Function at 0x40cfb0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get file attributes
Query environment variable
Resolve function by parsing pe exports
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x7fbc
call fcn.00410740
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x771]
mov byte [esp + 0x770], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x259]
mov byte [esp + 0x258], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x26a1]
mov byte [esp + 0x26a0], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x1a20], bl
mov ecx, 0x31f
lea edi, [esp + 0x1a21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov byte [esp + 0x1310], bl
mov ecx, 0x3f
lea edi, [esp + 0x1311]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1618], bl
mov ecx, 0x3f
lea edi, [esp + 0x1619]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1818], bl
mov ecx, 0x3f
lea edi, [esp + 0x1819]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xe0], bl
mov ecx, 9
lea edi, [esp + 0xe1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xae0], bl
mov ecx, 0x103
lea edi, [esp + 0xae1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or esi, 0xffffffff
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x879]
mov byte [esp + 0x878], bl
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x64], 0x12c
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x27a8], bl
mov ecx, 9
lea edi, [esp + 0x27a9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x1de
lea edi, [esp + 0x27d0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x2f50], bl
mov ecx, 0x3ff
lea edi, [esp + 0x2f51]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x7d], ecx
mov dword [esp + 0x81], ecx
mov dword [esp + 0x85], ecx
mov dword [esp + 0x89], ecx
stosw word es:[edi], ax
mov dword [esp + 0x8d], ecx
stosb byte es:[edi], al
mov dword [esp + 0x91], ecx
mov dword [esp + 0x95], ecx
mov word [esp + 0x99], cx
mov byte [esp + 0x9b], cl
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1101]
mov byte [esp + 0x1100], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x151]
mov byte [esp + 0x150], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x1209]
mov byte [esp + 0x1208], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x1410], bl
mov ecx, 0x81
lea edi, [esp + 0x1411]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x9e0], bl
mov ecx, 0x3f
lea edi, [esp + 0x9e1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x3f50], bl
mov ecx, 0x101c
lea edi, [esp + 0x3f51]
rep stosd dword es:[edi], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0x7c], bl
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xb0], 0xfffffffe
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa4], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xef0], bl
mov ecx, 0x40
lea edi, [esp + 0xef1]
rep stosd dword es:[edi], eax
mov byte [esp + 0xff8], bl
mov ecx, 0x40
lea edi, [esp + 0xff9]
rep stosd dword es:[edi], eax
mov byte [esp + 0x978], bl
mov ecx, 0x19
lea edi, [esp + 0x979]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1718], bl
mov ecx, 0x3f
lea edi, [esp + 0x1719]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1918], bl
mov ecx, 0x41
lea edi, [esp + 0x1919]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x668]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x66c]
push edx
push ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x68], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jle 0x40d6c4
lea eax, [esp + 0x668]
push 0x41d2dc
push eax
call fcn.00410723
mov edi, eax
add esp, 8
cmp edi, ebx
mov dword [esp + 0x50], edi
je 0x40d6c4
push 2
push 0xfffff85e
push edi
call fcn.00411410
push edi
push 0x7a2
lea ecx, [esp + 0x27bc]
push 1
push ecx
call fcn.004105de
add esp, 0x1c
cmp eax, 0x7a2
jne 0x40d6b4
mov edi, str.Kaseya_Remote_Control_Data_Table
lea esi, [esp + 0x27a8]
mov ecx, 0x21
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40d3a4
mov edi, str.Kaseya_Remote_Control_Relay_Table
lea esi, [esp + 0x27a8]
mov ecx, 0x22
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40d6b4
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
lea ecx, [esp + 0x25c]
push ecx
push str.TEMP
call esi
cmp eax, ebx
jle 0x40d429
cmp eax, 0x104
jae 0x40d429
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d3d3
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
je 0x40d402
lea edi, [esp + 0x258]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d3f0
mov dx, word [0x41d788]
mov word [edi], dx
cmp byte [esp + 0x258], bl
je 0x40d48e
xor eax, eax
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x1918], cl
inc eax
cmp cl, bl
jne 0x40d411
jmp 0x40d4a9
push 0x104
lea eax, [esp + 0x25c]
push eax
push 0x41df3c
call esi
cmp eax, ebx
jle 0x40d487
cmp eax, 0x104
jae 0x40d487
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d452
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
je 0x40d402
lea edi, [esp + 0x258]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d470
mov cx, word [0x41d788]
mov word [edi], cx
jmp 0x40d402
mov byte [esp + 0x258], bl
mov dx, word [0x41d6b4]
mov al, byte [0x41d6b6]
mov word [esp + 0x1918], dx
mov byte [esp + 0x191a], al
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x258]
push ecx
lea edx, [esp + 0x27ac]
push edx
push eax
call fcn.004073f0
add esp, 0xc
cmp eax, 0xfffffffd
je 0x40d529
cmp eax, 0xfffffffe
je 0x40d4ea
cmp eax, 0xffffffff
jne 0x40d549
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409310
push str.The_viewer_package_is_corrupted._The_table_header_is_invalid._Download_this_package_again._r_n
jmp 0x40d53c
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409310
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x36c]
push str.Unable_to_extract_viewer_files_to_the_directory__s._r_n
push ecx
call fcn.00410464
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x374]
push edx
push eax
call fcn.0040aa30
add esp, 0x1c
jmp 0x40d549
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00409310
push str.The_viewer_package_is_corrupted._Unable_to_read_viewer_files._Download_this_package_again._r_n
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040aa30
add esp, 0x10
cmp byte [esp + 0x27d0], bl
je 0x40d6b4
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0x100
lea edx, [esp + 0x172c]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0x1000
lea edx, [esp + 0x2f74]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x94]
push ecx
push ebx
push ebx
lea edx, [esp + 0x7c]
push edx
push 0x68
lea eax, [esp + 0x9b8]
push eax
push 0x101
lea ecx, [esp + 0x1040]
push ecx
push 0x101
lea edx, [esp + 0xf40]
push edx
push 0x4074
lea eax, [esp + 0x3fa8]
push eax
push 0x100
lea ecx, [esp + 0xa40]
push ecx
push 0x208
lea edx, [esp + 0x1478]
push edx
push 0x100
lea eax, [esp + 0x8e8]
push eax
push 0x410
lea ecx, [esp + 0xb58]
push ecx
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0xe4]
push eax
push 0x100
lea ecx, [esp + 0x18a0]
push ecx
push 0x100
lea edx, [esp + 0x16a8]
push edx
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x13ac]
push 0x100
push edx
lea eax, [esp + 0x2874]
call fcn.0040bff0
mov al, byte [esp + 0xb84]
add esp, 0xa4
cmp al, bl
je 0x40d6b4
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x27ac]
push ecx
lea edx, [esp + 0xae8]
push 0x410
push edx
call fcn.004076d0
add esp, 0x10
test eax, eax
je 0x40d6b4
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00409310
mov edx, dword [esp + 0x18]
push str.Unexpected_error_occurred_while_creating_path_to_components_in_temp_directory._r_n
push edx
call fcn.0040aa30
add esp, 0x10
mov eax, dword [esp + 0x50]
push eax
call fcn.00410676
add esp, 4
or esi, 0xffffffff
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0x100
lea edx, [esp + 0x172c]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0x1000
lea edx, [esp + 0x2f74]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x94]
push ecx
push 0x105
lea edx, [esp + 0x28c]
push edx
lea eax, [esp + 0x7c]
push eax
push 0x68
lea ecx, [esp + 0x9b8]
push ecx
push 0x101
lea edx, [esp + 0x1040]
push edx
push 0x101
lea eax, [esp + 0xf40]
push eax
push 0x4074
lea ecx, [esp + 0x3fa8]
push ecx
push 0x100
lea edx, [esp + 0xa40]
push edx
push 0x208
lea eax, [esp + 0x1478]
push eax
push 0x100
lea ecx, [esp + 0x8e8]
push ecx
push 0x410
lea edx, [esp + 0xb58]
push edx
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0xe4]
push ecx
push 0x100
lea edx, [esp + 0x18a0]
push edx
push 0x100
lea eax, [esp + 0x16a8]
push eax
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x13ac]
push 0x100
push eax
mov eax, dword [ebp + 0x10]
call fcn.0040bff0
mov eax, dword [esp + 0xf0]
add esp, 0xa4
cmp eax, ebx
je 0x40d844
lea ecx, [esp + 0x258]
push ecx
lea edx, [esp + 0x364]
push str._smstsc.exe
push edx
call fcn.00410464
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x360]
push eax
call edi
test eax, eax
jne 0x40d844
lea ecx, [esp + 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, esi
je 0x40d844
test al, 1
je 0x40d844
push 0x80
lea edx, [esp + 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x360]
push eax
call edi
lea eax, [esp + 0x1310]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d850
sub eax, edx
cmp eax, 1
jb 0x40d86a
cmp dword [esp + 0x14], ebx
jl 0x40d86a
cmp dword [esp + 0x28], ebx
jge 0x40d88c
cmp dword [esp + 0x60], ebx
jne 0x40d896
cmp dword [esp + 0x10], ebx
je 0x40d881
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x60], ebx
je 0x40dce4
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x668]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x66c]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x668]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d8c5
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40d8e7
mov cl, byte [esp + eax + 0x668]
cmp cl, 0x5c
je 0x40d8e7
cmp cl, 0x3a
je 0x40d8e7
dec eax
jns 0x40d8d3
inc eax
lea edx, [esp + eax + 0x668]
push edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1a24]
push str._s__s_ipAddr__p_portNumber__c_portNumber__i_sessionID__w_waitTimeSeconds___k_cryptoKey__n___________l_ipAddr____g_ipAddr____a_OR__b__app_cmd_string_____o_appIpOptionStr__n___________x__exit_cmd_string_____y_exitOptionStr____r____e____t___Opt1_r_nOpt2_r_n..._r_nOptX____n___________f____mw____d____j____v____h_____n
push eax
call fcn.00410464
lea edi, [esp + 0x1a2c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d911
mov ecx, 0xb
mov esi, str._s_ipAddr__relay_server_IP_address_or_name_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d930
mov ecx, 0xc
mov esi, str._p_portNumber__relay_server_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d950
mov ecx, 0x11
mov esi, str._c_portNumber__local_host_port_to_open_and_listen_for_connections_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d970
mov ecx, 0x15
mov esi, str._g_ipAddr__gateway_IP_address_or_name_for_direct_connection_to_remote_control_app_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d990
mov ecx, 0x14
mov esi, str._l_ipAddr__LAN_IP_address_or_name_for_direct_connection_to_remote_control_app_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d9b0
mov ecx, 8
mov esi, str._i_sessionID__relay_session_ID_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d9d0
mov ecx, 0x16
mov esi, str._w_waitTime__seconds_to_wait_for_response_from_connector_relay_client_via_relay_server_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40d9f0
mov ecx, 0x16
mov esi, str._k_cryptoKey__optional_crypto_key_for_this_session__maximum_of_128_bytes_of_hex_data__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da10
mov ecx, 0x12
mov esi, str._a__app_cmd_string___optional_application_command_line_string_to_run_OR_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1a20]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da30
mov ecx, 0x17
mov esi, str._b__app_cmd_string___same_as__a_but_prepend_App_Paths_directory_location_to_application_name_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da50
mov ecx, 0x1c
mov esi, str._o__appIpOptionStr___IP_option_string_to_prepend_to_IP_address_passed_as_command_line_option_to_app__e.g.__ip__n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da70
mov ecx, 0x18
mov esi, str._x__exit_cmd_string___optional_application_command_line_string_to_run_when_relay_client_exits_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40da90
mov ecx, 0x11
mov esi, str._y__exitOptionStr___command_line_option_string_passed_to_exit_cmd_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dab0
mov ecx, 0x12
mov esi, str._z__exitMsgStr___display_a_message_in_a_timed_dialog_box_for_2_minutes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dad0
mov ecx, 0x12
mov esi, str._zt__exitDlgTitleStr___title_shown_in_window_frame_of_timed_dialog_box_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40daf0
mov ecx, 0x14
mov esi, str.________if_none_specified__Agent_Title_attribute_value_in_KaseyaD.ini_is_used._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db10
mov ecx, 0x13
mov esi, str._r__generate_automatic_window_events_specific_to_RAdmin_login_dialog_boxes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db30
mov ecx, 0x16
mov esi, str._e__run_pcAnywhere_remote_viewer__Awrem32__with_the_Network.chf_file_on_the_command_line_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db50
mov ecx, 0x15
mov esi, str._t___Opt1_r_nOpt2_r_n..._r_nOptX____run_MS_terminal_server_remote_viewer__mstsc.exe._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db70
mov ecx, 0x17
mov esi, str.____Creates_.rdp_config_file_with_port_number_and_puts_config_filename_on_the_command_line._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40db90
mov ecx, 0x15
mov esi, str.____Options_are_in_the_form_of___disable_wallpaper:i:1_r_nredirectprinters:i:1_r_n_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dbb0
mov ecx, 6
mov esi, str._f__FTP_client_support_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dbd0
mov ecx, 0xc
mov esi, str._mw__manual_remote_control_support_for_WinVNC_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dbf0
mov ecx, 0x12
mov esi, str._mk_licenseKey__manual_remote_control_support_for_K_VNC_with_license_key_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dc10
mov ecx, 0x19
mov esi, str._d_exitDelayMinutes__minutes_to_delay_before_destroying_this_relay_clients_status_display_on_exit_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1a20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dc30
mov ecx, 0x13
mov esi, str._j__Enable_Ctl_Alt_Del_and_Software_Secure_Attention_Sequence_policy_helper_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1a20]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dc50
mov ecx, 0xa
mov esi, str._v__verbose_output_into_status_dialog_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dc70
mov ecx, 8
mov esi, str._h__display_this_help_message_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1a20]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40dc90
mov ecx, 8
mov esi, str.____display_this_help_message_n
lea eax, [esp + 0x1a20]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dcb0
push 0x40
sub eax, edx
lea ecx, [esp + 0x66c]
push ecx
lea edx, [esp + 0x1a28]
push edx
push ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x54], ebx
je 0x40dd01
cmp dword [esp + 0x10], ebx
jne 0x40dd01
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00409310
add esp, 8
lea edx, [esp + 0xd4]
push edx
call fcn.00411842
lea eax, [esp + 0xd8]
push eax
call fcn.00411829
mov ecx, dword [esp + 0x28]
add eax, 4
push eax
push ecx
lea edx, [esp + 0x370]
push str.Processing_for_session_ID__d_started_on__.15s._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x378]
push eax
push ecx
call fcn.0040aa30
lea edx, [esp + 0xb00]
push str.radmin
push edx
call fcn.0040ad90
mov edi, dword [esp + 0x90]
add esp, 0x28
test eax, eax
jne 0x40e480
cmp dword [esp + 0x44], ebx
jne 0x40e480
lea eax, [esp + 0xae0]
push str.mstsc
push eax
call fcn.0040ad90
add esp, 8
test eax, eax
jne 0x40e44b
cmp dword [esp + 0x4c], ebx
jne 0x40e44b
lea ecx, [esp + 0xae0]
push str.awrem32
push ecx
call fcn.0040ad90
add esp, 8
test eax, eax
jne 0x40e293
cmp edi, ebx
jne 0x40e293
lea edx, [esp + 0xae0]
push str.winvnc
push edx
call fcn.0040ad90
add esp, 8
test eax, eax
jne 0x40e050
cmp dword [esp + 0x48], ebx
jne 0x40e050
lea eax, [esp + 0xae0]
push str.kvncviewer
push eax
call fcn.0040ad90
add esp, 8
test eax, eax
je 0x40de51
mov ecx, dword [str.kVNCviewer.exe]
mov edx, dword [0x41f2d4]
mov eax, dword [0x41f2d8]
mov dword [esp + 0x150], ecx
mov cx, word [0x41f2dc]
mov dword [esp + 0x154], edx
mov dl, byte [0x41f2de]
mov dword [esp + 0x1c], 5
mov dword [esp + 0x158], eax
mov word [esp + 0x15c], cx
mov byte [esp + 0x15e], dl
jmp 0x40df81
lea eax, [esp + 0xae0]
push str.vncviewer
push eax
call fcn.0040ad90
add esp, 8
test eax, eax
je 0x40deac
mov ecx, dword [str.VNCviewer.exe]
mov edx, dword [0x41f2b8]
mov eax, dword [0x41f2bc]
mov dword [esp + 0x150], ecx
mov cx, word [0x41f2c0]
mov dword [esp + 0x1c], 5
mov dword [esp + 0x154], edx
mov dword [esp + 0x158], eax
mov word [esp + 0x15c], cx
jmp 0x40df81
lea edx, [esp + 0xae0]
push str.iexplore
push edx
call fcn.0040ad90
add esp, 8
test eax, eax
je 0x40dede
lea eax, [esp + 0x878]
push str.ftp:__
push eax
call fcn.0040ad90
add esp, 8
test eax, eax
jne 0x40dee8
cmp dword [esp + 0x40], ebx
je 0x40e01d
push 0x104
lea ecx, [esp + 0xae4]
push ecx
lea edx, [esp + 0x158]
push edx
mov dword [esp + 0x28], 7
mov dword [esp + 0xb0], 0x1c20
call fcn.00410340
mov ax, word [0x41f2a8]
mov cl, byte [0x41f2aa]
mov word [esp + 0x36c], ax
lea eax, [esp + 0x36c]
add esp, 0xc
mov byte [esp + 0x362], cl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df40
sub eax, edx
push eax
lea edx, [esp + 0x364]
push edx
push 1
push str.Use_PASV
push str.SoftwareMicrosoftFtp
push reloc.WSOCK32.dll_accept
call fcn.0040a260
push 0x410
lea ebx, [esp + 0xafc]
call fcn.0040b9e0
add esp, 0x1c
xor ebx, ebx
or esi, 0xffffffff
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x364]
push str.This_relay_client_has_been_tasked_to_run__s_on_this_machine._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x36c]
push eax
push ecx
call fcn.0040aa30
lea edx, [esp + 0x1324]
push edx
call fcn.00407960
mov edi, eax
add esp, 0x18
cmp edi, ebx
mov dword [esp + 0x40], edi
jne 0x40e622
lea eax, [esp + 0x1310]
push eax
lea ecx, [esp + 0x364]
push str.Failed_to_resolve_the_VSA_server_IP___s._r_nExiting..._r_n
push ecx
call fcn.00410464
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x36c]
push edx
push eax
call fcn.0040aa30
add esp, 0x14
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040aa60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x104
lea eax, [esp + 0xae4]
push eax
lea ecx, [esp + 0x158]
push ecx
call fcn.00410340
push 0x410
lea ebx, [esp + 0xaf0]
call fcn.0040b9e0
add esp, 0x10
jmp 0x40df7c
push str.vncviewer.exe
mov dword [esp + 0x20], 4
call fcn.00406f60
add esp, 4
test eax, eax
jne 0x40e0af
mov dword [esp + 0x18], 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xfa
call edi
mov ecx, dword [esp + 0x18]
dec ecx
push str.vncviewer.exe
mov dword [esp + 0x1c], ecx
call fcn.004070e0
add esp, 4
cmp eax, ebx
je 0x40e0b5
push str.vncviewer.exe
call fcn.00406f60
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ebx
jge 0x40e071
jmp 0x40e0b5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push str.kvncviewer.exe
call fcn.00406f60
add esp, 4
test eax, eax
jne 0x40e106
mov dword [esp + 0x18], 8
mov edi, edi
push 0xfa
call edi
mov ecx, dword [esp + 0x18]
dec ecx
push str.kvncviewer.exe
mov dword [esp + 0x1c], ecx
call fcn.004070e0
add esp, 4
cmp eax, ebx
je 0x40e106
push str.kvncviewer.exe
call fcn.00406f60
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ebx
jge 0x40e0d0
call fcn.00406000
test eax, eax
jge 0x40e136
lea edx, [esp + 0x360]
push str.Failed_to_reset_default_WinVNC_password._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x368]
push eax
push ecx
call fcn.0040aa30
add esp, 0x10
cmp dword [esp + 0x48], 2
jne 0x40e268
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x668]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x66c]
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x668]
push 0x5c
push eax
call fcn.00410ca0
add esp, 8
cmp eax, ebx
jne 0x40e19a
mov cx, word [0x41d6b4]
mov dl, byte [0x41d6b6]
mov word [esp + 0x668], cx
mov byte [esp + 0x66a], dl
jmp 0x40e19c
mov byte [eax], bl
mov eax, dword [esp + 0x10]
push str.logMessages.dll
push str.kvnc_
push eax
lea eax, [esp + 0x674]
call fcn.0040bc40
mov ecx, dword [esp + 0x1c]
push str.wm_hooks.dll
push str.kvnc_
push ecx
lea eax, [esp + 0x680]
call fcn.0040bc40
mov edx, dword [esp + 0x28]
push str.vncclipboard.exe
push str.kvnc_
push edx
lea eax, [esp + 0x68c]
call fcn.0040bc40
mov eax, dword [esp + 0x34]
push str.vncconfig.exe
push str.kvnc_
push eax
lea eax, [esp + 0x698]
call fcn.0040bc40
mov ecx, dword [esp + 0x40]
push str.WinVNC4.exe
push str.kvnc_
push ecx
lea eax, [esp + 0x6a4]
call fcn.0040bc40
mov al, byte [esp + 0x1754]
add esp, 0x3c
cmp al, bl
je 0x40e268
lea edx, [esp + 0x1718]
push edx
lea eax, [esp + 0x66c]
push eax
lea ecx, [esp + 0x368]
push str.__s_vncconfig.exe___license__s
push ecx
call fcn.00410464
push 0xf
push 1
lea edx, [esp + 0x378]
push edx
push ebx
call fcn.00409f00
add esp, 0x20
mov eax, dword [str.WinVNC4.exe]
mov ecx, dword [0x41f16c]
mov edx, dword [0x41f170]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
jmp 0x40df81
mov eax, dword [str.Awrem32.exe]
mov ecx, dword [0x41f140]
mov edx, dword [0x41f144]
mov dword [esp + 0x1c], 6
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
cmp edi, ebx
je 0x40df81
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x25c]
mov eax, 0x105
push edx
lea edx, [esp + 0x20]
lea ebx, [esp + 0x1108]
mov dword [esp + 0x20], eax
mov dword [esp + 0xbc], eax
call fcn.0040b4b0
add esp, 8
test eax, eax
jne 0x40e5f7
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e310
sub eax, edx
mov dword [esp + 0x50], eax
je 0x40e5f7
lea eax, [esp + 0x258]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e330
sub eax, edx
mov dword [esp + 0x50], eax
je 0x40e5f7
lea eax, [esp + 0x1100]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e350
mov si, word [0x41d788]
sub eax, edx
mov cl, byte [esp + eax + 0x10ff]
mov bl, 0x5c
cmp cl, bl
je 0x40e380
lea edi, [esp + 0x1100]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e375
mov word [edi], si
lea eax, [esp + 0x258]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e390
sub eax, edx
cmp byte [esp + eax + 0x257], bl
je 0x40e3bb
lea edi, [esp + 0x258]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e3b0
mov word [edi], si
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x120c]
push str._sNetwork.chf
push ecx
call fcn.00410464
lea edx, [esp + 0x1214]
push 0x41d2dc
push edx
call fcn.00410723
add esp, 0x14
test eax, eax
jne 0x40e5b2
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x120c]
push str._sNetwork__cable__dsl.chf
push ecx
call fcn.00410464
lea edx, [esp + 0x1214]
push 0x41d2dc
push edx
call fcn.00410723
add esp, 0x14
test eax, eax
jne 0x40e5b2
lea eax, [esp + 0x258]
push eax
lea ecx, [esp + 0x120c]
push str._sRemotesNetwork__cable__dsl.chf
push ecx
call fcn.00410464
add esp, 0xc
jmp 0x40e5bb
mov eax, dword [str.mstsc.exe]
mov ecx, dword [0x41df78]
mov dx, word [0x41df7c]
mov dword [esp + 0x1c], 0xb
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov word [esp + 0x158], dx
jmp 0x40e2c1
mov eax, dword [str.RAdmin.exe]
mov ecx, dword [0x41f0e4]
mov dx, word [0x41f0e8]
mov dword [esp + 0x150], eax
mov al, byte [0x41f0ea]
mov byte [esp + 0x15a], al
cmp dword [esp + 0x44], ebx
mov dword [esp + 0x1c], 2
mov dword [esp + 0x154], ecx
mov word [esp + 0x158], dx
je 0x40e2c1
lea eax, [esp + 0x258]
mov byte [esp + 0x7c], 0x3d
mov byte [esp + 0x7d], 0x2d
mov byte [esp + 0x7e], 0x30
mov byte [esp + 0x7f], 0x39
mov byte [esp + 0x80], 0x38
mov byte [esp + 0x81], 0x5b
mov byte [esp + 0x82], 0x70
mov byte [esp + 0x83], 0x6f
mov byte [esp + 0x84], 0x69
mov byte [esp + 0x85], 0x75
mov byte [esp + 0x86], 0x3b
mov byte [esp + 0x87], 0x6c
mov byte [esp + 0x88], 0x6b
mov byte [esp + 0x89], 0x6a
mov byte [esp + 0x8a], 0x68
mov byte [esp + 0x8b], 0x2e
mov byte [esp + 0x8c], 0x2c
mov byte [esp + 0x8d], 0x6d
mov byte [esp + 0x8e], 0x6e
mov byte [esp + 0x8f], 0x62
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e564
sub eax, edx
mov dword [esp + 0x50], eax
je 0x40df81
push 0x41d77c
lea ecx, [esp + 0x25c]
push ecx
lea edx, [esp + 0x26a8]
push str._s_s
push edx
call fcn.00410464
lea eax, [esp + 0x268]
push eax
call fcn.004066a0
add esp, 0x14
mov dword [esp + 0xa0], eax
jmp 0x40df81
push eax
call fcn.00410676
add esp, 4
lea edx, [esp + 0x1208]
push edx
lea eax, [esp + 0x87c]
push str.__s___c
push eax
call fcn.00410464
lea ecx, [esp + 0x110c]
push ecx
lea edx, [esp + 0xaf0]
push str.__sAwrem32.exe_
push edx
call fcn.00410464
add esp, 0x18
jmp 0x40df7c
mov eax, dword [esp + 0x10]
push str.Failed_to_get_the_installation_directory_for_pcAnywhere._r_nExiting..._r_n
push eax
call fcn.0040aa30
add esp, 8
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x1818], bl
je 0x40e669
lea edx, [esp + 0x1818]
push edx
call fcn.00407960
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x36c]
push str.The_specified_direct_connection_LAN_address_is__s:_d._r_n
push edx
mov dword [esp + 0x4c], eax
call fcn.00410464
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x374]
push eax
push ecx
call fcn.0040aa30
add esp, 0x1c
cmp byte [esp + 0x1618], bl
mov esi, dword [esp + 0x38]
je 0x40e6b4
lea edx, [esp + 0x1618]
push edx
call fcn.00407960
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x36c]
push str.The_specified_direct_connection_gateway_address_is__s:_d._r_n
push edx
mov dword [esp + 0x50], eax
call fcn.00410464
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x374]
push eax
push ecx
call fcn.0040aa30
add esp, 0x1c
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x24]
push edx
push 0x3c
push eax
push edi
call fcn.00407b50
add esp, 0x10
test eax, eax
jne 0x40f612
mov ecx, dword [esp + 0x28]
push ecx
push edi
lea edx, [esp + 0x368]
push str.Successfully_connected_to_the_VSA_server_at__s:_d._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x370]
push eax
push ecx
call fcn.0040aa30
mov eax, dword [esp + 0x7c]
add esp, 0x18
cmp eax, 0x1c20
jl 0x40e732
lea ecx, [eax + 0x708]
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_hour_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea ecx, [esp + 0x368]
push ecx
jmp 0x40e76b
cmp eax, 0x78
jl 0x40e75d
lea ecx, [eax + 0x1e]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_minute_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea ecx, [esp + 0x368]
push ecx
jmp 0x40e76b
push eax
push str.Starting_a__d_second_wait_for_a_response_from_the_relay_client_that_is_listening_for_the_connection_from_this_remote_control_session...
lea edx, [esp + 0x368]
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x360]
push eax
push ecx
call fcn.0040aa30
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
call fcn.00407d60
add esp, 0x14
cmp eax, ebx
jne 0x40f585
mov edx, dword [esp + 0x10]
push str.Done._r_n
push edx
call fcn.0040aa30
add esp, 8
cmp esi, ebx
mov dword [esp + 0x30], ebx
je 0x40e814
mov eax, dword [esp + 0x14]
push 0xf
push eax
push esi
call fcn.00407f10
add esp, 0xc
test eax, eax
jle 0x40e7e7
mov ecx, dword [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x38], 1
push str.Direct_connection_detected_to_remote_control_application_at_LAN_address__s:_d._r_n
jmp 0x40e84b
mov edx, dword [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x368]
push str.Direct_connection_is_unavailable_to_remote_control_application_at_LAN_address__s:_d._r_n
push eax
call fcn.00410464
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x370]
push ecx
push edx
call fcn.0040aa30
add esp, 0x18
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x40e90e
mov eax, dword [esp + 0x14]
push 0xf
push eax
push esi
call fcn.00407f10
add esp, 0xc
test eax, eax
jle 0x40e90e
mov ecx, dword [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x38], 2
push str.Direct_connection_is_unavailable_to_remote_control_application_at_gateway_address__s:_d._r_n
lea edx, [esp + 0x36c]
push edx
call fcn.00410464
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x370]
push eax
push ecx
call fcn.0040aa30
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
add esp, 0x18
push ebx
push 0x1000f
push edx
push eax
call fcn.004080a0
mov ecx, dword [esp + 0x20]
push str.Direct_connection_will_be_used_for_this_remote_control_session._r_nThe_command_has_been_sent_to_quit_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push ecx
call fcn.0040aa30
add esp, 0x18
cmp byte [esp + 0xae0], bl
je 0x40ef90
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
mov eax, 1
mov dword [esp + 0xc4], eax
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x1c]
mov ecx, 0xc
add eax, 0xfffffffe
cmp eax, 9
mov dword [esp + 0x108], 0x44
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xcc], ebx
ja case.0x40e907.3
movzx edx, byte [eax + 0x40fc70]
jmp dword [edx*4 + 0x40fc60]
mov edx, dword [esp + 0x10]
push str.This_remote_control_session_will_use_the_VSA_as_the_relay_server._r_nSending_command_to_start_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push edx
call fcn.0040aa30
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push eax
push 0x10001
push ecx
push edx
call fcn.004080a0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x4c]
push eax
push ecx
call fcn.00408130
add esp, 0x20
cmp eax, 0xfffffff9
jne 0x40e9de
mov eax, 0x2327
lea esp, [esp]
lea edx, [esp + 0x34]
inc eax
push edx
push eax
mov dword [esp + 0x1c], eax
call fcn.00408130
add esp, 8
cmp eax, 0xfffffff9
jne 0x40e9de
mov eax, dword [esp + 0x14]
cmp eax, 0x23ef
jl 0x40e960
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x364]
push str.Failed_to_open_a_port_on_this_machine_to_relay_data_from__s._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x36c]
push eax
push ecx
call fcn.0040aa30
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
add esp, 0x14
push ebx
push 0x1000f
push eax
push ecx
call fcn.004080a0
mov edx, dword [esp + 0x20]
push str.Sent_command_to_quit_the_relay_client_that_is_waiting_for_the_connection_from_this_remote_control_session._r_n
push edx
call fcn.0040aa30
add esp, 0x18
jmp 0x40f75c
cmp eax, ebx
jne 0x40e983
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x150]
push eax
push ecx
lea edx, [esp + 0x368]
push str.Port__d_opened_on_this_machine_to_relay_data_from__s._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x370]
push eax
push ecx
call fcn.0040aa30
mov eax, dword [esp + 0x80]
add esp, 0x18
cmp eax, ebx
je 0x40e894
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0xbc]
call fcn.0040b320
add esp, 4
cmp eax, ebx
mov dword [esp + 0xb0], eax
jg 0x40e894
mov eax, dword [esp + 0x10]
push str.ERROR:_Failed_to_disable_use_of_UDP_in_pcAnywhere__r_nThis_relay_session_may_fail._r_n
push eax
call fcn.0040aa30
add esp, 8
jmp 0x40e894
mov eax, dword [esp + 0x30]
sub eax, ebx
je 0x40eb05
dec eax
je 0x40eabf
dec eax
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
je 0x40eab0
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ea80
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0x87c]
push edx
lea eax, [esp + eax + 0xae8]
push str.__s127.0.0.1:_d
push eax
call fcn.00410464
add esp, 0x10
jmp 0x40ee76
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eab0
sub eax, edx
mov edx, dword [esp + 0x3c]
jmp 0x40eadd
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ead0
sub eax, edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x880]
push ecx
lea edx, [esp + eax + 0xaec]
push str.__s_s:_d
push edx
call fcn.00410464
add esp, 0x14
jmp 0x40ee76
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eb10
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0x87c]
push edx
lea eax, [esp + eax + 0xae8]
push str.__s127.0.0.1:_d
push eax
call fcn.00410464
add esp, 0x10
jmp 0x40ee76
mov eax, dword [esp + 0x30]
sub eax, ebx
je 0x40ebd0
dec eax
je 0x40eb90
dec eax
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
je 0x40eb83
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eb60
lea ecx, [esp + 0x878]
push ecx
sub eax, edx
push str.__s127.0.0.1
lea edx, [esp + eax + 0xae8]
push edx
jmp 0x40ee6e
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eb83
mov ecx, dword [esp + 0x3c]
jmp 0x40ebab
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eba0
mov ecx, dword [esp + 0x38]
sub eax, edx
push ecx
lea edx, [esp + 0x87c]
push edx
lea eax, [esp + eax + 0xae8]
push str.__s_s
push eax
call fcn.00410464
add esp, 0x10
jmp 0x40ee76
lea eax, [esp + 0xae0]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ebe0
lea ecx, [esp + 0x878]
push ecx
sub eax, edx
push str.__s127.0.0.1
lea edx, [esp + eax + 0xae8]
push edx
jmp 0x40ee6e
cmp dword [esp + 0x4c], ebx
je 0x40ee76
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x770]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x774]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x40ec54
mov cx, word [0x41d6b4]
mov dl, byte [0x41d6b6]
mov word [esp + 0x770], cx
mov byte [esp + 0x772], dl
jmp 0x40ec90
lea eax, [esp + 0x770]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ec60
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40ec84
mov edi, edi
mov cl, byte [esp + eax + 0x770]
cmp cl, 0x5c
je 0x40ec84
cmp cl, 0x3a
je 0x40ec84
dec eax
jns 0x40ec70
inc eax
mov dword [esp + 0x18], eax
mov byte [esp + eax + 0x770], bl
cmp byte [esp + 0x978], bl
lea eax, [esp + 0x770]
lea edx, [eax + 1]
je 0x40ecd0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40eca3
mov ecx, dword [esp + 0x14]
sub eax, edx
push ecx
lea edx, [esp + 0x97c]
push edx
lea eax, [esp + eax + 0x778]
push str._s._d.rdp
push eax
call fcn.00410464
add esp, 0x10
jmp 0x40ecf3
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ecd0
mov ecx, dword [esp + 0x14]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x774]
push str.ts_d.rdp
push edx
call fcn.00410464
add esp, 0xc
lea eax, [esp + 0x2f50]
push eax
call fcn.0040ce80
mov edi, eax
mov eax, dword [esp + 0x34]
add esp, 4
sub eax, ebx
lea esi, [esp + 0x2f50]
je 0x40ed39
dec eax
je 0x40ed2d
dec eax
je 0x40ed21
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x40ed3e
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
push edx
push eax
jmp 0x40ed43
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x38]
push ecx
push edx
jmp 0x40ed43
mov eax, dword [esp + 0x14]
push eax
push str.127.0.0.1
lea eax, [esp + 0x778]
call fcn.0040afd0
lea eax, [esp + 0xae8]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ed60
lea ecx, [esp + 0x770]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xae4]
push str.___s_
push edx
call fcn.00410464
add esp, 0xc
cmp edi, ebx
je 0x40ee76
lea edi, [esp + 0xae0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ed96
mov eax, dword [str.__admin]
mov ecx, dword [0x41ea04]
mov dword [edi], eax
mov dword [edi + 4], ecx
jmp 0x40ee76
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0xe4]
push 0x41d7e4
push eax
call fcn.00410464
mov eax, dword [esp + 0x3c]
add esp, 0xc
sub eax, ebx
je 0x40ee21
dec eax
lea edx, [esp + 0x878]
je 0x40ee0c
dec eax
je 0x40edf7
lea ecx, [esp + 0xe0]
push ecx
push str.127.0.0.1
push 0x100
push edx
jmp 0x40ee3b
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xe0]
push eax
push ecx
push 0x100
push edx
jmp 0x40ee3b
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xe0]
push eax
push ecx
push 0x100
push edx
jmp 0x40ee3b
lea eax, [esp + 0xe0]
push eax
push str.127.0.0.1
push 0x100
lea ecx, [esp + 0x884]
push ecx
call fcn.0040bda0
lea eax, [esp + 0xaf0]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ee50
sub eax, edx
lea edx, [esp + 0x878]
push edx
push 0x41e9fc
lea eax, [esp + eax + 0xae8]
push eax
call fcn.00410464
add esp, 0xc
lea ecx, [esp + 0xae0]
push 0x25
push ecx
call fcn.00410ce0
add esp, 8
test eax, eax
je 0x40eed3
push 0xc80
lea edx, [esp + 0x1a24]
push edx
lea eax, [esp + 0xae8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40eed3
cmp eax, 0x208
ja 0x40eed3
xor eax, eax
jmp 0x40eec0
mov cl, byte [esp + eax + 0x1a20]
mov byte [esp + eax + 0xae0], cl
inc eax
cmp cl, bl
jne 0x40eec0
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x10c]
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0xb00]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40ef30
lea eax, [esp + 0xae0]
push eax
lea ecx, [esp + 0x364]
push str.Failed_to_create_the_process_to_run__s._r_n
push ecx
call fcn.00410464
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x36c]
push edx
push eax
jmp 0x40ef57
lea ecx, [esp + 0xae0]
push ecx
lea edx, [esp + 0x364]
push str.Successfully_created_the_process_to_run__s._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x36c]
push eax
push ecx
call fcn.0040aa30
mov eax, dword [esp + 0x80]
add esp, 0x14
cmp eax, ebx
je 0x40ef71
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x40ef90
cmp dword [esp + 0x1c], 7
jne 0x40ef89
mov dword [esp + 0xa8], eax
jmp 0x40ef90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x48]
cmp esi, ebx
je 0x40efb8
mov edx, dword [esp + 0x10]
push str.Configuring_WinVNC_service._r_n
push edx
call fcn.0040aa30
lea eax, [esp + 0x1920]
push eax
push esi
call fcn.004059a0
add esp, 0x10
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x40f005
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0040b600
add esp, 4
cmp eax, ebx
jne 0x40efdd
mov edx, dword [esp + 0x10]
push str.Successfully_generated_input_for_the_RAdmin_splash_screen._r_n
push edx
jmp 0x40effd
cmp eax, 0xffffffff
jne 0x40efee
mov eax, dword [esp + 0x10]
push str.The_RAdmin_splash_screen_was_not_found._It_may_be_have_been_disabled._r_n
push eax
jmp 0x40effd
cmp eax, 0xfffffffe
jne 0x40f005
mov ecx, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_on_the_RAdmin_splash_screen._r_n
push ecx
call fcn.0040aa30
add esp, 8
cmp dword [esp + 0x30], ebx
jne 0x40f4f3
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x58]
push edx
push 0x3c
push eax
call fcn.00408150
add esp, 0xc
test eax, eax
jle 0x40f4b7
lea ecx, [esp + 0xd4]
push ecx
call fcn.00411842
lea edx, [esp + 0xd8]
push edx
call fcn.00411829
add eax, 0xb
push eax
lea eax, [esp + 0x36c]
push str.Starting_the_relay_at__.8s_for_this
push eax
call fcn.00410464
lea eax, [esp + 0x100c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f068
sub eax, edx
cmp eax, 2
jl 0x40f0ac
lea edi, [esp + 0x360]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f080
mov ecx, dword [str.encrypted]
mov edx, dword [0x41e888]
mov ax, word [0x41e88c]
mov dword [edi], ecx
mov cl, byte [0x41e88e]
mov dword [edi + 4], edx
mov word [edi + 8], ax
mov byte [edi + 0xa], cl
lea edi, [esp + 0x360]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f0b4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x360]
push edx
mov ecx, 7
mov esi, str.remote_control_session..._r_n
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040aa30
mov eax, dword [esp + 0x64]
add esp, 8
cmp eax, ebx
je 0x40f128
push 1
call fcn.00409b10
add esp, 4
cmp eax, 0xfffffffe
je 0x40f116
cmp eax, 1
je 0x40f10a
cmp eax, 2
jne 0x40f128
mov ecx, dword [esp + 0x10]
push str.SoftwareSASGeneration_policy_setting_already_enabled._r_n
push ecx
jmp 0x40f120
mov edx, dword [esp + 0x10]
push str.Policy_setting_does_not_require_Ctl_Alt_Del._r_n
push edx
jmp 0x40f120
mov eax, dword [esp + 0x10]
push str.Failed_to_enable_SoftwareSASGeneration_policy._May_not_be_able_to_send_Ctl_Alt_Del._r_n
push eax
call fcn.0040aa30
add esp, 8
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0xffc]
push edx
mov edx, dword [esp + 0x2c]
push edi
push eax
mov eax, dword [esp + 0x38]
push ebx
push 1
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push eax
push esi
push ecx
call fcn.004091f0
mov eax, dword [esp + 0x70]
add esp, 0x2c
cmp eax, ebx
je 0x40f215
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x7c]
push edx
push str.A1F62E73_C423_481f_8966_AC79B8AE4A7B
push eax
call fcn.0040b760
add esp, 0xc
cmp eax, ebx
jne 0x40f1dc
mov ecx, dword [esp + 0x10]
push str.Successfully_generated_input_to_the_RAdmin_password_dialog_box._r_n
push ecx
call fcn.0040aa30
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
push 0xc
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x1000]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push esi
push eax
push ecx
call fcn.00401b00
add esp, 0x20
mov dword [esp + 0x9c], eax
jmp 0x40f215
cmp eax, 0xffffffff
jne 0x40f1ed
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_RAdmin_password_dialog_box._r_n
push edx
jmp 0x40f20d
cmp eax, 0xfffffffe
jne 0x40f1fe
mov eax, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_in_the_RAdmin_password_dialog_box._r_n
push eax
jmp 0x40f20d
cmp eax, 0xfffffffd
jne 0x40f215
mov ecx, dword [esp + 0x10]
push str.Failed_to_locate_the_password_text_field_in_the_RAdmin_password_dialog_box._r_n
push ecx
call fcn.0040aa30
add esp, 8
cmp edi, 7
jne 0x40f252
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
push 0xa
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x1000]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push esi
push eax
push ecx
call fcn.00401b00
add esp, 0x20
mov dword [esp + 0x9c], eax
jmp 0x40f362
cmp edi, 4
jne 0x40f362
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x150]
push edx
push eax
lea ecx, [esp + 0x368]
push str.Port__d_will_now_be_closed_after_accepting_a_relay_connection_from__s._r_n
push ecx
call fcn.00410464
lea edi, [esp + 0x370]
add esp, 0x10
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f285
mov edx, dword [str.Continuing_to_relay]
mov eax, dword [0x41e60c]
mov ecx, dword [0x41e610]
mov dword [edi], edx
mov edx, dword [0x41e614]
mov dword [edi + 4], eax
mov eax, dword [0x41e618]
mov dword [edi + 8], ecx
mov cl, byte [0x41e61c]
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], eax
lea eax, [esp + 0xff8]
mov byte [edi + 0x14], cl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f2d0
sub eax, edx
cmp eax, 2
jl 0x40f312
lea edi, [esp + 0x360]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f2e6
mov edx, dword [str.encrypted]
mov eax, dword [0x41e888]
mov cx, word [0x41e88c]
mov dword [edi], edx
mov dl, byte [0x41e88e]
mov dword [edi + 4], eax
mov word [edi + 8], cx
mov byte [edi + 0xa], dl
lea edi, [esp + 0x360]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f320
mov ecx, 6
mov esi, str.remote_control_data..._r_n
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x360]
push eax
push ecx
movsb byte es:[edi], byte [esi]
call fcn.0040aa30
mov edx, dword [esp + 0x3c]
push 1
push edx
call fcn.004051d0
mov edi, dword [esp + 0x2c]
add esp, 0x10
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0040aa80
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00407a30
add esp, 8
cmp edi, 7
jne 0x40f3fc
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0x9c]
push edx
push eax
call fcn.00401ba0
add esp, 8
cmp eax, 1
jne 0x40f3c8
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x364]
push str.The_relay_session_has_timed_out_because__s_has_been_idle._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x36c]
push eax
push ecx
jmp 0x40f3f4
cmp eax, 2
jne 0x40f3fc
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x364]
push str._s_has_terminated._r_n
push eax
call fcn.00410464
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x36c]
push ecx
push edx
call fcn.0040aa30
add esp, 0x14
cmp dword [esp + 0x5c], ebx
je case.0x40f414.2
push 2
call fcn.00409b10
add eax, 5
add esp, 4
cmp eax, 9
ja case.0x40f414.2
jmp dword [eax*4 + 0x40fc7c]
mov eax, dword [esp + 0x10]
push str.Successfully_removed_SoftwareSASGeneration_policy_setting._r_n
push eax
jmp 0x40f450
push str.Successfully_restored_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40f44b
mov edx, dword [esp + 0x10]
push str.Failed_to_remove_SoftwareSASGeneration_policy_setting._r_n
push edx
jmp 0x40f450
mov eax, dword [esp + 0x10]
push str.Failed_to_restore_SoftwareSASGeneration_policy_setting._r_n
push eax
jmp 0x40f450
push str.SoftwareSASGeneration_policy_setting_has_not_been_restored_because_it_has_changed_since_this_session_started._r_n
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040aa30
add esp, 8
mov edx, dword [esp + 0x10]
push edx
call fcn.0040aab0
lea eax, [esp + 0xd8]
push eax
call fcn.00411842
lea ecx, [esp + 0xdc]
push ecx
call fcn.00411829
add eax, 0xb
push eax
lea edx, [esp + 0x370]
push str.The_relay_session_has_terminated_at__.8s._r_n
push edx
call fcn.00410464
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x378]
push eax
push ecx
call fcn.0040aa30
add esp, 0x20
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40f75c
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x364]
push str.No_connection_was_made_by__s_to_this_relay_client._r_n
push eax
call fcn.00410464
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x36c]
push ecx
push edx
call fcn.0040aa30
add esp, 0x14
mov dword [esp + 0x58], 0xffffffff
jmp 0x40f75c
cmp esi, ebx
je 0x40f75c
mov ecx, dword [esp + 0x74]
lea eax, [esp + 0x7c]
push eax
push str.A1F62E73_C423_481f_8966_AC79B8AE4A7B
push ecx
call fcn.0040b760
add esp, 0xc
cmp eax, ebx
jne 0x40f52d
mov edx, dword [esp + 0x10]
push str.Successfully_generated_input_to_the_RAdmin_password_dialog_box._r_n
push edx
call fcn.0040aa30
add esp, 8
jmp 0x40f75c
cmp eax, 0xffffffff
jne 0x40f549
mov eax, dword [esp + 0x10]
push str.Failed_to_locate_the_RAdmin_password_dialog_box._r_n
push eax
call fcn.0040aa30
add esp, 8
jmp 0x40f75c
cmp eax, 0xfffffffe
jne 0x40f565
mov ecx, dword [esp + 0x10]
push str.Failed_to_locate_the_OK_button_in_the_RAdmin_password_dialog_box._r_n
push ecx
call fcn.0040aa30
add esp, 8
jmp 0x40f75c
cmp eax, 0xfffffffd
jne 0x40f75c
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_password_text_field_in_the_RAdmin_password_dialog_box._r_n
push edx
call fcn.0040aa30
add esp, 8
jmp 0x40f75c
cmp eax, 0x2bad2bad
jne 0x40f5fb
push 1
lea eax, [esp + 0x364]
push str.Failed._r_n_r_n____ERROR:_This_viewer_package_version___d__is_obsolete._r_n___________Please_restart_the_remote_control_session_by_first_selecting_a_machine_from_the_Kaseya_Virtual_System_r_n___________Administrator_remote_control_web_page_and_then_run_download_the_viewer_package_again._r_n_r_nThis_package_will_exit_now..._r_n
push eax
call fcn.00410464
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x40f5c9
push 0x10
lea ecx, [esp + 0x66c]
push ecx
lea edx, [esp + 0x368]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f75c
lea ecx, [esp + 0x360]
push ecx
push eax
call fcn.0040aa30
add esp, 8
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
push edx
call fcn.0040aa60
add esp, 4
mov dword [esp + 0x10], ebx
jmp 0x40f75c
mov eax, dword [esp + 0x10]
push str.Failed._r_nRelay_for_remote_control_session_failed_to_establish_a_connection_with_the_other_relay_client._r_n
push eax
call fcn.0040aa30
add esp, 8
jmp 0x40f75c
lea ecx, [esp + 0x360]
push 0x41de40
push ecx
call fcn.00410464
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x368]
push edx
push eax
call fcn.0040aa30
mov ecx, dword [esp + 0x38]
push ecx
push edi
lea edx, [esp + 0x378]
push str.ERROR:__Unable_to_connect_to_the_KServer_at__s_on_port__d._r_n_r_n
push edx
call fcn.00410464
lea edi, [esp + 0x380]
add esp, 0x20
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40f660
mov ecx, 0x10
mov esi, str.Please_check_that_your_firewall__router__and_or_proxy_server_is_r_n
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x360]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f680
mov ecx, dword [esp + 0x28]
sub eax, edx
mov edx, dword [esp + 0x40]
push ecx
push edx
lea eax, [esp + eax + 0x368]
push str.allowing_outbound_TCP_connections_to__s_on_port__d._r_n
push eax
call fcn.00410464
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x370]
push ecx
push edx
call fcn.0040aa30
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x28]
add esp, 0x18
cmp eax, ebx
je 0x40f6ca
cmp esi, ebx
jne 0x40f6ee
mov eax, dword [esp + 0x1c]
cmp eax, 5
je 0x40f6ee
cmp eax, 2
je 0x40f6ee
cmp eax, 0xb
je 0x40f6ee
cmp eax, 6
je 0x40f6ee
cmp eax, 7
je 0x40f6ee
push 0x7530
jmp 0x40f74e
lea eax, [esp + 0x668]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f6f8
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40f724
jmp 0x40f710
mov cl, byte [esp + eax + 0x668]
cmp cl, 0x5c
je 0x40f724
cmp cl, 0x3a
je 0x40f724
dec eax
jns 0x40f710
inc eax
push 0x78
mov dword [esp + 0x1c], eax
push 0x50010
lea eax, [esp + eax + 0x670]
push eax
lea ecx, [esp + 0x36c]
push ecx
push esi
call fcn.0040ab10
add esp, 0x14
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x24], 0xffffffff
cmp byte [esp + 0x770], bl
je 0x40f7ad
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x770]
push edx
call esi
test eax, eax
jne 0x40f7ad
lea eax, [esp + 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f7ad
test al, 1
je 0x40f7ad
push 0x80
lea ecx, [esp + 0x774]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x770]
push edx
call esi
cmp dword [esp + 0xb0], ebx
jle 0x40f7e3
mov eax, dword [esp + 0xac]
push eax
mov eax, dword [esp + 0xbc]
call fcn.0040b420
add esp, 4
test eax, eax
jge 0x40f7e3
mov ecx, dword [esp + 0x10]
push str.ERROR:_Failed_to_restore_of_UDP_registry_setting_for_pcAnywhere__r_n
push ecx
call fcn.0040aa30
add esp, 8
mov eax, dword [esp + 0xa0]
cmp eax, ebx
je 0x40f7f5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x40]
push edx
call fcn.00410b6d
mov eax, dword [esp + 0x3c]
add esp, 4
cmp eax, ebx
je 0x40f813
push eax
call fcn.00410b6d
add esp, 4
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x40f824
push eax
call fcn.00410b6d
add esp, 4
mov eax, dword [esp + 0x58]
cmp eax, 0xffffffff
je 0x40f837
push ebx
push eax
call fcn.004051d0
add esp, 8
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x40f85f
push 1
push eax
call fcn.004051d0
mov eax, dword [esp + 0x24]
add esp, 8
cmp eax, 7
jne 0x40f85f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x40f873
push 1
push eax
call fcn.004051d0
add esp, 8
mov eax, dword [esp + 0x10]
push eax
call fcn.0040aab0
mov esi, dword [esp + 0x4c]
add esp, 4
cmp esi, ebx
je 0x40f8bb
mov ecx, dword [esp + 0x10]
push str.Removing_WinVNC_service._r_n
push ecx
call fcn.0040aa30
push esi
call fcn.00405eb0
mov edx, dword [esp + 0x1c]
push 0x1e
push 0x50040
push str.Virtual_System_Administrator
push str.Remote_control_session_with_your_administrator_has_ended.
push edx
call fcn.0040ab10
add esp, 0x20
cmp byte [esp + 0x3f50], bl
je 0x40f94d
lea eax, [esp + 0x3f50]
push eax
push 0x41de40
mov ecx, eax
push str._r_n
push ecx
call fcn.0040aeb0
mov al, byte [esp + 0xf00]
add esp, 0x10
cmp al, bl
jne 0x40f929
lea edx, [esp + 0xef0]
push edx
push str.Agent_Title
push str._SERVER_COMMUNICATIONS_
call fcn.00409990
mov al, byte [esp + 0xefc]
add esp, 0xc
cmp al, bl
jne 0x40f929
mov ecx, 7
mov esi, str.Virtual_System_Administrator
lea edi, [esp + 0xef0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x10]
push 0x78
push 0x50040
lea eax, [esp + 0xef8]
push eax
lea ecx, [esp + 0x3f5c]
push ecx
push edx
call fcn.0040ab10
add esp, 0x14
cmp byte [esp + 0x1410], bl
je 0x40fb20
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
mov eax, 0xfffff830
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov eax, 0xc
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc8], eax
xor eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
cmp byte [esp + 0x9e0], bl
mov ecx, 1
mov dword [esp + 0x108], 0x44
mov dword [esp + 0x134], 5
mov word [esp + 0x138], bx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ecx
je 0x40fa1a
lea eax, [esp + 0x1410]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f9f4
lea ecx, [esp + 0x9e0]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x1414]
push 0x41e9fc
push edx
call fcn.00410464
add esp, 0xc
lea eax, [esp + 0x1410]
push 0x25
push eax
call fcn.00410ce0
add esp, 8
test eax, eax
je 0x40fa73
push 0xc80
lea ecx, [esp + 0x1a24]
push ecx
lea edx, [esp + 0x1418]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40fa73
cmp eax, 0x208
ja 0x40fa73
xor eax, eax
jmp 0x40fa60
mov cl, byte [esp + eax + 0x1a20]
mov byte [esp + eax + 0x1410], cl
inc eax
cmp cl, bl
jne 0x40fa60
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x10c]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x1430]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40fad0
lea edx, [esp + 0x1410]
push edx
lea eax, [esp + 0x364]
push str.Failed_to_start_the_cleanup_process__s._r_n
push eax
call fcn.00410464
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x36c]
push ecx
push edx
jmp 0x40faf7
lea eax, [esp + 0x1410]
push eax
lea ecx, [esp + 0x364]
push str.Successfully_started_the_cleanup_process__s._r_n
push ecx
call fcn.00410464
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x36c]
push edx
push eax
call fcn.0040aa30
mov eax, dword [esp + 0x80]
add esp, 0x14
cmp eax, ebx
je 0x40fb11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x40fb20
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jne 0x40fb35
mov dword [esp + 0x9e0], 0x776f6e
jmp 0x40fb78
cmp eax, 1
jne 0x40fb62
mov ecx, dword [str.in_1_minute]
mov edx, dword [0x41e014]
mov eax, dword [0x41e018]
mov dword [esp + 0x9e0], ecx
mov dword [esp + 0x9e4], edx
mov dword [esp + 0x9e8], eax
jmp 0x40fb78
push eax
lea ecx, [esp + 0x9e4]
push str.in__d_minutes
push ecx
call fcn.00410464
add esp, 0xc
mov esi, dword [esp + 0x30]
cmp esi, ebx
jle 0x40fb97
lea edx, [esp + 0x9e0]
push edx
push str.This_relay_helper_will_exit__s_because_a_direct_connection_has_been_established..._r_n
lea eax, [esp + 0x368]
push eax
jmp 0x40fbac
lea ecx, [esp + 0x9e0]
push ecx
push str.This_relay_client_will_exit__s..._r_n
lea edx, [esp + 0x368]
push edx
call fcn.00410464
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x360]
push eax
push ecx
call fcn.0040aa30
add esp, 8
cmp esi, ebx
jne 0x40fbd4
push 0x2710
jmp 0x40fbd9
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x10], ebx
je 0x40fc48
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jbe 0x40fc48
cmp eax, 0x1179e
jbe 0x40fbfe
mov dword [esp + 0x2c], 0xffffffff
jmp 0x40fc0c
imul eax, eax, 0xea60
cmp eax, ebx
mov dword [esp + 0x2c], eax
je 0x40fc48
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xea60
jmp 0x40fc20
mov edx, dword [esp + 0x10]
push 0x41df80
push edx
call fcn.0040aa30
mov eax, dword [esp + 0x34]
add esp, 8
cmp eax, edi
jbe 0x40fc45
push edi
call esi
sub dword [esp + 0x2c], edi
jne 0x40fc20
jmp 0x40fc48
push eax
call esi
mov eax, dword [esp + 0x10]
push eax
call fcn.0040aa60
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10