Function at 0x40c630
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6d74
call fcn.00412890
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x5f1]
mov byte [esp + 0x5f0], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x13d9]
mov byte [esp + 0x13d8], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x6f8], bl
mov ecx, 0x13
lea edi, [esp + 0x6f9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x4e9]
mov byte [esp + 0x4e8], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x14e0], bl
mov ecx, 0x31f
lea edi, [esp + 0x14e1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov byte [esp + 0xab8], bl
mov ecx, 0x3f
lea edi, [esp + 0xab9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xbb8], bl
mov ecx, 0x103
lea edi, [esp + 0xbb9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xfc8], bl
mov ecx, 0x3f
lea edi, [esp + 0xfc9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2160], bl
mov ecx, 9
lea edi, [esp + 0x2161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or edx, 0xffffffff
stosb byte es:[edi], al
mov ecx, 0x1de
xor eax, eax
lea edi, [esp + 0x2188]
mov dword [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x48], 0x12c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0xd8], bl
mov ecx, 0x41
lea edi, [esp + 0xd9]
rep stosd dword es:[edi], eax
mov byte [esp + 0x10c8], bl
mov ecx, 0x81
lea edi, [esp + 0x10c9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x748], bl
mov ecx, 0x3f
lea edi, [esp + 0x749]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2d08], bl
mov ecx, 0x101c
lea edi, [esp + 0x2d09]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x9b8], bl
mov ecx, 0x3f
lea edi, [esp + 0x9b9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x12d0], bl
mov ecx, 0x40
lea edi, [esp + 0x12d1]
rep stosd dword es:[edi], eax
mov byte [esp + 0x950], bl
mov ecx, 0x19
lea edi, [esp + 0x951]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x848], bl
mov ecx, 0x41
lea edi, [esp + 0x849]
push str.KRlyCCon.log
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x6c], ebx
rep stosd dword es:[edi], eax
call fcn.0040ade0
add esp, 4
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x5f0]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x5f4]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, eax
xor ecx, ecx
mov edi, edi
mov al, byte [esp + ecx + 0x5f0]
mov byte [esp + ecx + 0x13d8], al
inc ecx
cmp al, bl
jne 0x40c890
cmp esi, ebx
jle 0x40cc28
lea edx, [esp + 0x5f0]
push 0x41f97c
push edx
call fcn.00413abd
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x4c], esi
je 0x40cc28
push 2
push 0xfffff85e
push esi
call fcn.00413b5f
push esi
push 0x7a2
lea eax, [esp + 0x2174]
push 1
push eax
call fcn.00413872
add esp, 0x1c
cmp eax, 0x7a2
jne 0x40cc1b
mov edi, str.Kaseya_Remote_Control_Data_Table
lea esi, [esp + 0x2160]
mov ecx, 0x21
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40c930
mov edi, str.Kaseya_Remote_Control_Relay_Table
lea esi, [esp + 0x2160]
mov ecx, 0x22
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40cc1b
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
lea ecx, [esp + 0x4ec]
push ecx
push str.TEMP
call esi
cmp eax, ebx
jle 0x40c9b9
cmp eax, 0x104
jae 0x40c9b9
lea eax, [esp + 0x4e8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40c960
sub eax, edx
cmp byte [esp + eax + 0x4e7], 0x5c
je 0x40c992
lea edi, [esp + 0x4e8]
dec edi
jmp 0x40c980
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c980
mov dx, word [0x41f890]
mov word [edi], dx
cmp byte [esp + 0x4e8], bl
je 0x40ca1e
xor eax, eax
mov cl, byte [esp + eax + 0x4e8]
mov byte [esp + eax + 0x848], cl
inc eax
cmp cl, bl
jne 0x40c9a1
jmp 0x40ca39
push 0x104
lea eax, [esp + 0x4ec]
push eax
push 0x421f74
call esi
cmp eax, ebx
jle 0x40ca17
cmp eax, 0x104
jae 0x40ca17
lea eax, [esp + 0x4e8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40c9e2
sub eax, edx
cmp byte [esp + eax + 0x4e7], 0x5c
je 0x40c992
lea edi, [esp + 0x4e8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ca00
mov cx, word [0x41f890]
mov word [edi], cx
jmp 0x40c992
mov byte [esp + 0x4e8], bl
mov dx, word [0x41f5b4]
mov al, byte [0x41f5b6]
mov word [esp + 0x848], dx
mov byte [esp + 0x84a], al
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x2168]
push eax
push ecx
call fcn.00405ce0
add esp, 0x10
cmp eax, 0xfffffffd
je 0x40cabe
cmp eax, 0xfffffffe
je 0x40ca7f
cmp eax, 0xffffffff
jne 0x40cade
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004089f0
push str.ERROR:_The_viewer_package_is_corrupted._The_table_header_is_invalid._Download_this_package_again._r_n
jmp 0x40cad1
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004089f0
lea ecx, [esp + 0x4f0]
push ecx
lea edx, [esp + 0x1ec]
push str.ERROR:_Unable_to_extract_viewer_files_to_the_directory__s._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x1f4]
push eax
push ecx
call fcn.0040b060
add esp, 0x1c
jmp 0x40cade
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004089f0
push str.ERROR:_The_viewer_package_is_corrupted._Unable_to_read_viewer_files._Download_this_package_again._r_n
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040b060
add esp, 0x10
cmp byte [esp + 0x2188], bl
je 0x40cc1b
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x4c]
push eax
push 0x68
lea ecx, [esp + 0x974]
push ecx
push 0x101
lea edx, [esp + 0x12fc]
push edx
push 0x100
lea eax, [esp + 0x9ec]
push eax
push 0x4074
lea ecx, [esp + 0x2d44]
push ecx
push 0x100
lea edx, [esp + 0x78c]
push edx
push 0x208
lea eax, [esp + 0x1114]
push eax
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0xb8]
push edx
push 0x100
lea eax, [esp + 0x1024]
push eax
push 0x410
lea ecx, [esp + 0xc1c]
push ecx
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0xb30]
push 0x100
push eax
lea edi, [esp + 0x2208]
call fcn.0040bae0
mov al, byte [esp + 0xc38]
add esp, 0x80
cmp al, bl
je 0x40cc1b
lea ecx, [esp + 0x4e8]
push ecx
lea edx, [esp + 0x2164]
push edx
lea eax, [esp + 0xbc0]
push 0x410
push eax
call fcn.004061d0
add esp, 0x10
test eax, eax
je 0x40cc1b
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004089f0
mov eax, dword [esp + 0x18]
push str.Unexpected_error_occurred_while_creating_path_to_components_in_temp_directory._r_n
push eax
call fcn.0040b060
add esp, 0x10
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.004136b3
add esp, 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x4c]
push eax
push 0x68
lea ecx, [esp + 0x974]
push ecx
push 0x101
lea edx, [esp + 0x12fc]
push edx
push 0x100
lea eax, [esp + 0x9ec]
push eax
push 0x4074
lea ecx, [esp + 0x2d44]
push ecx
push 0x100
mov edi, dword [ebp + 0x10]
lea edx, [esp + 0x78c]
push edx
push 0x208
lea eax, [esp + 0x1114]
push eax
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0xb8]
push edx
push 0x100
lea eax, [esp + 0x1024]
push eax
push 0x410
lea ecx, [esp + 0xc1c]
push ecx
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0xb30]
push 0x100
push eax
call fcn.0040bae0
lea eax, [esp + 0xb38]
add esp, 0x80
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cd10
sub eax, edx
cmp eax, 1
jb 0x40cd2a
cmp dword [esp + 0x14], ebx
jl 0x40cd2a
cmp dword [esp + 0x20], ebx
jge 0x40cd4d
cmp dword [esp + 0x18], ebx
jne 0x40cd57
cmp dword [esp + 0x10], ebx
je 0x40cd41
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x18], ebx
je 0x40d1ad
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x5f0]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x5f4]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x5f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cd86
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40cda8
mov cl, byte [esp + eax + 0x5f0]
cmp cl, 0x5c
je 0x40cda8
cmp cl, 0x3a
je 0x40cda8
dec eax
jns 0x40cd94
lea edx, [esp + eax + 0x5f1]
push edx
lea eax, [esp + 0x14e4]
push str._s__s_ipAddr__p_portNumber__c_portNumber__i_sessionID__w_waitTimeSeconds___k_cryptoKey__n___________r____e____f____a_OR__b__app_cmd_string_____o_appOptionStr____l____g_appWaitSeconds__n___________x__exit_cmd_string_____y_exitOptionStr____mr____d____j____v____h_____n
push eax
call fcn.00412696
lea edi, [esp + 0x14ec]
add esp, 0xc
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cdd0
mov ecx, 0xb
mov esi, str._s_ipAddr__relay_server_IP_address_or_name_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cdf0
mov ecx, 0xc
mov esi, str._p_portNumber__relay_server_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce10
mov ecx, 0xb
mov esi, str._c_portNumber__local_host_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce30
mov ecx, 8
mov esi, str._i_sessionID__relay_session_ID_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce50
mov ecx, 0x16
mov esi, str._w_waitTime__seconds_to_wait_for_response_from_listener_relay_client_via_relay_server_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce70
mov ecx, 0x16
mov esi, str._k_cryptoKey__optional_crypto_key_for_this_session__maximum_of_128_bytes_of_hex_data__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce90
mov ecx, 0x14
mov esi, str._r__perform_optional_support_specific_to_RAdmin_server_application__R_Server._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ceb0
mov ecx, 0xe
mov esi, str.________R_Server_is_restarted_with_a_specific_password._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ced0
mov ecx, 0x15
mov esi, str._e__perform_optional_support_specific_to_pcAnywhere_server_application__Awhost32._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cef0
mov ecx, 0xf
mov esi, str.________Awhost32_is_run_with_Network.bhf_on_the_command_line._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cf10
mov ecx, 6
mov esi, str._f__FTP_server_support_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cf30
mov ecx, 0xf
mov esi, str._mr__manual_remote_control_support_for_RAdmins_r_server.exe_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cf50
mov ecx, 0x11
mov esi, str._a__app_cmd_string___optional_application_command_line_string_to_run_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cf70
mov ecx, 0x17
mov esi, str._b__app_cmd_string___same_as__a_but_prepend_App_Paths_directory_location_to_application_name_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cf90
mov ecx, 0x14
mov esi, str._o__appOptionStr___option_string_to_pass_on_the_command_line_to_app__e.g.__8bit__n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cfb0
mov ecx, 0x15
mov esi, str._l__always_run_application_specified_by__a_or__b._by_default_without_this_option__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cfd0
mov ecx, 0x18
mov esi, str.________the_application_is_run_only_if_the_port_specified_in__c_is_not_listening_for_connections._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cff0
mov ecx, 0x16
mov esi, str.________it_is_assumed_that_the_port_from__c_is_opened_by_the_application_from__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d010
mov ecx, 0x17
mov esi, str._g_appWaitSeconds__seconds_to_wait_for_completion_of_the_application_specified_by__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x14e0]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d030
mov ecx, 0x1a
mov esi, str.________0_to_wait_forever._e.g._used_when_running_Windows_scripts_that_should_complete_before_proceeding._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d050
mov ecx, 0x18
mov esi, str._x__exit_cmd_string___optional_application_command_line_string_to_run_when_relay_client_exits_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d070
mov ecx, 0x11
mov esi, str._y__exitOptionStr___command_line_option_string_passed_to_exit_cmd_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d090
mov ecx, 0x12
mov esi, str._z__exitMsgStr___display_a_message_in_a_timed_dialog_box_for_2_minutes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d0b0
mov ecx, 0x12
mov esi, str._zt__exitDlgTitleStr___title_shown_in_window_frame_of_timed_dialog_box_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d0d0
mov ecx, 0x14
mov esi, str.________if_none_specified__Agent_Title_attribute_value_in_KaseyaD.ini_is_used._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d0f0
mov ecx, 0x19
mov esi, str._d_exitDelayMinutes__minutes_to_delay_before_destroying_this_relay_clients_status_display_on_exit_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d110
mov ecx, 0x13
mov esi, str._j__Enable_Ctl_Alt_Del_and_Software_Secure_Attention_Sequence_policy_helper_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x14e0]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d130
mov ecx, 0xa
mov esi, str._v__verbose_output_into_status_dialog_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x14e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d150
mov ecx, 6
mov esi, str._q__enable_detail_status_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14e0]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d170
mov ecx, 9
mov esi, str._h_or_____display_this_help_message_n
rep movsd dword es:[edi], dword [esi]
push 0x40
lea ecx, [esp + 0x5f4]
push ecx
lea edx, [esp + 0x14e8]
push edx
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x3c], ebx
je 0x40d1ca
cmp dword [esp + 0x10], ebx
jne 0x40d1ca
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004089f0
add esp, 8
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x1e4]
push str.Session_ID__d._r_n
push eax
call fcn.00412696
lea ecx, [esp + 0x90]
push ecx
call fcn.00413d52
lea edx, [esp + 0x94]
push edx
call fcn.00413d39
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x13ec]
push ecx
add eax, 4
push eax
push edx
lea eax, [esp + 0x200]
push str.Processing_for_session_ID__d_started_on__.15s._r_nPath__s__r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x208]
push ecx
push edx
call fcn.0040b060
lea eax, [esp + 0x518]
push eax
lea ecx, [esp + 0x214]
push str.Temp_path___s__r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x21c]
push edx
push eax
call fcn.0040b060
mov al, byte [esp + 0x88c]
add esp, 0x44
cmp al, bl
mov eax, str.NULL
je 0x40d276
lea eax, [esp + 0x848]
push eax
lea ecx, [esp + 0x1e4]
push str.Concate_file_path___s__r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
mov cl, byte [esp + 0x85c]
neg cl
lea edx, [esp + 0x85c]
sbb ecx, ecx
and ecx, edx
push ecx
call fcn.00402f80
add esp, 0x18
cmp eax, ebx
je 0x40d308
push eax
lea eax, [esp + 0x1e4]
push str.Failed_to_initialize_crypto_function._Error:__d_r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
call fcn.0040b060
add esp, 0x14
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ac50
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xbb8]
push str.rserv30
push ecx
call fcn.0040b150
mov edi, dword [esp + 0x58]
add esp, 8
test eax, eax
jne 0x40d4f5
cmp dword [esp + 0x30], ebx
jne 0x40d4f5
cmp dword [esp + 0x2c], ebx
jne 0x40d4f5
lea edx, [esp + 0xbb8]
push str.awhost32
push edx
call fcn.0040b150
add esp, 8
test eax, eax
jne 0x40d4b8
cmp edi, ebx
jne 0x40d4b8
lea eax, [esp + 0xbb8]
push str.winvnc
push eax
call fcn.0040b150
add esp, 8
test eax, eax
je 0x40d3ae
mov ecx, dword [str.WinVNC4.exe]
mov edx, dword [0x421394]
mov eax, dword [0x421398]
mov dword [esp + 0x28], 4
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], eax
jmp 0x40d530
lea ecx, [esp + 0xbb8]
push str.kvncviewer
push ecx
call fcn.0040b150
add esp, 8
test eax, eax
je 0x40d421
mov edx, dword [str.kVncViewer.exe]
mov eax, dword [0x421378]
mov ecx, dword [0x42137c]
mov dword [esp + 0xd8], edx
mov dx, word [0x421380]
mov dword [esp + 0xdc], eax
mov al, byte [0x421382]
lea esi, [esp + 0xfc8]
mov dword [esp + 0x28], 5
mov dword [esp + 0xe0], ecx
mov word [esp + 0xe4], dx
mov byte [esp + 0xe6], al
call fcn.0040b460
jmp 0x40d530
lea ecx, [esp + 0xbb8]
push str.vncviewer
push ecx
call fcn.0040b150
add esp, 8
test eax, eax
je 0x40d46e
mov edx, dword [str.VNCviewer.exe]
mov eax, dword [0x42135c]
mov ecx, dword [0x421360]
mov dword [esp + 0xd8], edx
mov dx, word [0x421364]
mov dword [esp + 0x28], 5
mov word [esp + 0xe4], dx
jmp 0x40d522
cmp dword [esp + 0x44], ebx
push 0x104
je 0x40d49e
lea eax, [esp + 0xbbc]
push eax
lea ecx, [esp + 0xe0]
push ecx
mov dword [esp + 0x34], 8
call fcn.00412010
add esp, 0xc
jmp 0x40d530
lea edx, [esp + 0xbbc]
push edx
lea eax, [esp + 0xe0]
push eax
call fcn.00412010
add esp, 0xc
jmp 0x40d530
mov ecx, dword [str.Awhost32.exe]
mov edx, dword [0x42134c]
mov eax, dword [0x421350]
mov dword [esp + 0xd8], ecx
mov cl, byte [0x421354]
mov dword [esp + 0x28], 6
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], eax
mov byte [esp + 0xe4], cl
jmp 0x40d530
mov edx, dword [str.rserver3.exe]
mov eax, dword [0x41f6c8]
mov ecx, dword [0x41f6cc]
mov dword [esp + 0xd8], edx
mov dl, byte [0x41f6d0]
mov dword [esp + 0x28], 3
mov byte [esp + 0xe4], dl
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], ecx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x1e4]
push str.This_relay_client_has_been_tasked_to_run__s_on_this_machine._r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
mov eax, dword [esp + 0x40]
add esp, 0x14
cmp eax, ebx
je 0x40d5a7
mov ecx, dword [esp + 0x10]
push str.Configuring_Remote_Administrator_server._r_n
push ecx
call fcn.0040b060
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x704]
push 0x41f8e0
push eax
call fcn.00412696
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x710]
push edx
call fcn.00404700
add esp, 0x1c
jmp 0x40d620
cmp dword [esp + 0x30], ebx
je 0x40d5c2
call fcn.0040b8d0
test eax, eax
je 0x40d620
mov eax, dword [esp + 0x10]
push str.RAdmin_is_not_properly_installed_on_this_machine._Unable_to_set_user_infomation._r_n
push eax
jmp 0x40d618
cmp edi, ebx
je 0x40d620
push str.awhost32.exe
call fcn.004059a0
add esp, 4
test eax, eax
je 0x40d605
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1e4]
push str.Awhost32.exe_is_already_running_and_waiting_for_connections_on_port__d._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1ec]
push eax
push ecx
call fcn.0040b060
add esp, 0x14
jmp 0x40d620
call fcn.0040b630
test eax, eax
je 0x40d620
mov edx, dword [esp + 0x10]
push str.pcAnywhere_is_not_properly_installed_on_this_machine._Unable_to_run_Awhost32.exe._r_n
push edx
call fcn.0040b060
add esp, 8
cmp byte [esp + 0xbb8], bl
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x40d91d
cmp dword [esp + 0x64], ebx
jne 0x40d655
mov eax, dword [esp + 0x14]
push 2
push eax
push str.127.0.0.1
call fcn.00406a30
add esp, 0xc
cmp eax, ebx
jg 0x40d8e9
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
mov eax, 0xc
mov dword [esp + 0x78], eax
mov dword [esp + 0x6c], eax
cmp byte [esp + 0xbb8], 0x22
mov ecx, 1
mov dword [esp + 0x90], 0x44
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
je 0x40d733
lea ecx, [esp + 0xbb8]
push str..exe
push ecx
call fcn.0040b150
add esp, 8
cmp eax, ebx
je 0x40d733
add eax, 4
lea edx, [esp + 0xbb8]
cmp edx, eax
mov byte [esp + 0x2908], 0x22
mov ecx, 1
je 0x40d6ff
mov ecx, eax
sub ecx, edx
mov dword [esp + 0x4c], ecx
mov esi, edx
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0x2909]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edx
inc ecx
mov byte [esp + ecx + 0x2908], 0x22
sub ecx, eax
lea edx, [esp + ecx + 0x2909]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x40d710
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x2908]
mov byte [esp + eax + 0xbb8], cl
inc eax
cmp cl, bl
jne 0x40d720
cmp byte [esp + 0xfc8], bl
je 0x40d76c
lea eax, [esp + 0xbb8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d746
lea ecx, [esp + 0xfc8]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xbbc]
push 0x4211c8
push edx
call fcn.00412696
add esp, 0xc
lea eax, [esp + 0xbb8]
push 0x25
push eax
call fcn.004129d0
add esp, 8
test eax, eax
je 0x40d7c3
push 0xc80
lea ecx, [esp + 0x14e4]
push ecx
lea edx, [esp + 0xbc0]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40d7c3
cmp eax, 0x410
ja 0x40d7c3
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x14e0]
mov byte [esp + eax + 0xbb8], cl
inc eax
cmp cl, bl
jne 0x40d7b0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x94]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0xbd8]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40d82f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0xbbc]
push edx
lea eax, [esp + 0x1e8]
push str.Failed_to_create_the_process_to_run__s.__Code:__d___r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040b060
add esp, 0x18
jmp 0x40d85e
lea eax, [esp + 0xbb8]
push eax
lea ecx, [esp + 0x1e4]
push str.Successfully_created_the_process_to_run__s._r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
add esp, 0x14
push 0x1f4
call esi
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x40d874
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x58]
cmp ecx, ebx
je 0x40d91d
mov eax, dword [esp + 0x40]
cmp eax, ebx
jl 0x40d8e0
push ebx
jne 0x40d88f
push 0xffffffffffffffff
jmp 0x40d896
imul eax, eax, 0x3e8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, ebx
je 0x40d8dc
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xbb8]
push ecx
push edx
lea eax, [esp + 0x1e8]
push str.ERROR:_Timeout_expired_after__d_seconds_waiting_for___s__to_complete._r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040b060
add esp, 0x18
push 0x2710
call esi
mov ecx, dword [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d91d
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x1e8]
push str._s_is_already_running_and_waiting_for_connections_on_port__d._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1f0]
push eax
push ecx
call fcn.0040b060
add esp, 0x18
lea edx, [esp + 0xab8]
push edx
call fcn.00406460
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x18], edi
jne 0x40d98b
lea eax, [esp + 0xab8]
push eax
lea ecx, [esp + 0x1e4]
push str.Failed_to_resolve_the_VSA_server_IP___s._r_nExiting..._r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
add esp, 0x14
push 0x3a98
call esi
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040ac50
add esp, 4
call fcn.00403050
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x38]
push edx
push 0x3c
push eax
push edi
call fcn.00406650
add esp, 0x10
test eax, eax
lea edx, [esp + 0x1e0]
jne 0x40de41
mov ecx, dword [esp + 0x20]
push ecx
push edi
push str.Successfully_connected_to_the_VSA_server_at__s:_d._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1f0]
push eax
push ecx
call fcn.0040b060
mov eax, dword [esp + 0x60]
add esp, 0x18
cmp eax, 0x1c20
jl 0x40da09
lea ecx, [eax + 0x708]
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_hour_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea ecx, [esp + 0x1e8]
push ecx
jmp 0x40da42
cmp eax, 0x78
jl 0x40da34
lea ecx, [eax + 0x1e]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_minute_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea ecx, [esp + 0x1e8]
push ecx
jmp 0x40da42
push eax
push str.Starting_a__d_second_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea edx, [esp + 0x1e8]
push edx
call fcn.00412696
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x1e0]
push eax
push ecx
call fcn.0040b060
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
call fcn.004066a0
add esp, 0x14
cmp eax, ebx
jne 0x40dd6e
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x1e4]
push str.Done._r_nConnecting_to_the_remote_control_application__s_on_this_machine...
push eax
call fcn.00412696
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
call fcn.0040b060
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x48]
push eax
push 2
push ecx
push str.127.0.0.1
call fcn.00406650
mov edi, eax
add esp, 0x24
cmp edi, ebx
je 0x40db1d
mov edx, dword [esp + 0x10]
push str.Retrying...
push edx
call fcn.0040b060
add esp, 8
mov esi, 3
lea ecx, [ecx]
cmp esi, ebx
jle 0x40db15
mov eax, dword [esp + 0x10]
push 0x420e6c
push eax
dec esi
call fcn.0040b060
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push ecx
push 1
push edx
push str.127.0.0.1
call fcn.00406650
mov edi, eax
add esp, 0x18
cmp edi, ebx
jne 0x40dae0
jmp 0x40db1d
cmp edi, ebx
jne 0x40dd2d
lea eax, [esp + 0x84]
push eax
call fcn.00413d52
lea ecx, [esp + 0x88]
push ecx
call fcn.00413d39
add eax, 0xb
push eax
lea edx, [esp + 0x1ec]
push str.Done._r_nStarting_the_relay_at__.8s_for_this
push edx
call fcn.00412696
lea eax, [esp + 0x12e4]
add esp, 0x14
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40db60
sub eax, edx
cmp eax, 2
jl 0x40dba1
lea edi, [esp + 0x1e0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db76
mov eax, dword [str.encrypted]
mov ecx, dword [0x420e38]
mov dx, word [0x420e3c]
mov dword [edi], eax
mov al, byte [0x420e3e]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
lea edi, [esp + 0x1e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dbb0
mov edx, dword [esp + 0x10]
mov ecx, 7
mov esi, str.remote_control_session..._r_n
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1e0]
push ecx
push edx
call fcn.0040b060
mov esi, dword [esp + 0x70]
add esp, 8
cmp esi, ebx
je 0x40dc24
push 1
call fcn.004091f0
add esp, 4
cmp eax, 0xfffffffe
je 0x40dc12
cmp eax, 1
je 0x40dc06
cmp eax, 2
jne 0x40dc24
mov eax, dword [esp + 0x10]
push str.SoftwareSASGeneration_policy_setting_already_enabled._r_n
push eax
jmp 0x40dc1c
mov ecx, dword [esp + 0x10]
push str.Policy_setting_does_not_require_Ctl_Alt_Del._r_n
push ecx
jmp 0x40dc1c
mov edx, dword [esp + 0x10]
push str.Failed_to_enable_SoftwareSASGeneration_policy._May_not_be_able_to_send_Ctl_Alt_Del._r_n
push edx
call fcn.0040b060
add esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x12d4]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x34]
push 2
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
call fcn.004088d0
mov eax, dword [esp + 0x3c]
push eax
call fcn.0040ac70
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00406530
mov edx, dword [esp + 0x44]
push edx
call fcn.0040aca0
lea eax, [esp + 0xbc]
push eax
call fcn.00413d52
lea ecx, [esp + 0xc0]
push ecx
call fcn.00413d39
add esp, 0x40
add eax, 0xb
push eax
lea edx, [esp + 0x1e4]
push str.The_relay_session_has_terminated_at__.8s._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1ec]
push eax
push ecx
call fcn.0040b060
add esp, 0x14
cmp esi, ebx
je case.0x40dcd9.2
push 2
call fcn.004091f0
add eax, 5
add esp, 4
cmp eax, 9
ja case.0x40dcd9.2
jmp dword [eax*4 + 0x40e3e8]
mov edx, dword [esp + 0x10]
push str.Successfully_removed_SoftwareSASGeneration_policy_setting._r_n
push edx
jmp 0x40dd15
push str.Successfully_restored_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40dd10
mov ecx, dword [esp + 0x10]
push str.Failed_to_remove_SoftwareSASGeneration_policy_setting._r_n
push ecx
jmp 0x40dd15
mov edx, dword [esp + 0x10]
push str.Failed_to_restore_SoftwareSASGeneration_policy_setting._r_n
push edx
jmp 0x40dd15
push str.SoftwareSASGeneration_policy_setting_has_not_been_restored_because_it_has_changed_since_this_session_started._r_n
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b060
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40df57
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x1e8]
push str.Failed._r_nThis_relay_client_failed_to_connect_to__s_locally_on_port__d._r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040b060
add esp, 0x18
mov dword [esp + 0x34], 0xffffffff
jmp 0x40df57
cmp eax, 0x2bad2bad
jne 0x40ddee
push 1
lea eax, [esp + 0x1e4]
push str.Failed._r_n_r_n____ERROR:_This_viewer_package_version___d__is_obsolete._r_n___________Please_restart_the_remote_control_session_by_first_selecting_a_machine_from_the_Kaseya_Virtual_System_r_n___________Administrator_remote_control_web_page_and_then_run_download_the_viewer_package_again._r_n_r_nThis_package_will_exit_now..._r_n
push eax
call fcn.00412696
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x40ddb9
push 0x10
lea ecx, [esp + 0x5f4]
push ecx
lea edx, [esp + 0x1e8]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x2710
call esi
jmp 0x40df61
lea ecx, [esp + 0x1e0]
push ecx
push eax
call fcn.0040b060
add esp, 8
push 0x7530
call esi
mov edx, dword [esp + 0x10]
push edx
call fcn.0040ac50
add esp, 4
push 0x2710
mov dword [esp + 0x14], ebx
call esi
jmp 0x40df61
cmp eax, ebx
jle 0x40de23
cmp dword [esp + 0x30], ebx
jne 0x40ddfe
cmp dword [esp + 0x2c], ebx
je 0x40de05
push 0x7530
call esi
mov eax, dword [esp + 0x10]
push str.Done._r_nRelay_for_remote_control_session_is_not_required._r_n
push eax
call fcn.0040b060
add esp, 8
push 0x2710
call esi
jmp 0x40df61
mov ecx, dword [esp + 0x10]
push str.Failed._r_nRelay_for_remote_control_session_failed_to_establish_a_connection_with_the_other_relay_client._r_n
push ecx
call fcn.0040b060
add esp, 8
push 0x2710
call esi
jmp 0x40df61
push 0x41fffc
push edx
call fcn.00412696
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1e8]
push eax
push ecx
call fcn.0040b060
mov edx, dword [esp + 0x30]
push edx
push edi
lea eax, [esp + 0x1f8]
push str.ERROR:__Unable_to_connect_to_the_KServer_at__s_on_port__d._r_n_r_n
push eax
call fcn.00412696
lea edi, [esp + 0x200]
add esp, 0x20
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40de81
mov ecx, 0x10
mov esi, str.Please_check_that_your_firewall__router__and_or_proxy_server_is_r_n
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1e0]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dea1
mov ecx, dword [esp + 0x20]
sub eax, edx
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esp + eax + 0x1e8]
push str.allowing_outbound_TCP_connections_to__s_on_port__d._r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040b060
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x28]
add esp, 0x18
cmp eax, ebx
je 0x40deeb
cmp esi, ebx
jne 0x40def2
cmp dword [esp + 0x28], 5
jne 0x40df4f
lea eax, [esp + 0x5f0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df00
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40df24
mov edi, edi
mov cl, byte [esp + eax + 0x5f0]
cmp cl, 0x5c
je 0x40df24
cmp cl, 0x3a
je 0x40df24
dec eax
jns 0x40df10
push 0x78
push 0x50010
lea eax, [esp + eax + 0x5f9]
push eax
lea ecx, [esp + 0x1ec]
push ecx
push esi
call fcn.0040ad00
add esp, 0x14
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x38], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebx
je 0x40df9b
mov edx, dword [esp + 0x10]
push str.Removing_Remote_Administrator_server._r_n
push edx
call fcn.0040b060
call fcn.00404bc0
mov eax, dword [esp + 0x18]
push 0x1e
push 0x50040
push str.Virtual_System_Administrator
push str.Remote_control_session_with_your_administrator_has_ended.
push eax
call fcn.0040ad00
add esp, 0x1c
jmp 0x40dfa6
cmp dword [esp + 0x30], ebx
je 0x40dfa6
call fcn.00404650
cmp byte [esp + 0x2d08], bl
je 0x40e054
lea ecx, [esp + 0x2d08]
push ecx
push 0x41fffc
mov edx, ecx
push str._r_n
push edx
call fcn.0040b270
mov al, byte [esp + 0x9c8]
add esp, 0x10
cmp al, bl
jne 0x40e01e
lea eax, [esp + 0x9b8]
push eax
push str.Agent_Title
push str._SERVER_COMMUNICATIONS_
call fcn.00409070
mov al, byte [esp + 0x9c4]
add esp, 0xc
cmp al, bl
jne 0x40e01e
mov ecx, 7
mov esi, str.Virtual_System_Administrator
lea edi, [esp + 0x9b8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2d08]
push 0x78
push ecx
call fcn.00409450
add esp, 8
test eax, eax
jne 0x40e054
push 0x78
push 0x50040
lea edx, [esp + 0x9c0]
push edx
lea eax, [esp + 0x2d14]
push eax
push ebx
call fcn.0040ad00
add esp, 0x14
push edi
call fcn.004130bd
mov eax, dword [esp + 0x3c]
add esp, 4
cmp eax, 0xffffffff
je 0x40e071
push 1
push eax
call fcn.00402df0
add esp, 8
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x40e085
push 1
push eax
call fcn.00402df0
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040aca0
mov al, byte [esp + 0x10cc]
add esp, 4
cmp al, bl
je 0x40e264
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
mov eax, 0xfffff830
xor edx, edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov eax, 0xc
mov dword [esp + 0x54], edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x6c], eax
cmp byte [esp + 0x748], bl
mov dword [esp + 0x58], edx
mov ecx, 1
mov dword [esp + 0x5c], edx
mov dword [esp + 0x90], 0x44
mov dword [esp + 0xbc], 5
mov word [esp + 0xc0], bx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x60], edx
je 0x40e156
lea eax, [esp + 0x10c8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e130
lea ecx, [esp + 0x748]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x10cc]
push 0x4211c8
push edx
call fcn.00412696
add esp, 0xc
lea eax, [esp + 0x10c8]
push 0x25
push eax
call fcn.004129d0
add esp, 8
test eax, eax
je 0x40e1b3
push 0xc80
lea ecx, [esp + 0x14e4]
push ecx
lea edx, [esp + 0x10d0]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40e1b3
cmp eax, 0x208
ja 0x40e1b3
xor eax, eax
jmp 0x40e1a0
mov cl, byte [esp + eax + 0x14e0]
mov byte [esp + eax + 0x10c8], cl
inc eax
cmp cl, bl
jne 0x40e1a0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x94]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x10e8]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e210
lea edx, [esp + 0x10c8]
push edx
lea eax, [esp + 0x1e4]
push str.Failed_to_start_the_cleanup_process__s._r_n
push eax
call fcn.00412696
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
jmp 0x40e237
lea eax, [esp + 0x10c8]
push eax
lea ecx, [esp + 0x1e4]
push str.Successfully_started_the_cleanup_process__s._r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
mov eax, dword [esp + 0x68]
add esp, 0x14
cmp eax, ebx
je 0x40e24e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x40e25d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call esi
cmp dword [esp + 0x44], ebx
je 0x40e2d8
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1e4]
push str.Performing_FTP_cleanup_for_connection_to_port__d...
push edx
call fcn.00412696
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1ec]
push eax
push ecx
call fcn.0040b060
mov eax, dword [esp + 0x28]
call fcn.0040b9a0
lea edx, [esp + 0x1f4]
push str.Done._r_n
push edx
call fcn.00412696
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x1fc]
push eax
push ecx
call fcn.0040b060
mov eax, dword [esp + 0x60]
add esp, 0x24
cmp eax, ebx
je 0x40e2d8
cmp dword [esp + 0x10], ebx
je 0x40e2d8
push 0x3a98
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x40e2ed
mov dword [esp + 0x748], 0x776f6e
jmp 0x40e330
cmp eax, 1
jne 0x40e31a
mov edx, dword [str.in_1_minute]
mov eax, dword [0x420778]
mov ecx, dword [0x42077c]
mov dword [esp + 0x748], edx
mov dword [esp + 0x74c], eax
mov dword [esp + 0x750], ecx
jmp 0x40e330
push eax
lea edx, [esp + 0x74c]
push str.in__d_minutes
push edx
call fcn.00412696
add esp, 0xc
lea eax, [esp + 0x748]
push eax
lea ecx, [esp + 0x1e4]
push str.This_relay_client_will_exit__s..._r_n
push ecx
call fcn.00412696
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040b060
add esp, 0x14
push 0x1388
call esi
cmp dword [esp + 0x10], ebx
je 0x40e3c8
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jbe 0x40e3c8
cmp eax, 0x1179e
jbe 0x40e385
mov dword [esp + 0x1c], 0xffffffff
jmp 0x40e393
imul eax, eax, 0xea60
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x40e3c8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xea60
mov edi, edi
mov ecx, dword [esp + 0x10]
push 0x420e6c
push ecx
call fcn.0040b060
mov eax, dword [esp + 0x24]
add esp, 8
cmp eax, edi
jbe 0x40e3c5
push edi
call esi
sub dword [esp + 0x1c], edi
jne 0x40e3a0
jmp 0x40e3c8
push eax
call esi
mov edx, dword [esp + 0x10]
push edx
call fcn.0040ac50
add esp, 4
call fcn.00403050
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10