Function at 0x40c4f0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Write file on windows

Disassembly:
sub esp, 0x608
mov eax, dword [str._q_]
xor eax, esp
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x610], eax
mov eax, dword [esi]
push str.Update_existing_installation...
push eax
call fcn.00404120
add esp, 8
push 0x70
mov ecx, 0x4224e8
call fcn.00408bf0
mov ecx, dword [esi]
push str.Stop_user_interface_modules...
push ecx
call fcn.00404120
mov eax, dword [0x4225c0]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
add esp, 8
test eax, eax
je 0x40c553
mov eax, dword [0x4225d4]
test eax, eax
je 0x40c58e
mov eax, dword [0x4224e8]
push 0x200
lea edx, [esp + 0x14]
push edx
push 0x74
push eax
mov byte [esp + 0x20], 0
call edi
mov eax, dword [0x4224f4]
test eax, eax
je 0x40c582
lea ecx, [esp + 0x10]
push ecx
push 0x3e9
push eax
call ebp
push 0
mov ecx, 0x4224f0
call fcn.0040d030
mov ecx, esi
call fcn.00409580
test eax, eax
jne 0x40caa9
mov eax, dword [0x4225c0]
test eax, eax
je 0x40c5af
mov eax, dword [0x4225d4]
test eax, eax
je 0x40c5ea
mov eax, dword [0x4224e8]
push 0x200
lea edx, [esp + 0x14]
push edx
push 0x74
push eax
mov byte [esp + 0x20], 0
call edi
mov eax, dword [0x4224f4]
test eax, eax
je 0x40c5de
lea ecx, [esp + 0x10]
push ecx
push 0x3e9
push eax
call ebp
push 5
mov ecx, 0x4224f0
call fcn.0040d030
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
mov edx, dword [esi]
push str.Stop_agent_service...
push edx
call fcn.00404120
mov eax, dword [0x4225c0]
add esp, 8
test eax, eax
je 0x40c61a
mov eax, dword [0x4225d4]
test eax, eax
je 0x40c656
mov ecx, dword [0x4224e8]
push 0x200
lea eax, [esp + 0x18]
push eax
push 0x73
push ecx
mov byte [esp + 0x24], 0
call edi
mov eax, dword [0x4224f4]
test eax, eax
je 0x40c64a
lea edx, [esp + 0x14]
push edx
push 0x3e9
push eax
call ebp
push 0xa
mov ecx, 0x4224f0
call fcn.0040d030
mov ecx, esi
call fcn.004091a0
test eax, eax
jne 0x40caa8
mov eax, dword [0x4225c0]
test eax, eax
je 0x40c677
mov eax, dword [0x4225d4]
test eax, eax
je 0x40c6b3
mov ecx, dword [0x4224e8]
push 0x200
lea eax, [esp + 0x18]
push eax
push 0x73
push ecx
mov byte [esp + 0x24], 0
call edi
mov eax, dword [0x4224f4]
test eax, eax
je 0x40c6a7
lea edx, [esp + 0x14]
push edx
push 0x3e9
push eax
call ebp
push 0xf
mov ecx, 0x4224f0
call fcn.0040d030
push 0xbb8
call ebx
mov eax, dword [esi]
push str.Copying_files...
push eax
call fcn.00404120
add esp, 8
push 0x14
mov ecx, esi
call fcn.0040bbf0
test eax, eax
jne 0x40caa8
mov ecx, dword [esi]
push str.Updating_package_infomation_file...
push ecx
call fcn.00404120
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push str.Package.xml
push eax
lea ecx, [esp + 0x24]
push str._s_s
push ecx
xor ebx, ebx
call fcn.0040f6f9
lea edx, [esp + 0x2c]
push edx
call fcn.0040dd50
add esp, 0x1c
test eax, eax
jne 0x40c7a9
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
push str.Package
push 0x41c758
push ecx
push 0x41c758
push str.Package
lea edx, [esp + 0x228]
push str.__xml_version_1.0_____r_n_____Please_do_not_remove_or_modify_this_file._____r_n__s__r_n__s__s___s__r_n___s__r_n
push edx
call fcn.0040f6f9
add esp, 0x1c
push ebx
push 0x80
push 2
push ebx
push ebx
mov ebp, eax
push 0x40000000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c796
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x220]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c78d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c79e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x40c7a9
mov eax, ebx
jmp 0x40caa8
mov eax, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40c852
push str.Removing_legacy_agent_service...
push eax
call fcn.00404120
add esp, 8
push 0x4b
push 0x75
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.00409430
mov ebp, eax
test ebp, ebp
jne 0x40caa6
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
push str.Installing_new_agent_service...
push eax
call fcn.00404120
add esp, 8
push 0x50
push 0x7d
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.0040b460
mov ebp, eax
cmp ebp, 0x431
jne 0x40c88b
mov ecx, dword [esi]
push str.Agent_service_exists._Updating_agent_service...
push ecx
call fcn.00404120
add esp, 8
push 0x53
push 0x82
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.0040b5e0
mov edx, dword [esi]
mov ebp, eax
push ebp
push str.Updating_agent_service_returns__d
push edx
jmp 0x40c883
push str.Configuring_agent_service...
push eax
call fcn.00404120
add esp, 8
push 0x4b
push 0x82
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.0040b5e0
mov ebp, eax
mov eax, dword [esi]
push ebp
push str.Updating_agent_service_returns__d
push eax
call fcn.00404120
add esp, 0xc
test ebp, ebp
jne 0x40caa6
push 0x55
push 0x7b
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.00409630
mov eax, dword [esi]
mov ecx, dword [eax + 0x68]
test ecx, ecx
jne 0x40c8db
push str.Adding_uninstall_key...
push eax
call fcn.00404120
add esp, 8
push 0x5a
push 0x81
mov ecx, 0x4224e8
call fcn.00408c70
push 1
mov ecx, esi
call fcn.00409fd0
jmp 0x40c8e9
push str.Skip_Adding_uninstall_key.
push eax
call fcn.00404120
add esp, 8
mov eax, dword [esi]
mov ecx, dword [eax + 0x64]
test ecx, ecx
jne 0x40c91c
push str.Creating_shortcut...
push eax
call fcn.00404120
add esp, 8
push 1
mov ecx, esi
call fcn.0040aa60
mov ecx, dword [esi]
push eax
push str.Shortcut_creation_returns_0x_x
push ecx
call fcn.00404120
add esp, 0xc
jmp 0x40c92a
push str.Skip_Shortcut_creation.
push eax
call fcn.00404120
add esp, 8
mov eax, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40ca43
push str.Remove_legacy_agent_registry_settings...
push eax
call fcn.00404120
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call edi
test eax, eax
jne 0x40c97f
mov eax, dword [esp + 0x10]
push str.Kaseya_Agent_Service_Helper
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call edi
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jne 0x40c9b5
mov eax, dword [esp + 0x10]
push str.48C76121_4F90_11D5_9884_0050BA85A903
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
call edi
test eax, eax
jne 0x40c9e5
mov eax, dword [esp + 0x10]
push str.AgentMon.exe
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SYSTEMCurrentControlSetServicesVxD
push 0x80000002
call edi
test eax, eax
jne 0x40ca15
mov eax, dword [esp + 0x10]
push str.Kaseya
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esi]
push str.Remove_legacy_agent_uninstallation_files...
push edx
call fcn.00404120
push 0x104
lea eax, [esp + 0x20]
push eax
push str.__ProgramFiles__InstallShield_Installation_Information48C76121_4F90_11D5_9884_0050BA85A903
call fcn.00401dd0
lea ecx, [esp + 0x28]
push ecx
call fcn.00402a20
add esp, 0x18
mov eax, dword [esi]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x40ca71
push str.Setup_drivers...
push eax
call fcn.00404120
add esp, 8
push 0x5f
push 0x7c
mov ecx, 0x4224e8
call fcn.00408c70
mov ecx, esi
call fcn.0040b760
jmp 0x40caa6
push 0x104
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov byte [esp + 0x1c], 0
call fcn.0040a440
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004106a2
add esp, 8
test eax, eax
jne 0x40caa6
push eax
mov ecx, esi
call fcn.0040a4e0
mov eax, ebp
pop ebx
mov ecx, dword [esp + 0x610]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040f175
add esp, 0x608
ret