Function at 0x4080c0
Capabilities:
Check mutex on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Move file

Disassembly:
push 8
push 0x690
mov eax, 0x450b6f
call fcn.0044fa95
mov byte [ebp - 0x650], dl
mov byte [ebp - 0x654], cl
xor eax, eax
lea ecx, [ebp - 0x330]
push ecx
push eax
push eax
push 0x1c
push eax
mov dword [ebp - 0x33c], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40812e
mov ecx, dword [0x46ba90]
cmp ecx, 0x46ba90
je 0x40812e
test byte [ecx + 0x1c], 4
je 0x40812e
push eax
lfence
mov eax, dword [0x46ba90]
mov edx, 0x45ff40
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.00407e06
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x52c], 0xf
mov dword [ebp - 0x540], eax
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], eax
mov byte [ebp - 0x540], al
lea eax, [ebp - 0x330]
push eax
call fcn.00401bec
and dword [ebp - 4], 0
lea ecx, [ebp - 0x540]
push str.CheckPointEndpointClientUI_tiny.log
call fcn.0040aa6b
mov byte [ebp - 4], 1
lea eax, [ebp - 0x540]
cmp dword [ebp - 0x52c], 0x10
xorps xmm0, xmm0
push 0xf
cmovae eax, dword [ebp - 0x540]
xor ecx, ecx
mov dword [ebp - 0x358], ecx
pop esi
mov dword [ebp - 0x348], ecx
mov byte [ebp - 0x358], cl
lea ecx, [ebp - 0x358]
push eax
movlpd qword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x344], esi
call fcn.00401bec
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x378], eax
lea ecx, [ebp - 0x378]
push str.root
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], esi
mov byte [ebp - 0x378], al
call fcn.00401bec
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x340], 5
push ecx
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x338], 0x1400000
push ecx
sub esp, 0x18
lea esi, [ebp - 0x358]
mov ecx, esp
xor eax, eax
mov byte [ebp - 0x334], al
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x378]
push eax
call fcn.0040ade7
mov edx, esi
lea ecx, [ebp - 0x3b0]
call fcn.004124a7
xor edi, edi
add esp, 0x24
inc edi
mov ecx, edi
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x33c], ecx
lea ecx, [ebp - 0x378]
call fcn.00401bc6
mov ecx, esi
call fcn.00401bc6
mov ecx, dword [ebp - 0x3b0]
mov eax, edi
add ecx, 0x2c
xchg dword [ecx], eax
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x380]
call fcn.0040a4c8
mov byte [ebp - 4], 7
call fcn.0040731c
push ecx
push ecx
mov edx, esp
mov esi, eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x380]
mov dword [edx], ecx
mov ecx, esi
mov eax, dword [ebp - 0x37c]
mov dword [edx + 4], eax
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], eax
call fcn.0040720c
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x37c]
test ecx, ecx
je 0x4082e1
call fcn.00402298
sub esp, 0x18
xor eax, eax
mov ecx, esp
push str._Y__m__d__T._e_t:__5t___10_n____5_l___v_____
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
call fcn.00401bec
xor esi, esi
mov ecx, esi
call fcn.0040744c
add esp, 0x18
call fcn.0040731c
push eax
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x340], eax
call fcn.0040a62c
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + 0x94]
mov dword [ebp - 0x65c], ecx
mov eax, dword [ecx]
cmp eax, ecx
je 0x40834f
mov edx, dword [eax + 0x20]
mov ecx, edi
add edx, 0x2c
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, ecx
cmp ecx, dword [ebp - 0x65c]
jne 0x408339
mov eax, dword [ebp - 0x340]
push dword [ebp - 0x634]
mov dword [eax + 0xd4], edi
call fcn.0042d25a
pop ecx
call fcn.0040731c
push eax
lea ecx, [ebp - 0x65c]
mov dword [ebp - 0x340], eax
call fcn.0040a62c
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + 0x94]
mov dword [ebp - 0x634], ecx
mov eax, dword [ecx]
cmp eax, ecx
je 0x4083ac
mov edx, dword [eax + 0x20]
mov ecx, edi
add edx, 0x30
xchg dword [edx], ecx
mov ecx, dword [eax]
mov eax, ecx
cmp ecx, dword [ebp - 0x634]
jne 0x408396
mov eax, dword [ebp - 0x340]
push dword [ebp - 0x65c]
mov dword [eax + 0xd8], edi
call fcn.0042d25a
pop ecx
mov ecx, dword [ebp - 0x3ac]
test ecx, ecx
je 0x4083d3
call fcn.00402298
mov dword [ebp - 4], esi
jmp 0x4083f4
call fcn.0040731c
sub esp, 0x14
mov dword [ebp - 0x384], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov edi, esp
mov dword [ebp - 0x380], 0x6e
mov dword [ebp - 0x37c], str.InstallationWrapper
lea esi, [ebp - 0x384]
mov ecx, dword [eax + 0x114]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d7d8
mov byte [ebp - 4], 9
mov eax, dword [0x46ba90]
mov esi, 0x46ba90
cmp eax, esi
je 0x40845d
test byte [eax + 0x1c], 1
je 0x40845d
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.00407d99
pop ecx
pop ecx
and dword [ebp - 0x638], 0
call fcn.0040194f
or dword [ebp - 0x504], 0xffffffff
mov cl, al
xor eax, eax
mov byte [ebp - 0x334], cl
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], eax
mov byte [ebp - 4], 0xa
test cl, cl
je 0x4084a8
call dword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
mov byte [ebp - 0x3d0], al
lea ecx, [ebp - 0x508]
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.00422b8c
test al, al
jne 0x40855d
mov eax, dword [0x46ba90]
cmp eax, esi
je 0x4084fa
test byte [eax + 0x1c], 1
je 0x4084fa
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.00407d99
pop ecx
pop ecx
push str.Failed_to_initialize_Endpoint_Setup__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
call fcn.0040731c
push str.Failed_to_initialize_Endpoint_Setup_
push 4
sub esp, 0xc
mov dword [ebp - 0x3a8], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x3a8]
mov edi, esp
mov dword [ebp - 0x3a4], 0xdf
mov dword [ebp - 0x3a0], str.InstallProcedure
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d801
jmp 0x409e63
cmp byte [ebp - 0x650], 0
jne 0x4085ff
cmp byte [ebp - 0x654], 0
jne 0x4085ff
push str.CheckPointEndpoint_Security_AgentEndpoint_Common_bincpda.exe
lea ecx, [ebp - 0x378]
call fcn.00401a04
push str.CheckPointEndpoint_SecurityEndpoint_Common_bincpda.exe
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0xb
call fcn.00401a04
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x378]
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x634], 1
call fcn.0040175e
test al, al
jne 0x408b10
lea edx, [ebp - 0x47c]
mov dword [ebp - 0x634], 1
lea ecx, [ebp - 0x634]
call fcn.0040175e
test al, al
jne 0x408b10
lea ecx, [ebp - 0x47c]
call fcn.00401a5a
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0xa
call fcn.00401a5a
push 0xf
xor eax, eax
lea ecx, [ebp - 0x528]
pop esi
mov dword [ebp - 0x528], eax
push str.___BLOB_BEGIN__
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], esi
mov byte [ebp - 0x528], al
call fcn.00401bec
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x558]
push str.___BLOB_END__
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], esi
mov byte [ebp - 0x558], al
call fcn.00401bec
push 0x5f
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xe
call fcn.0040aa07
push 0x5f
lea ecx, [ebp - 0x558]
call fcn.0040aa07
mov esi, dword [ebp - 0x518]
lea ecx, [ebp - 0x528]
call fcn.0040a9fc
mov edx, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x640]
push esi
push eax
call fcn.00401424
mov esi, dword [ebp - 0x548]
mov edi, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x634], edi
call fcn.0040a9fc
mov edx, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x640]
push esi
push eax
call fcn.00401424
mov esi, eax
pop ecx
pop ecx
test edi, edi
je 0x409e32
test esi, esi
je 0x409e32
cmp esi, edi
jbe 0x409e32
xor eax, eax
lea edi, [ebp - 0x3a8]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x3a8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040a22a
mov byte [ebp - 4], 0xf
sub esi, dword [ebp - 0x634]
mov eax, dword [ebp - 0x518]
sub esi, eax
add eax, dword [ebp - 0x634]
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x648], eax
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x408747
test byte [eax + 0x1c], 1
je 0x408747
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00407d99
pop ecx
pop ecx
push dword [ebp - 0x3d0]
lea edx, [ebp - 0x3a8]
push 0
lea ecx, [ebp - 0x64c]
call fcn.00421c28
pop ecx
pop ecx
cmp eax, 1
jne 0x409e0a
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0040a1f0
lea ecx, [ebp - 0x3a8]
mov esi, dword [eax]
lea eax, [ebp - 0x634]
push eax
call fcn.0040a1fc
lea ecx, [ebp - 0x334]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0x494]
call fcn.0040d853
xor eax, eax
mov byte [ebp - 4], 0x10
lea edi, [ebp - 0x39c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x494]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x65c]
push eax
call fcn.0040aa42
lea ecx, [ebp - 0x494]
mov esi, dword [eax]
lea eax, [ebp - 0x340]
push eax
call fcn.0040aa5a
lea ecx, [ebp - 0x655]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0x39c]
call fcn.0040d87d
lea eax, [ebp - 0x39c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040780f
push 0xf
xor eax, eax
mov byte [ebp - 4], 0x12
pop esi
mov dword [ebp - 0x378], eax
lea ecx, [ebp - 0x378]
push str.DA_CONFIG
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], esi
mov byte [ebp - 0x378], al
call fcn.00401bec
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00407852
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x15
call fcn.00401bc6
xor eax, eax
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x41c], eax
lea ecx, [ebp - 0x41c]
push str.__xml_version1.0_encodingUTF_8__
mov dword [ebp - 0x40c], eax
mov byte [ebp - 0x41c], al
call fcn.00401bec
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x41c]
push str._DA_CONFIG_
lea ecx, [ebp - 0x358]
call fcn.0040b87b
pop ecx
lea ecx, [ebp - 0x4c8]
mov byte [ebp - 4], 0x17
push ecx
mov ecx, eax
call fcn.0040aa8a
push eax
lea ecx, [ebp - 0x47c]
call fcn.0040aac5
mov edi, dword [ebp - 0x338]
or edi, 8
push str.__DA_CONFIG_
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0x18
call fcn.0040aa6b
push eax
lea ecx, [ebp - 0x3ec]
call fcn.0040aac5
or edi, 0x10
mov dword [ebp - 0x338], edi
lea ecx, [ebp - 0x47c]
call fcn.00401bc6
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x1b
call fcn.00401bc6
xor eax, eax
mov dword [ebp - 0x364], esi
mov dword [ebp - 0x378], eax
lea ecx, [ebp - 0x378]
push 0x460a84
mov dword [ebp - 0x368], eax
mov byte [ebp - 0x378], al
call fcn.00401bec
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00407852
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x1e
call fcn.00401bc6
mov ecx, dword [0x46ba90]
cmp ecx, 0x46ba90
je 0x4089a6
test byte [ecx + 0x1c], 1
je 0x4089a6
cmp dword [ebp - 0x3b4], 0x10
lea eax, [ebp - 0x3c8]
mov edx, 0x45ff40
cmovae eax, dword [ebp - 0x3c8]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push esi
pop ecx
call fcn.00407e25
add esp, 0xc
call fcn.0040731c
mov dword [ebp - 0x384], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov dword [ebp - 0x380], 0x12f
mov dword [ebp - 0x37c], str.InstallProcedure
mov eax, dword [eax + 0x114]
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x3c8]
push eax
push ecx
push ecx
mov ecx, esp
push str.Endpoint_Setup:_Found_an_URL:_
call fcn.0040d919
mov ecx, dword [ebp - 0x634]
lea esi, [ebp - 0x384]
push 2
sub esp, 0xc
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d8f0
push 9
mov edi, 0x460aac
lea ecx, [ebp - 0x3c8]
push edi
call fcn.0040a99e
mov esi, eax
lea ecx, [esi + 1]
push ecx
push edi
lea ecx, [ebp - 0x3c8]
call fcn.0040a99e
cmp esi, 0xffffffff
je 0x409da0
cmp eax, 0xffffffff
je 0x409da0
lea eax, [ebp - 0x655]
push eax
lea eax, [esi - 8]
push eax
push 8
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x434]
call fcn.0040ae68
mov edi, dword [ebp - 0x338]
or edi, 0x20
lea eax, [ebp - 0x334]
mov byte [ebp - 4], 0x1f
push eax
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x44c]
call fcn.0040ae68
or edi, 0x40
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x33c], edi
cmp byte [ebp - 0x654], 0
mov byte [ebp - 4], 0x20
je 0x408ba6
cmp dword [ebp - 0x3d8], 0x10
lea esi, [ebp - 0x3ec]
push 2
cmovae esi, dword [ebp - 0x3ec]
call fcn.00432fe8
push esi
push str.Config_Dat:_n_s_n
push eax
call fcn.004021b2
cmp dword [ebp - 0x3b4], 0x10
lea esi, [ebp - 0x3c8]
push 2
cmovae esi, dword [ebp - 0x3c8]
call fcn.00432fe8
push esi
push str.URL:_n_s_n
push eax
call fcn.004021b2
add esp, 0x20
lea ecx, [ebp - 0x44c]
call fcn.00401bc6
lea ecx, [ebp - 0x434]
call fcn.00401bc6
jmp 0x409dbb
cmp byte [ebp - 0x334], 0
je 0x408b2d
xor eax, eax
push eax
push str.Error
push str.Endpoint_already_installed._Nothing_to_do._Use____For_more_options
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Endpoint_Agent_already_installed__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
call fcn.0040731c
push str.Endpoint_Agent_already_installed_
push 4
sub esp, 0xc
mov dword [ebp - 0x3a8], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x3a8]
mov edi, esp
mov dword [ebp - 0x3a4], 0xf3
mov dword [ebp - 0x3a0], str.InstallProcedure
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d82a
lea ecx, [ebp - 0x47c]
call fcn.00401a5a
lea ecx, [ebp - 0x378]
call fcn.00401a5a
jmp 0x409e63
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x17
mov esi, eax
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x408bee
push str.Failed_to_parse_internal_data___html__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
jmp 0x408af5
push method.__IOleInPlaceSiteEx.virtual_40
push 0x136
push 0x258
mov ecx, 0x1f4
mov edx, eax
push ecx
push ecx
push 0x90080000
push 0x460b14
lea ecx, [ebp - 0x638]
call fcn.00426827
mov ecx, dword [ebp - 0x638]
test ecx, ecx
je 0x408c3d
push str.Log_function_registered
mov dword [ecx + 0x48], fcn.00408040
call fcn.00408040
pop ecx
mov ecx, dword [ebp - 0x638]
mov esi, 0x407f50
mov edx, str.closebtn
push esi
call fcn.00426e14
mov ecx, dword [ebp - 0x638]
mov edx, str.abortbtn
push esi
call fcn.00426e14
mov eax, dword [ebp - 0x638]
test eax, eax
je 0x408c7e
mov dword [eax + 0x4c], 0x407ff0
mov eax, dword [eax + 0x48]
test eax, eax
je 0x408c7e
push str.Close_Window_function_registered
call eax
pop ecx
push 0xf
xor eax, eax
lea ecx, [ebp - 0x358]
pop esi
mov dword [ebp - 0x358], eax
push str.fqdn
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], esi
mov byte [ebp - 0x358], al
call fcn.00401bec
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x378], eax
lea ecx, [ebp - 0x378]
push str.server
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], esi
mov byte [ebp - 0x378], al
call fcn.00401bec
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040794e
lea ecx, [ebp - 0x378]
call fcn.00401bc6
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x25
call fcn.00401bc6
cmp dword [ebp - 0x4cc], 0x10
lea edx, [ebp - 0x4e0]
push dword [ebp - 0x4d0]
cmovae edx, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x404]
call fcn.00401345
pop ecx
push eax
mov edx, str.Server:
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x47c]
call fcn.0040d972
pop ecx
lea ecx, [ebp - 0x404]
mov byte [ebp - 4], 0x28
call fcn.00401a5a
lea ecx, [ebp - 0x47c]
call fcn.00401bbb
mov ecx, dword [ebp - 0x638]
mov edx, str.SetServerName
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x634]
push eax
push 1
call fcn.00426ce6
lea ecx, [ebp - 0x47c]
call fcn.00401a5a
lea ecx, [ebp - 0x464]
call fcn.00401a24
xor esi, esi
mov byte [ebp - 4], 0x29
mov edi, esi
mov dword [ebp - 0x340], esi
cmp edi, 5
jge 0x409d59
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x634]
mov dword [ebp - 0x634], str.Initial_Client:_Downloading...
push eax
push 1
mov edx, str.SetStatusBoxForInitialClient
call fcn.00426ce6
push 0x80
lea eax, [ebp - 0x630]
push esi
push eax
call fcn.00430240
add esp, 0xc
lea ecx, [ebp - 0x64c]
cmp byte [ebp - 0x3d0], 0
sete al
mov byte [ebp - 0x65c], al
lea eax, [ebp - 0x3a8]
push eax
push ecx
lea ecx, [ebp - 0x6a0]
call fcn.0040d995
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 0x2a
lea edx, [ebp - 0x44c]
cmp dword [ebp - 0x438], 0x10
lea ecx, [ebp - 0x674]
push dword [ebp - 0x43c]
cmovae edx, dword [ebp - 0x44c]
call fcn.00401345
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2b
call fcn.00401bbb
cmp dword [ebp - 0x420], 0x10
lea edx, [ebp - 0x434]
push dword [ebp - 0x424]
cmovae edx, dword [ebp - 0x434]
lea ecx, [ebp - 0x47c]
mov edi, eax
call fcn.00401345
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2c
call fcn.00401bbb
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x630]
push dword [ebp - 0x634]
push edi
push eax
call fcn.00423885
lea ecx, [ebp - 0x47c]
call fcn.00401a5a
lea ecx, [ebp - 0x674]
call fcn.00401a5a
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x30
call fcn.0040a1c2
push str._temp_
lea ecx, [ebp - 0x5b0]
call fcn.00422f0e
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0x31
call fcn.00422fc8
cmp byte [ebp - 0x5ac], 0
je 0x408fb8
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x408f27
test byte [eax + 0x1c], 1
je 0x408f27
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.00407d99
pop ecx
pop ecx
lea ecx, [ebp - 0x578]
call fcn.00401bbb
mov edx, eax
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
cmp cx, si
jne 0x408f37
sub edx, edi
lea ecx, [ebp - 0x464]
sar edx, 1
push edx
push eax
call fcn.00401ac7
call fcn.0040731c
mov dword [ebp - 0x3f8], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
lea esi, [ebp - 0x3f8]
mov dword [ebp - 0x3f4], 0x19b
lea edi, [ebp - 0x370]
mov dword [ebp - 0x3f0], str.InstallProcedure
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x464]
movsd dword es:[edi], dword [esi]
push eax
push ecx
push ecx
movsd dword es:[edi], dword [esi]
mov eax, esp
push 2
sub esp, 0xc
movsd dword es:[edi], dword [esi]
mov edi, esp
mov dword [eax], str.Temp_file_was_generated_in_temp_folder_
mov dword [eax + 4], 0x29
lea esi, [ebp - 0x370]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d9b1
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0x30
call fcn.00423091
xor eax, eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x454], eax
je 0x409cd3
lea ecx, [ebp - 0x464]
call fcn.00401bbb
push 0
mov dword [ebp - 0x634], eax
lea esi, [ebp - 0x34c]
sub esp, 0x28
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x34c], eax
mov ecx, esp
sub esp, 0xc
lea eax, [ebp - 0x3d4]
mov dword [ebp - 0x348], eax
mov edi, esp
lea eax, [ebp - 0x638]
mov dword [ebp - 0x344], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040d9da
push dword [ebp - 0x634]
lea ecx, [ebp - 0x630]
call fcn.00423e53
test al, al
je 0x409cd3
mov eax, dword [0x46ba90]
mov esi, 0x46ba90
cmp eax, esi
je 0x409072
test byte [eax + 0x1c], 1
je 0x409072
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.00407d99
pop ecx
pop ecx
mov eax, dword [ebp - 0x3d4]
mov ecx, eax
inc eax
mov dword [ebp - 0x3d4], eax
cmp ecx, 0x66
jae 0x4090b2
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x634]
mov dword [ebp - 0x634], 0x46081c
push eax
push 1
mov edx, 0x460820
call fcn.00426ce6
jmp 0x409072
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x29
call fcn.00424246
mov eax, dword [0x46ba90]
cmp eax, esi
je 0x4090e5
test byte [eax + 0x1c], 1
je 0x4090e5
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.00407d99
pop ecx
pop ecx
call fcn.0040731c
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x34c], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
push ecx
push 2
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x34c]
sub esp, 0xc
mov dword [ebp - 0x348], 0x1e4
mov edi, esp
mov dword [ebp - 0x344], str.InstallProcedure
mov dword [ebp - 0x380], str.EPS.msi_downloaded
mov dword [ebp - 0x37c], 0x12
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00411e30
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x35c], str.Initial_Client:_Installing...
push eax
push 1
mov edx, str.SetStatusBoxForInitialClient
call fcn.00426ce6
lea eax, [ebp - 0x464]
mov edx, 0x460d90
push eax
lea ecx, [ebp - 0x674]
call fcn.0040d92b
pop ecx
push str.__qn
mov edx, eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x378]
call fcn.0040d9f6
pop ecx
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 0x34
call fcn.00401a5a
lea ecx, [ebp - 0x464]
call fcn.00401bbb
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00401a04
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 0x334], 0
call fcn.00401bbb
xor ecx, ecx
push ecx
mov dword [ebp - 0x35c], ecx
lea ecx, [ebp - 0x35c]
push ecx
push eax
lea ecx, [ebp - 0x334]
call fcn.004209b1
test al, al
jne 0x40923f
push str.Failed_to_download_or_verify_Windows_Installer_package__EPS.msi___n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x4f8]
call fcn.00401a5a
lea ecx, [ebp - 0x378]
call fcn.00401a5a
lea ecx, [ebp - 0x464]
call fcn.00401a5a
lea ecx, [ebp - 0x4e0]
call fcn.00401bc6
jmp 0x408af5
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x409266
test byte [eax + 0x1c], 1
je 0x409266
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00407d99
pop ecx
pop ecx
call fcn.0040731c
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x34c], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
push ecx
push 2
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x34c]
sub esp, 0xc
mov dword [ebp - 0x348], 0x204
mov edi, esp
mov dword [ebp - 0x344], str.InstallProcedure
mov dword [ebp - 0x380], str.EPS.msi_verified
mov dword [ebp - 0x37c], 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00411e30
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.00430240
mov al, byte [ebp - 0x650]
add esp, 0xc
test al, al
jne 0x4093ce
lea ecx, [ebp - 0x358]
call fcn.004015eb
mov byte [ebp - 4], 0x36
cmp dword [ebp - 0x348], 0
jne 0x409326
push str.Failed_to_find_program_files_folder_n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x358]
call fcn.00401a5a
jmp 0x40920e
lea ecx, [ebp - 0x358]
call fcn.00401bbb
push eax
mov esi, 0x104
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x409452
push 0x45fac0
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x409452
push str.CheckPointEndpoint_Security_AgentEndpoint_Common_bin_
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x409452
lea ecx, [ebp - 0x228]
call fcn.004017f6
test al, al
je 0x409448
push str.config.dat
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.004344dd
add esp, 0xc
test eax, eax
jne 0x409448
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x35
call fcn.00401a5a
mov al, byte [ebp - 0x650]
cmp dword [ebp - 0x3d8], 0x10
lea esi, [ebp - 0x3ec]
mov edi, dword [ebp - 0x3dc]
cmovae esi, dword [ebp - 0x3ec]
test al, al
je 0x40945c
lea ecx, [ebp - 0x404]
call fcn.0040151c
mov byte [ebp - 4], 0x37
mov edx, eax
mov ecx, dword [ebp - 0x338]
or ecx, 2
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x33c], ecx
lea ecx, [ebp - 0x674]
push str.config.dat
call fcn.0040d9f6
pop ecx
mov dword [ebp - 4], 0x38
mov ecx, dword [ebp - 0x338]
or ecx, 4
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x33c], ecx
mov ecx, eax
call fcn.00401bbb
jmp 0x409462
push str.Failed_to_create_our_program_files_folder_for_config.dat_n
jmp 0x409300
push str.Failed_to_create_our_program_files_folder_n
jmp 0x409300
lea eax, [ebp - 0x228]
push edi
push esi
push eax
lea ecx, [ebp - 0x380]
call fcn.0040a125
mov dword [ebp - 4], 0x39
mov eax, dword [ebp - 0x338]
test al, 4
je 0x40949b
and eax, 0xfffffffb
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x338], eax
call fcn.00401a5a
mov eax, dword [ebp - 0x338]
mov byte [ebp - 4], 0x3b
test al, 2
je 0x4094ae
lea ecx, [ebp - 0x404]
call fcn.00401a5a
cmp byte [ebp - 0x37c], 0
jne 0x4094f0
push str.Failed_to_save_config.dat_n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
cmp dword [ebp - 0x380], 0xffffffff
je 0x40920e
push dword [ebp - 0x380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40920e
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x409517
test byte [eax + 0x1c], 1
je 0x409517
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00407d99
pop ecx
pop ecx
call fcn.0040731c
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 0x34c], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
push ecx
push 2
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x34c]
sub esp, 0xc
mov dword [ebp - 0x348], 0x261
mov edi, esp
mov dword [ebp - 0x344], str.InstallProcedure
mov dword [ebp - 0x3b0], str.config.dat_saved
mov dword [ebp - 0x3ac], 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00411e30
mov byte [ebp - 4], 0x35
cmp dword [ebp - 0x380], 0xffffffff
je 0x409589
push dword [ebp - 0x380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x650], 0
je 0x409a73
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x4095bd
test byte [eax + 0x1c], 1
je 0x4095bd
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.00407d99
pop ecx
pop ecx
xor eax, eax
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
call fcn.0040151c
push str.EPS.msi
mov edx, eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x404]
call fcn.0040d9f6
pop ecx
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 0x3e
call fcn.00401a5a
lea ecx, [ebp - 0x404]
call fcn.00401bbb
lea ecx, [ebp - 0x4f8]
mov esi, eax
call fcn.00401bbb
xor edi, edi
inc edi
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4096ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x11
jne 0x40967f
lea ecx, [ebp - 0x404]
call fcn.00401bbb
lea ecx, [ebp - 0x4f8]
mov esi, eax
call fcn.00401bbb
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4096ab
push str.Failed_to_copy_EPS.msi_from_temp_folder_n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x404]
jmp 0x40931c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
mov esi, eax
call fcn.00432fe8
mov dword [esp], 0x460f94
push esi
push str.Failed_to_copy_EPS.msi_from_temp_folder_with_error:
push str._s__d__s
push eax
call fcn.004021b2
add esp, 0x14
jmp 0x409674
mov byte [ebp - 0x35c], 0
lea eax, [ebp - 0x404]
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x4f8]
push eax
call fcn.0040ad71
call fcn.0040731c
push str.Going_to_save_config_to_msi
push 2
sub esp, 0xc
mov dword [ebp - 0x34c], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x34c]
mov edi, esp
mov dword [ebp - 0x348], 0x283
mov dword [ebp - 0x344], str.InstallProcedure
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040da2f
lea ecx, [ebp - 0x4f8]
call fcn.00401bbb
lea edx, [ebp - 0x33c]
mov ecx, eax
call fcn.00424bae
test al, al
jne 0x40977e
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x40975e
test byte [eax + 0x1c], 1
je 0x40975e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x46ba90]
push eax
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x45ff40
push 0x17
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
jmp 0x409a0a
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
push eax
mov edx, str.SELECT__FROM_Binary
call fcn.00424c54
pop ecx
test al, al
jne 0x4097d6
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x4097cf
test byte [eax + 0x1c], 1
je 0x4097cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x46ba90]
push eax
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x18
mov edx, 0x45ff40
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_View__n
jmp 0x409763
lea ecx, [ebp - 0x390]
call fcn.0040151c
push str.config.dat
mov edx, eax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x358]
call fcn.0040d9f6
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x40
call fcn.00401bbb
mov ecx, dword [ebp - 0x338]
mov edx, eax
push str.CPINSTADDEXT_config.dat
call fcn.00424d2d
pop ecx
lea ecx, [ebp - 0x358]
mov byte [ebp - 0x334], al
call fcn.00401a5a
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x3e
call fcn.00401a5a
cmp byte [ebp - 0x334], 0
jne 0x40987e
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x409874
test byte [eax + 0x1c], 1
je 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x46ba90]
mov edx, 0x45ff40
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x19
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_add_local_file__n
jmp 0x409763
mov ecx, dword [ebp - 0x33c]
call fcn.00425071
test al, al
jne 0x4098cc
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x4098c2
test byte [eax + 0x1c], 1
je 0x4098c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x46ba90]
mov edx, 0x45ff40
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1a
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_config_commit__n
jmp 0x409763
mov ecx, dword [ebp - 0x338]
call fcn.0042510f
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
push eax
mov edx, str.SELECT__FROM_Property
call fcn.00424c54
pop ecx
test al, al
jne 0x409927
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x4097cf
test byte [eax + 0x1c], 1
je 0x4097cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x46ba90]
push eax
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x1b
jmp 0x4097c1
mov ecx, dword [ebp - 0x338]
mov edx, str.RECONF
push 0x46081c
call fcn.00424e61
pop ecx
test al, al
jne 0x409980
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x409976
test byte [eax + 0x1c], 1
je 0x409976
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x46ba90]
push eax
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x45ff40
push 0x1c
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_property__n
jmp 0x409763
mov ecx, dword [ebp - 0x33c]
call fcn.00425071
test al, al
jne 0x4099ce
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x4099c4
test byte [eax + 0x1c], 1
je 0x4099c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x46ba90]
mov edx, 0x45ff40
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1d
pop ecx
call fcn.00407e06
add esp, 0xc
push str.Failed_to_open_EPS.msi_for_modifications_reconf_commit__n
jmp 0x409763
lea ecx, [ebp - 0x358]
call fcn.0040151c
mov ecx, eax
call fcn.00401bbb
push 2
mov esi, eax
call fcn.00432fe8
mov dword [esp], str.EPS.msi_created_n
push esi
push str._S_s
push eax
call fcn.004021b2
add esp, 0x10
lea ecx, [ebp - 0x358]
call fcn.00401a5a
mov ecx, dword [ebp - 0x338]
test ecx, ecx
je 0x409a19
call fcn.0042510f
mov ecx, dword [ebp - 0x33c]
test ecx, ecx
je 0x409a28
call fcn.0042510f
lea ecx, [ebp - 0x390]
call fcn.0040151c
push str.config.dat
mov edx, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x358]
call fcn.0040d9f6
pop ecx
mov ecx, eax
call fcn.00401bbb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x358]
call fcn.00401a5a
lea ecx, [ebp - 0x390]
call fcn.00401a5a
jmp 0x409674
push 0xf
xor eax, eax
lea ecx, [ebp - 0x404]
pop esi
mov dword [ebp - 0x404], eax
push str.VPN_CONFIG
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f0], esi
mov byte [ebp - 0x404], al
call fcn.00401bec
lea eax, [ebp - 0x404]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00407852
lea ecx, [ebp - 0x404]
mov byte [ebp - 4], 0x44
call fcn.00401bc6
cmp dword [ebp - 0x46c], 0
je 0x409b93
xor eax, eax
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0x390], eax
lea ecx, [ebp - 0x390]
push str.VPNConfig
mov dword [ebp - 0x380], eax
mov byte [ebp - 0x390], al
call fcn.00401bec
xor eax, eax
mov byte [ebp - 4], 0x45
mov dword [ebp - 0x358], eax
lea ecx, [ebp - 0x358]
push str.SOFTWARECheckPointEndpoint_Security
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], esi
mov byte [ebp - 0x358], al
call fcn.00401bec
lea eax, [ebp - 0x47c]
mov byte [ebp - 4], 0x46
push eax
lea edx, [ebp - 0x390]
lea ecx, [ebp - 0x358]
call fcn.00401896
pop ecx
lea ecx, [ebp - 0x358]
call fcn.00401bc6
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x44
call fcn.00401bc6
mov eax, dword [0x46ba90]
mov esi, 0x46ba90
cmp eax, esi
je 0x409b98
test byte [eax + 0x1c], 1
je 0x409b98
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x1e
pop ecx
call fcn.00407d99
pop ecx
pop ecx
jmp 0x409b98
mov esi, 0x46ba90
push str.Global_MSIExecute
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x409c1c
push str.Setup_failed__since_another_installation_is_currently_in_progress_n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
call fcn.0040731c
push str.Setup_failed__since_another_installation_is_currently_in_progress
push 2
sub esp, 0xc
mov dword [ebp - 0x34c], str.F:ckp_srcEP_MiniInstallE86_40SrcCPDropper.cpp
mov ecx, dword [eax + 0x114]
lea esi, [ebp - 0x34c]
mov edi, esp
mov dword [ebp - 0x348], 0x2d7
mov dword [ebp - 0x344], str.InstallProcedure
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040da58
lea ecx, [ebp - 0x47c]
call fcn.00401bc6
jmp 0x40920e
lea eax, [ebp - 0x334]
mov byte [ebp - 0x334], 0
push eax
lea ecx, [ebp - 0x510]
call fcn.00412aac
push 0x54
lea eax, [ebp - 0x5b0]
mov byte [ebp - 4], 0x47
push 0
push eax
call fcn.00430240
add esp, 0xc
lea ecx, [ebp - 0x378]
call fcn.00401bbb
push eax
push str.msiexec.exe
lea ecx, [ebp - 0x5b0]
call fcn.004251ad
test al, al
je 0x409c9d
mov eax, dword [0x46ba90]
cmp eax, esi
je 0x409c90
test byte [eax + 0x1c], 1
je 0x409c90
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x1f
pop ecx
call fcn.00407d99
pop ecx
pop ecx
lea ecx, [ebp - 0x510]
call fcn.004022f0
jmp 0x409cc1
mov eax, dword [0x46ba90]
cmp eax, esi
je 0x409cc1
test byte [eax + 0x1c], 1
je 0x409cc1
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x20
pop ecx
call fcn.00407d99
pop ecx
pop ecx
cmp dword [ebp - 0x50c], 0
jne 0x409eab
jmp 0x409c0c
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x634]
mov dword [ebp - 0x634], str.Initial_Client:__span_style_color:_red____Failed_to_download_files__span_
push eax
push 1
mov edx, str.SetStatusBoxForInitialClient
call fcn.00426ce6
mov edi, dword [ebp - 0x340]
test edi, edi
jne 0x409d2e
lea ecx, [ebp - 0x37c]
xor eax, eax
push ecx
lea ecx, [ebp - 0x63c]
mov dword [ebp - 0x63c], eax
push ecx
mov ecx, dword [ebp - 0x638]
mov edx, str.ForceRetry
push eax
call fcn.00426ce6
push 0xffffffffffffffff
push dword [0x46d6bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x29
call fcn.00424246
inc edi
xor esi, esi
mov dword [ebp - 0x340], edi
jmp 0x408db7
mov eax, dword [0x46ba90]
cmp eax, 0x46ba90
je 0x409d80
test byte [eax + 0x1c], 1
je 0x409d80
push dword [eax + 0x14]
mov edx, 0x45ff40
push dword [eax + 0x10]
push 0x21
pop ecx
call fcn.00407d99
pop ecx
pop ecx
push str.Failed_to_download_Windows_Installer_package__EPS.msi___n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
jmp 0x409224
push str.Failed_to_parse_internal_data__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x3c8]
call fcn.00401bc6
lea ecx, [ebp - 0x3ec]
call fcn.00401bc6
lea ecx, [ebp - 0x41c]
call fcn.00401bc6
lea ecx, [ebp - 0x4c8]
call fcn.00401bc6
lea ecx, [ebp - 0x4ac]
call fcn.00401bc6
lea ecx, [ebp - 0x39c]
call fcn.0040a207
lea ecx, [ebp - 0x494]
call fcn.00401bc6
jmp 0x409e25
push str.Failed_to_authenticate_EndpointSetup__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x3a8]
call fcn.0040a207
jmp 0x409e4d
push str.Failed_to_parse_configuration_data__n
push 0x4606bc
push 2
call fcn.00432fe8
pop ecx
push eax
call fcn.004021b2
add esp, 0xc
lea ecx, [ebp - 0x558]
call fcn.00401bc6
lea ecx, [ebp - 0x528]
call fcn.00401bc6
lea ecx, [ebp - 0x508]
call fcn.00422e3f
jmp 0x409e97
lea ecx, [ebp - 0x540]
call fcn.00401bc6
mov ecx, dword [ebp - 0x1c]
call fcn.0044f9a4
ret
call fcn.00439064
int3