Function at 0x402cd0
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Identify system language via api
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x107c
call fcn.0040d6e0
mov eax, dword [0x43f1c0]
xor eax, esp
mov dword [esp + 0x1078], eax
push ebx
push esi
xor eax, eax
push edi
xor ebx, ebx
push str.GlobaliNodeDamaInstallMtx
push ebx
push ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x50], bl
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov dword [esp + 0x59], eax
mov dword [esp + 0x5d], eax
mov dword [esp + 0x61], eax
mov dword [esp + 0x65], eax
mov dword [esp + 0x69], eax
mov dword [esp + 0x6d], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], al
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
mov dword [esp + 0x18], eax
je 0x402d8a
cmp eax, 0xb7
jne 0x402d8a
push str.Last_session_is_still_in.
call fcn.004010d2
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x40], 0x10
jb 0x4037a2
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040c526
add esp, 4
jmp 0x4037a2
push 0x21
lea ecx, [esp + 0x48]
push ecx
push str.ClientId
push str.SOFTWAREiNodeDAM_Agent
push 0x80000002
call fcn.00401181
add esp, 0x14
test eax, eax
je 0x402dc0
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402db3
sub eax, edx
jne 0x402e14
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x1c], 0x21
call fcn.00401109
add esp, 0xc
test eax, eax
jne 0x402e14
push str.Fail_1.
call fcn.004010d2
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x40], 0x10
jb 0x4037a2
mov edx, dword [esp + 0x2c]
push edx
call fcn.0040c526
add esp, 4
jmp 0x4037a2
lea eax, [esp + 0x44]
push eax
push str.ClientId
push str.SOFTWAREiNodeDAM_Agent
push 0x80000002
call fcn.004010dc
add esp, 0x10
test eax, eax
jne 0x402e65
push str.Fail_2
call fcn.004010d2
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x40], 0x10
jb 0x4037a2
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0040c526
add esp, 4
jmp 0x4037a2
lea edx, [esp + 0x44]
push edx
push str.C:iNode_DAM_Agent_
lea eax, [esp + 0x70]
push str._s_s
push eax
call fcn.0040c979
push str.DamAgent.exe
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0xb70]
push 0x4383d0
push edx
call fcn.0040c979
add esp, 0x20
push str.GlobaliNodeDamaSrvMutex
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x402f9d
push eax
call edi
lea eax, [esp + 0xb58]
push eax
mov dword [esp + 0x20], 1
call fcn.00401140
add esp, 4
test eax, eax
je 0x402f9d
lea ecx, [esp + 0xb58]
push ecx
call fcn.0040120d
add esp, 4
test eax, eax
jne 0x402f9d
push str.Return_1.
call fcn.004010d2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc68]
push eax
mov dword [esp + 0x1c], 0x105
call fcn.00401118
add esp, 0xc
test eax, eax
je 0x402f75
lea ecx, [esp + 0xc60]
push ecx
call fcn.004010d2
lea edx, [esp + 0xc64]
push str.explorer.exe
push edx
call fcn.004284d1
add esp, 0xc
test eax, eax
jne 0x402f75
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, 0x804
jne 0x402f60
mov eax, 0x43834c
mov ecx, 0x438328
jmp 0x402f6a
mov eax, str.The_version_to_be_installed_is_the_same_as__or_lower_than__current_installed_version._nSetup_has_been_canceled.
mov ecx, str.iNode_DAM_Agent_Setup
push 0x30
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call edi
lea ecx, [esp + 0x28]
call fcn.0040116d
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1078]
xor ecx, esp
call fcn.0040c96a
mov esp, ebp
pop ebp
ret 0x10
push str.C:iNode_DAM_Agent
call fcn.0040123f
add esp, 4
test eax, eax
jne 0x402fba
push ebx
push str.C:iNode_DAM_Agent
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x68]
push eax
call fcn.0040123f
add esp, 4
test eax, eax
jne 0x402fd7
push ebx
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 0
je 0x403021
push str.Global_evnt_Rem_mon_switch_
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x403158
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
push esi
call edi
push str.running.
call fcn.004010d2
add esp, 4
push 1
push str.H3C_DAM_Agent
call fcn.0040112c
push 1
push str.iNode_DAM_Agent
call fcn.0040112c
add esp, 0x10
xor esi, esi
mov edi, edi
push str.GlobaliNodeDamaSrvMutex
push 0
push 0x1f0001
add esi, 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40307f
push eax
call edi
push 0x32
call ebx
cmp esi, 0x12c
jb 0x403040
push str.Fail_3.1.
call fcn.004010d2
mov edx, dword [esp + 0x18]
add esp, 4
push edx
jmp 0x403797
push str.DamAgent.exe
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xd70]
push 0x4383d0
push eax
xor esi, esi
call fcn.0040c979
push str.DamAgentTray.exe
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0xe88]
push 0x4383d0
push edx
call fcn.0040c979
add esp, 0x20
lea esp, [esp]
lea eax, [esp + 0xd68]
push eax
call fcn.00401140
add esp, 4
test eax, eax
jne 0x4030e8
lea ecx, [esp + 0xe70]
push ecx
call fcn.00401140
add esp, 4
test eax, eax
je 0x40310b
cmp esi, 0x12c
jae 0x40310b
lea edx, [esp + 0x68]
push 0x4381f4
push edx
call fcn.0040104b
add esp, 8
push 0x32
add esi, 1
call ebx
jmp 0x4030c0
lea eax, [esp + 0xd68]
push eax
call fcn.00401140
add esp, 4
test eax, eax
jne 0x403133
lea ecx, [esp + 0xe70]
push ecx
call fcn.00401140
add esp, 4
test eax, eax
je 0x40318b
cmp dword [esp + 0x10], 0
jne 0x403785
push str.Fail_3.2___Try_Again.
call fcn.004010d2
add esp, 4
mov dword [esp + 0x10], 1
jmp 0x402fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0xadc]
push str.Fail_3_with_Err__u.
push edx
call fcn.0040c979
lea eax, [esp + 0xae4]
push eax
call fcn.004010d2
mov ecx, dword [esp + 0x24]
add esp, 0x10
push ecx
jmp 0x403797
push 0x103
lea eax, [esp + 0x8cd]
push 0
push eax
mov byte [esp + 0x8d4], 0
call fcn.0040d630
push 0x103
lea ecx, [esp + 0x9e1]
push 0
push ecx
mov byte [esp + 0x9e8], 0
call fcn.0040d630
push 0x104
lea edx, [esp + 0x5cc]
push 0
push edx
call fcn.0040d630
add esp, 0x24
push 0x104
lea eax, [esp + 0x5b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x41
lea esi, [esp + 0x5b0]
lea edi, [esp + 0x9d0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x5b0]
push 0x5c
push ecx
call fcn.0040c530
add eax, 1
lea edx, [esp + 0x8d0]
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x403222
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x9d8]
xor edi, edi
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call fcn.00401190
add esp, 0xc
test eax, eax
je 0x403763
cmp dword [esp + 0x24], edi
jne 0x403763
cmp dword [esp + 0x20], 0x4b000
jbe 0x403763
push 1
lea edx, [esp + 0x5b4]
push 0x104
push edx
call fcn.00401127
add esp, 0xc
test eax, eax
jne 0x4032aa
push str.Fail_5.
call fcn.004010d2
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403799
push 0x4b000
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x8d4]
push eax
lea ecx, [esp + 0x5c0]
push ecx
call fcn.00401037
add esp, 0x14
test eax, eax
jne 0x40330c
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x174]
push str.Fail_6_err_is__d
push eax
call fcn.0040c979
lea ecx, [esp + 0x17c]
push ecx
call fcn.004010d2
mov edx, dword [esp + 0x24]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403799
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._slog
push ecx
call fcn.0040c979
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._sSoftDlvrMng
push ecx
call fcn.0040c979
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._sdata
push ecx
call fcn.0040c979
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._s_resources
push ecx
call fcn.0040c979
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._s_resourcesen_us
push ecx
call fcn.0040c979
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x194]
push str._s_resourceszh_cn
push ecx
call fcn.0040c979
add esp, 0xc
push edi
lea edx, [esp + 0x194]
push edx
call esi
push str.DamAgent.res
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x6c0]
push str._s_resourcesen_us_s
push ecx
call fcn.0040c979
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea edx, [esp + 0x6b8]
push edx
call esi
push str.DamAgent_en.res
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x4b0]
push 0x4383d0
push ecx
call fcn.0040c979
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
add esp, 0x10
lea edx, [esp + 0x6b8]
push edx
lea eax, [esp + 0x4ac]
push eax
call edi
push str.DamAgent.res
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x6c0]
push str._s_resourceszh_cn_s
push edx
call fcn.0040c979
add esp, 0x10
lea eax, [esp + 0x6b8]
push eax
call esi
push str.DamAgent_zh.res
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x4b0]
push 0x4383d0
push edx
call fcn.0040c979
add esp, 0x10
lea eax, [esp + 0x6b8]
push eax
lea ecx, [esp + 0x4ac]
push ecx
call edi
push 0x104
lea edx, [esp + 0x7c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x7c0]
add eax, 0xffffffff
lea ecx, [ecx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4034d0
mov ecx, dword [str._system32]
mov edx, dword [0x4380c0]
mov dword [eax], ecx
mov cx, word [0x4380c4]
mov dword [eax + 4], edx
lea edx, [esp + 0x68]
push edx
mov word [eax + 8], cx
lea eax, [esp + 0x29c]
push str._sDamAgent.exe
push eax
call fcn.0040c979
add esp, 0xc
call fcn.0040117c
test eax, eax
je 0x403532
push str.DamAgent64.exe
lea ecx, [esp + 0x6c]
push ecx
push 0x4383d0
lea edx, [esp + 0x4b4]
push edx
jmp 0x403549
push str.DamAgent32.exe
lea eax, [esp + 0x6c]
push eax
push 0x4383d0
lea ecx, [esp + 0x4b4]
push ecx
call fcn.0040c979
add esp, 0x10
lea edx, [esp + 0x298]
push edx
lea eax, [esp + 0x4ac]
push eax
call fcn.0040d6aa
lea ecx, [esp + 0x7c8]
push ecx
lea edx, [esp + 0x3ac]
push str._sDamAgent.exe
push edx
call fcn.0040c979
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x14
xor edi, edi
push edi
lea eax, [esp + 0x3a4]
push eax
lea ecx, [esp + 0x2a0]
push ecx
call esi
call fcn.0040117c
test eax, eax
je 0x4035c4
call fcn.004011c2
push edi
lea edx, [esp + 0x3a4]
push edx
lea eax, [esp + 0x2a0]
push eax
call esi
call fcn.0040100a
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x29c]
push str._sDamAgentTray.exe
push edx
call fcn.0040c979
lea eax, [esp + 0x7cc]
push eax
lea ecx, [esp + 0x3b0]
push str._sDamAgentTray.exe
push ecx
call fcn.0040c979
add esp, 0x18
push edi
lea edx, [esp + 0x3a4]
push edx
lea eax, [esp + 0x2a0]
push eax
call esi
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x29c]
push str._s_svchost.exe
push edx
call fcn.0040c979
lea eax, [esp + 0x7cc]
push eax
lea ecx, [esp + 0x3b0]
push str._shssvchost.exe
push ecx
call fcn.0040c979
add esp, 0x18
push edi
lea edx, [esp + 0x3a4]
push edx
lea eax, [esp + 0x2a0]
push eax
call esi
call fcn.0040117c
test eax, eax
je 0x403678
call fcn.004011c2
push edi
lea ecx, [esp + 0x3a4]
push ecx
lea edx, [esp + 0x2a0]
push edx
call esi
call fcn.0040100a
push str.H3C_DAM_Agent
call fcn.0040103c
push str.iNode_DAM_Agent
call fcn.0040103c
add esp, 8
push 0x64
call ebx
push str.DamAgent.exe
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xf80]
push 0x4383d0
push ecx
call fcn.0040c979
add esp, 0x10
push edi
push edi
push edi
lea edx, [esp + 0xf84]
push edx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor esi, esi
jmp 0x4036d0
lea eax, [esp + 0x10]
push eax
push str.iNode_DAM_Agent
mov dword [esp + 0x18], edi
call fcn.004010fa
add esp, 8
cmp dword [esp + 0x10], 4
je 0x4036fe
push 0x32
add esi, 1
call ebx
cmp esi, 0x4b0
jb 0x4036d0
jmp 0x40370b
push str.iNode_DAM_Agent_is_running.
call fcn.004010d2
add esp, 4
cmp dword [esp + 0x1c], edi
je 0x403733
push str.Global_evnt_Rem_mon_switch_
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
cmp esi, edi
je 0x403733
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
call fcn.0040116d
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1078]
xor ecx, esp
call fcn.0040c96a
mov esp, ebp
pop ebp
ret 0x10
push str.Fail_4.
call fcn.004010d2
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov dword [esp + 0x1c], 0x160
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403799
push str.Fail_3.2.
call fcn.004010d2
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call edi
lea ecx, [esp + 0x28]
call fcn.0040116d
mov ecx, dword [esp + 0x1084]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040c96a
mov esp, ebp
pop ebp
ret 0x10