Function at 0x40b290
Capabilities:
Check if file exists
Delete file
Get file attributes
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5f4
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1a8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x1ac]
xor esi, esi
push eax
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x1a8]
push 0x5c
push ecx
call fcn.00414320
add esp, 8
cmp eax, esi
je 0x40b2ea
mov byte [eax + 1], 0
jmp 0x40b305
mov dx, word [0x422974]
mov al, byte [0x422976]
mov word [esp + 0x1a8], dx
mov byte [esp + 0x1aa], al
mov ebx, dword [ebp + 8]
cmp ebx, 2
jl 0x40b329
cmp ebx, 4
jle 0x40b329
cmp ebx, 0x69
jne 0x40b329
mov ecx, 0x10
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsKServer.Exe
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
jmp 0x40b33a
mov esi, str.SystemCurrentControlSetServicesVxDKaseya
lea edi, [esp + 0x20]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x2c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, eax
xor eax, eax
test edx, edx
mov ecx, 0x41
lea edi, [esp + 0xa0]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [esp + 0x18], 0x105
jne 0x40b4f8
add ebx, 0xfffffffe
cmp ebx, 0x67
mov dword [esp + 0x14], ebx
ja case.0x40b390.5
movzx eax, byte [ebx + 0x40b7c4]
jmp dword [eax*4 + 0x40b7b0]
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x42621c]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x40b3a0
push str.KasAgent.log
lea ecx, [esp + 0x1ac]
push ecx
push str._s_s
lea edx, [esp + 0x3c4]
push edx
jmp 0x40b479
xor eax, eax
mov cl, byte [eax + 0x42620c]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x40b3d0
push str.KasFirewall.log
jmp 0x40b464
xor eax, eax
jmp 0x40b3f0
mov cl, byte [eax + 0x4261fc]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x40b3f0
push str.KasStats.log
lea edx, [esp + 0x1ac]
push edx
push str._s_s
lea eax, [esp + 0x3c4]
push eax
jmp 0x40b479
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x426230]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x40b420
push str.KServer.log
lea ecx, [esp + 0x1ac]
push ecx
push str._s_s
lea edx, [esp + 0x3c4]
push edx
jmp 0x40b479
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x4261ec]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x40b450
push str.KasError.log
lea eax, [esp + 0x1ac]
push eax
lea ecx, [esp + 0x3c0]
push str._s_s
push ecx
call fcn.004142bd
add esp, 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xa4]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 0
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40b4d2
lea eax, [esp + 0xa0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b4c0
sub eax, edx
cmp eax, 1
jae 0x40b58f
xor eax, eax
jmp 0x40b4e0
mov cl, byte [esp + eax + 0x3b8]
mov byte [esp + eax + 0xa0], cl
inc eax
test cl, cl
jne 0x40b4e0
jmp 0x40b58f
lea eax, [ebx - 2]
cmp eax, 0x67
mov dword [esp + 0x14], eax
ja case.0x40b50b.5
movzx edx, byte [eax + 0x40b840]
jmp dword [edx*4 + 0x40b82c]
push str.KasAgent.log
lea eax, [esp + 0x1ac]
push eax
push str._s_s
lea ecx, [esp + 0xac]
push ecx
jmp 0x40b587
push str.KasFirewall.log
jmp 0x40b572
push str.KasStats.log
lea ecx, [esp + 0x1ac]
push ecx
push str._s_s
lea edx, [esp + 0xac]
push edx
jmp 0x40b587
push str.KServer.log
lea eax, [esp + 0x1ac]
push eax
push str._s_s
lea ecx, [esp + 0xac]
push ecx
jmp 0x40b587
push str.KasError.log
lea edx, [esp + 0x1ac]
push edx
lea eax, [esp + 0xa8]
push str._s_s
push eax
call fcn.004142bd
add esp, 0x10
lea ecx, [esp + 0xa0]
push 0x422ac4
push ecx
call fcn.004141fc
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b5fd
lea edx, [esp + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b6ee
test al, 1
je 0x40b6ee
push 0x80
lea eax, [esp + 0xa4]
push eax
call ebx
lea ecx, [esp + 0xa0]
push 0x422ac4
push ecx
call fcn.004141fc
mov esi, eax
add esp, 8
test esi, esi
je 0x40b6ee
push 2
push 0
push esi
call fcn.0041559f
push esi
call fcn.004154cf
add esp, 0x10
cmp eax, 0x4c4b40
jle 0x40b70a
cmp dword [ebp + 8], 0x69
jne 0x40b70a
lea edx, [esp + 0xa0]
push edx
lea eax, [esp + 0x2b4]
push 0x422ac0
push eax
call fcn.004142bd
add esp, 0xc
lea ecx, [esp + 0x4c0]
push ecx
lea edx, [esp + 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40b6b8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x2b0]
push eax
call edi
test eax, eax
jne 0x40b6b8
lea ecx, [esp + 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b7a7
test al, 1
je 0x40b7a7
push 0x80
lea edx, [esp + 0x2b4]
push edx
call ebx
lea eax, [esp + 0x2b0]
push eax
call edi
test eax, eax
je 0x40b7a7
push esi
call fcn.0041414f
lea ecx, [esp + 0x2b4]
push ecx
lea edx, [esp + 0xa8]
push edx
call fcn.0041605f
lea eax, [esp + 0xac]
push 0x422ac4
push eax
call fcn.004141fc
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x40b6f7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call fcn.0041559f
push esi
call fcn.004154cf
add esp, 0x10
test eax, eax
jne 0x40b7a7
mov eax, dword [esp + 0x14]
cmp eax, 0x67
ja case.0x40b722.3
movzx ecx, byte [eax + 0x40b8bc]
jmp dword [ecx*4 + 0x40b8a8]
push str.v1.0
push str._s_Timestamp____________Configuration_Change_n
push esi
call fcn.004155e8
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.v1.0
push str._s_Timestamp______Attacks__Src_IP___Src_Port__Dest_IP____Dest_Port___Protocol_Distinguished_Name_n
push esi
call fcn.004155e8
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.v1.0
push str._s_Timestamp________Receive_____Sent_____Application_n
push esi
call fcn.004155e8
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Timestamp_______________Description_n
push esi
call fcn.004155e8
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.v1.0
push str._s_Timestamp____________System_Status_or_Error_n
push esi
call fcn.004155e8
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret