Function at 0x4210d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473f20
push 0x459fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5cc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0xe8], al
mov ecx, 0x13
lea edi, [ebp - 0xe7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x33c], bl
mov ecx, 0x13
xor eax, eax
lea edi, [ebp - 0x33b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x2ec], ebx
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x2e8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4d8], 0x94
mov dword [ebp - 0x4d4], ebx
mov ecx, 0x23
lea edi, [ebp - 0x4d0]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x5dc], al
mov ecx, 0x40
lea edi, [ebp - 0x5db]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041c090
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x4211bc
cmp dword [0x4cd608], ebx
jne 0x4211d0
push 1
push 0x41c1f0
push str..pipekaseyaAgent
mov ecx, 0x4cb554
call fcn.0044e660
test eax, eax
jne 0x4211d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0041cf30
lea ecx, [ebp - 0x5dc]
push ecx
call fcn.0041c6a0
add esp, 4
mov edi, 0x4cb158
mov esi, 0x486214
mov edi, edi
mov edx, dword [esi]
push edx
lea eax, [ebp - 0x5dc]
push eax
push 0x4697b0
push edi
call fcn.00458ee7
add esp, 0x10
add esi, 4
add edi, 0x104
cmp esi, 0x486220
jl 0x4211f0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0x18]
mov dword [0x4cb47c], ecx
mov ecx, 0x14
xor eax, eax
mov edi, 0x4cb4b0
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x30]
push edx
call fcn.0045a1c9
lea eax, [ebp - 0x30]
push eax
call fcn.0045b026
mov dword [ebp - 0x90], eax
push eax
push 0x473ef0
push 0x50
push 0x4cb4b0
call fcn.0045b00b
add esp, 0x18
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x444]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x444]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x1c], eax
push 0x5c
lea edx, [ebp - 0x444]
push edx
call fcn.0045a180
add esp, 8
mov dword [ebp - 0x40], eax
cmp eax, ebx
je 0x4212a7
inc eax
mov dword [ebp - 0x40], eax
mov byte [eax], 0
jmp 0x4212c0
mov ax, word [0x472f84]
mov word [ebp - 0x444], ax
mov cl, byte [0x472f86]
mov byte [ebp - 0x442], cl
lea edi, [ebp - 0x444]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4212c7
mov edx, dword [str.lastChk.txt]
mov dword [edi], edx
mov eax, dword [0x472f7c]
mov dword [edi + 4], eax
mov ecx, dword [0x472f80]
mov dword [edi + 8], ecx
push 0x473eec
lea edx, [ebp - 0x444]
push edx
call fcn.00459902
add esp, 8
mov ebx, eax
mov dword [ebp - 0x88], ebx
test ebx, ebx
je 0x4214f7
lea eax, [ebp - 0x28]
push eax
push 0x472f74
push ebx
call fcn.0045b709
mov esi, eax
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0045a1c9
add esp, 0x10
cmp esi, 1
jne 0x4214ee
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x28]
jl 0x4214ee
mov eax, dword [str.Agent_stopped]
mov dword [ebp - 0x2e8], eax
mov ecx, dword [0x4736e0]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [0x4736e4]
mov dword [ebp - 0x2e0], edx
mov ax, word [0x4736e8]
mov word [ebp - 0x2dc], ax
push 0x50
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0xe8]
push edx
call fcn.0041bd90
add esp, 0xc
cmp eax, esi
jne 0x4213bd
lea eax, [ebp - 0x2e8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421396
sub eax, edx
lea ecx, [ebp - 0xe8]
push ecx
push str._v_s
lea edx, [ebp + eax - 0x2e8]
push edx
call fcn.00458ee7
add esp, 0xc
jmp 0x421408
lea edi, [ebp - 0x2e8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4213c4
mov eax, dword [str.._Version_unavailable]
mov dword [edi], eax
mov ecx, dword [0x4736c0]
mov dword [edi + 4], ecx
mov edx, dword [0x4736c4]
mov dword [edi + 8], edx
mov eax, dword [0x4736c8]
mov dword [edi + 0xc], eax
mov ecx, dword [0x4736cc]
mov dword [edi + 0x10], ecx
mov dx, word [0x4736d0]
mov word [edi + 0x14], dx
mov byte [ebp - 0xe8], 0
lea eax, [ebp - 0x2e8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421411
sub eax, edx
push str.._Agent_start_time_unavailable_due_to_unexpected_shutdown._n
lea eax, [ebp + eax - 0x2e8]
push eax
call fcn.00458ee7
mov dword [ebp - 0x2ec], 1
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2ec]
push edx
call fcn.0043d8e0
push str.Agent_started_:_restart_after_unexpeced_shutdown
lea eax, [ebp - 0x2e8]
push eax
call fcn.00458ee7
add esp, 0x18
mov al, byte [ebp - 0xe8]
test al, al
je 0x421497
lea eax, [ebp - 0x2e8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421470
sub eax, edx
lea ecx, [ebp - 0xe8]
push ecx
push str._v_s
lea edx, [ebp + eax - 0x2e8]
push edx
call fcn.00458ee7
add esp, 0xc
jmp 0x4214b7
lea edi, [ebp - 0x2e8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4214a0
mov ecx, 5
mov esi, str.._Version_unavailable.
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2e8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4214c0
mov ax, word [0x46b328]
mov word [edi], ax
mov dword [ebp - 0x2ec], 1
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2ec]
push edx
call fcn.0043d8e0
add esp, 8
push ebx
call fcn.00459521
add esp, 4
lea eax, [ebp - 0x444]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x421547
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x98], eax
cmp eax, 0xffffffff
je 0x421547
test al, 1
je 0x421547
push 0x80
lea edx, [ebp - 0x444]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x444]
push eax
call esi
mov dword [ebp - 0x34], eax
call fcn.0041c120
mov dword [ebp - 0x94], eax
push eax
push str.Agent_started____u_seconds_elapsed_since_system_started
lea ecx, [ebp - 0x2e8]
push ecx
call fcn.00458ee7
push 0x50
lea edx, [ebp - 0x33c]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.0041bd90
add esp, 0x18
cmp eax, 1
jne 0x4215b7
lea eax, [ebp - 0x2e8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421590
sub eax, edx
lea ecx, [ebp - 0xe8]
push ecx
push str._v_s
lea edx, [ebp + eax - 0x2e8]
push edx
call fcn.00458ee7
add esp, 0xc
jmp 0x4215d7
lea edi, [ebp - 0x2e8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4215c0
mov ecx, 5
mov esi, str.._Version_unavailable.
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2e8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4215e0
mov ax, word [0x46b328]
mov word [edi], ax
mov dword [ebp - 0x2ec], 1
lea ecx, [ebp - 0x2ec]
push ecx
call fcn.0043e010
add esp, 4
mov ecx, 0xfb90
xor eax, eax
mov edi, 0x48bff8
rep stosd dword es:[edi], eax
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov al, byte [0x4cae38]
test al, al
jne 0x42164e
push str.KEventLog.dll
lea edx, [ebp - 0x5dc]
push edx
push 0x4697b0
push 0x4cae38
call fcn.00458ee7
add esp, 0x10
mov al, byte [0x4cae38]
test al, al
je 0x421662
push 0x4cae38
mov ecx, 0x4cc860
call fcn.00433440
mov esi, eax
mov dword [ebp - 0x20], esi
xor ebx, ebx
cmp esi, ebx
jne 0x421683
push str.KEventLog.dll
push str._s_is_loaded.
lea eax, [ebp - 0x2e8]
push eax
call fcn.00458ee7
add esp, 0xc
jmp 0x42169d
push esi
push str.KEventLog.dll
push str._s_is_not_loaded._Return_code:__x.
lea ecx, [ebp - 0x2e8]
push ecx
call fcn.00458ee7
add esp, 0x10
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0x4cae38
call fcn.0044c5e0
add esp, 0xc
test eax, eax
jne 0x421712
mov eax, dword [ebp - 0x24]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x2c]
movzx edx, ax
push edx
shr eax, 0x10
push eax
push str._Version__d._d._d._d.
lea eax, [ebp - 0xe8]
push eax
call fcn.00458ee7
add esp, 0x18
lea eax, [ebp - 0xe8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4216e8
sub eax, edx
lea edi, [ebp - 0x2e8]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4216f8
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x42175d
lea edi, [ebp - 0x2e8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421720
mov ecx, dword [str._Version_unavailable.]
mov dword [edi], ecx
mov edx, dword [0x4738d0]
mov dword [edi + 4], edx
mov eax, dword [0x4738d4]
mov dword [edi + 8], eax
mov ecx, dword [0x4738d8]
mov dword [edi + 0xc], ecx
mov edx, dword [0x4738dc]
mov dword [edi + 0x10], edx
mov ax, word [0x4738e0]
mov word [edi + 0x14], ax
lea edi, [ebp - 0x2e8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421764
mov cx, word [0x46b328]
mov word [edi], cx
mov dword [ebp - 0x2ec], 1
lea edx, [ebp - 0x2ec]
push edx
call fcn.0043e010
add esp, 4
or esi, 0xffffffff
mov dword [ebp - 0x20], esi
mov al, byte [0x4cb048]
test al, al
jne 0x4217c5
push str.LogParser.dll
lea eax, [ebp - 0x5dc]
push eax
push 0x4697b0
push 0x4cb048
call fcn.00458ee7
add esp, 0x10
mov al, byte [0x4cb048]
test al, al
je 0x4217d9
push 0x4cb048
mov ecx, 0x4ccf98
call fcn.0043e080
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
jne 0x4217f8
push str.LogParser.dll
push str._s_is_loaded.
lea ecx, [ebp - 0x2e8]
push ecx
call fcn.00458ee7
add esp, 0xc
jmp 0x421812
push esi
push str.LogParser.dll
push str._s_is_not_loaded._Return_code:__x.
lea edx, [ebp - 0x2e8]
push edx
call fcn.00458ee7
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x4cb048
call fcn.0044c5e0
add esp, 0xc
test eax, eax
jne 0x42188a
mov eax, dword [ebp - 0x24]
movzx edx, ax
push edx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x2c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._Version__d._d._d._d.
lea edx, [ebp - 0xe8]
push edx
call fcn.00458ee7
add esp, 0x18
lea eax, [ebp - 0xe8]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421860
sub eax, edx
lea edi, [ebp - 0x2e8]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x421870
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4218ce
lea edi, [ebp - 0x2e8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421891
mov eax, dword [str._Version_unavailable.]
mov dword [edi], eax
mov ecx, dword [0x4738d0]
mov dword [edi + 4], ecx
mov edx, dword [0x4738d4]
mov dword [edi + 8], edx
mov eax, dword [0x4738d8]
mov dword [edi + 0xc], eax
mov ecx, dword [0x4738dc]
mov dword [edi + 0x10], ecx
mov dx, word [0x4738e0]
mov word [edi + 0x14], dx
lea edi, [ebp - 0x2e8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4218d5
mov ax, word [0x46b328]
mov word [edi], ax
mov dword [ebp - 0x2ec], 1
lea ecx, [ebp - 0x2ec]
push ecx
call fcn.0043e010
add esp, 4
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp eax, ebx
jne 0x4219c5
push str.online.ico
push 0x66
push esi
call fcn.00415740
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], 0x41f770
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], eax
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x6c], eax
push 1
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], str.AgentMon
mov dword [0x4cb478], esi
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4219c5
mov ecx, 0x14
mov esi, str.ERROR:_Unable_to_start_Agent_due_a_failure_while_registering_its_window_class._n
lea edi, [ebp - 0x2e8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2ec], 1
lea eax, [ebp - 0x2ec]
push eax
call fcn.0043e010
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call fcn.00459f32
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x88080008
push str.Virtual_System_Administrator_Agent
push str.AgentMon
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4cb474], eax
mov dword [ebp - 0x4d8], 0x94
lea edx, [ebp - 0x4d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x4c8]
cmp ecx, 1
jne 0x421a21
cmp eax, ebx
je 0x421a21
mov eax, dword [0x4cb474]
push eax
call fcn.00432d70
add esp, 4
jmp 0x421a2f
cmp ecx, 2
jne 0x421a32
cmp eax, ebx
je 0x421a32
call fcn.004332c0
mov dword [ebp - 0x1c], eax
call fcn.0044b760
mov dword [ebp - 0x1c], eax
push str.____Agent_started____
call fcn.00432720
add esp, 4
mov dword [ebp - 4], 1
mov edi, edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x421a77
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x421a50
mov dword [ebp - 4], ebx
jmp 0x421a98
mov dword [ebp - 4], 0xffffffff
call fcn.00421ae5
mov esi, 0x4cb464
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
nop
cmp dword [esi], ebx
je 0x421ac5
push ebx
push esi
call edi
cmp eax, ebx
je 0x421ac5
push eax
call fcn.0045932f
add esp, 4
add esi, 4
cmp esi, 0x4cb470
jl 0x421ab0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret