
je 0x429d6c
mov eax, dword [0x4865b0]
mov ecx, dword [0x4cc450]
push esi
push 0x4cbee0
push eax
push ecx
push 2
call fcn.00439260
mov dword [esp + 0x54], 0x4cbee0
jmp 0x429d8e
mov edx, dword [0x4865b0]
mov eax, dword [0x4cc450]
push 0x4cbfe0
push esi
push edx
push eax
push 2
call fcn.00439260
mov dword [esp + 0x54], 0x4cbfe0
mov edi, eax
add esp, 0x1c
cmp edi, esi
mov dword [esp + 0x14], edi
jne 0x429dab
mov dword [esp + 0x94], 3
jmp 0x4299e5
push 1
call fcn.00415aa0
add esp, 4
cmp edi, 0xfffffffa
jne 0x429dbf
mov edi, 2
mov ecx, dword [0x4cc450]
push 1
push ecx
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 8
mov dword [0x4cc450], esi
mov dword [0x4cc44c], esi
mov dword [0x486af4], 0xfffffff0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x200
mov edi, ebx
rep stosd dword es:[edi], eax
push ebx
push str.Password
push str._SERVER_COMMUNICATIONS_
stosb byte es:[edi], al
call fcn.00427b80
xor eax, eax
push 0x2d
mov ecx, 0x5d
lea edi, [esp + 0x780]
push ebx
rep stosd dword es:[edi], eax
call fcn.004590c0
add esp, 0x14
cmp eax, esi
jne 0x429e67
lea edx, [esp + 0x12c]
push str.Unable_to_locate_template_account_because_of_invalid_format._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x130]
push eax
mov dword [esp + 0x134], 1
call fcn.0043e010
add esp, 0xc
mov ebx, 0x4024
jmp 0x42a225
push 0x50
inc eax
push eax
lea ecx, [esp + 0x81e]
push ecx
call fcn.00458f80
push 0x50
lea edx, [esp + 0x4c0]
push str.newuser_kaseya.com
push edx
call fcn.00458f80
lea eax, [esp + 0x4c8]
push 0x2e
push eax
call fcn.004590c0
mov edi, eax
add esp, 0x20
cmp edi, esi
jne 0x429edb
lea ecx, [esp + 0x12c]
push str.Unable_to_locate_group_identifier_because_of_invalid_format._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x130]
push edx
mov dword [esp + 0x134], 1
call fcn.0043e010
add esp, 0xc
mov ebx, 0x4024
jmp 0x42a225
push 0x50
lea eax, [esp + 0x4b4]
push eax
lea ecx, [esp + 0x77c]
push ecx
mov byte [edi], 0
call fcn.00458f80
push 0x50
inc edi
lea edx, [esp + 0x7d5]
push edi
push edx
call fcn.00458f80
lea eax, [esp + 0x788]
push eax
push 0xc000000d
call fcn.00439e70
lea ecx, [esp + 0x887]
push ecx
push esi
call fcn.00439e70
push 0x50
lea edx, [esp + 0x8bf]
push 0x4cba18
push edx
call fcn.00458f80
push 0x27
lea eax, [esp + 0x8a3]
push 0x4cba9d
push eax
call fcn.00458f80
mov edx, dword [0x4cc450]
add esp, 0x40
push 0x174
lea ecx, [esp + 0x774]
push ecx
push edx
call fcn.004394c0
mov ebx, eax
add esp, 0xc
cmp ebx, esi
mov dword [esp + 0x14], ebx
je 0x429fb1
push ebx
push ebx
lea eax, [esp + 0x134]
push str.Unable_to_send_the_new_account_creation_request_to_the_server._Error__d__0x_08X__n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x138]
push ecx
mov dword [esp + 0x13c], 1
call fcn.0043e010
add esp, 0x14
mov dword [0x4cc44c], esi
jmp 0x42a229
mov ecx, dword [esp + 0x34]
push esi
push esi
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x4cc450]
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
call fcn.00427790
mov ebx, eax
add esp, 0x18
cmp ebx, esi
mov dword [esp + 0x14], ebx
je 0x42a015
push ebx
push ebx
lea eax, [esp + 0x134]
push str.Unable_to_get_the_new_account_information_from_the_server._Error__d__0x_08X__n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x138]
push ecx
mov dword [esp + 0x13c], 1
call fcn.0043e010
add esp, 0x14
mov dword [0x4cc44c], esi
jmp 0x42a229
mov eax, dword [esp + 0x18]
cmp eax, 0x95
jae 0x42a063
push eax
lea edx, [esp + 0x130]
push str.Unable_to_get_the_new_account_information_from_the_server._Received_too_few_bytes___d_._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x134]
push eax
mov dword [esp + 0x138], 1
call fcn.0043e010
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0045932f
add esp, 0x14
mov dword [0x4cc44c], esi
jmp 0x42a229
mov esi, dword [esp + 0x10]
push esi
call fcn.00439e40
lea edx, [esi + 4]
push edx
mov dword [esp + 0xb0], eax
call fcn.00439e40
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xac], edi
jne 0x42a1a6
cmp dword [esp + 0xa8], 0x50000007
jne 0x42a1a6
xor eax, eax
mov ecx, 0x14
mov edi, str.newuser_kaseya.com
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov dword [str.password], eax
xor ecx, ecx
mov dword [0x48658c], eax
mov dword [0x4cc0e4], ecx
mov dword [0x486590], eax
mov dword [0x4cc0e8], ecx
mov dword [0x486594], eax
mov dword [0x4cc0ec], ecx
mov dword [0x486598], eax
mov dword [0x4cc0f0], ecx
mov dword [0x48659c], eax
mov dword [0x4cc0f4], ecx
push 0x50
lea edx, [esi + 0x29]
mov dword [0x4865a0], eax
mov dword [0x4cc0f8], ecx
push edx
mov dword [0x4865a4], eax
mov word [0x4cc0fc], cx
push str.newuser_kaseya.com
mov byte [0x4865a8], al
mov byte [0x4cc0fe], cl
call fcn.00458f80
push 0x1a
lea eax, [esi + 0x7a]
push eax
push 0x4cc0e4
call fcn.00458f80
push 0x20
lea ecx, [esi + 8]
push ecx
push str.password
call fcn.00458f80
push str.password
push str.Password
push str._SERVER_COMMUNICATIONS_
call fcn.00427d80
push str.newuser_kaseya.com
push str.User_Name
push str._SERVER_COMMUNICATIONS_
call fcn.00427d80
push 0x4cc0e4
push str.Agent_Guid
push str._SERVER_COMMUNICATIONS_
call fcn.00427d80
mov edx, dword [0x4869c0]
add esp, 0x48
or edx, 1
push esi
mov dword [0x4869c0], edx
call fcn.0045932f
add esp, 4
call fcn.00415b20
xor esi, esi
jmp 0x42a229
push esi
call fcn.0045932f
push edi
push edi
lea edx, [esp + 0x138]
push str.Server_was_unable_to_create_account._Error__d__0x_08X_
push edx
call fcn.00458ee7
add esp, 0x14
cmp edi, 0x4046
lea edi, [esp + 0x12c]
jne 0x42a1ea
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42a1d3
mov ecx, 0xa
mov esi, str.___license_limit_exceeded_for_group_ID._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42a201
dec edi
jmp 0x42a1f0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42a1f0
mov ax, word [0x46b328]
mov word [edi], ax
lea ecx, [esp + 0x128]
push ecx
mov dword [esp + 0x12c], 1
call fcn.0043e010
mov ebx, dword [esp + 0xb0]
add esp, 4
xor esi, esi
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0xa4]
push edx
call fcn.0045932f
add esp, 4
cmp ebx, esi
je 0x42c4b8
cmp dword [esp + 0x14], 0x4018
jne 0x42a262
mov eax, dword [0x4cc434]
inc eax
mov dword [0x4cc434], eax
cdq
mov ecx, 0xa
idiv ecx
test edx, edx
jne 0x42a283
xor esi, esi
mov edi, dword [0x4869c0]
and edi, 0xfffffffe
push esi
mov dword [0x4869c0], edi
call fcn.0045a1c9
add esp, 4
mov dword [0x4cc430], eax
jmp 0x42a285
xor esi, esi
push 2
call fcn.00415aa0
mov edx, dword [0x4cc450]
push 1
push edx
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 0xc
mov dword [0x4cc450], esi
mov dword [0x4cc44c], esi
mov dword [0x486af4], 0xfffffff0
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, 1
je 0x42c4b8
mov eax, dword [0x4cc450]
push eax
mov dword [esp + 0x2c], 0
call fcn.00426ef0
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x554]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x558]
push 0x65
push edx
stosb byte es:[edi], al
call fcn.00401300
add esp, 0x10
test eax, eax
mov dword [esp + 0x20], eax
jne 0x42a337
mov al, byte [esp + 0x550]
test al, al
je 0x42a337
push 0x65
lea eax, [esp + 0x334]
push eax
lea ecx, [esp + 0x558]
push ecx
call fcn.0044ddd0
add esp, 0xc
jmp 0x42a33f
mov byte [esp + 0x330], 0
mov esi, str.____
lea eax, [esp + 0x330]
jmp 0x42a350
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42a378
test cl, cl
je 0x42a374
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42a378
add eax, 2
add esi, 2
test cl, cl
jne 0x42a350
xor eax, eax
jmp 0x42a37d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42a4c1
mov al, byte [esp + 0x330]
test al, al
je 0x42a3af
lea eax, [esp + 0x330]
push eax
lea ecx, [esp + 0x130]
push str.Username:__s_n
push ecx
call fcn.00458ee7
add esp, 0xc
jmp 0x42a3c4
lea edx, [esp + 0x12c]
push str.Username:__none__n
push edx
call fcn.00458ee7
add esp, 8
lea eax, [esp + 0x128]
mov ebx, 1
push eax
mov dword [esp + 0x12c], ebx
call fcn.0043e010
mov eax, dword [0x4cc488]
add esp, 4
test eax, eax
jne 0x42a4aa
mov edi, 0x4767b0
mov esi, 0x4cb838
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42a4a4
mov edi, 0x4767ac
mov esi, 0x4cb838
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x42a4a4
mov edi, 0x4767a8
mov esi, 0x4cb838
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42a4a4
push str.KaUsrTsk
call fcn.00447a40
add esp, 4
test eax, eax
je 0x42a4aa
mov eax, dword [esp + 0x28]
test eax, eax
je 0x42a4aa
mov al, byte [esp + 0x330]
test al, al
je 0x42a471
lea eax, [esp + 0x330]
push str.SYSTEM
push eax
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x42a4a4
push str.KaUsrTsk.exe
call fcn.00403b00
lea ecx, [esp + 0x130]
push str.Closing_KaUsrTsk.exe_because_it_was_installed_using_the_LAN_Watch_function_and_was_running_under_the_context_of_the_system._KaUsrTsk_will_restart_properly_under_the_context_of_the_user_the_next_time_someone_logs_off_and_back_in_to_Windows._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x134]
push edx
mov dword [esp + 0x138], ebx
call fcn.0043e010
add esp, 0x10
mov dword [0x4cc488], ebx
mov eax, dword [0x4cc44c]
test eax, eax
je 0x42a4c6
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42a4c6
mov dword [esp + 0x1c], ebx
jmp 0x42a4c6
mov ebx, 1
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x42a4f4
mov al, byte [esp + 0x330]
test al, al
je 0x42a4f4
xor eax, eax
jmp 0x42a4e0
mov cl, byte [esp + eax + 0x330]
mov byte [eax + str.____], cl
inc eax
test cl, cl
jne 0x42a4e0
jmp 0x42a4fb
mov byte [str.____], 0
xor eax, eax
mov ecx, 0x2b
lea edi, [esp + 0x5b8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 2
jne 0x42a531
mov ecx, dword [esp + 0x5b8]
mov edx, dword [esp + 0x660]
lea eax, [edx + ecx]
jmp 0x42a541
mov eax, dword [esp + 0x5b8]
mov ecx, dword [esp + 0x60c]
add eax, ecx
cmp eax, dword [0x4cc43c]
je 0x42a566
mov dword [0x4cc43c], eax
mov eax, dword [0x4cc44c]
test eax, eax
mov dword [ebp + 8], ebx
je 0x42a566
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42a566
mov dword [esp + 0x1c], ebx
mov al, byte [0x4cc0e4]
test al, al
jne 0x42a580
mov eax, str.newuser_kaseya.com
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a577
jmp 0x42a58f
mov eax, 0x4cc0e4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a588
sub eax, edx
inc eax
mov esi, 0xff
cmp eax, esi
mov dword [esp + 0x10], eax
jle 0x42a5a3
mov dword [esp + 0x10], esi
mov eax, 0x4cba18
lea edx, [eax + 1]
jmp 0x42a5b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a5b0
sub eax, edx
inc eax
cmp eax, esi
mov dword [esp + 0x14], eax
jle 0x42a5c6
mov dword [esp + 0x14], esi
mov eax, str.____
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a5d0
sub eax, edx
inc eax
cmp eax, esi
mov dword [esp + 0x2c], eax
jle 0x42a5e6
mov dword [esp + 0x2c], esi
mov eax, 0x4cba9d
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a5f0
sub eax, edx
inc eax
cmp eax, esi
mov dword [esp + 0x20], eax
jle 0x42a606
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add edx, eax
add edx, ebx
lea esi, [edx + ecx + 0x61]
push 1
push esi
mov dword [esp + 0x48], esi
call fcn.00459dd1
mov ebx, eax
xor edi, edi
add esp, 8
cmp ebx, edi
mov dword [esp + 0x44], ebx
jne 0x42a69d
push esi
lea edx, [esp + 0x130]
push str.Failed_to_allocate__d_bytes_of_memory_for_identity_message._Unable_to_checkin._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x134]
push eax
mov dword [esp + 0x138], 1
call fcn.0043e010
mov ecx, dword [0x4cc450]
push 1
push ecx
mov dword [0x4cc454], edi
call fcn.00439ba0
add esp, 0x18
mov dword [0x4cc450], edi
mov dword [0x4cc44c], edi
mov dword [0x486af4], 0xfffffff0
mov eax, 5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0xc000001c
call fcn.00439e70
mov dl, byte [esp + 0x18]
lea eax, [ebx + 5]
push eax
push 0x61
mov byte [ebx + 4], dl
call fcn.00439e70
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, 1
jle 0x42a6fa
mov ecx, dword [esp + 0x10]
mov al, byte [0x4cc0e4]
dec ecx
test al, al
lea edi, [ebx + 0x61]
jne 0x42a6e7
mov edx, ecx
shr ecx, 2
mov esi, str.newuser_kaseya.com
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x42a6f5
mov eax, ecx
shr ecx, 2
mov esi, 0x4cc0e4
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov cl, byte [esp + 0x14]
lea edx, [ebx + 0xa]
add esi, 0x61
push edx
push esi
mov dword [esp + 0x18], esi
mov byte [ebx + 9], cl
call fcn.00439e70
mov eax, dword [esp + 0x1c]
add esp, 8
cmp eax, 1
jle 0x42a741
mov ecx, eax
mov eax, dword [esp + 0x10]
dec ecx
mov edx, ecx
shr ecx, 2
mov esi, 0x4cba18
lea edi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, eax
add esi, dword [esp + 0x14]
mov al, byte [esp + 0x2c]
lea ecx, [ebx + 0xf]
push ecx
push esi
mov dword [esp + 0x18], esi
mov byte [ebx + 0xe], al
call fcn.00439e70
mov eax, dword [esp + 0x34]
add esp, 8
cmp eax, 1
jle 0x42a785
mov edx, dword [esp + 0x10]
mov ecx, eax
dec ecx
mov eax, ecx
shr ecx, 2
mov esi, str.____
lea edi, [edx + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov eax, dword [esp + 0x2c]
mov cl, byte [esp + 0x20]
lea edx, [ebx + 0x14]
add esi, eax
push edx
push esi
mov dword [esp + 0x18], esi
mov byte [ebx + 0x13], cl
call fcn.00439e70
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 1
jle 0x42a7cb
mov ecx, eax
mov eax, dword [esp + 0x10]
dec ecx
mov edx, ecx
shr ecx, 2
mov esi, 0x4cba9d
lea edi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, eax
mov al, byte [0x4cba6f]
mov edi, dword [esp + 0x20]
mov byte [ebx + 0x18], al
mov ecx, dword [0x4cba70]
lea edx, [esp + 0x104]
push edx
mov dword [ebx + 0x19], ecx
lea eax, [esp + 0x87]
push eax
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x7f]
push edx
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x8f]
push ecx
lea edx, [esp + 0xb8]
push edx
push str._d_c_d_c_d_c_d
add esi, edi
push 0x4cb848
mov dword [esp + 0x34], esi
call fcn.00458f3f
add esp, 0x24
cmp eax, 7
jne 0x42a872
cmp byte [esp + 0x7b], 0x2e
jne 0x42a872
cmp byte [esp + 0x73], 0x2e
jne 0x42a872
cmp byte [esp + 0x83], 0x2e
jne 0x42a872
mov al, byte [esp + 0xa0]
mov byte [ebx + 0x1d], al
mov cl, byte [esp + 0xf8]
mov byte [ebx + 0x1e], cl
mov dl, byte [esp + 0x100]
mov byte [ebx + 0x1f], dl
mov al, byte [esp + 0x104]
mov byte [ebx + 0x20], al
xor esi, esi
call fcn.00421b20
test eax, eax
je 0x42a882
mov esi, 1
mov eax, dword [0x4cc448]
test eax, eax
jne 0x42a88e
or esi, 2
cmp dword [0x4cc48c], esi
je 0x42a8af
mov eax, dword [0x4cc44c]
test eax, eax
je 0x42a8af
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42a8af
mov dword [esp + 0x1c], 1
lea ecx, [ebx + 0x21]
push ecx
push esi
mov dword [0x4cc48c], esi
call fcn.00439e70
mov eax, dword [0x4cc490]
add esp, 8
test eax, eax
je 0x42a926
mov ecx, dword [0x4cc44c]
test ecx, ecx
je 0x42a8fd
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x42a8fd
mov edx, dword [0x4cc494]
mov ecx, dword [esp + 0x40]
cmp edx, ecx
jne 0x42a8f5
mov edi, ebx
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42a8fd
mov dword [esp + 0x1c], 1
mov ecx, dword [0x4cc494]
cmp ecx, dword [esp + 0x40]
je 0x42a93c
push eax
call fcn.0045932f
add esp, 4
mov dword [0x4cc490], 0
mov dword [0x4cc494], 0
mov edx, dword [esp + 0x40]
push edx
call fcn.00459619
add esp, 4
test eax, eax
mov dword [0x4cc490], eax
je 0x42a95a
mov edx, dword [esp + 0x40]
mov ecx, edx
mov edi, eax
mov eax, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x4cc494], edx
call fcn.00428460
push 0
push 0
push 0
cdq
sub eax, edx
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0xa4]
push edx
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0xc4]
sar eax, 1
push edx
push eax
call fcn.00445bb0
mov esi, eax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0xfc]
push edx
mov dword [esp + 0x60], esi
call fcn.0042eb60
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd0]
mov edi, dword [esp + 0xd4]
add esp, 0x4c
test eax, eax
jne 0x42aa13
test ecx, ecx
jne 0x42aa13
test edx, edx
jne 0x42aa13
test edi, edi
je 0x42aa2b
push edi
push edx
push ecx
push eax
push str.Monitor_Set:_Log_entries_uploaded:_counter_d__service_d__process_d__snmp_d
call fcn.00432720
mov eax, dword [esp + 0xa0]
add esp, 0x14
test esi, esi
jne 0x42ad3a
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x9c]
mov ebx, dword [esp + 0x68]
test eax, eax
mov eax, dword [esp + 0x7c]
jle 0x42aa5a
mov esi, dword [esp + 0x54]
test esi, esi
je 0x42aa5a
test ebx, ebx
jg 0x42aac2
mov esi, dword [esp + 0x90]
test esi, esi
jle 0x42aa71
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x42aa71
test eax, eax
jg 0x42aac2
mov esi, dword [esp + 0x84]
test esi, esi
jle 0x42aa88
mov esi, dword [esp + 0x50]
test esi, esi
je 0x42aa88
test ecx, ecx
jg 0x42aac2
mov esi, dword [esp + 0x88]
test esi, esi
jle 0x42aa9f
mov esi, dword [esp + 0x48]
test esi, esi
je 0x42aa9f
test edx, edx
jg 0x42aac2
mov esi, dword [esp + 0xb4]
test esi, esi
jle 0x42ad3a
mov esi, dword [esp + 0x74]
test esi, esi
je 0x42ad3a
test edi, edi
jle 0x42ad3a
mov esi, dword [esp + 0x40]
add edi, esi
add edi, edx
add edi, ecx
add edi, eax
push 1
add edi, ebx
push edi
call fcn.00459dd1
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42ad0c
mov eax, esi
mov esi, dword [esp + 0x44]
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x9c]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x68]
add edx, ecx
mov ecx, dword [esp + 0x7c]
add edx, esi
add edx, ecx
mov ecx, dword [esp + 0x8c]
add edx, edi
add eax, edx
mov dword [esp + 0x40], eax
lea eax, [ebx + 0x25]
push eax
push ecx
call fcn.00439e70
mov eax, dword [esp + 0x70]
lea edx, [ebx + 0x2d]
push edx
push eax
call fcn.00439e70
mov edx, dword [esp + 0x20]
lea ecx, [ebx + 0x29]
push ecx
push edx
call fcn.00439e70
mov ecx, dword [esp + 0x80]
add esp, 0x18
test ecx, ecx
jle 0x42ab7a
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x54]
mov edx, ecx
shr ecx, 2
lea edi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x68]
mov esi, dword [esp + 0x10]
add esi, ecx
mov ecx, dword [esp + 0x90]
lea eax, [ebx + 0x31]
push eax
push ecx
mov dword [esp + 0x18], esi
call fcn.00439e70
mov eax, dword [esp + 0x84]
lea edx, [ebx + 0x39]
push edx
push eax
call fcn.00439e70
lea ecx, [ebx + 0x35]
push ecx
push esi
call fcn.00439e70
mov ecx, dword [esp + 0x94]
add esp, 0x18
test ecx, ecx
jle 0x42abdb
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x4c]
mov eax, ecx
shr ecx, 2
lea edi, [edx + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x7c]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
add esi, ecx
lea ecx, [ebx + 0x3d]
push ecx
push edx
mov dword [esp + 0x18], esi
call fcn.00439e70
mov ecx, dword [esp + 0x60]
lea eax, [ebx + 0x45]
push eax
push ecx
call fcn.00439e70
lea edx, [ebx + 0x41]
push edx
push esi
call fcn.00439e70
mov ecx, dword [esp + 0x70]
add esp, 0x18
test ecx, ecx
jle 0x42ac36
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x50]
mov edx, ecx
shr ecx, 2
lea edi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x58]
mov esi, dword [esp + 0x10]
add esi, ecx
mov ecx, dword [esp + 0x88]
lea eax, [ebx + 0x49]
push eax
push ecx
mov dword [esp + 0x18], esi
call fcn.00439e70
mov eax, dword [esp + 0x74]
lea edx, [ebx + 0x51]
push edx
push eax
call fcn.00439e70
lea ecx, [ebx + 0x4d]
push ecx
push esi
call fcn.00439e70
mov ecx, dword [esp + 0x84]
add esp, 0x18
test ecx, ecx
jle 0x42ac94
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x48]
mov eax, ecx
shr ecx, 2
lea edi, [edx + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xb4]
add esi, ecx
lea ecx, [ebx + 0x55]
push ecx
push edx
mov dword [esp + 0x18], esi
call fcn.00439e70
mov ecx, dword [esp + 0xa4]
lea eax, [ebx + 0x5d]
push eax
push ecx
call fcn.00439e70
lea edx, [ebx + 0x59]
push edx
push esi
call fcn.00439e70
mov ecx, dword [esp + 0xb4]
add esp, 0x18
test ecx, ecx
jle 0x42acf1
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x74]
mov edx, ecx
shr ecx, 2
lea edi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x4cc44c]
test eax, eax
je 0x42ad3e
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42ad3e
mov dword [esp + 0x1c], 1
jmp 0x42ad3e
push esi
lea eax, [esp + 0x130]
push str.Failed_to_allocate__d_bytes_to_send_monitor_data_with_identity_message._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x134]
push ecx
mov dword [esp + 0x138], 1
call fcn.0043e010
add esp, 0x10
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x54]
xor edi, edi
cmp eax, edi
je 0x42ad55
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x54], edi
mov eax, dword [esp + 0x4c]
cmp eax, edi
je 0x42ad6a
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x50]
cmp eax, edi
je 0x42ad7f
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x50], edi
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x42ad94
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x48], edi
mov eax, dword [esp + 0x74]
cmp eax, edi
je 0x42ada9
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x74], edi
cmp dword [esp + 0x1c], edi
je 0x42c48f
cmp dword [0x4cc448], edi
mov eax, dword [esp + 0x40]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], edi
mov esi, ebx
mov dword [esp + 0x20], eax
jne 0x42ae31
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push ecx
push eax
push ebx
call fcn.00431f20
add esp, 0x10
cmp eax, edi
jne 0x42adf9
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x42ae03
mov edx, dword [esp + 0x1c]
mov esi, ecx
mov dword [esp + 0x20], edx
jmp 0x42ae31
cmp eax, 0xffffffff
je 0x42ae31
cmp eax, 0xfffffffb
je 0x42ae31
push eax
lea eax, [esp + 0x130]
push str.Data_are_not_compressed._Proceed_with_no_compression._Code:__d_n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x134]
push ecx
mov dword [esp + 0x138], 1
call fcn.0043e010
add esp, 0x10
cmp dword [0x486af4], edi
mov edx, dword [esp + 0x20]
jl 0x42ae52
push 0x20
push 0x4cb818
push edx
push esi
call fcn.00431d40
add esp, 0x10
xor edi, edi
jmp 0x42ae6b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
mov eax, esi
call fcn.00427270
mov edi, dword [esp + 0x30]
add esp, 0xc
lea eax, [esp + 0xf4]
push eax
call fcn.0045a1c9
add esp, 4
test edi, edi
je 0x42aea2
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4cc450]
push ecx
push edi
push edx
call fcn.004394c0
mov esi, eax
push edi
mov dword [esp + 0x24], esi
call fcn.0045932f
add esp, 0x10
jmp 0x42aebd
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4cc450]
push eax
push esi
push ecx
call fcn.004394c0
mov esi, eax
add esp, 0xc
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x2c]
xor edi, edi
cmp eax, edi
je 0x42aed0
push eax
call fcn.0045932f
add esp, 4
cmp ebx, edi
je 0x42aee3
cmp ebx, dword [esp + 0x44]
je 0x42aee3
push ebx
call fcn.0045932f
add esp, 4
mov edx, dword [esp + 0x44]
push edx
call fcn.0045932f
push 1
call fcn.0043f1f0
push 1
call fcn.0043f220
push 1
call fcn.0043f250
push 1
call fcn.0043f280
add esp, 0x14
cmp esi, edi
jne 0x42c470
cmp dword [0x486af4], edi
mov dword [esp + 0x10], edi
jl 0x42af3e
mov edx, dword [esp + 0x34]
push 0x20
push 0x4cb818
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x4cc450]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
jmp 0x42af56
mov eax, dword [esp + 0x34]
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [0x4cc450]
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
call fcn.00427790
add esp, 0x18
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x42c45f
cmp dword [esp + 0x18], 0x2c
jb 0x42c45f
lea edx, [esp + 0xfc]
push edx
call fcn.0045a1c9
mov ecx, dword [esp + 0x100]
mov esi, dword [esp + 0xf8]
mov eax, dword [0x4cc4b4]
sub ecx, esi
mov dword [eax*4 + 0x486b60], ecx
inc eax
cdq
mov ecx, 3
idiv ecx
mov edi, dword [esp + 0x14]
push edi
mov dword [0x4cc4b4], edx
call fcn.00439e40
lea edx, [edi + 4]
push edx
mov esi, eax
call fcn.00439e40
mov ebx, eax
lea eax, [edi + 8]
push eax
call fcn.00439e40
add esp, 0x10
cmp esi, 0x50000001
mov dword [esp + 0x24], eax
jne 0x42c32a
cmp ebx, 0x4004
je 0x42affc
cmp ebx, 0x402f
je 0x42affc
cmp ebx, 0x4046
jne 0x42b2ac
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
mov dword [0x4cc44c], esi
push edi
jne 0x42b044
call fcn.0045932f
push 2
call fcn.00415aa0
add esp, 8
cmp ebx, 0x402f
jne 0x42b028
call fcn.00429060
mov eax, dword [0x4cc44c]
test eax, eax
jne 0x42c401
lea edx, [esp + 0x30]
push edx
push 0xc00000ff
jmp 0x42c40b
call fcn.0045932f
push 0x4cc0e4
push str.password
lea ecx, [esp + 0x8f4]
push ecx
lea edx, [esp + 0x410]
push edx
call fcn.0044dfb0
add esp, 0x14
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x42b0b9
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x400]
push eax
call fcn.0044dfc0
push 0x4cc0e4
push str.password
lea ecx, [esp + 0x8f4]
push ecx
lea edx, [esp + 0x410]
push edx
call fcn.0044dfb0
add esp, 0x14
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x42b269
movzx ecx, word [esp + 0x60]
lea eax, [esp + 0x95d]
push eax
push ecx
call fcn.00439e70
mov eax, dword [esp + 0x40]
add esp, 8
cmp eax, esi
je 0x42b227
push 0x101
push eax
lea edx, [esp + 0x989]
push edx
call fcn.00458f80
mov eax, dword [0x486af4]
add esp, 0xc
cmp eax, esi
jl 0x42b116
push 0x20
push 0x4cb818
lea eax, [esp + 0x8f0]
push 0x19a
push eax
call fcn.00431d40
add esp, 0x10
mov edx, dword [0x4cc450]
push 0x19a
lea ecx, [esp + 0x8ec]
push ecx
push edx
call fcn.004394c0
add esp, 0xc
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x42b297
cmp dword [0x486af4], esi
mov dword [esp + 0x10], esi
jl 0x42b168
mov edx, dword [esp + 0x34]
push 0x20
push 0x4cb818
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x4cc450]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
jmp 0x42b180
mov eax, dword [esp + 0x34]
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [0x4cc450]
lea edx, [esp + 0x1c]
push edx
push eax
push ecx
call fcn.00427790
add esp, 0x18
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x42b1fd
cmp dword [esp + 0x18], 0x2c
jb 0x42b1fd
mov esi, dword [esp + 0x10]
push esi
call fcn.00439e40
add esp, 4
cmp eax, 0x50000006
jne 0x42b1df
push 0
lea edx, [esp + 0x130]
push str.Kaseya_Server_Agent_registered_with_update_server._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x134]
push eax
mov dword [esp + 0x138], 1
call fcn.0043e010
add esp, 0x10
call fcn.00415b20
push esi
call fcn.0045932f
lea edx, [esp + 0x404]
add esp, 4
push edx
call fcn.0044dfc0
add esp, 4
jmp 0x42b028
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x42b297
push eax
call fcn.0045932f
lea edx, [esp + 0x404]
add esp, 4
push edx
call fcn.0044dfc0
add esp, 4
jmp 0x42b028
lea ecx, [esp + 0x12c]
push str.Kaseya_Server_Agent_is_missing_server_ip_addresses_in_its_KaseyaD.ini_file._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x130]
push edx
mov dword [esp + 0x134], 1
call fcn.0043e010
lea edx, [esp + 0x40c]
add esp, 0xc
push edx
call fcn.0044dfc0
add esp, 4
jmp 0x42b028
push eax
lea eax, [esp + 0x130]
push str.Kaseya_Server_Agent_registration_failed_with_error_0x_04X._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x134]
push ecx
mov dword [esp + 0x138], 1
call fcn.0043e010
add esp, 0x10
lea edx, [esp + 0x400]
push edx
call fcn.0044dfc0
add esp, 4
jmp 0x42b028
test ebx, ebx
jne 0x42c32a
mov esi, dword [esp + 0x24]
cmp esi, 0xffffffff
je 0x42c32e
mov eax, dword [ebp + 8]
test eax, eax
jne 0x42b2d1
cmp esi, 1
jne 0x42c32e
xor eax, eax
mov dl, byte [edi + eax + 0xc]
mov cl, byte [eax + 0x486564]
xor cl, dl
mov dl, byte [eax + str.password]
mov byte [esp + eax + 0x108], cl
xor dl, byte [edi + eax + 0xc]
mov byte [esp + eax + 0x398], dl
mov cl, byte [edi + eax + 0xc]
mov byte [esp + eax + 0x448], cl
inc eax
cmp eax, 0x20
jl 0x42b2d3
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x10c]
push 0x20
push eax
call fcn.00431910
push edi
call fcn.0045932f
add esp, 0x10
cmp esi, 1
je 0x42b36c
mov eax, dword [0x486af4]
test eax, eax
jl 0x42b36c
lea ecx, [esp + 0x24]
push ecx
call fcn.0045a1c9
mov eax, dword [esp + 0x28]
mov esi, dword [0x4cc460]
mov edx, eax
sub edx, esi
add esp, 4
cmp edx, 0xe10
jle 0x42b36c
mov dword [0x4cc460], eax
mov eax, dword [0x4cc450]
push eax
call fcn.00429120
add esp, 4
cmp dword [0x4869d4], 0xffffffff
jne 0x42b402
xor ecx, ecx
mov dword [0x4cc4b8], ecx
mov dword [0x4cc4bc], ecx
lea edx, [esp + 0x98]
push edx
mov dword [0x4cc4c0], ecx
mov dword [0x4cc4c4], ecx
push 0x4869d4
push 0x4cc4b8
mov dword [0x4cc4c8], ecx
call fcn.0044d4b0
add esp, 0xc
test eax, eax
mov dword [esp + 0x14], eax
je 0x42b3e2
xor eax, eax
mov dword [0x4cc4b8], eax
mov dword [0x4cc4bc], eax
mov dword [0x4cc4c0], eax
mov dword [0x4cc4c4], eax
mov dword [0x4869d4], 0
mov dword [0x4cc4c8], eax
jmp 0x42b402
mov eax, dword [esp + 0x98]
test eax, eax
je 0x42b402
cmp byte [eax], 0
je 0x42b402
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b3f5
sub eax, edx
mov dword [esp + 0x3c], eax
mov esi, dword [esp + 0x3c]
add esi, 0x1b2
push esi
mov dword [esp + 0x28], esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42c118
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x42b47b
lea eax, [ebx + 0x1a4]
push eax
push 0x1b1
call fcn.00439e70
mov edx, dword [esp + 0x44]
lea ecx, [ebx + 0x1a8]
push ecx
push edx
call fcn.00439e70
mov ecx, dword [esp + 0xa8]
add esp, 0x10
lea edx, [ebx + 0x1b1]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42b471
push ebx
push 0xc000001f
call fcn.00439e70
mov ecx, dword [esp + 0xc0]
lea eax, [ebx + 4]
mov dword [eax], ecx
mov edx, dword [esp + 0xc4]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0xc8]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0xcc]
mov dword [eax + 0xc], edx
mov ecx, dword [esp + 0xd0]
mov dword [eax + 0x10], ecx
mov eax, dword [esp + 0xe8]
lea edx, [ebx + 0x18]
mov dword [edx], eax
mov ecx, dword [esp + 0xec]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0xf0]
mov dword [edx + 8], eax
mov ecx, dword [esp + 0xf4]
mov dword [edx + 0xc], ecx
mov eax, dword [esp + 0xf8]
mov dword [edx + 0x10], eax
mov cl, byte [0x4cba69]
mov byte [ebx + 0x2c], cl
mov dl, byte [0x4cba6a]
mov byte [ebx + 0x2d], dl
mov eax, dword [0x4cba6b]
mov dword [ebx + 0x2e], eax
mov cl, byte [0x4cba74]
mov byte [ebx + 0x32], cl
mov edx, dword [0x4cba75]
mov dword [ebx + 0x33], edx
mov al, byte [0x4cba79]
mov byte [ebx + 0x37], al
mov ecx, dword [0x4cba7a]
mov dword [ebx + 0x38], ecx
mov dl, byte [0x4cba7e]
mov byte [ebx + 0x3c], dl
mov eax, dword [0x4cba7f]
mov dword [ebx + 0x3d], eax
mov cl, byte [0x4cba83]
mov byte [ebx + 0x41], cl
mov edx, dword [0x4cba84]
mov dword [ebx + 0x42], edx
mov al, byte [0x4cba88]
mov byte [ebx + 0x46], al
mov ecx, dword [0x4cba89]
mov dword [ebx + 0x47], ecx
mov dl, byte [0x4cba8d]
mov byte [ebx + 0x4b], dl
mov eax, dword [0x4cba8e]
mov dword [ebx + 0x4c], eax
mov cl, byte [0x4cba92]
mov byte [ebx + 0x50], cl
mov dl, byte [0x4cba93]
mov byte [ebx + 0x51], dl
mov eax, dword [0x4cba94]
mov dword [ebx + 0x52], eax
mov cl, byte [0x4cba98]
mov byte [ebx + 0x56], cl
mov edx, dword [0x4cba99]
mov dword [ebx + 0x57], edx
mov eax, dword [0x4cb974]
mov dword [ebx + 0x5b], eax
mov ecx, dword [0x4cb978]
mov dword [ebx + 0x5f], ecx
mov edx, dword [0x4cb97c]
push 0x83
mov dword [ebx + 0x63], edx
mov eax, dword [0x4cb980]
lea ecx, [ebx + 0x6b]
push 0x4cb988
push ecx
mov dword [ebx + 0x67], eax
call fcn.00458f80
push 8
push 0x4cb838
lea edx, [ebx + 0xef]
push edx
call fcn.00458f80
push 0x8b
lea eax, [ebx + 0xf7]
push 0x4cb8c8
push eax
call fcn.00458f80
mov ecx, dword [0x4cba0c]
mov dword [ebx + 0x19c], ecx
mov ecx, dword [0x4cc43c]
mov edx, dword [0x4cba10]
lea eax, [ebx + 0x183]
push eax
push ecx
mov dword [ebx + 0x1a0], edx
call fcn.00439e70
mov eax, dword [0x4869d4]
xor edi, edi
add esp, 0x34
cmp eax, edi
jge 0x42b63c
mov byte [ebx + 0x187], 0
jmp 0x42b658
push 0x13
lea edx, [ebx + 0x188]
push 0x4cc4b8
push edx
mov byte [ebx + 0x187], al
call fcn.00458f80
add esp, 0xc
mov byte [ebx + 0x1ac], 0xff
cmp dword [0x4cc470], edi
je 0x42b68e
mov al, byte [0x4cc464]
mov dword [0x4cc470], edi
lea ecx, [ebx + 0x1ad]
mov byte [ebx + 0x1ac], al
mov edx, dword [0x4cc468]
push ecx
push edx
call fcn.00439e70
add esp, 8
cmp dword [0x486af4], edi
jl 0x42b6a7
mov eax, dword [0x4cc450]
push 0x20
push 0x4cb818
push esi
push ebx
push eax
jmp 0x42b6b2
mov ecx, dword [0x4cc450]
push edi
push edi
push esi
push ebx
push ecx
call fcn.004276b0
add esp, 0x14
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x42c0ff
mov ecx, dword [esp + 0x34]
push edi
push edi
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x4cc450]
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
mov dword [esp + 0x28], edi
call fcn.00427790
add esp, 0x18
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x42c0ee
cmp dword [esp + 0x18], 0xc
jb 0x42c0ee
mov eax, dword [esp + 0x10]
add eax, 4
push eax
call fcn.00439e40
add esp, 4
cmp eax, 0x4005
mov dword [esp + 0x20], eax
je 0x42b7f0
cmp eax, 0x402f
je 0x42b7f0
cmp eax, 0x4002
jne 0x42b7d6
mov eax, dword [0x4cc4a8]
cmp eax, 1
jge 0x42b7c7
lea ecx, [esp + 0x12c]
inc eax
push 0x476490
push ecx
mov dword [0x4cc4a8], eax
call fcn.00458ee7
mov edx, dword [esp + 0x40]
add esp, 8
cmp edx, edi
je 0x42b790
lea eax, [esp + 0x12c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b771
push edx
sub eax, esi
lea edx, [esp + eax + 0x130]
push 0x47648c
push edx
call fcn.00458ee7
add esp, 0xc
lea edi, [esp + 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42b798
lea eax, [esp + 0x128]
mov ecx, 0xf
mov esi, str.rejected_authentication_message_due_to_unexpected_content._n
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [esp + 0x12c], 1
call fcn.0043e010
add esp, 4
mov dword [0x486af4], 0xfffffffc
jmp 0x42baa7
mov dword [0x486af4], 0
mov dword [esp + 0xd0], 1
jmp 0x42b90e
lea ecx, [esp + 0x12c]
push str.Agent_retrying_authentication_to_KServer._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x130]
push edx
mov dword [esp + 0x134], 1
call fcn.0043e010
lea eax, [esp + 0xc4]
push eax
mov ecx, 8
lea esi, [esp + 0x3a8]
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x3a8]
push 0x20
push ecx
call fcn.00431910
mov edx, dword [esp + 0xd0]
mov dword [ebx + 4], edx
mov eax, dword [esp + 0xd4]
mov dword [ebx + 8], eax
mov ecx, dword [esp + 0xd8]
mov dword [ebx + 0xc], ecx
mov edx, dword [esp + 0xdc]
mov ecx, dword [esp + 0x3c]
xor esi, esi
push esi
mov dword [ebx + 0x10], edx
mov eax, dword [esp + 0xe4]
push esi
push ecx
mov dword [ebx + 0x14], eax
mov edx, dword [0x4cc450]
push ebx
push edx
call fcn.004276b0
add esp, 0x2c
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x42b984
mov eax, dword [esp + 0x10]
push eax
call fcn.0045932f
mov eax, dword [esp + 0x38]
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [0x4cc450]
lea edx, [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x2c], esi
call fcn.00427790
add esp, 0x1c
cmp eax, esi
mov dword [esp + 0x14], eax
jne 0x42b95a
cmp dword [esp + 0x18], 0xc
jb 0x42b95a
mov edi, dword [esp + 0x10]
lea edx, [edi + 4]
push edx
call fcn.00439e40
mov esi, eax
add esp, 4
cmp esi, 0x4005
mov dword [esp + 0x20], esi
je 0x42b92a
cmp esi, 0x402f
je 0x42b92a
mov dword [0x486af4], 1
mov ecx, 8
lea esi, [esp + 0x108]
mov edi, 0x4cb818
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
jmp 0x42b9af
push 3
call fcn.00415aa0
add esp, 4
cmp esi, 0x402f
mov dword [0x4cc4ac], 1
jne 0x42b94b
call fcn.00429060
mov dword [0x486af4], 0xffffffff
jmp 0x42baab
mov edi, dword [esp + 0x10]
cmp edi, esi
je 0x42b971
push edi
call fcn.0045932f
add esp, 4
xor edi, edi
mov dword [esp + 0x10], edi
push 8
mov dword [0x486af4], 0xfffffffe
call fcn.00415aa0
jmp 0x42b999
push 8
mov dword [0x486af4], 0xfffffffd
call fcn.00415aa0
mov edi, dword [esp + 0x14]
mov eax, dword [0x486af4]
add esp, 4
cmp eax, esi
mov dword [0x4cc44c], esi
jl 0x42baab
mov esi, dword [esp + 0x38]
test esi, esi
je 0x42baab
cmp word [esp + 0x60], 0
je 0x42baab
cmp esi, 0x4cbee0
je 0x42baab
cmp esi, 0x4cbfe0
je 0x42baab
push 0x4cbfe0
push esi
call fcn.0045ba9a
add esp, 8
test eax, eax
je 0x42ba03
push 0x4cbee0
push esi
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x42ba15
mov ax, word [esp + 0x60]
cmp ax, word [0x4cc0e0]
je 0x42baab
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x6b]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x6b]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x86]
push eax
lea ecx, [esp + 0x4c]
push ecx
push str._d_c_d_c_d_c_d
push esi
call fcn.00458f3f
add esp, 0x24
cmp eax, 7
jl 0x42ba75
cmp byte [esp + 0x72], 0x2e
jne 0x42ba75
cmp byte [esp + 0x5f], 0x2e
jne 0x42ba75
cmp byte [esp + 0x67], 0x2e
jne 0x42ba75
push 0xff
push esi
mov edi, 0x4cbfe0
push 0x4cbee0
jmp 0x42ba85
push 0xff
push esi
mov edi, 0x4cbee0
push 0x4cbfe0
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
call fcn.00458f80
mov dx, word [esp + 0x6c]
add esp, 0xc
mov word [0x4cc0e0], dx
call fcn.00421c70
mov edi, dword [esp + 0x10]
test edi, edi
je 0x42be12
mov eax, dword [0x486af4]
test eax, eax
jl 0x42bad1
mov eax, dword [esp + 0x18]
push 0x20
push 0x4cb818
push eax
push edi
call fcn.00431d40
add esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x40]
push edx
push eax
xor esi, esi
push edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x34], esi
call fcn.00432040
add esp, 0x10
cmp eax, esi
jne 0x42bb10
cmp dword [esp + 0x3c], esi
je 0x42bb15
push edi
call fcn.0045932f
mov edi, dword [esp + 0x40]
add esp, 4
mov dword [esp + 0x10], edi
jmp 0x42bb43
cmp eax, 0xffffffff
je 0x42bb43
push eax
lea ecx, [esp + 0xda0]
push str.Data_decompression_failed_with_error__d_n
push ecx
call fcn.00458ee7
lea edx, [esp + 0xda4]
push edx
mov dword [esp + 0xda8], 1
call fcn.0043e010
add esp, 0x10
push edi
call fcn.00439e40
add esp, 4
cmp eax, 0x50000002
je 0x42bb6d
mov ecx, dword [0x486af4]
xor eax, eax
cmp ecx, esi
setge al
lea eax, [eax + eax - 3]
mov dword [esp + 0x14], eax
jmp 0x42be09
lea ecx, [edi + 4]
push ecx
call fcn.00439e40
add esp, 4
cmp eax, esi
mov dword [esp + 0x20], eax
je 0x42bb8e
mov dword [esp + 0x14], 0xfffffffe
jmp 0x42be09
add edi, 8
push edi
call fcn.00439e40
add esp, 4
cmp eax, esi
mov dword [esp + 0xa8], eax
jne 0x42bbb3
mov dword [esp + 0x14], esi
mov esi, 1
jmp 0x42bdfe
mov edx, dword [esp + 0x10]
push 0
push 0
push 3
push eax
add edx, 0xc
mov esi, 1
push edx
lea eax, [esp + 0xa9c]
mov dword [esp + 0x28], esi
call fcn.004239f0
xor eax, eax
mov ecx, 0x200
lea edi, [esp + 0xfb4]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0xfb4]
push eax
push str.AgentPassword
push str._SERVER_COMMUNICATIONS_
call fcn.00427b80
mov al, byte [esp + 0xfc0]
add esp, 0x20
test al, al
je 0x42bcd3
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x3b8]
rep stosd dword es:[edi], eax
push 0x20
lea ecx, [esp + 0x3bc]
push ecx
push 0x486564
stosb byte es:[edi], al
call fcn.00439f40
lea edx, [esp + 0xfac]
push edx
lea eax, [esp + 0x3c8]
push eax
call fcn.0045ba9a
add esp, 0x14
test eax, eax
je 0x42bc59
mov dword [esp + 0xac], esi
xor ecx, ecx
mov dword [0x486564], ecx
mov dword [0x486568], ecx
mov dword [0x48656c], ecx
mov dword [0x486570], ecx
mov dword [0x486574], ecx
mov dword [0x486578], ecx
mov dword [0x48657c], ecx
mov dword [0x486580], ecx
lea eax, [esp + 0xfa0]
mov byte [0x486584], cl
lea edx, [eax + 1]
jmp 0x42bca0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bca0
sub eax, edx
shr eax, 1
mov edi, eax
cmp edi, 0x20
jle 0x42bcb7
mov edi, 0x20
push edi
lea edx, [esp + 0xfa4]
push 0x486564
push edx
call fcn.00439e90
add esp, 0xc
mov dword [0x4cc100], edi
mov eax, dword [0x4cc44c]
test eax, eax
je 0x42bda6
xor eax, eax
mov ecx, 0x200
lea edi, [esp + 0x1fa8]
rep stosd dword es:[edi], eax
mov ecx, 0x200
lea edi, [esp + 0x17a8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1fa8]
push eax
push str.Server_Name
push str._SERVER_COMMUNICATIONS_
call fcn.00427b80
lea ecx, [esp + 0x17b4]
push ecx
push str.Server_Port
push str._SERVER_COMMUNICATIONS_
call fcn.00427b80
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x17c4]
push 0x4696c0
push eax
call fcn.00458f3f
add esp, 0x24
cmp eax, esi
je 0x42bd58
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0x1fa8]
push 0x4cbfe0
push ecx
call fcn.0045ba9a
add esp, 8
test eax, eax
je 0x42bd8a
lea edx, [esp + 0x1fa8]
push 0x4cbee0
push edx
call fcn.0045ba9a
add esp, 8
test eax, eax
jne 0x42bd9b
mov ax, word [esp + 0xcc]
cmp ax, word [0x4cc0e0]
je 0x42bda6
mov dword [esp + 0x94], 4
call fcn.00415a50
mov eax, dword [0x4cd608]
test eax, eax
jne 0x42bdfe
push str..pipekaseyaUser
call fcn.00448a30
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x42bdfe
xor eax, eax
push eax
push eax
push eax
lea ecx, [esp + 0xe0]
push ecx
push edi
mov dword [esp + 0xe8], 0x3f0
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
call fcn.00448ad0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xa4], esi
push edi
call fcn.0045932f
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x42c10f
xor esi, esi
push esi
mov dword [0x4cc4ac], esi
call fcn.00415a90
push esi
call fcn.00415aa0
mov eax, dword [0x4865b4]
add esp, 8
cmp eax, 0x708
push 0x20
push 0x4cb818
jge 0x42be56
mov edx, dword [0x4cc450]
push 0x708
push edx
jmp 0x42be5d
push eax
mov eax, dword [0x4cc450]
push eax
call fcn.00413db0
mov ecx, dword [0x4cc450]
add esp, 0x10
push ecx
lea ecx, [esp + 0xa8c]
call fcn.00428b50
mov edx, dword [0x4cc450]
push edx
call fcn.00428fb0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x670]
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [esp + 0xb98]
push 0x1ff
rep stosd dword es:[edi], eax
lea eax, [esp + 0xba0]
push 0x4cc328
push eax
call fcn.00458f80
mov al, byte [esp + 0xba8]
add esp, 0x14
test al, al
mov dword [esp + 0xb90], 2
je 0x42bef1
push 0x103
lea ecx, [esp + 0xb98]
push ecx
lea edx, [esp + 0x670]
push edx
call fcn.00458f80
add esp, 0xc
jmp 0x42bf0a
mov eax, dword [str.c:_temp]
mov ecx, dword [0x47335c]
mov dword [esp + 0x668], eax
mov dword [esp + 0x66c], ecx
lea eax, [esp + 0x668]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bf14
sub eax, edx
cmp byte [esp + eax + 0x667], 0x5c
je 0x42bf42
lea edi, [esp + 0x668]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42bf30
mov dx, word [0x469b10]
mov word [edi], dx
lea edi, [esp + 0x668]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42bf50
mov eax, dword [str.kMonitorSets]
mov ecx, dword [0x476418]
mov edx, dword [0x47641c]
mov dword [edi], eax
mov al, byte [0x476420]
mov dword [edi + 4], ecx
lea ecx, [esp + 0x668]
mov dword [edi + 8], edx
push str..xml
push ecx
mov byte [edi + 0xc], al
call fcn.004458b0
add esp, 8
cmp eax, esi
mov dword [esp + 0x14], eax
jle 0x42c0cf
call fcn.00428460
push esi
push esi
push esi
cdq
sub eax, edx
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0xa0]
push edx
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0xbc]
push edx
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0xc4]
sar eax, 1
push ecx
push eax
call fcn.00445bb0
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xc4]
mov edi, dword [esp + 0xc8]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xcc]
add esp, 0x40
cmp eax, esi
jne 0x42c031
cmp ecx, esi
jne 0x42c031
cmp edx, esi
jne 0x42c031
cmp edi, esi
je 0x42c042
push edi
push edx
push ecx
push eax
push str.Monitor_Set:_Log_entries_uploaded:_counter_d__service_d__process_d__snmp_d
call fcn.00432720
add esp, 0x14
mov eax, dword [esp + 0x54]
cmp eax, esi
je 0x42c057
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x54], esi
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x42c06c
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x4c], esi
mov eax, dword [esp + 0x50]
cmp eax, esi
je 0x42c081
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x50], esi
mov eax, dword [esp + 0x48]
cmp eax, esi
je 0x42c096
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x48], esi
mov eax, dword [esp + 0x74]
cmp eax, esi
je 0x42c0ab
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x74], esi
push 1
call fcn.0043f1f0
push 1
call fcn.0043f220
push 1
call fcn.0043f250
push 1
call fcn.0043f280
add esp, 0x10
call fcn.00444660
mov ecx, dword [esp + 0x94]
mov edx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, 1
setle al
mov dword [edx], 1
mov dword [0x4cc44c], eax
jmp 0x42c10f
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x42c0ff
push eax
call fcn.0045932f
add esp, 4
push 8
call fcn.00415aa0
add esp, 4
mov dword [0x4cc44c], edi
push ebx
call fcn.0045932f
add esp, 4
mov eax, dword [esp + 0x98]
test eax, eax
je 0x42c137
push eax
call fcn.0045932f
add esp, 4
mov dword [esp + 0x98], 0
mov eax, dword [0x4cc44c]
test eax, eax
jne 0x42c14c
lea ecx, [esp + 0x30]
push ecx
push 0xc00000ff
jmp 0x42c156
lea edx, [esp + 0x30]
push edx
push 0xc00000cc
call fcn.00439e70
mov eax, dword [0x486af4]
add esp, 8
test eax, eax
jl 0x42c17d
push 0x20
push 0x4cb818
lea eax, [esp + 0x38]
push 4
push eax
call fcn.00431d40
add esp, 0x10
mov edx, dword [0x4cc450]
push 4
lea ecx, [esp + 0x34]
push ecx
push edx
call fcn.004394c0
mov ecx, dword [esp + 0xdc]
mov eax, 1
add esp, 0xc
cmp ecx, eax
jne 0x42c4b8
cmp dword [esp + 0xa4], eax
jne 0x42c4b8
mov eax, dword [esp + 0xac]
test eax, eax
jne 0x42c4b8
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x468]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x508]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x3b8]
rep stosd dword es:[edi], eax
push 0x20
lea ecx, [esp + 0x50c]
push ecx
lea edx, [esp + 0x450]
push edx
stosb byte es:[edi], al
call fcn.00439f40
push 0x20
lea eax, [esp + 0x3c8]
push eax
push 0x486564
call fcn.00439f40
lea ecx, [esp + 0x480]
push ecx
push 0x40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x52c]
push eax
call fcn.00439fa0
add esp, 0x28
test eax, eax
jne 0x42c4b8
xor ecx, ecx
mov dword [0x486564], ecx
mov dword [0x486568], ecx
mov dword [0x48656c], ecx
mov dword [0x486570], ecx
mov dword [0x486574], ecx
mov dword [0x486578], ecx
push 0x20
mov dword [0x48657c], ecx
lea edx, [esp + 0x46c]
mov dword [0x486580], ecx
push 0x486564
push edx
mov byte [0x486584], cl
call fcn.00439e90
lea eax, [esp + 0x474]
push eax
push str.AgentPassword
push str._SERVER_COMMUNICATIONS_
mov dword [0x4cc100], 0x20
call fcn.00427d80
mov eax, dword [esp + 0xc0]
xor edi, edi
add esp, 0x18
cmp eax, edi
je 0x42c2cd
call fcn.00415a50
cmp dword [0x4cd608], edi
jne 0x42c4b8
push str..pipekaseyaUser
call fcn.00448a30
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x42c4b8
push edi
push edi
push edi
lea ecx, [esp + 0xe0]
push ecx
push esi
mov dword [esp + 0xe8], 0x3f0
mov dword [esp + 0xec], edi
mov dword [esp + 0xf0], edi
call fcn.00448ad0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42c4b8
mov esi, dword [esp + 0x24]
push 0
call fcn.0043f1f0
push 0
call fcn.0043f220
push 0
call fcn.0043f250
push 0
call fcn.0043f280
push edi
call fcn.0045932f
mov eax, dword [0x4cc4ac]
add esp, 0x14
test eax, eax
jne 0x42c36f
test ebx, ebx
jne 0x42c36f
push ebx
call fcn.00415a90
push ebx
call fcn.00415aa0
add esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x42c3ed
cmp esi, 0xffffffff
jne 0x42c3ed
lea eax, [esp + 0x12c]
push str.Server_has_requested_that_this_Agent_skip_this_full_checkin_due_to_high_CPU_utilization._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x130]
mov esi, 1
push ecx
mov dword [esp + 0x134], esi
call fcn.0043e010
add esp, 0xc
call fcn.00428460
sar eax, 2
cmp eax, 5
mov dword [esp + 0xa0], eax
jge 0x42c3c8
mov eax, 5
jmp 0x42c3d2
cmp eax, 0x1e
jle 0x42c3d9
mov eax, 0x1e
mov dword [esp + 0xa0], eax
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00415b20
jmp 0x42c3f2
mov esi, 1
cmp dword [esp + 0x94], esi
jg 0x42c449
mov dword [0x4cc44c], esi
lea eax, [esp + 0x30]
push eax
push 0xc00000cc
call fcn.00439e70
mov eax, dword [0x486af4]
add esp, 8
test eax, eax
jl 0x42c432
push 0x20
push 0x4cb818
lea ecx, [esp + 0x38]
push 4
push ecx
call fcn.00431d40
add esp, 0x10
mov eax, dword [0x4cc450]
push 4
lea edx, [esp + 0x34]
push edx
push eax
call fcn.004394c0
add esp, 0xc
jmp 0x42c4b8
lea edx, [esp + 0x30]
push edx
mov dword [0x4cc44c], 0
push 0xc00000ff
jmp 0x42c40b
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x42c470
push eax
call fcn.0045932f
add esp, 4
push 8
call fcn.00415aa0
add esp, 4
lea edx, [esp + 0x30]
push edx
mov dword [0x4cc44c], edi
push 0xc00000ff
jmp 0x42c40b
push edi
call fcn.00415a90
add esp, 4
cmp ebx, edi
je 0x42c4ab
cmp ebx, dword [esp + 0x44]
je 0x42c4ab
push ebx
call fcn.0045932f
add esp, 4
mov edx, dword [esp + 0x44]
push edx
call fcn.0045932f
add esp, 4
call fcn.00415a60
cmp eax, 1
jge 0x42c4c7
call fcn.004417a0
mov eax, dword [0x4cc44c]
xor esi, esi
cmp eax, esi
jne 0x42c4fa
mov eax, dword [0x4cc450]
push 1
push eax
mov dword [0x4cc454], esi
call fcn.00439ba0
add esp, 8
mov dword [0x4cc450], esi
mov dword [0x486af4], 0xfffffff0
jmp 0x42c504
mov dword [0x4cc454], 1
cmp dword [0x4869d0], 0xffffffff
jne 0x42c518
mov dword [0x4869d0], esi
call fcn.00427640
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret