Function at 0x402146
Capabilities:
Check mutex on windows
Create process on windows
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a34
call fcn.00408e20
or dword [ebp - 0x14], 0xffffffff
push esi
push edi
mov esi, str.EPOWStub32Mutex
xor edi, edi
push esi
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x402196
push 0x10
push str.NAI_Agent_Installation
push str.There_is_a_previous_copy_of_NAI_Agent_Install_program_still_running_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.NAIMServInst
call fcn.00402a12
or eax, 0xffffffff
jmp 0x402a0e
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [0x415000], eax
jne 0x4021b0
xor eax, eax
jmp 0x402a0e
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x684]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x990]
push eax
call fcn.00408890
lea eax, [ebp - 0x990]
push 0x5c
push eax
call fcn.00408df0
add esp, 0x10
test eax, eax
je 0x402200
lea eax, [ebp - 0x990]
push 0x5c
push eax
call fcn.00408df0
and byte [eax], 0
pop ecx
pop ecx
lea eax, [ebp - 0x684]
push 0x413b6c
push eax
call fcn.00408dd0
pop ecx
mov dword [ebp - 4], eax
pop ecx
xor ecx, ecx
cmp eax, edi
setne cl
mov esi, ecx
cmp esi, edi
je 0x402320
push str.__temp.zip
lea eax, [ebp - 0x788]
push dword [ebp + 8]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x788]
push 0x413b54
push eax
call fcn.00408dd0
add esp, 0x18
xor ecx, ecx
cmp eax, edi
mov dword [ebp - 8], eax
setne cl
mov esi, ecx
cmp esi, edi
je 0x402320
and byte [0x413501], 0
push 0x4134f9
call fcn.00408da5
mov edi, eax
xor eax, eax
test edi, edi
setg al
mov esi, eax
pop ecx
test esi, esi
jne 0x40229d
push 0x10
push str.NAI_Agent_Installation
push str.The_agent_install_package_is_corrupted._nPlease_advise_your_Policy_Orchestrator_system_administrator.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
push dword [ebp - 4]
call fcn.00408c8e
add esp, 0xc
test esi, esi
je 0x402320
mov edi, 0x2710
push edi
call fcn.00408c1a
pop ecx
mov dword [ebp - 0xc], eax
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x402320
push dword [ebp - 4]
push edi
push 1
push dword [ebp - 0xc]
call fcn.00408b32
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x4022ff
push dword [ebp - 8]
push edi
push 1
push dword [ebp - 0xc]
call fcn.00408a28
mov esi, eax
add esp, 0x10
sub esi, edi
neg esi
sbb esi, esi
inc esi
jne 0x4022cb
test esi, esi
je 0x402320
push dword [ebp - 8]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0xc]
call fcn.00408a28
mov esi, eax
add esp, 0x10
sub esi, dword [ebp - 0x10]
neg esi
sbb esi, esi
inc esi
xor edi, edi
cmp dword [ebp - 8], edi
je 0x402330
push dword [ebp - 8]
call fcn.004089d2
pop ecx
cmp dword [ebp - 4], edi
je 0x40233e
push dword [ebp - 4]
call fcn.004089d2
pop ecx
cmp esi, edi
je 0x402412
mov word [ebp - 0x47c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x47a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x47c]
push ebx
push eax
lea eax, [ebp - 0x788]
push 0xffffffffffffffff
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x402412
lea eax, [ebp - 0x47c]
push 1
push eax
call sym.wstub32.exe_zlib_open_zip
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x402403
and word [ebp - 0x47c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x47a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x47c]
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x402403
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0xc]
call sym.wstub32.exe_zlib_unzip_all
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x402403
push 0x10
push str.NAI_Agent_Installtion
push str.Fail_to_extract_the_agent_install_package._nPlease_advise_your_Policy_Orchestrator_system_administrator.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0xc], 0
je 0x402412
push dword [ebp - 0xc]
call sym.wstub32.exe_zlib_close_zip
pop ecx
lea eax, [ebp - 0x788]
push eax
call fcn.00410a60
test esi, esi
pop ecx
je 0x402a0a
push str.Install.pkg
lea eax, [ebp - 0x88c]
push dword [ebp + 8]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x88c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 0xa94]
push ebx
push eax
push 0x415008
push str.AgentInstall
push str.Install
call esi
xor ecx, ecx
push 0x24
test eax, eax
setg cl
mov dword [ebp - 8], ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x50c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x510]
mov dword [ebp - 0x510], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x500], 1
jne 0x402516
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x230]
push ebx
push eax
push str.poaginst.exe
push str.AgentSfxFilename
push str.Install
call esi
cmp dword [ebp + 0xc], 1
jne 0x4024de
push 1
lea eax, [ebp - 0x230]
push str.ShowInstallUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
mov dword [ebp + 0xc], eax
cmp byte [0x416ac4], 0
jne 0x402504
push ebx
push 0x416ac4
push 0x415008
lea eax, [ebp - 0x230]
push str.InstallPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea eax, [ebp - 0x230]
push 0x415004
push eax
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
cmp dword [ebp - 8], 0
je 0x402a0a
cmp byte [0x416ac4], 0
jne 0x4026cc
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x12c]
push ebx
push eax
push 0x415008
push str.InstallPath
push str.Install
call esi
xor ecx, ecx
test eax, eax
setg cl
test ecx, ecx
mov dword [ebp - 8], ecx
je 0x402590
lea eax, [ebp - 0x12c]
push eax
push 0x413a04
push 0x416ac4
call fcn.00408980
add esp, 0xc
jmp 0x4026cc
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_Plugins
push str.ePOAgent2000
mov edi, str._s_s
push esi
lea eax, [ebp - 0x378]
push edi
push eax
call fcn.00408980
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x378]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4025ea
cmp dword [ebp - 4], eax
jne 0x40261f
push str.ePOAgent1000
push esi
lea eax, [ebp - 0x378]
push edi
push eax
call fcn.00408980
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x378]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402677
cmp dword [ebp - 4], eax
je 0x402677
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.Plugin_Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 8], eax
je 0x402677
lea eax, [ebp - 0x230]
push 0x5c
push eax
call fcn.00408df0
pop ecx
test eax, eax
pop ecx
je 0x402662
and byte [eax], 0
lea eax, [ebp - 0x230]
push eax
push 0x416ac4
call fcn.00408890
pop ecx
pop ecx
jmp 0x4026bd
lea eax, [ebp - 0x12c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
mov dword [ebp - 8], eax
je 0x4026bd
and byte [ebp - 0x129], 0
lea eax, [ebp - 0x12c]
push str.EPOAgent
push eax
call fcn.004088a0
lea eax, [ebp - 0x12c]
push eax
push 0x413a04
push 0x416ac4
call fcn.00408980
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x4026cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 8], esi
je 0x402a0a
cmp dword [0x416ac0], esi
push 0x41374c
push str.password
push 0x413638
push str.domain
push 0x413524
push str.user
je 0x402741
lea eax, [ebp - 0x684]
push eax
push str.module
push 0x416ac4
push str.installpath
push dword [ebp + 0xc]
lea eax, [ebp - 0xa94]
push str.showui
push str.install
push eax
lea eax, [ebp - 0x1a34]
push dword [ebp + 8]
push str._s_s___s___s_d____s_s_____s_s____s_s___s_s___s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x44
jmp 0x402777
push 0x416ac4
push str.installpath
push dword [ebp + 0xc]
lea eax, [ebp - 0xa94]
push str.showui
push str.install
push eax
lea eax, [ebp - 0x1a34]
push dword [ebp + 8]
push str._s_s___s___s_d____s_s____s_s___s_s___s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x3c
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
and byte [ebp - 0x378], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x377]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorAgent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402988
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40298a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push str.Installed_Path
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
neg edi
sbb edi, edi
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x40298a
lea eax, [ebp - 0x12c]
push eax
call fcn.00408810
cmp byte [ebp + eax - 0x12d], 0x5c
pop ecx
je 0x402832
lea eax, [ebp - 0x12c]
push 0x413894
push eax
call fcn.004088a0
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push str.nagshr32.dll
push eax
lea eax, [ebp - 0x378]
push 0x41387c
push eax
call fcn.00408980
add esp, 0x10
lea eax, [ebp - 0x378]
push 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [ebp - 0xc], eax
mov eax, ecx
cmp eax, esi
je 0x402978
push str.UnloadPluginDLL
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [ebp - 4], eax
mov eax, ecx
cmp eax, esi
je 0x402978
lea eax, [ebp + 8]
push eax
push str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_Plugins
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x402912
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x402912
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x402912
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [ebp - 0x230]
dec eax
push ebx
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call esi
test eax, eax
jne 0x402910
lea eax, [ebp - 0x230]
push eax
call dword [ebp - 4]
dec dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push ebx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x4028ed
xor esi, esi
cmp dword [ebp + 8], esi
je 0x402920
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x402978
mov edi, str.SOFTWARENetwork_AssociatesePolicy_OrchestratorApplication_Plugins
lea eax, [ebp - 0x230]
push edi
push str.HKLM_s
push eax
call fcn.00408980
push str.TFU_SSK
push edi
lea eax, [ebp - 0x580]
push str.HKLM_s_s
push eax
call fcn.00408980
add esp, 0x1c
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00402c8d
test eax, eax
je 0x402978
lea eax, [ebp - 0x230]
push eax
call fcn.00402a81
cmp dword [ebp - 0xc], esi
je 0x40298a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40298a
xor esi, esi
push 0x44
lea eax, [ebp - 0x274]
pop edi
push edi
push esi
push eax
call fcn.00408470
add esp, 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x274], edi
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1a34]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402a0a
cmp dword [0x416ac0], esi
je 0x4029e2
push 0x3e8
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0x14], esi
jmp 0x4029fa
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 0x14]
pop ebx
pop edi
pop esi
leave
ret