Function at 0x405fd0
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Get disk information
Get file attributes
Get session user name
Query environment variable
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1abc
call fcn.0040d0b0
xor eax, eax
mov byte [esp + 0x5ec], al
push ebx
mov byte [esp + 0x2b8], al
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x1b9]
mov byte [esp + 0x1b8], 0
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5f9]
rep stosd dword es:[edi], eax
mov ecx, 0x45
lea edi, [esp + 0x2c1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x4e0], 0
mov ecx, 0x45
lea edi, [esp + 0x4e1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x12b8], 0
mov ecx, 0x202
lea edi, [esp + 0x12b9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x4a], eax
xor esi, esi
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov ecx, 0x80
mov edi, 0x420070
mov word [esp + 0x56], ax
rep stosd dword es:[edi], eax
mov eax, dword [str.Kaseya_Agent]
cmp eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], esi
mov word [esp + 0x48], si
mov dword [esp + 0x5c], 0x4177a4
mov dword [esp + 0x60], str.KaUsrTsk.exe
mov dword [esp + 0x64], str.KaUpdHlp.exe
mov dword [esp + 0x68], str.kPrtPng.exe
mov dword [esp + 0x6c], str.psapi.dll
mov dword [esp + 0x70], str.sporder.dll
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
je 0x406125
cmp byte [eax], 0
je 0x406125
push 0x1f6
push eax
push 0x420070
call fcn.0040c870
mov edi, 0x420070
add esp, 0xc
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406100
mov ecx, dword [str._Setup]
mov dx, word [0x41a234]
mov al, byte [0x41a236]
mov dword [edi], ecx
mov word [edi + 4], dx
mov byte [edi + 6], al
jmp 0x40616b
mov ecx, dword [0x41a21c]
mov edx, dword [0x41a220]
mov eax, dword [0x41a224]
mov dword [0x420070], ecx
mov ecx, dword [0x41a228]
mov dword [0x420074], edx
mov dx, word [0x41a22c]
mov dword [0x420078], eax
mov al, byte [0x41a22e]
mov dword [0x42007c], ecx
mov word [0x420080], dx
mov byte [0x420082], al
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x3d8]
rep stosd dword es:[edi], eax
push 0x105
lea ecx, [esp + 0x3dc]
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x4061e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_modules_current_location_could_not_be_determined.
push 0x41f648
mov dword [esp + 0x30], eax
call fcn.0040c6b6
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405930
mov eax, dword [esp + 0x38]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4061f0
sub eax, edx
add eax, 0x80a
push eax
call fcn.0040c292
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x14], ebx
jne 0x40623b
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x3d8]
push 0x41a1ac
push eax
call fcn.0040c618
mov esi, eax
add esp, 8
test esi, esi
jne 0x406324
call fcn.0040c9cd
cmp dword [eax], 2
jne 0x4062da
call fcn.00401ce0
test eax, eax
je 0x4062da
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4062da
push str.Wow64DisableWow64FsRedirection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ebx, ebx
mov dword [esp + 0x24], eax
je 0x4062cf
test eax, eax
je 0x4062cf
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
je 0x4062cf
lea edx, [esp + 0x3d8]
push 0x41a1ac
push edx
call fcn.0040c618
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 8
push eax
call dword [esp + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp + 0x14]
test esi, esi
jne 0x406324
call fcn.0040c9cd
mov ecx, dword [eax]
push ecx
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0x41f648
call fcn.0040c6b6
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405930
add esp, 0x14
call fcn.0040c9cd
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0xfffff800
push esi
call fcn.0040c573
push esi
push 0x800
lea ecx, [esp + 0x12cc]
push 1
push ecx
call fcn.0040c19f
add esp, 0x1c
cmp eax, 0x800
je 0x406396
call fcn.0040c9cd
mov edx, dword [eax]
push edx
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_embedded_arguments_could_not_be_read_from_the_package.
push 0x41f648
call fcn.0040c6b6
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x1c]
mov ebx, esi
push ecx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405930
add esp, 0x14
call fcn.0040c9cd
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x201
push 0x420278
push esi
call fcn.00405b00
mov edi, eax
push esi
mov dword [esp + 0x2c], edi
call fcn.0040c2f0
add esp, 0x10
test edi, edi
je 0x4063ca
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
jmp 0x407db3
lea ecx, [esp + 0x18]
push ecx
push 0x420278
call fcn.00405c50
mov edx, dword [ebp + 0x10]
push edx
lea eax, [esp + 0x12c4]
push eax
push str._s__s
push ebx
call fcn.0040c6b6
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.0040a030
add esp, 0x20
test eax, eax
mov dword [esp + 0x1c], eax
je 0x406444
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x407dc3
push eax
call fcn.0040bef2
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.KaseyaClientSetupSingleInstance
push 1
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
call ebx
cmp eax, 0xb7
je 0x406473
cmp eax, 5
je 0x406473
test edi, edi
jne 0x4064b1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.KaseyaClientSetupSingleInstance
push 1
push 0
call esi
mov esi, eax
mov dword [esp + 0x10], esi
call ebx
cmp eax, 0xb7
mov dword [esp + 0x24], eax
je 0x4088f9
cmp eax, 5
je 0x4088f9
test esi, esi
je 0x4088f9
push 0x420278
lea ecx, [esp + 0xebc]
push str.Server_address:__s
push ecx
call fcn.0040c6b6
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xec4]
push edx
push 0
push 1
push 3
push eax
call fcn.0040bd80
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0x324]
add esp, 0x20
test eax, eax
je 0x406596
mov cl, byte [eax]
test cl, cl
je 0x406596
cmp cl, 0x22
jne 0x406512
cmp byte [eax + 2], 0x3a
jne 0x406518
cmp cl, cl
je 0x406596
cmp byte [eax + 1], 0x3a
je 0x406596
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406547
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406547
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_the_specified_install_path_does_not_contain_a_drive_letter_designator.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0xc]
push str.Installation_package_failed_to_install_due_to_missing_drive_letter_specification_in_the_installation_path.
push 0xfffffffffffffff7
push 3
push 1
push edx
call fcn.0040bd80
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x24]
push edx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405930
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x406588
push eax
call fcn.0040bef2
add esp, 4
mov eax, 0xfffffff7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edx + 0x31c]
test eax, eax
je 0x4065f5
cmp byte [eax], 0
je 0x4065f5
xor eax, eax
mov ecx, 0x80
mov edi, 0x420070
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x31c]
push 0x1f6
push eax
push 0x420070
call fcn.0040c870
mov edi, 0x420070
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4065d2
mov ecx, dword [str._Setup]
mov dx, word [0x41a234]
mov al, byte [0x41a236]
mov dword [edi], ecx
mov word [edi + 4], dx
mov byte [edi + 6], al
mov eax, 0x420070
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406600
sub eax, edx
add eax, 2
push eax
call fcn.0040c292
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x320], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x320]
add esp, 4
test edx, edx
jne 0x4066ae
mov ecx, dword [eax + 0x260]
test ecx, ecx
je 0x40665f
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x40665f
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_of_memory_allocation_failure.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Installation_package_failed_during_memory_allocation.
push 0xfffffffffffffff3
push 3
push 1
push eax
call fcn.0040bd80
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x24]
push eax
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405930
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x4066a0
push eax
call fcn.0040bef2
add esp, 4
mov eax, 0xfffffff3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x420070
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4066b3
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x3d8]
rep stosd dword es:[edi], eax
push 0x105
lea ecx, [esp + 0x3dc]
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esp + 0xc]
test eax, eax
mov eax, dword [edx + 0x25c]
jg 0x406784
test eax, eax
jne 0x40678c
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406729
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406729
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_determine_its_name_or_location.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call ebx
mov edx, dword [esp + 0xc]
push str.Installation_package_could_not_determine_its_name_or_location.
push eax
push 3
push 1
push edx
mov dword [esp + 0x30], eax
call fcn.0040bd80
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405930
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x407dc3
push eax
call fcn.0040bef2
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x406812
lea eax, [esp + 0x3d8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406796
sub eax, esi
dec eax
js 0x4067b6
mov cl, byte [esp + eax + 0x3d8]
cmp cl, 0x5c
je 0x4067b6
cmp cl, 0x3a
je 0x4067b6
dec eax
jns 0x4067a2
mov ecx, dword [edx + 0x258]
test ecx, ecx
jne 0x4067d7
mov edx, dword [edx + 0x318]
push edx
lea eax, [esp + eax + 0x3dd]
push eax
call fcn.00404a70
add esp, 8
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406804
push eax
call fcn.0040bef2
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [edx + 0x328]
test al, al
jne 0x406873
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406847
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406847
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_doesnt_have_valid_instance_ID.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call ebx
push str.Installation_package_doesnt_have_valid_instance_ID.
push eax
push 3
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push 1
push eax
call fcn.0040bd80
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x24]
push edx
jmp 0x406750
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x406940
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 1
jne 0x4068cb
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4068cb
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4068b8
push 0x50010
push 0x420070
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator__or_download_WinSock2_for_Windows_95_at_nhttp:__www.microsoft.com_windows95_downloads_contents_wuadmintools_s_wunetworkingtools_w95sockets2_default.asp___nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call ebx
push eax
mov eax, dword [esp + 0x14]
push 3
push 1
push eax
jmp 0x4068fd
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4068ec
push 0x50010
push 0x420070
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call ebx
mov ecx, dword [esp + 0x10]
push eax
push 3
push 1
push ecx
call fcn.0040bd80
add esp, 0x14
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406932
push eax
call fcn.0040bef2
add esp, 4
mov eax, 0xffffffe6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x14]
cmp ecx, 1
jne 0x4069a7
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x406a2e
push eax
call fcn.004057b0
add esp, 4
test eax, eax
je 0x406a2e
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x40699c
push eax
call fcn.0040bef2
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 2
je 0x406a2e
push str.Unknown_operating_system_version.
push 0xffffffffffffffe7
push 2
push 3
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x24c]
add esp, 0x14
test ecx, ecx
jne 0x406a2e
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4069f3
push 0x50010
push 0x420070
push str.The_Agent_cannot_be_installed_because_this_installation_nprogram_cannot_determine_the_which_OS_is_on_this_system._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406a20
push eax
call fcn.0040bef2
add esp, 4
mov eax, 0xffffffe7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1b8]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x1bc]
push edx
push str.TEMP
stosb byte es:[edi], al
call esi
test eax, eax
jle 0x406ae4
cmp eax, 0x104
jae 0x406ae4
mov al, byte [esp + 0x1b8]
test al, al
je 0x406ae4
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406a80
sub eax, edx
cmp byte [esp + eax + 0x1b7], 0x5c
jne 0x406ab0
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406aa0
sub eax, edx
mov byte [esp + eax + 0x1b7], cl
lea eax, [esp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406ae4
test al, 0x10
je 0x406ae4
lea edi, [esp + 0x1b8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406ad0
mov cx, word [0x41775c]
mov word [edi], cx
jmp 0x406af5
xor eax, eax
lea edi, [esp + 0x1b8]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [esp + 0x1b8]
test al, al
jne 0x406ba9
push 0x104
lea edx, [esp + 0x1bc]
push edx
push 0x419a74
call esi
test eax, eax
jle 0x406b98
cmp eax, 0x104
jae 0x406b98
mov al, byte [esp + 0x1b8]
test al, al
je 0x406b98
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b38
sub eax, edx
cmp byte [esp + eax + 0x1b7], 0x5c
jne 0x406b65
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b55
sub eax, edx
mov byte [esp + eax + 0x1b7], cl
lea eax, [esp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406b98
test al, 0x10
je 0x406b98
lea edi, [esp + 0x1b8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406b84
mov cx, word [0x41775c]
mov word [edi], cx
jmp 0x406ba9
xor eax, eax
lea edi, [esp + 0x1b8]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0xc]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x700]
rep stosd dword es:[edi], eax
add edx, 0x328
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x8a4]
push str.SOFTWAREKaseyaAgent_s
push eax
mov dword [esp + 0x2c], 0x105
call fcn.0040c6b6
lea ecx, [esp + 0x30]
push ecx
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x38]
lea ebx, [esp + 0x718]
lea eax, [esp + 0x8b8]
call fcn.00404f60
add esp, 0x18
test eax, eax
jne 0x406c30
mov edx, dword [esp + 0xc]
push str.An_Agent_with_same_instance_ID_is_already_installed.
push eax
push 1
push 3
push edx
mov dword [esp + 0x44], 1
mov dword [esp + 0x3c], eax
call fcn.0040bd80
add esp, 0x14
mov edi, dword [esp + 0x18]
test edi, edi
mov ebx, 1
je 0x406cd0
cmp byte [edi], 0
mov esi, edi
je 0x406c9e
jmp 0x406c50
push str.Legacy
push esi
call fcn.0040c70e
add esp, 8
test eax, eax
je 0x406c7b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c67
sub eax, edx
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x406c50
jmp 0x406c9e
mov eax, dword [esp + 0xc]
push str.Legacy_agent_is_installed_and_connects_to_the_same_server.
push 0
push ebx
push 3
push eax
call fcn.0040bd80
add esp, 0x14
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x250]
test ecx, ecx
je 0x406cc7
push str.An_exisiting_agent_already_connects_to_the_same_server.
push 0
push ebx
push 3
push eax
call fcn.0040bd80
add esp, 0x14
mov dword [esp + 0x28], 0
push edi
call fcn.0040bef2
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x406e35
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x244]
test ecx, ecx
jne 0x406d54
mov ecx, dword [eax + 0x248]
test ecx, ecx
je 0x40709c
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x40709c
push 0x50024
push 0x420070
push str.The_Agent_is_already_installed._nDo_you_want_to_reinstall_the_Agent_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
mov ecx, dword [esp + 0xc]
jne 0x406d4e
push str.Re_installation_of_the_Agent_was_stopped_by_the_user.
push 0xffffffffffffffe3
push 1
push 3
push ecx
call fcn.0040bd80
add esp, 0x14
push 0x50040
push 0x420070
push str.Installation_of_the_Agent_stopped.
jmp 0x4070d6
mov dword [ecx + 0x244], ebx
xor eax, eax
jmp 0x406d60
mov cl, byte [esp + eax + 0x700]
mov byte [esp + eax + 0x9a8], cl
inc eax
test cl, cl
jne 0x406d60
lea ecx, [esp + 0x9a8]
push 0x5c
push ecx
call fcn.0040c9a0
add esp, 8
test eax, eax
je 0x406d8d
mov byte [eax + 1], 0
mov dword [esp + 0x20], 6
xor ebx, ebx
jmp 0x406da0
xor eax, eax
jmp 0x406db0
mov cl, byte [esp + eax + 0x9a8]
mov byte [esp + eax + 0x700], cl
inc eax
test cl, cl
jne 0x406db0
mov eax, dword [esp + ebx*4 + 0x5c]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406dd0
lea edi, [esp + 0x700]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406de1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x700]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406e23
test al, 1
je 0x406e23
push 0x80
lea eax, [esp + 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x20]
inc ebx
cmp ebx, eax
jl 0x406da0
mov ebx, 1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x406eca
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x44], edx
mov eax, dword [eax + 0x31c]
push 0
lea edx, [esp + 0x44]
push edx
push 0x405470
push 0
push 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], ebx
call fcn.0040cb18
mov edi, eax
add esp, 0x18
test edi, edi
je 0x406eca
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebx
mov eax, dword [esp + 0x44]
test eax, eax
mov esi, 0xc8
je 0x406ebe
cmp esi, 0x3a98
jge 0x406ebe
push 0xa
call ebx
mov eax, dword [esp + 0x44]
add esi, 0xa
test eax, eax
jne 0x406ea7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
xor eax, eax
mov ecx, 0x28a
mov edi, 0x41f648
rep stosd dword es:[edi], eax
push 0xa27
lea eax, [esp + 0x3dc]
push eax
push 0x41f648
mov dword [0x41f444], 0xf
call fcn.0040c870
push 0x41991c
push 0x41f648
call fcn.00408b10
xor esi, esi
add esp, 0x14
cmp eax, esi
je 0x4086d6
push 0x41f648
mov byte [eax + 2], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x4086d6
cmp eax, esi
je 0x4086d6
lea ecx, [esp + 0x3d8]
push str.Temporary_Internet_Files
push ecx
call fcn.00408b10
add esp, 8
test eax, eax
je 0x406f6a
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x406f6a
cmp dword [eax + 8], 4
jne 0x406f6a
cmp dword [eax + 0x98], esi
je 0x4086d6
lea edx, [esp + 0x3d8]
push 0x41a1ac
push edx
call fcn.0040c618
mov edi, eax
add esp, 8
cmp edi, esi
mov dword [esp + 0x18], edi
jne 0x407108
call fcn.0040c9cd
cmp dword [eax], 2
jne 0x40700e
call fcn.00401ce0
test eax, eax
je 0x40700e
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40700e
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebx
push str.Wow64RevertWow64FsRedirection
push esi
mov edi, eax
call ebx
test edi, edi
mov ebx, eax
je 0x406ffe
test ebx, ebx
je 0x406ffe
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x406ffe
lea ecx, [esp + 0x3d8]
push 0x41a1ac
push ecx
call fcn.0040c618
mov edx, dword [esp + 0x24]
add esp, 8
push edx
mov dword [esp + 0x1c], eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x18]
mov ebx, 1
xor esi, esi
cmp edi, esi
jne 0x407108
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x407042
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
call fcn.0040c9cd
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Installation_package_could_not_be_accessed.
push eax
push 3
push ebx
push ecx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x40708b
cmp dword [eax + 0x258], esi
jne 0x40708b
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
jmp 0x407fe9
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0xffffffffffffffe3
push ebx
push 3
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x258]
add esp, 0x14
test ecx, ecx
jne 0x4070de
mov ecx, dword [eax + 0x250]
test ecx, ecx
jne 0x4070de
push 0x50040
push 0x420070
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
mov eax, 0xffffffe3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x78]
push ecx
push edi
call fcn.0040b4f0
lea edx, [esp + 0x80]
push edx
push edi
call fcn.0040b570
add esp, 0x10
test eax, eax
jge 0x4071ae
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x407156
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
call fcn.0040c9cd
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Failed_to_read_setup_file_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x40719f
cmp dword [eax + 0x258], esi
jne 0x40719f
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_read_from_the_installation_package.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x407fe5
lea ecx, [esp + 0xa0]
push str.KAgentSilent.exe
push ecx
call fcn.0040c70e
add esp, 8
test eax, eax
je 0x407241
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x4071f1
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
call fcn.0040c9cd
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.Failed_to_find_setup_file_from_the_installation_package.
push edx
push 3
push ebx
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x407fdb
cmp dword [eax + 0x258], esi
jne 0x407fdb
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push esi
jmp 0x407fd5
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
test cl, cl
jne 0x407251
lea edi, [esp + 0x2c0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407270
mov eax, dword [str.KAgentSilent.exe]
mov ecx, dword [0x419770]
mov edx, dword [0x419774]
mov dword [edi], eax
mov eax, dword [0x419778]
mov dword [edi + 4], ecx
mov cl, byte [0x41977c]
mov dword [edi + 8], edx
lea edx, [esp + 0x2c0]
mov dword [edi + 0xc], eax
push 0x4196b8
push edx
mov byte [edi + 0x10], cl
call fcn.0040c618
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x407390
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40730e
test al, 1
je 0x40730e
push 0x80
lea ecx, [esp + 0x2c4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x2c0]
push 0x4196b8
push edx
call fcn.0040c618
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x407390
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x407338
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
call fcn.0040c9cd
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x407381
cmp dword [eax + 0x258], esi
jne 0x407381
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x407fe5
mov ecx, 0x28a
xor eax, eax
mov edi, 0x41f648
rep stosd dword es:[edi], eax
mov edi, edi
mov cl, byte [eax + str.KAgentSilent.exe]
mov byte [eax + 0x41f648], cl
inc eax
test cl, cl
jne 0x4073a0
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x258], ebx
jne 0x4073d3
mov edi, 0x41f648
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4073c3
mov ecx, dword [0x4195f8]
mov dword [edi], ecx
mov eax, 0x41f648
lea edx, [eax + 1]
jmp 0x4073e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4073e0
sub eax, edx
lea edx, [esi + 0x135]
push edx
add esi, 0x328
push esi
lea eax, [eax + 0x41f648]
push str.__a__k__g__s__l___s_
push eax
call fcn.0040c6b6
mov edx, dword [esp + 0x1c]
mov al, byte [edx + 0x3dc]
lea ecx, [edx + 0x3dc]
add esp, 0x10
test al, al
je 0x407449
mov eax, 0x41f648
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407427
push ecx
sub eax, esi
lea ecx, [eax + 0x41f648]
push str.__v___s_
push ecx
call fcn.0040c6b6
mov edx, dword [esp + 0x18]
add esp, 0xc
mov al, byte [edx + 0x33d]
test al, al
lea esi, [edx + 0x33d]
je 0x407483
mov eax, 0x41f648
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407461
sub eax, edx
push esi
lea edx, [eax + 0x41f648]
push str.__o___s_
push edx
call fcn.0040c6b6
mov edx, dword [esp + 0x18]
add esp, 0xc
mov al, byte [edx + 0x370]
test al, al
lea esi, [edx + 0x370]
je 0x4074c2
mov eax, 0x41f648
lea edx, [eax + 1]
jmp 0x4074a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4074a0
sub eax, edx
push esi
lea eax, [eax + 0x41f648]
push str.__p___s_
push eax
call fcn.0040c6b6
mov edx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4074e8
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4074e8
mov edi, 0x41f648
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074d8
mov ecx, dword [0x4195b8]
mov dword [edi], ecx
mov eax, dword [edx + 0x3d8]
test eax, eax
je 0x407507
mov edi, 0x41f648
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074f8
mov eax, dword [0x4195b4]
mov dword [edi], eax
mov dword [esp + 0x34], 0x5c3a43
mov eax, dword [edx + 0x324]
test eax, eax
je 0x40758e
push 0x3a
push eax
call fcn.0040cff0
add esp, 8
test eax, eax
je 0x407541
mov al, byte [eax - 1]
cmp al, 0x61
mov byte [esp + 0x34], al
jl 0x407541
cmp al, 0x7a
jg 0x407541
and al, 0xdf
mov byte [esp + 0x34], al
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx + 0x324]
cmp byte [esi], 0x22
mov eax, 0x41f648
lea edx, [eax + 1]
je 0x407570
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407558
push esi
sub eax, edx
push str.__d___s_
lea edx, [eax + 0x41f648]
push edx
jmp 0x407586
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407570
push esi
sub eax, edx
push str.__d__s
lea eax, [eax + 0x41f648]
push eax
call fcn.0040c6b6
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40864e
test al, 0x10
je 0x40864e
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1b4]
push edi
push edx
mov ebx, 1
push ebx
push eax
mov dword [esp + 0x3c], 0x258
call fcn.0040c06a
push edi
mov esi, eax
call fcn.0040c2f0
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp esi, eax
je 0x407677
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x40761c
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], 0
call fcn.0040c9cd
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407668
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407668
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x407fe5
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b570
add esp, 8
test eax, eax
jge 0x407712
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x4076c1
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], 0
call fcn.0040c9cd
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407668
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407668
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x407660
lea edx, [esp + 0xa0]
push str.KaseyaD.ini
push edx
call fcn.0040c70e
add esp, 8
test eax, eax
je 0x4077ba
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x40775f
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], 0
call fcn.0040c9cd
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Failed_to_find_configuration_file_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x4077ab
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4077ab
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x407fe5
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x5f8], cl
inc eax
test cl, cl
jne 0x4077c0
lea edi, [esp + 0x5f8]
dec edi
jmp 0x4077e0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4077e0
mov ecx, dword [str.KaseyaD.ini]
mov edx, dword [0x4194d0]
mov eax, dword [0x4194d4]
mov dword [edi], ecx
lea ecx, [esp + 0x5f8]
mov dword [edi + 4], edx
push 0x4196b8
push ecx
mov dword [edi + 8], eax
call fcn.0040c618
mov esi, eax
add esp, 8
test esi, esi
jne 0x4078c1
lea edx, [esp + 0x5f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407865
test al, 1
je 0x407865
push 0x80
lea eax, [esp + 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x5f8]
push 0x4196b8
push ecx
call fcn.0040c618
mov esi, eax
add esp, 8
test esi, esi
jne 0x4078c1
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x64
call fcn.0040c9cd
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push 1
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407951
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407951
push 0x50010
jmp 0x40793f
mov eax, dword [esp + 0x1a8]
mov ecx, dword [esp + 0x1b4]
push esi
push eax
push 1
push ecx
call fcn.0040c06a
push esi
mov edi, eax
call fcn.0040c2f0
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp edi, eax
je 0x40797f
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x64
call fcn.0040c9cd
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push 1
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407951
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407951
push 0x10
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
call fcn.0040c9cd
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x5f8]
push eax
push ecx
mov dword [0x41e2c8], 0x1f4
mov dword [0x41f444], 0x5f
call fcn.0040a440
add esp, 8
cmp eax, 0xfffffffe
mov dword [esp + 0x1c], eax
je 0x407a0d
cmp eax, 0xffffffe9
je 0x407a0d
test eax, eax
je 0x407a0d
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_accessed.
push eax
push 3
push 3
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407da5
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407da5
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_contents_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407da5
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x407ac9
cmp dword [eax + 8], 4
jb 0x407ac9
mov ecx, dword [eax + 0x98]
test ecx, ecx
jne 0x407ac9
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x2c0]
push 0x117
lea edx, [esp + 0x3dc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x2c8]
push eax
call fcn.0040c870
mov edx, dword [esp + 0x18]
xor eax, eax
mov ecx, 0x28a
mov edi, 0x41f648
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
push ecx
add edx, 0x135
push edx
lea eax, [esp + 0x2d4]
push eax
push str._s__l__s__s
push 0x41f648
call fcn.0040c6b6
mov esi, dword [esp + 0x30]
xor ebx, ebx
add esp, 0x20
test esi, esi
mov dword [esp + 0x2c], ebx
je 0x407c63
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407c63
mov ecx, dword [esp + 0x28]
xor esi, esi
cmp ecx, esi
jne 0x407adf
cmp dword [eax + 0x240], esi
je 0x407c59
cmp dword [eax + 0x23c], esi
je 0x407c59
push esi
push eax
call fcn.0040b8f0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004048d0
add esp, 0xc
cmp eax, esi
je 0x407bd0
cmp eax, 0xffffffff
jne 0x407b8d
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41f444], 0x65
je 0x407b34
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
mov edx, dword [esp + 0xc]
push str.User_canceled_the_installation.
push 0xffffffffffffffff
push 1
push 3
push edx
call fcn.0040bd80
add esp, 0x14
push 0x50040
push 0x420070
push str.Installation_of_the_Agent_terminated_because_nthe_required_configuration_parameters_were_not_entered.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esp + 0xc]
push str.Configuration_parameters_are_missing_and_the__s_switch_was_used.
push eax
push 1
push 3
push edx
call fcn.0040bd80
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405930
add esp, 0x1c
mov eax, 0xffffffed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x5f8]
push edx
push eax
call fcn.0040b080
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x407c63
mov ecx, dword [esp + 0xc]
push str.Installation_of_the_Agent_terminated.
push eax
push 1
push 3
push ecx
call fcn.0040bd80
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x258]
add esp, 0x14
cmp eax, esi
jne 0x407da5
mov eax, dword [0x41f440]
cmp eax, esi
mov dword [0x41f444], 0x65
je 0x407c3e
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], esi
push 0x50040
push 0x420070
push str.Installation_of_the_Agent_terminated_because_nthe_configuration_could_not_be_updated.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407da5
push esi
push eax
call fcn.0040b8f0
add esp, 8
xor edi, edi
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
push edx
push ebx
push 0x41f648
lea eax, [esp + 0x2cc]
push eax
push ecx
call fcn.0040a790
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffec
mov dword [esp + 0x1c], esi
jne 0x407ca3
cmp edi, 4
jge 0x407cbf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x407c65
cmp esi, 0xfffffff4
jne 0x407cbf
mov edx, dword [esp + 0xc]
push edx
call fcn.00404960
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
je 0x407c65
mov esi, eax
mov eax, dword [esp + 0xc]
push str.Installation_process_returned.
push esi
push 1
push 3
push eax
call fcn.0040bd80
add esp, 0x14
test esi, esi
je 0x407e7d
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x65
je 0x407d12
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x260]
test ecx, ecx
je 0x407e47
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407e47
cmp esi, 1
jne 0x407dd0
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x54]
movzx ecx, word [esp + 0x56]
mov eax, 0x3b
sub eax, edx
imul eax, eax, 0x3e8
add eax, ecx
cmp eax, 0x2710
jae 0x407d6d
mov eax, 0x2710
jmp 0x407d79
cmp eax, 0xd6d8
jbe 0x407d79
mov eax, 0xd6d8
mov edx, dword [esp + 0xc]
push 0
push eax
push str.The_Agent_installation_has_been_scheduled._n_nPlease_wait_up_to_one_minute_for_the_installation_to_proceed.
push edx
call fcn.004049d0
mov eax, dword [esp + 0x1c]
add esp, 0x10
push str.The_installation_package_is_re_running_under_an_authorized_account
push esi
push 1
push 3
push eax
call fcn.0040bd80
add esp, 0x14
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
lea ecx, [esp + 0xc]
push eax
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0xffffffec
jne 0x407dfa
push 0x50040
push 0x420070
push str.The_installation_package_containing_the_Agent_failed_to_run_nbecause_the_Windows_NT_Task_Scheduler_is_not_running.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.The_installation_package_containing_the_Agent_failed_to_run.
push esi
push 3
jmp 0x407d9a
cmp esi, 0xffffffff
jne 0x407e27
push 0x50040
push 0x420070
push str.Installation_of_the_Agent_terminated_because_nthe_required_credentials_were_missing_or_incorrect._User_cancelled_the_nthe_installation..
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
jmp 0x407d9a
cmp esi, 2
je 0x407e47
push 0x50010
push 0x420070
push str.The_installation_package_containing_the_Agent_failed_to_run.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
cmp esi, 1
je 0x407d92
cmp esi, 2
je 0x407d92
cmp esi, 0xffffffed
jne 0x407e6b
push str.The_credentials_contained_in_the_installation_package_were_incorrect_or_missing._Agent_failed_to_run.
push esi
push 3
jmp 0x407d9a
cmp esi, 0xffffffff
jne 0x407df0
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
jmp 0x407d9a
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x700]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
push edx
stosw word es:[edi], ax
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x70c]
lea eax, [esp + 0x8ac]
mov dword [0x41e2c8], 0x64
mov dword [0x41f444], 0x63
mov dword [esp + 0x2c], 0x105
call fcn.00404f60
mov esi, eax
xor edi, edi
add esp, 0xc
cmp esi, edi
mov ebx, 1
jne 0x4085b6
cmp dword [esp + 0x24], ebx
jne 0x4085b6
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4085b6
cmp eax, 0x105
jae 0x4085b6
cmp dword [esp + 0x28], edi
jne 0x407f1c
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x240], edi
je 0x408009
push edi
lea ecx, [esp + 0x704]
push ecx
lea edx, [esp + 0x600]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x407f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x407f43
xor esi, esi
lea eax, [esp + 0x5f8]
push eax
call fcn.0040cfb5
lea ecx, [esp + 0x2c4]
push ecx
call fcn.0040cfb5
add esp, 8
cmp esi, edi
je 0x408009
mov eax, dword [0x41f440]
cmp eax, edi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x407f92
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], edi
call fcn.0040c9cd
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_moved_to_the_installation_directory.
push edx
push 3
push ebx
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x407fdb
cmp dword [eax + 0x258], edi
jne 0x407fdb
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_moved_to_the_installation_directory.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
mov ebx, dword [esp + 0x20]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
call fcn.0040c9cd
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push str.Path
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x2cc]
lea eax, [esp + 0x8ac]
mov dword [esp + 0x2c], 0x117
call fcn.00404f60
add esp, 0xc
test eax, eax
je 0x4080b7
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x258]
test eax, eax
jne 0x408073
push 0x50010
push 0x420070
push str.The_installation_path_for_the_Agent_cannot_be_found_n_nThe_Agent_cannot_be_started.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0xc]
push str.Cannot_launch_the_agent_because_the_path_could_not_be_found.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.0040bd80
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405930
add esp, 0x1c
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
xor eax, eax
jmp 0x4080c0
mov cl, byte [esp + eax + 0x2c0]
mov byte [esp + eax + 0x1b8], cl
inc eax
cmp cl, bl
jne 0x4080c0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b570
add esp, 8
test eax, eax
jne 0x4082ef
lea ecx, [ecx]
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x4e0]
rep stosd dword es:[edi], eax
cmp byte [esp + 0xa0], 0x5c
je 0x408198
cmp byte [esp + 0xa1], 0x3a
je 0x408198
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x4e0], cl
inc eax
cmp cl, bl
jne 0x408120
lea eax, [esp + 0x4e0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408140
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x4e4]
push 0x41775c
push edx
call fcn.0040ce80
lea eax, [esp + 0x4ec]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408170
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x4e8]
push eax
call fcn.0040ce80
jmp 0x4081b2
push 0x117
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x4e8]
push edx
call fcn.0040c870
lea eax, [esp + 0x4ec]
add esp, 0xc
push eax
call fcn.00408e40
lea ecx, [esp + 0x4e4]
push 0x4196b8
push ecx
call fcn.0040c618
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x408239
lea edx, [esp + 0x4e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x408222
test al, 1
je 0x408222
push 0x80
lea eax, [esp + 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x4e0]
push 0x4196b8
push ecx
call fcn.0040c618
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x408239
lea edx, [esp + 0x4e0]
push edx
push str.WARNING:_Unable_to_open_the_file__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea eax, [esp + 0xab8]
push eax
jmp 0x408280
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1b4]
push esi
push edx
push 1
push eax
call fcn.0040c06a
push esi
mov edi, eax
call fcn.0040c2f0
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp edi, eax
je 0x4082d5
lea ecx, [esp + 0x4e0]
push ecx
push str.WARNING:_Unable_to_write_the_file_content_to__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea edx, [esp + 0xab8]
push edx
call fcn.0040c6b6
call fcn.0040c9cd
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xabc]
push ecx
push edx
push 3
push 1
push eax
call fcn.0040bd80
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x260]
add esp, 0x20
cmp ecx, ebx
je 0x4082d5
cmp dword [eax + 0x258], ebx
jne 0x4082d5
push 0x50010
push 0x420070
lea ecx, [esp + 0xab8]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b570
add esp, 8
test eax, eax
je 0x4080f0
cmp dword [esp + 0x28], ebx
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x64
je 0x4084a3
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x264], ebx
je 0x40836c
push 4
lea edx, [esp + 0x5c]
push edx
push 4
push str.EnableRemoteControl
lea eax, [esp + 0x8b0]
push eax
push 0x80000002
mov dword [esp + 0x70], ebx
call fcn.00408c30
add esp, 0x18
cmp eax, ebx
jne 0x408355
mov ecx, dword [esp + 0xc]
push str.Disabled_remote_control.
push eax
push 1
push 3
push ecx
jmp 0x408364
mov edx, dword [esp + 0xc]
push str.Failed_to_disable_remote_control.
push eax
push 2
push 3
push edx
call fcn.0040bd80
add esp, 0x14
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x808]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x808]
push eax
mov dword [esp + 0x80c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4084a3
cmp dword [esp + 0x818], 2
jne 0x4084a3
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0xcb8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xcbc]
push edx
mov dword [esp + 0x28], 0x1ff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4084a3
cmp byte [esp + 0xcb8], bl
je 0x4084a3
lea eax, [esp + 0xcb8]
push str.SYSTEM
push eax
call fcn.0040c70e
add esp, 8
test eax, eax
je 0x4084a3
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x2c0]
mov byte [esp + eax + 0x1b8], cl
inc eax
cmp cl, bl
jne 0x408410
lea eax, [esp + 0x2c0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408430
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x2c4]
push 0x418cec
push edx
call fcn.0040ce80
push ebx
push ebx
lea eax, [esp + 0x2d4]
push str.KaUsrTsk.exe
push eax
call fcn.00405990
add esp, 0x1c
cmp eax, ebx
je 0x408485
mov ecx, dword [esp + 0xc]
push str.Failed_to_launch_the_service_helper_task.
push eax
push 3
push 3
push ecx
call fcn.0040bd80
add esp, 0x14
xor eax, eax
jmp 0x408490
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
cmp cl, bl
jne 0x408490
lea eax, [esp + 0x2c0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4084b0
sub eax, edx
mov edx, 0x117
sub edx, eax
push edx
lea eax, [esp + 0x2c4]
push str.AgentMon.exe
push eax
call fcn.0040ce80
mov edx, dword [esp + 0x18]
push ebx
push ebx
push str.agentmon.exe
lea ecx, [esp + 0x2d8]
push ecx
push edx
call fcn.0040a790
add esp, 0x20
cmp eax, ebx
je 0x40850a
push str.Cannot_launch_the_agent.
push eax
mov eax, dword [esp + 0x14]
push 3
push 3
push eax
call fcn.0040bd80
add esp, 0x14
mov eax, dword [0x41f440]
cmp eax, ebx
mov dword [0x41f444], 0x65
je 0x40852e
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], ebx
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x260], ebx
je 0x408565
cmp dword [eax + 0x258], ebx
jne 0x408565
cmp dword [eax + 0x254], ebx
jne 0x40856d
mov ecx, dword [eax + 0x318]
push 1
push 0x7530
push ecx
push eax
call fcn.004049d0
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp dword [eax + 0x254], ebx
je 0x40858d
call fcn.004053a0
cmp eax, ebx
je 0x40858d
mov edx, dword [esp + 0xc]
push str.Attempt_to_reboot_the_system_failed.
push eax
push 3
push 1
push edx
call fcn.0040bd80
add esp, 0x14
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x41f440]
cmp eax, edi
mov dword [0x41e2c8], ebx
mov dword [0x41f444], 0x65
je 0x4085e0
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], edi
mov edx, dword [esp + 0xc]
push str.Installation_of_the_Agent_Failed.
push esi
push 3
push ebx
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x408622
cmp dword [eax + 0x258], edi
jne 0x408622
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_Failed
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movsx edx, byte [esp + 0x34]
push edx
push str.Installation_of_the_Agent_failed_because_nthe_target_installation_drive___c:__could_not_be_found_on_this_computer.
push 0x41f648
call fcn.0040c6b6
add esp, 0xc
push 0x50010
push 0x420070
push 0x41f648
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [esp + 0x34]
push eax
push str.Cannot_install_agent_on_machine_because_the_target_installation_drive___c:__is_missing.
push 0x41f648
call fcn.0040c6b6
mov ecx, dword [esp + 0x18]
push 0x41f648
push 0xffffffffffffffe2
push 3
push 3
push ecx
call fcn.0040bd80
mov ebx, dword [esp + 0x38]
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x3c]
lea esi, [esp + 0x38]
call fcn.00405930
add esp, 0x28
mov eax, 0xffffffe2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x3d8]
push 0x5c
push ecx
call fcn.0040c9a0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x408791
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x65
je 0x408720
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], ebx
mov edx, dword [esp + 0xc]
push str.Failed_to_locate_the_installation_name_for_scheduling.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x408767
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x408767
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_name_of_the_installation_file_was_not_found.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
add esp, 8
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc ebx
xor eax, eax
jmp 0x4087a0
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
test cl, cl
jne 0x4087a0
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087b7
lea edi, [esp + 0x2c0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4087c8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
lea edx, [esp + 0x2c4]
push edx
lea eax, [esp + 0x3e0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x41f440]
test eax, eax
mov dword [0x41e2c8], 1
mov dword [0x41f444], 0x65
je 0x40882c
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f440], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x408855
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
push ebx
mov dword [ecx + 0x98], 1
xor eax, eax
push str._s__s
mov ecx, 0x28a
mov edi, 0x41f648
push 0x41f648
rep stosd dword es:[edi], eax
call fcn.0040c6b6
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0x41f648
lea eax, [esp + 0x2dc]
push eax
push ecx
call fcn.0040a790
add esp, 0x24
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4088f2
mov edx, dword [esp + 0xc]
push str.Local_copy_of_the_installation_package_could_not_be_accessed.
push eax
push 3
push 1
push edx
call fcn.0040bd80
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x4088f2
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4088f2
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nthe_local_copy_of_the_installation_package_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ebx, ebx
jmp 0x407da9
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x40891e
push 0x50010
push 0x420070
push str.Installation_of_the_Agent_failed_because_nanother_instance_of_this_installation_package_is_already_running.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405930
mov eax, dword [esp + 0x2c]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10