Function at 0x41e270
Capabilities:
Check os version
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8c
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov byte [esp + 0xe8], al
mov dword [esp + 0x8a8], ebx
mov ecx, 0x79
lea edi, [esp + 0x8ac]
rep stosd dword es:[edi], eax
mov ecx, 0x1f
lea edi, [esp + 0xe9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x1f4], ebx
mov ecx, 0x23
lea edi, [esp + 0x1f8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1f0]
push eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x1f4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esp + 0x24], eax
cmp dword [0x4cb484], ebx
jne 0x41e3b7
mov eax, dword [0x4cb800]
inc eax
cmp eax, 0xa
mov dword [0x4cb800], eax
jl 0x41e3b7
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x288]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x28c]
push 0x65
push edx
stosb byte es:[edi], al
call fcn.00401300
add esp, 0xc
test eax, eax
je 0x41e34f
mov byte [esp + 0x288], bl
mov esi, 0x4cb798
lea eax, [esp + 0x288]
jmp 0x41e360
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41e384
test cl, cl
je 0x41e380
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41e384
add eax, 2
add esi, 2
test cl, cl
jne 0x41e360
xor eax, eax
jmp 0x41e389
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x41e3b1
lea eax, [esp + 0x288]
push eax
call fcn.00451240
push 4
lea ecx, [esp + 0x290]
push ecx
push 0x4cb798
call fcn.00458f80
add esp, 0x10
mov dword [0x4cb800], ebx
cmp dword [0x4cb470], ebx
je 0x41e404
cmp dword [0x4cb50c], 0xa
mov dword [esp + 0x1c], 0x10000
je 0x41e3d7
mov ebx, 0xa
jmp 0x41e41c
cmp dword [0x4cb510], 2
jg 0x41e3f3
call fcn.00421b20
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 2
jmp 0x41e41c
mov ebx, 1
mov dword [0x4cb510], 3
jmp 0x41e428
cmp dword [0x4cb510], 2
jle 0x41e3e0
mov ebx, 1
mov dword [0x4cb510], 3
cmp ebx, dword [0x4cb50c]
je 0x41eacb
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x2f0]
push edx
push 0x27
stosb byte es:[edi], al
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41e47d
cmp dword [esp + 0x2f0], 2
jne 0x41e47d
mov al, byte [esp + 0x2f4]
test al, al
je 0x41e47d
push 0x80
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.00458f80
add esp, 0xc
jmp 0x41e492
mov edx, dword [0x4723c4]
mov ax, word [0x4723c8]
mov dword [esp + 0x58], edx
mov word [esp + 0x5c], ax
cmp ebx, 0xa
ja case.0x41e4a2.3
movzx ecx, byte [ebx + 0x41f760]
jmp dword [ecx*4 + 0x41f74c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x4cd608]
or ecx, 1
test eax, eax
mov dword [esp + 0x1c], ecx
je 0x41e8e1
mov edx, dword [0x4cb478]
push str.online.ico
push 0x66
push edx
call fcn.00415740
add esp, 0xc
mov esi, eax
jmp 0x41e886
mov eax, dword [0x4cd608]
test eax, eax
je 0x41e500
mov eax, dword [0x4cb478]
push str.offline.ico
push 0x68
push eax
call fcn.00415740
add esp, 0xc
mov dword [esp + 0x18], eax
xor eax, eax
mov cl, byte [esp + eax + 0x58]
mov byte [esp + eax + 0x168], cl
inc eax
test cl, cl
jne 0x41e502
mov esi, dword [0x4cb518]
test esi, esi
jge 0x41e523
cmp esi, 9
jl 0x41e523
xor esi, esi
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esi + 0x2710]
push 0x64
push edx
stosb byte es:[edi], al
call fcn.0043bdd0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x41e57a
push eax
lea eax, [esp + 0x5c]
push str._s__
push eax
call fcn.00458ee7
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x20], eax
call fcn.0045932f
add esp, 0x10
mov dword [esp + 0x14], 0
jmp 0x41e59a
shl esi, 6
add esi, 0x486238
push esi
lea edx, [esp + 0x5c]
push str._s__
push edx
call fcn.00458ee7
add esp, 0xc
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x10]
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0045a290
mov esi, dword [esp + 0x24]
add esp, 0xc
jmp 0x41e886
mov eax, dword [0x4cd608]
test eax, eax
je 0x41e5e6
mov eax, dword [0x4cb478]
push str.noremote.ico
push 0x69
push eax
call fcn.00415740
add esp, 0xc
mov esi, eax
jmp 0x41e5ea
mov esi, dword [esp + 0x18]
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x58]
mov byte [esp + eax + 0x168], cl
inc eax
test cl, cl
jne 0x41e5f0
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x64
push 0x2719
stosb byte es:[edi], al
call fcn.0043bdd0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x41e655
push eax
lea edx, [esp + 0x5c]
push str._s__
push edx
call fcn.00458ee7
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
push eax
call fcn.0045932f
add esp, 0x10
mov dword [esp + 0x14], 0
jmp 0x41e66b
lea ecx, [esp + 0x58]
push str.Remote_control_is_disabled__
push ecx
call fcn.00458ee7
add esp, 8
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov edx, 0x80
sub edx, ecx
push edx
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.0045a290
mov eax, dword [esp + 0x28]
add esp, 0xc
or eax, 2
jmp 0x41e882
mov eax, dword [0x4cd608]
test eax, eax
je 0x41e6bf
mov edx, dword [0x4cb478]
push str.blink.ico
push 0x67
push edx
call fcn.00415740
mov esi, eax
add esp, 0xc
mov dword [esp + 0x18], esi
jmp 0x41e6c3
mov esi, dword [esp + 0x18]
cmp dword [0x4cb510], 2
jle 0x41e79b
xor eax, eax
mov cl, byte [esp + eax + 0x58]
mov byte [esp + eax + 0x168], cl
inc eax
test cl, cl
jne 0x41e6d2
mov esi, dword [0x4cb518]
test esi, esi
jge 0x41e6f3
cmp esi, 9
jl 0x41e6f3
xor esi, esi
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x2710]
push 0x64
push ecx
call fcn.0043bdd0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x41e74a
push eax
lea edx, [esp + 0x5c]
push str._s__
push edx
call fcn.00458ee7
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
push eax
call fcn.0045932f
add esp, 0x10
mov dword [esp + 0x14], 0
jmp 0x41e76a
shl esi, 6
add esi, 0x486238
push esi
lea ecx, [esp + 0x5c]
push str._s__
push ecx
call fcn.00458ee7
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edx, 0x80
sub edx, eax
push edx
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.0045a290
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add esp, 0xc
or eax, 3
jmp 0x41e882
call fcn.00421b20
test eax, eax
jne 0x41e84c
jmp 0x41e7b0
mov cl, byte [esp + eax + 0x58]
mov byte [esp + eax + 0x168], cl
inc eax
test cl, cl
jne 0x41e7b0
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
push edx
push 0x64
push 0x2719
stosb byte es:[edi], al
call fcn.0043bdd0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x41e815
push eax
lea eax, [esp + 0x5c]
push str._s__
push eax
call fcn.00458ee7
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x20], eax
call fcn.0045932f
add esp, 0x10
mov dword [esp + 0x14], 0
jmp 0x41e82b
lea edx, [esp + 0x58]
push str.Remote_control_is_disabled__
push edx
call fcn.00458ee7
add esp, 8
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, 0x80
sub eax, ecx
push eax
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0045a290
add esp, 0xc
mov eax, dword [esp + 0x1c]
or eax, 3
jmp 0x41e882
mov eax, dword [0x4cd608]
test eax, eax
je 0x41e877
mov eax, dword [0x4cb478]
push str.online.ico
push 0x66
push eax
call fcn.00415740
add esp, 0xc
mov esi, eax
jmp 0x41e87b
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
or eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [0x4cd608]
test eax, eax
je 0x41e8e5
test esi, esi
jne 0x41e8a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov dword [esp + 0x8a8], 0x1e8
mov dword [esp + 0x8ac], ecx
mov dword [esp + 0x8b0], 0x3e8
mov dword [esp + 0x8b4], 6
mov dword [esp + 0x8b8], 0x402
mov dword [esp + 0x8bc], esi
jmp 0x41e8e5
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
test edi, edi
mov dword [esp + 0x10], 0x80
mov dword [0x4cb50c], ebx
je 0x41e90f
cmp dword [esp + 0x200], 2
jne 0x41e90f
cmp dword [esp + 0x1f4], 5
jae 0x41e940
lea edx, [esp + 0x58]
push edx
push 0x47393a
mov eax, edx
push 0x473938
push eax
call fcn.0044dcb0
lea ecx, [esp + 0x68]
push ecx
push 0x473934
mov edx, ecx
push 0x46b328
push edx
call fcn.0044dcb0
add esp, 0x20
lea eax, [esp + 0x58]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e947
mov ecx, dword [esp + 0x10]
sub eax, edx
add ecx, 0xfffffffa
cmp eax, ecx
jge 0x41ea1d
lea edx, [esp + 0x2f0]
push edx
push 6
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41ea1d
mov ecx, dword [esp + 0x2f0]
mov eax, 2
cmp ecx, eax
jne 0x41ea1d
mov cl, byte [esp + 0x2f4]
test cl, cl
je 0x41ea1d
test edi, edi
je 0x41e9d4
cmp dword [esp + 0x200], eax
jne 0x41e9d4
cmp dword [esp + 0x1f4], 5
jb 0x41e9d4
lea edi, [esp + 0x58]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41e9b8
mov ax, word [0x4698f0]
mov cl, byte [0x4698f2]
mov word [edi], ax
mov byte [edi + 2], cl
jmp 0x41e9f0
lea edi, [esp + 0x58]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41e9e0
mov edx, dword [0x473930]
mov dword [edi], edx
lea eax, [esp + 0x58]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e9f7
sub eax, edx
mov ecx, 0x80
sub ecx, eax
push ecx
lea edx, [esp + 0x2f8]
push edx
lea eax, [esp + 0x60]
push eax
call fcn.0045a290
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + eax + 0x57]
test cl, cl
je 0x41ea58
mov cl, 0x2e
mov byte [esp + eax + 0xe6], cl
mov byte [esp + eax + 0xe5], cl
mov byte [esp + eax + 0xe4], cl
mov byte [esp + eax + 0xe7], 0
mov eax, dword [0x4cd608]
test eax, eax
je 0x41eaa2
xor eax, eax
jmp 0x41ea70
mov cl, byte [esp + eax + 0xe8]
mov byte [esp + eax + 0x8c0], cl
inc eax
test cl, cl
jne 0x41ea70
mov eax, dword [0x4cb508]
test eax, eax
je 0x41eac0
lea ecx, [esp + 0x8a8]
push ecx
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov dword [esp + 0x34], eax
jmp 0x41eac0
mov eax, dword [0x4cb508]
test eax, eax
je 0x41eac0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xe8]
push edx
push eax
call fcn.0041d0d0
add esp, 8
test esi, esi
je 0x41eacb
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41eda5
cmp dword [esp + 0x1f4], 5
jb 0x41eda5
cmp dword [0x4869d8], 0x3c
jl 0x41eda5
lea ecx, [esp + 0x1c]
push ecx
call fcn.0045a1c9
mov eax, dword [0x4869d4]
add esp, 4
cmp eax, 0xffffffff
je 0x41eda5
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x4cc46c]
mov eax, dword [0x4869d8]
sub edx, ecx
cmp edx, eax
jle 0x41eda5
mov al, byte [0x4cb360]
test al, al
je 0x41eda5
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x808]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x808]
push eax
mov dword [esp + 0x80c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41ed98
mov al, byte [esp + 0x8a2]
cmp al, 2
je 0x41eb77
cmp al, 3
jne 0x41ed98
mov eax, dword [0x4869d4]
cmp eax, 3
je 0x41eb8a
cmp eax, 4
jne 0x41ed98
mov eax, dword [0x4cb46c]
xor edi, edi
cmp eax, edi
je 0x41ebcf
mov al, byte [0x4cc9b0]
test al, al
je 0x41ebcf
push edi
push 0x4cb46c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
cmp esi, edi
je 0x41ebcf
push esi
mov ecx, 0x4cc9a8
call fcn.00432a80
test eax, eax
jne 0x41ebcf
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0045932f
add esp, 4
cmp dword [0x4cc9ac], edi
jne 0x41ed2d
push 0x4cb360
mov ecx, 0x4cc9a8
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], edi
call fcn.00438d40
cmp eax, edi
jne 0x41ec12
push str.KAgentExt.dll
lea ecx, [esp + 0x500]
push str._s_is_loaded.
push ecx
call fcn.00458ee7
add esp, 0xc
jmp 0x41ec2d
push eax
push str.KAgentExt.dll
lea edx, [esp + 0x504]
push str._s_is_not_loaded._Return_code:__x.
push edx
call fcn.00458ee7
add esp, 0x10
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x4cb360
call fcn.0044c5e0
add esp, 0xc
test eax, eax
jne 0x41ecab
mov eax, dword [esp + 0x24]
movzx edx, ax
push edx
shr eax, 0x10
push eax
mov eax, dword [esp + 0x20]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea edx, [esp + 0xaa0]
push str._Version__d._d._d._d.
push edx
call fcn.00458ee7
lea eax, [esp + 0xaa8]
add esp, 0x18
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ec80
lea edi, [esp + 0x4fc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41ec91
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41ecf0
lea edi, [esp + 0x4fc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41ecb3
mov eax, dword [str._Version_unavailable.]
mov ecx, dword [0x4738d0]
mov edx, dword [0x4738d4]
mov dword [edi], eax
mov eax, dword [0x4738d8]
mov dword [edi + 4], ecx
mov ecx, dword [0x4738dc]
mov dword [edi + 8], edx
mov dx, word [0x4738e0]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov word [edi + 0x14], dx
lea edi, [esp + 0x4fc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41ecf8
mov ax, word [0x46b328]
lea ecx, [esp + 0x4f8]
mov word [edi], ax
push ecx
mov dword [esp + 0x4fc], 1
call fcn.0043e010
mov eax, dword [0x4cc9ac]
add esp, 4
test eax, eax
je 0x41ed98
lea edx, [esp + 0x24]
xor esi, esi
push edx
mov ecx, 0x4cc9a8
mov dword [esp + 0x28], esi
call fcn.00438de0
test eax, eax
jne 0x41ed7e
mov eax, dword [esp + 0x24]
cmp eax, esi
mov dword [0x4cc464], eax
je 0x41ed74
lea eax, [esp + 0x18]
push eax
mov ecx, 0x4cc9a8
mov dword [esp + 0x1c], esi
call fcn.00438ed0
test eax, eax
jne 0x41ed74
mov ecx, dword [esp + 0x18]
mov dword [0x4cc468], ecx
mov dword [0x4cc470], 1
mov edx, dword [0x4cc468]
mov eax, dword [0x4cc464]
push edx
push eax
push str.ExchangeServerInstalled_d__MBoxCount_d
call fcn.00432720
add esp, 0xc
push 0x4cc46c
call fcn.0045a1c9
add esp, 4
mov eax, dword [0x4cb49c]
test eax, eax
jne 0x41f323
mov eax, dword [0x4cb484]
test eax, eax
jne 0x41f323
mov eax, dword [0x4cd608]
test eax, eax
jne 0x41eeab
lea ecx, [esp + 0x20]
push ecx
call fcn.0045a1c9
mov eax, dword [0x486478]
add esp, 4
test eax, eax
jle 0x41ee29
mov esi, dword [esp + 0x20]
mov edi, dword [0x4cb524]
mov edx, esi
sub edx, edi
cmp edx, eax
jl 0x41ee29
mov ecx, dword [0x486220]
mov eax, dword [0x486224]
mov edx, dword [0x4cb488]
mov edi, ecx
sub edi, eax
cmp edx, edi
jge 0x41ee23
sub eax, dword [0x4cb490]
mov edi, ecx
sub edi, edx
cmp eax, edi
jge 0x41ee23
sub ecx, eax
mov dword [0x4cb488], ecx
mov dword [0x4cb524], esi
lea eax, [esp + 0x20]
push eax
call fcn.0045a1c9
add esp, 4
call fcn.00428460
mov esi, dword [0x4cb538]
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
sar eax, 1
test eax, eax
jle 0x41ee5b
mov ecx, edx
sub ecx, esi
cmp ecx, eax
jl 0x41ee5b
cmp ecx, 0x1e
jge 0x41ee62
sub edx, esi
cmp edx, 0x78
jl 0x41eeab
mov ecx, 0x4cc860
call fcn.00434130
test eax, eax
jne 0x41ee79
call fcn.0042e460
test eax, eax
je 0x41eea2
mov ecx, dword [0x486220]
mov eax, dword [0x486224]
mov ebx, dword [0x4cb490]
mov edi, dword [0x4cb488]
mov edx, ecx
sub eax, ebx
sub edx, edi
cmp eax, edx
jge 0x41eea2
sub ecx, eax
mov dword [0x4cb488], ecx
mov eax, dword [esp + 0x20]
mov dword [0x4cb538], eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.00467c8d
mov eax, dword [esp + 0x44]
mov ecx, dword [0x48bfec]
mov esi, dword [esp + 0x40]
add esp, 4
cmp ax, cx
jb 0x41eee3
sub esi, dword [0x48bfe8]
imul esi, esi, 0x3e8
movzx edx, cx
movzx eax, ax
sub esi, edx
add esi, eax
jmp 0x41eef9
sub esi, dword [0x48bfe8]
imul esi, esi, 0x3e8
movzx ecx, cx
movzx edx, ax
sub esi, ecx
add esi, edx
lea eax, [esp + 0x2f0]
push eax
push 0xb
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41ef51
cmp dword [esp + 0x2f0], 1
jne 0x41ef51
mov ecx, dword [esp + 0x2f4]
imul ecx, ecx, 0x3e8
cmp esi, ecx
jl 0x41ef51
call fcn.0043c940
call fcn.0043c2d0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [0x48bfe8], edx
mov dword [0x48bfec], eax
mov dword [0x48bff0], ecx
lea edx, [esp + 0x700]
push edx
call fcn.00421d70
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [esp + 0x718]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov esi, eax
cmp esi, 0xffffffff
je 0x41efa3
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x28]
cmp edx, dword [0x4cb4a0]
jne 0x41efc4
mov eax, dword [esp + 0x2c]
cmp eax, dword [0x4cb4a4]
jne 0x41efc4
cmp esi, 0xffffffff
jne 0x41f183
call fcn.00428450
mov edi, eax
call fcn.00428460
mov ebx, eax
call fcn.00419440
mov eax, dword [0x4cd608]
test eax, eax
jne 0x41f01e
push str..pipekaseyaUser
call fcn.00448a30
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x41f01e
xor eax, eax
push eax
push eax
push eax
lea ecx, [esp + 0x58]
push ecx
push esi
mov dword [esp + 0x60], 0x3f0
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call fcn.00448ad0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x2f0]
push edx
push 0x29
call fcn.00423070
add esp, 8
test eax, eax
mov esi, 1
jne 0x41f052
cmp dword [esp + 0x2f0], esi
jne 0x41f052
mov eax, dword [esp + 0x2f4]
push eax
call fcn.0043f0a0
add esp, 4
lea ecx, [esp + 0x2f0]
push ecx
push 0x22
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41f07e
cmp dword [esp + 0x2f0], esi
jne 0x41f07e
mov edx, dword [esp + 0x2f4]
mov dword [0x486478], edx
lea eax, [esp + 0x2f0]
push eax
push 0x23
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41f0ad
cmp dword [esp + 0x2f0], esi
jne 0x41f0ad
mov ecx, dword [esp + 0x2f4]
push ecx
call fcn.00401040
add esp, 4
mov dword [0x4cb50c], 0xffffffff
call fcn.00428450
mov esi, eax
call fcn.00428460
cmp edi, esi
jne 0x41f0cb
cmp ebx, eax
je 0x41f13d
mov esi, dword [0x486220]
mov eax, dword [0x4cb488]
mov edi, dword [0x486224]
mov ebx, dword [0x4cb490]
sub esi, eax
sub edi, ebx
call fcn.00428450
mov dword [0x486220], eax
call fcn.00428460
mov ecx, dword [0x486220]
cmp esi, ecx
mov dword [0x486224], eax
mov dword [0x486228], 1
jg 0x41f11a
mov edx, ecx
sub edx, esi
mov dword [0x4cb488], edx
jmp 0x41f124
mov dword [0x4cb488], 0
cmp edi, eax
jg 0x41f131
sub eax, edi
mov dword [0x4cb490], eax
jmp 0x41f143
mov dword [0x4cb490], 0
jmp 0x41f143
mov ecx, dword [0x486220]
mov eax, dword [0x4cb4a0]
xor esi, esi
cmp eax, esi
jne 0x41f166
cmp dword [0x4cb4a4], esi
jne 0x41f166
mov dword [0x4cb488], ecx
mov dword [0x486228], 1
call fcn.004159e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4cb4a8], esi
mov dword [0x4cb4ac], esi
lea eax, [esp + 0x700]
push eax
call fcn.004224f0
add esp, 4
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x718]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x41f1c9
lea edx, [esp + 0x28]
push edx
push 0
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, dword [0x4cb4a8]
jne 0x41f1e6
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [0x4cb4ac]
jne 0x41f1e6
cmp esi, 0xffffffff
jne 0x41f23f
lea edx, [esp + 0x2f0]
push edx
push 9
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41f21d
mov ecx, dword [esp + 0x2f0]
mov eax, 1
cmp ecx, eax
jne 0x41f21d
cmp dword [esp + 0x2f4], eax
jne 0x41f21d
cmp esi, 0xffffffff
je 0x41f21d
push eax
jmp 0x41f21f
push 0
call fcn.004180b0
add esp, 4
call fcn.00452c30
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x4cb4a8], eax
mov dword [0x4cb4ac], ecx
lea edx, [esp + 0x20]
push edx
call fcn.0045a1c9
add esp, 4
call fcn.00428460
mov esi, dword [0x4cb52c]
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
sar eax, 1
test eax, eax
jle 0x41f271
mov ecx, edx
sub ecx, esi
cmp ecx, eax
jl 0x41f271
cmp ecx, 0x1e
jge 0x41f27c
sub edx, esi
cmp edx, 0x78
jl 0x41f323
lea eax, [esp + 0x700]
push eax
mov byte [esp + 0x704], 0
call fcn.004158b0
mov al, byte [esp + 0x704]
add esp, 4
test al, al
je 0x41f31a
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x718]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x41f31a
lea edx, [esp + 0x28]
push edx
push 0
push 0
push esi
call ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x41f31a
mov ecx, dword [0x4cb530]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov ecx, dword [esp + 0x2c]
jne 0x41f2f9
cmp ecx, dword [0x4cb534]
je 0x41f31a
mov edx, dword [0x486220]
mov dword [0x4cb488], edx
mov dword [0x4cb48c], 0
mov dword [0x4cb530], eax
mov dword [0x4cb534], ecx
mov eax, dword [esp + 0x20]
mov dword [0x4cb52c], eax
mov eax, dword [0x4cd608]
xor esi, esi
cmp eax, esi
jne 0x41f341
cmp dword [0x48647c], esi
jle 0x41f341
mov dword [0x48647c], esi
call fcn.0041dfd0
cmp dword [0x486480], esi
jle 0x41f354
mov dword [0x486480], esi
call fcn.0041c8b0
call fcn.0044b9a0
mov eax, dword [0x4cb488]
cmp eax, dword [0x486220]
jge 0x41f43c
mov ecx, dword [0x4cb490]
cmp ecx, dword [0x486224]
jge 0x41f456
cmp dword [0x4cb49c], esi
jne 0x41f6b0
cmp dword [0x4cb484], esi
jne 0x41f6b0
mov ecx, dword [0x4cb490]
inc eax
inc ecx
mov dword [0x4cb488], eax
mov dword [0x4cb490], ecx
cdq
mov ecx, 0x3c
idiv ecx
test edx, edx
jne 0x41f6b0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x38]
push ecx
push str.CheckinNow
push str.SystemCurrentControlSetServicesVxDKaseya
mov edi, 4
push 0x80000002
mov dword [esp + 0x28], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x48], esi
call fcn.0044b2c0
add esp, 0x18
test eax, eax
jne 0x41f6b0
cmp dword [esp + 0x30], edi
jne 0x41f6b0
cmp dword [esp + 0x10], esi
jle 0x41f6b0
cmp dword [esp + 0x38], esi
je 0x41f6b0
push str.CheckinNow
push str.SystemCurrentControlSetServicesVxDKaseya
push 0x80000002
call fcn.0044b0e0
mov edx, dword [0x486220]
add esp, 0xc
mov dword [0x4cb488], edx
jmp 0x41f6b0
call fcn.00428450
test eax, eax
jg 0x41f463
mov eax, dword [0x4cb490]
cmp eax, dword [0x486224]
jl 0x41f66e
call fcn.00428460
test eax, eax
jle 0x41f66e
cmp dword [0x4cb49c], esi
jne 0x41f66e
cmp dword [0x4cb484], esi
jne 0x41f66e
call fcn.00446f60
test eax, eax
jne 0x41f66e
mov ecx, dword [0x4cb488]
cmp ecx, dword [0x486220]
jl 0x41f4a8
mov dword [0x4cb494], 1
mov dword [0x4cb51c], esi
jmp 0x41f4ae
mov dword [0x4cb494], esi
cmp dword [0x4cb790], esi
jne 0x41f55f
cmp dword [0x4cb520], esi
jne 0x41f55f
call fcn.00439bd0
mov ebx, eax
test ebx, ebx
jle 0x41f4ea
test bl, 1
jne 0x41f4db
test bh, 5
je 0x41f4ea
mov dword [0x4cb790], 1
jmp 0x41f564
lea edx, [esp + 0x2f0]
push edx
push 0x1e
call fcn.00423070
add esp, 8
test eax, eax
jne 0x41f564
mov ecx, dword [esp + 0x2f0]
mov eax, 1
cmp ecx, eax
jne 0x41f564
cmp dword [esp + 0x2f4], eax
jne 0x41f564
mov ebx, eax
test byte [0x4cb78c], 4
jne 0x41f564
mov edx, dword [0x4cb78c]
lea eax, [esp + 0x4f8]
or edx, 4
mov ecx, 0x13
mov esi, str.Forcing_checkin_with_the_KServer_even_though_not_connected_to_the_network._n
lea edi, [esp + 0x4fc]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x4cb78c], edx
mov dword [esp + 0x4fc], ebx
call fcn.0043e010
add esp, 4
jmp 0x41f564
mov ebx, 1
test ebx, ebx
mov dword [0x4cb520], 0
jne 0x41f5c2
test byte [0x4cb78c], 1
jne 0x41f66e
mov esi, dword [0x4cb78c]
mov eax, 1
or esi, eax
mov dword [0x4cb78c], esi
mov ecx, 0x13
mov esi, str.No_attempt_to_connect_to_KServer._Computer_is_not_connected_to_the_network._n
lea edi, [esp + 0x4fc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x4f8]
movsb byte es:[edi], byte [esi]
push ecx
mov dword [esp + 0x4fc], eax
call fcn.0043e010
add esp, 4
jmp 0x41f66e
cmp ebx, 0xffffffff
jne 0x41f610
test byte [0x4cb78c], 2
jne 0x41f610
mov edx, dword [0x4cb78c]
mov ecx, 0x1a
mov esi, str.Unable_to_determine_if_computer_is_connected_to_the_network._Proceeding_to_attempt_connection_to_KServer._n
lea edi, [esp + 0x4fc]
rep movsd dword es:[edi], dword [esi]
or edx, 2
movsw word es:[edi], word [esi]
mov dword [0x4cb78c], edx
lea edx, [esp + 0x4f8]
movsb byte es:[edi], byte [esi]
push edx
mov dword [esp + 0x4fc], 1
call fcn.0043e010
add esp, 4
mov eax, dword [0x4cb51c]
test eax, eax
jne 0x41f66e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xe4]
push eax
push 0
push ecx
push 0x4194b0
push 0
push 0
call fcn.004599db
add esp, 0x18
test eax, eax
mov dword [0x4cb484], eax
jne 0x41f66e
lea edx, [esp + 0x4fc]
push str.Failed_to_start_thread_for_communications_with_the_server_n
push edx
call fcn.00458ee7
lea eax, [esp + 0x500]
push eax
mov dword [esp + 0x504], 1
call fcn.0043e010
add esp, 0xc
mov ecx, dword [0x486220]
cmp dword [0x4cb488], ecx
jl 0x41f69c
mov eax, dword [0x486228]
xor esi, esi
mov dword [0x4cb488], esi
mov dword [0x4cb490], esi
call fcn.0041bfb0
mov dword [0x486228], esi
jmp 0x41f6b0
mov dword [0x4cb490], 0
call fcn.00428460
mov dword [0x486224], eax
call fcn.0043f0e0
lea edx, [esp + 0x20]
push edx
mov edi, eax
call fcn.0045a1c9
mov eax, dword [esp + 0x24]
add esp, 4
cmp eax, edi
jl 0x41f721
call fcn.0043f0d0
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
call fcn.00428460
cdq
sub eax, edx
sar eax, 1
cmp eax, esi
jg 0x41f6f4
mov eax, esi
cmp eax, 5
jge 0x41f700
mov eax, 5
jmp 0x41f70c
cmp eax, 0x12c
jle 0x41f70c
mov eax, 0x12c
mov ecx, dword [esp + 0x20]
lea edx, [eax + edi]
cmp ecx, edx
jl 0x41f73e
sub ecx, dword [0x4cb788]
cmp ecx, eax
jmp 0x41f72a
sub eax, dword [0x4cb788]
cmp eax, 0x1e
jl 0x41f73e
call fcn.00444660
push 0x4cb788
call fcn.0045a1c9
add esp, 4
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret