Function at 0x40b810
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x686c
call fcn.0040de90
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x5f0], bl
mov ecx, 0x13
lea edi, [esp + 0x5f1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x4e9]
mov byte [esp + 0x4e8], bl
rep stosd dword es:[edi], eax
mov byte [esp + 0x13d8], bl
mov ecx, 0x31f
lea edi, [esp + 0x13d9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov byte [esp + 0x9b0], bl
mov ecx, 0x3f
lea edi, [esp + 0x9b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xec0], bl
mov ecx, 0x103
lea edi, [esp + 0xec1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xab0], bl
mov ecx, 0x3f
lea edi, [esp + 0xab1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2058], bl
mov ecx, 9
lea edi, [esp + 0x2059]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x1de
lea edi, [esp + 0x2080]
rep stosd dword es:[edi], eax
or edx, 0xffffffff
stosw word es:[edi], ax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xd9]
mov byte [esp + 0xd8], bl
mov dword [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x44], 0x12c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov byte [esp + 0xbb0], bl
mov ecx, 0x81
lea edi, [esp + 0xbb1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x748], bl
mov ecx, 0x3f
lea edi, [esp + 0x749]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x2800], bl
mov ecx, 0x101c
lea edi, [esp + 0x2801]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x8b0], bl
mov ecx, 0x3f
lea edi, [esp + 0x8b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xdb8], bl
mov ecx, 0x40
lea edi, [esp + 0xdb9]
rep stosd dword es:[edi], eax
mov byte [esp + 0x848], bl
mov ecx, 0x19
lea edi, [esp + 0x849]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x12d0], bl
mov ecx, 0x41
lea edi, [esp + 0x12d1]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x640]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x644]
push ecx
push ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x5c], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jle 0x40bdb3
lea edx, [esp + 0x640]
push 0x41b2c4
push edx
call fcn.0040de73
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x68], esi
je 0x40bdb3
push 2
push 0xfffff85e
push esi
call fcn.0040eaf0
push esi
push 0x7a2
lea eax, [esp + 0x206c]
push 1
push eax
call fcn.0040dd2e
add esp, 0x1c
cmp eax, 0x7a2
jne 0x40bda6
mov edi, str.Kaseya_Remote_Control_Data_Table
lea esi, [esp + 0x2058]
mov ecx, 0x21
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40babe
mov edi, str.Kaseya_Remote_Control_Relay_Table
lea esi, [esp + 0x2058]
mov ecx, 0x22
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40bda6
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
lea ecx, [esp + 0x4ec]
push ecx
push str.TEMP
call esi
cmp eax, ebx
jle 0x40bb49
cmp eax, 0x104
jae 0x40bb49
lea eax, [esp + 0x4e8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40baf0
sub eax, edx
cmp byte [esp + eax + 0x4e7], 0x5c
je 0x40bb22
lea edi, [esp + 0x4e8]
dec edi
jmp 0x40bb10
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bb10
mov dx, word [0x41b5d8]
mov word [edi], dx
cmp byte [esp + 0x4e8], bl
je 0x40bbae
xor eax, eax
mov cl, byte [esp + eax + 0x4e8]
mov byte [esp + eax + 0x12d0], cl
inc eax
cmp cl, bl
jne 0x40bb31
jmp 0x40bbc9
push 0x104
lea eax, [esp + 0x4ec]
push eax
push 0x41d344
call esi
cmp eax, ebx
jle 0x40bba7
cmp eax, 0x104
jae 0x40bba7
lea eax, [esp + 0x4e8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40bb72
sub eax, edx
cmp byte [esp + eax + 0x4e7], 0x5c
je 0x40bb22
lea edi, [esp + 0x4e8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bb90
mov cx, word [0x41b5d8]
mov word [edi], cx
jmp 0x40bb22
mov byte [esp + 0x4e8], bl
mov dx, word [0x41b2f4]
mov al, byte [0x41b2f6]
mov word [esp + 0x12d0], dx
mov byte [esp + 0x12d2], al
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x4e8]
push ecx
lea edx, [esp + 0x205c]
push edx
push eax
call fcn.004063c0
add esp, 0xc
cmp eax, 0xfffffffd
je 0x40bc49
cmp eax, 0xfffffffe
je 0x40bc0a
cmp eax, 0xffffffff
jne 0x40bc69
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004082e0
push str.ERROR:_The_viewer_package_is_corrupted._The_table_header_is_invalid._Download_this_package_again._r_n
jmp 0x40bc5c
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004082e0
lea eax, [esp + 0x4f0]
push eax
lea ecx, [esp + 0x1ec]
push str.ERROR:_Unable_to_extract_viewer_files_to_the_directory__s._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1f4]
push edx
push eax
call fcn.0040a0c0
add esp, 0x1c
jmp 0x40bc69
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004082e0
push str.ERROR:_The_viewer_package_is_corrupted._Unable_to_read_viewer_files._Download_this_package_again._r_n
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040a0c0
add esp, 0x10
cmp byte [esp + 0x2080], bl
je 0x40bda6
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x68
lea eax, [esp + 0x86c]
push eax
push 0x101
lea ecx, [esp + 0xde4]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x8e4]
push edx
push 0x4074
lea eax, [esp + 0x283c]
push eax
push pe_nt_image_headers32
lea ecx, [esp + 0x78c]
push ecx
push 0x208
lea edx, [esp + 0xbfc]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0xa0]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0xb0c]
push edx
push 0x410
lea eax, [esp + 0xf24]
push eax
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0xa28]
push pe_nt_image_headers32
push edx
lea edi, [esp + 0x2100]
call fcn.0040acc0
mov al, byte [esp + 0xf40]
add esp, 0x80
cmp al, bl
je 0x40bda6
lea eax, [esp + 0x4e8]
push eax
lea ecx, [esp + 0x205c]
push ecx
lea edx, [esp + 0xec8]
push 0x410
push edx
call fcn.004066a0
add esp, 0x10
test eax, eax
je 0x40bda6
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004082e0
mov edx, dword [esp + 0x18]
push str.Unexpected_error_occurred_while_creating_path_to_components_in_temp_directory._r_n
push edx
call fcn.0040a0c0
add esp, 0x10
mov eax, dword [esp + 0x68]
push eax
call fcn.0040ddc6
add esp, 4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x68
lea eax, [esp + 0x86c]
push eax
push 0x101
lea ecx, [esp + 0xde4]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x8e4]
push edx
push 0x4074
lea eax, [esp + 0x283c]
push eax
push pe_nt_image_headers32
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x78c]
push ecx
push 0x208
lea edx, [esp + 0xbfc]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0xa0]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0xb0c]
push edx
push 0x410
lea eax, [esp + 0xf24]
push eax
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0xa28]
push pe_nt_image_headers32
push edx
call fcn.0040acc0
lea eax, [esp + 0xa30]
add esp, 0x80
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40be95
sub eax, edx
cmp eax, 1
jb 0x40beaf
cmp dword [esp + 0x14], ebx
jl 0x40beaf
cmp dword [esp + 0x20], ebx
jge 0x40bed2
cmp dword [esp + 0x18], ebx
jne 0x40bedc
cmp dword [esp + 0x10], ebx
je 0x40bec6
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x18], ebx
je 0x40c33b
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x640]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x644]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x640]
lea edx, [eax + 1]
jmp 0x40bf10
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40bf10
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40bf34
mov edi, edi
mov cl, byte [esp + eax + 0x640]
cmp cl, 0x5c
je 0x40bf34
cmp cl, 0x3a
je 0x40bf34
dec eax
jns 0x40bf20
lea ecx, [esp + eax + 0x641]
push ecx
lea edx, [esp + 0x13dc]
push str._s__s_ipAddr__p_portNumber__c_portNumber__i_sessionID__w_waitTimeSeconds___k_cryptoKey__n___________r____e____f____a_OR__b__app_cmd_string_____o_appOptionStr____l____g_appWaitSeconds__n___________x__exit_cmd_string_____y_exitOptionStr____mr____d____j____v____h_____n
push edx
call fcn.0040dbb4
lea edi, [esp + 0x13e4]
add esp, 0xc
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bf60
mov ecx, 0xb
mov esi, str._s_ipAddr__relay_server_IP_address_or_name_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bf80
mov ecx, 0xc
mov esi, str._p_portNumber__relay_server_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bfa0
mov ecx, 0xb
mov esi, str._c_portNumber__local_host_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bfc0
mov ecx, 8
mov esi, str._i_sessionID__relay_session_ID_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40bfe0
mov ecx, 0x16
mov esi, str._w_waitTime__seconds_to_wait_for_response_from_listener_relay_client_via_relay_server_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c000
mov ecx, 0x16
mov esi, str._k_cryptoKey__optional_crypto_key_for_this_session__maximum_of_128_bytes_of_hex_data__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c020
mov ecx, 0x14
mov esi, str._r__perform_optional_support_specific_to_RAdmin_server_application__R_Server._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c040
mov ecx, 0xe
mov esi, str.________R_Server_is_restarted_with_a_specific_password._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c060
mov ecx, 0x15
mov esi, str._e__perform_optional_support_specific_to_pcAnywhere_server_application__Awhost32._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c080
mov ecx, 0xf
mov esi, str.________Awhost32_is_run_with_Network.bhf_on_the_command_line._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c0a0
mov ecx, 6
mov esi, str._f__FTP_server_support_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c0c0
mov ecx, 0xf
mov esi, str._mr__manual_remote_control_support_for_RAdmins_r_server.exe_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c0e0
mov ecx, 0x11
mov esi, str._a__app_cmd_string___optional_application_command_line_string_to_run_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c100
mov ecx, 0x17
mov esi, str._b__app_cmd_string___same_as__a_but_prepend_App_Paths_directory_location_to_application_name_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c120
mov ecx, 0x14
mov esi, str._o__appOptionStr___option_string_to_pass_on_the_command_line_to_app__e.g.__8bit__n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c140
mov ecx, 0x15
mov esi, str._l__always_run_application_specified_by__a_or__b._by_default_without_this_option__n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c160
mov ecx, 0x18
mov esi, str.________the_application_is_run_only_if_the_port_specified_in__c_is_not_listening_for_connections._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c180
mov ecx, 0x16
mov esi, str.________it_is_assumed_that_the_port_from__c_is_opened_by_the_application_from__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c1a0
mov ecx, 0x17
mov esi, str._g_appWaitSeconds__seconds_to_wait_for_completion_of_the_application_specified_by__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x13d8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c1c0
mov ecx, 0x1a
mov esi, str.________0_to_wait_forever._e.g._used_when_running_Windows_scripts_that_should_complete_before_proceeding._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c1e0
mov ecx, 0x18
mov esi, str._x__exit_cmd_string___optional_application_command_line_string_to_run_when_relay_client_exits_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c200
mov ecx, 0x11
mov esi, str._y__exitOptionStr___command_line_option_string_passed_to_exit_cmd_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c220
mov ecx, 0x12
mov esi, str._z__exitMsgStr___display_a_message_in_a_timed_dialog_box_for_2_minutes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c240
mov ecx, 0x12
mov esi, str._zt__exitDlgTitleStr___title_shown_in_window_frame_of_timed_dialog_box_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c260
mov ecx, 0x14
mov esi, str.________if_none_specified__Agent_Title_attribute_value_in_KaseyaD.ini_is_used._n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c280
mov ecx, 0x19
mov esi, str._d_exitDelayMinutes__minutes_to_delay_before_destroying_this_relay_clients_status_display_on_exit_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x13d8]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c2a0
mov ecx, 0x13
mov esi, str._j__Enable_Ctl_Alt_Del_and_Software_Secure_Attention_Sequence_policy_helper_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x13d8]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c2c0
mov ecx, 0xa
mov esi, str._v__verbose_output_into_status_dialog_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c2e0
mov ecx, 8
mov esi, str._h__display_this_help_message_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x13d8]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40c300
push 0x40
mov ecx, 8
mov esi, str.____display_this_help_message_n
lea eax, [esp + 0x644]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x13e0]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x3c], ebx
je 0x40c358
cmp dword [esp + 0x10], ebx
jne 0x40c358
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004082e0
add esp, 8
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x1e4]
push str.Session_ID__d._r_n
push edx
call fcn.0040dbb4
lea eax, [esp + 0x90]
push eax
call fcn.0040ef22
lea ecx, [esp + 0x94]
push ecx
call fcn.0040ef09
mov edx, dword [esp + 0x38]
add eax, 4
push eax
push edx
lea eax, [esp + 0x1fc]
push str.Processing_for_session_ID__d_started_on__.15s._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x204]
push ecx
push edx
call fcn.0040a0c0
lea eax, [esp + 0xeec]
push str.rserv30
push eax
call fcn.0040a330
mov edi, dword [esp + 0x98]
add esp, 0x34
test eax, eax
jne 0x40c5a6
cmp dword [esp + 0x30], ebx
jne 0x40c5a6
cmp dword [esp + 0x2c], ebx
jne 0x40c5a6
lea ecx, [esp + 0xec0]
push str.awhost32
push ecx
call fcn.0040a330
add esp, 8
test eax, eax
jne 0x40c56a
cmp edi, ebx
jne 0x40c56a
lea edx, [esp + 0xec0]
push str.winvnc
push edx
call fcn.0040a330
add esp, 8
test eax, eax
je 0x40c45f
mov eax, dword [str.WinVNC4.exe]
mov ecx, dword [0x41c7dc]
mov edx, dword [0x41c7e0]
mov dword [esp + 0x28], 4
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], edx
jmp 0x40c5e1
lea eax, [esp + 0xec0]
push str.kvncviewer
push eax
call fcn.0040a330
add esp, 8
test eax, eax
je 0x40c4d3
mov ecx, dword [str.kVncViewer.exe]
mov edx, dword [0x41c7c0]
mov eax, dword [0x41c7c4]
mov dword [esp + 0xd8], ecx
mov cx, word [0x41c7c8]
mov dword [esp + 0xdc], edx
mov dl, byte [0x41c7ca]
lea esi, [esp + 0xab0]
mov dword [esp + 0x28], 5
mov dword [esp + 0xe0], eax
mov word [esp + 0xe4], cx
mov byte [esp + 0xe6], dl
call fcn.0040a640
jmp 0x40c5e1
lea eax, [esp + 0xec0]
push str.vncviewer
push eax
call fcn.0040a330
add esp, 8
test eax, eax
je 0x40c520
mov ecx, dword [str.VNCviewer.exe]
mov edx, dword [0x41c7a4]
mov eax, dword [0x41c7a8]
mov dword [esp + 0xd8], ecx
mov cx, word [0x41c7ac]
mov dword [esp + 0x28], 5
mov word [esp + 0xe4], cx
jmp 0x40c5d3
cmp dword [esp + 0x40], ebx
push 0x104
je 0x40c550
lea edx, [esp + 0xec4]
push edx
lea eax, [esp + 0xe0]
push eax
mov dword [esp + 0x34], 8
call fcn.0040da90
add esp, 0xc
jmp 0x40c5e1
lea ecx, [esp + 0xec4]
push ecx
lea edx, [esp + 0xe0]
push edx
call fcn.0040da90
add esp, 0xc
jmp 0x40c5e1
mov eax, dword [str.Awhost32.exe]
mov ecx, dword [0x41c794]
mov edx, dword [0x41c798]
mov dword [esp + 0xd8], eax
mov al, byte [0x41c79c]
mov dword [esp + 0x28], 6
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], edx
mov byte [esp + 0xe4], al
jmp 0x40c5e1
mov ecx, dword [str.rserver3.exe]
mov edx, dword [0x41b410]
mov eax, dword [0x41b414]
mov dword [esp + 0xd8], ecx
mov cl, byte [0x41b418]
mov dword [esp + 0x28], 3
mov byte [esp + 0xe4], cl
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], eax
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x1e4]
push str.This_relay_client_has_been_tasked_to_run__s_on_this_machine._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
call fcn.0040a0c0
mov eax, dword [esp + 0x40]
add esp, 0x14
cmp eax, ebx
je 0x40c658
mov eax, dword [esp + 0x10]
push str.Configuring_Remote_Administrator_server._r_n
push eax
call fcn.0040a0c0
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x5fc]
push 0x41b628
push edx
call fcn.0040dbb4
lea eax, [esp + 0x12e4]
push eax
lea ecx, [esp + 0x608]
push ecx
call fcn.00404e00
add esp, 0x1c
jmp 0x40c6d1
cmp dword [esp + 0x30], ebx
je 0x40c673
call fcn.0040aab0
test eax, eax
je 0x40c6d1
mov edx, dword [esp + 0x10]
push str.RAdmin_is_not_properly_installed_on_this_machine._Unable_to_set_user_infomation._r_n
push edx
jmp 0x40c6c9
cmp edi, ebx
je 0x40c6d1
push str.awhost32.exe
call fcn.004060b0
add esp, 4
test eax, eax
je 0x40c6b6
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1e4]
push str.Awhost32.exe_is_already_running_and_waiting_for_connections_on_port__d._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040a0c0
add esp, 0x14
jmp 0x40c6d1
call fcn.0040a810
test eax, eax
je 0x40c6d1
mov ecx, dword [esp + 0x10]
push str.pcAnywhere_is_not_properly_installed_on_this_machine._Unable_to_run_Awhost32.exe._r_n
push ecx
call fcn.0040a0c0
add esp, 8
cmp byte [esp + 0xec0], bl
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x40c92e
cmp dword [esp + 0x4c], ebx
jne 0x40c706
mov edx, dword [esp + 0x14]
push 2
push edx
push str.127.0.0.1
call fcn.00406ee0
add esp, 0xc
cmp eax, ebx
jg 0x40c8fa
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
mov eax, 0xc
mov dword [esp + 0x6c], eax
mov dword [esp + 0x78], eax
cmp byte [esp + 0xab0], bl
mov ecx, 1
mov dword [esp + 0x90], 0x44
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ecx
je 0x40c786
lea eax, [esp + 0xec0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40c760
lea ecx, [esp + 0xab0]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xec4]
push 0x41c614
push edx
call fcn.0040dbb4
add esp, 0xc
lea eax, [esp + 0xec0]
push 0x25
push eax
call fcn.0040e3c0
add esp, 8
test eax, eax
je 0x40c7e3
push 0xc80
lea ecx, [esp + 0x13dc]
push ecx
lea edx, [esp + 0xec8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40c7e3
cmp eax, 0x410
ja 0x40c7e3
xor eax, eax
jmp 0x40c7d0
mov cl, byte [esp + eax + 0x13d8]
mov byte [esp + eax + 0xec0], cl
inc eax
cmp cl, bl
jne 0x40c7d0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x94]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xee0]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40c840
lea edx, [esp + 0xec0]
push edx
lea eax, [esp + 0x1e4]
push str.Failed_to_create_the_process_to_run__s._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
jmp 0x40c867
lea eax, [esp + 0xec0]
push eax
lea ecx, [esp + 0x1e4]
push str.Successfully_created_the_process_to_run__s._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040a0c0
add esp, 0x14
push 0x1f4
call esi
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x40c885
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x58]
cmp ecx, ebx
je 0x40c92e
mov eax, dword [esp + 0x48]
cmp eax, ebx
jl 0x40c8f1
push ebx
jne 0x40c8a0
push 0xffffffffffffffff
jmp 0x40c8a7
imul eax, eax, 0x3e8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, ebx
je 0x40c8ed
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0xec0]
push ecx
push edx
lea eax, [esp + 0x1e8]
push str.ERROR:_Timeout_expired_after__d_seconds_waiting_for___s__to_complete._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040a0c0
add esp, 0x18
push 0x2710
call esi
mov ecx, dword [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c92e
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x1e8]
push str._s_is_already_running_and_waiting_for_connections_on_port__d._r_n
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1f0]
push eax
push ecx
call fcn.0040a0c0
add esp, 0x18
lea edx, [esp + 0x9b0]
push edx
call fcn.00406930
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x18], edi
jne 0x40c997
lea eax, [esp + 0x9b0]
push eax
lea ecx, [esp + 0x1e4]
push str.Failed_to_resolve_the_VSA_server_IP___s._r_nExiting..._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040a0c0
add esp, 0x14
push 0x3a98
call esi
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040a0f0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x34]
push edx
push 0x3c
push eax
push edi
call fcn.00406b20
add esp, 0x10
test eax, eax
lea edx, [esp + 0x1e0]
jne 0x40ce51
mov ecx, dword [esp + 0x20]
push ecx
push edi
push str.Successfully_connected_to_the_VSA_server_at__s:_d._r_n
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1f0]
push eax
push ecx
call fcn.0040a0c0
mov eax, dword [esp + 0x5c]
add esp, 0x18
cmp eax, 0x1c20
jl 0x40ca15
lea ecx, [eax + 0x708]
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_hour_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea ecx, [esp + 0x1e8]
push ecx
jmp 0x40ca4e
cmp eax, 0x78
jl 0x40ca40
lea ecx, [eax + 0x1e]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Starting_a__d_minute_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea ecx, [esp + 0x1e8]
push ecx
jmp 0x40ca4e
push eax
push str.Starting_a__d_second_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea edx, [esp + 0x1e8]
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x1e0]
push eax
push ecx
call fcn.0040a0c0
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
push edx
push eax
push ecx
call fcn.00406b70
add esp, 0x14
cmp eax, ebx
jne 0x40cd7e
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x1e4]
push str.Done._r_nConnecting_to_the_remote_control_application__s_on_this_machine...
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
call fcn.0040a0c0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x4c]
push eax
push 2
push ecx
push str.127.0.0.1
call fcn.00406b20
mov edi, eax
add esp, 0x24
cmp edi, ebx
je 0x40cb2d
mov edx, dword [esp + 0x10]
push str.Retrying...
push edx
call fcn.0040a0c0
add esp, 8
mov esi, 3
lea esp, [esp]
cmp esi, ebx
jle 0x40cb25
mov eax, dword [esp + 0x10]
push 0x41c2c4
push eax
dec esi
call fcn.0040a0c0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x40]
push ecx
push 1
push edx
push str.127.0.0.1
call fcn.00406b20
mov edi, eax
add esp, 0x18
cmp edi, ebx
jne 0x40caf0
jmp 0x40cb2d
cmp edi, ebx
jne 0x40cd3d
lea eax, [esp + 0x84]
push eax
call fcn.0040ef22
lea ecx, [esp + 0x88]
push ecx
call fcn.0040ef09
add eax, 0xb
push eax
lea edx, [esp + 0x1ec]
push str.Done._r_nStarting_the_relay_at__.8s_for_this
push edx
call fcn.0040dbb4
lea eax, [esp + 0xdcc]
add esp, 0x14
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cb70
sub eax, edx
cmp eax, 2
jl 0x40cbb1
lea edi, [esp + 0x1e0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cb86
mov eax, dword [str.encrypted]
mov ecx, dword [0x41c290]
mov dx, word [0x41c294]
mov dword [edi], eax
mov al, byte [0x41c296]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
lea edi, [esp + 0x1e0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40cbc0
mov edx, dword [esp + 0x10]
mov ecx, 7
mov esi, str.remote_control_session..._r_n
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1e0]
push ecx
push edx
call fcn.0040a0c0
mov esi, dword [esp + 0x58]
add esp, 8
cmp esi, ebx
je 0x40cc34
push 1
call fcn.00408ae0
add esp, 4
cmp eax, 0xfffffffe
je 0x40cc22
cmp eax, 1
je 0x40cc16
cmp eax, 2
jne 0x40cc34
mov eax, dword [esp + 0x10]
push str.SoftwareSASGeneration_policy_setting_already_enabled._r_n
push eax
jmp 0x40cc2c
mov ecx, dword [esp + 0x10]
push str.Policy_setting_does_not_require_Ctl_Alt_Del._r_n
push ecx
jmp 0x40cc2c
mov edx, dword [esp + 0x10]
push str.Failed_to_enable_SoftwareSASGeneration_policy._May_not_be_able_to_send_Ctl_Alt_Del._r_n
push edx
call fcn.0040a0c0
add esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xdbc]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x34]
push 2
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
call fcn.004081c0
mov eax, dword [esp + 0x3c]
push eax
call fcn.0040a110
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00406a00
mov edx, dword [esp + 0x44]
push edx
call fcn.0040a140
lea eax, [esp + 0xbc]
push eax
call fcn.0040ef22
lea ecx, [esp + 0xc0]
push ecx
call fcn.0040ef09
add esp, 0x40
add eax, 0xb
push eax
lea edx, [esp + 0x1e4]
push str.The_relay_session_has_terminated_at__.8s._r_n
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1ec]
push eax
push ecx
call fcn.0040a0c0
add esp, 0x14
cmp esi, ebx
je case.0x40cce9.2
push 2
call fcn.00408ae0
add eax, 5
add esp, 4
cmp eax, 9
ja case.0x40cce9.2
jmp dword [eax*4 + 0x40d3e0]
mov edx, dword [esp + 0x10]
push str.Successfully_removed_SoftwareSASGeneration_policy_setting._r_n
push edx
jmp 0x40cd25
push str.Successfully_restored_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40cd20
mov ecx, dword [esp + 0x10]
push str.Failed_to_remove_SoftwareSASGeneration_policy_setting._r_n
push ecx
jmp 0x40cd25
mov edx, dword [esp + 0x10]
push str.Failed_to_restore_SoftwareSASGeneration_policy_setting._r_n
push edx
jmp 0x40cd25
push str.SoftwareSASGeneration_policy_setting_has_not_been_restored_because_it_has_changed_since_this_session_started._r_n
mov eax, dword [esp + 0x14]
push eax
call fcn.0040a0c0
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40cf67
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x1e8]
push str.Failed._r_nThis_relay_client_failed_to_connect_to__s_locally_on_port__d._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040a0c0
add esp, 0x18
mov dword [esp + 0x38], 0xffffffff
jmp 0x40cf67
cmp eax, 0x2bad2bad
jne 0x40cdfe
push 1
lea eax, [esp + 0x1e4]
push str.Failed._r_n_r_n____ERROR:_This_viewer_package_version___d__is_obsolete._r_n___________Please_restart_the_remote_control_session_by_first_selecting_a_machine_from_the_Kaseya_Virtual_System_r_n___________Administrator_remote_control_web_page_and_then_run_download_the_viewer_package_again._r_n_r_nThis_package_will_exit_now..._r_n
push eax
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x40cdc9
push 0x10
lea ecx, [esp + 0x644]
push ecx
lea edx, [esp + 0x1e8]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x2710
call esi
jmp 0x40cf71
lea ecx, [esp + 0x1e0]
push ecx
push eax
call fcn.0040a0c0
add esp, 8
push 0x7530
call esi
mov edx, dword [esp + 0x10]
push edx
call fcn.0040a0f0
add esp, 4
push 0x2710
mov dword [esp + 0x14], ebx
call esi
jmp 0x40cf71
cmp eax, ebx
jle 0x40ce33
cmp dword [esp + 0x30], ebx
jne 0x40ce0e
cmp dword [esp + 0x2c], ebx
je 0x40ce15
push 0x7530
call esi
mov eax, dword [esp + 0x10]
push str.Done._r_nRelay_for_remote_control_session_is_not_required._r_n
push eax
call fcn.0040a0c0
add esp, 8
push 0x2710
call esi
jmp 0x40cf71
mov ecx, dword [esp + 0x10]
push str.Failed._r_nRelay_for_remote_control_session_failed_to_establish_a_connection_with_the_other_relay_client._r_n
push ecx
call fcn.0040a0c0
add esp, 8
push 0x2710
call esi
jmp 0x40cf71
push 0x41bddc
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1e8]
push eax
push ecx
call fcn.0040a0c0
mov edx, dword [esp + 0x30]
push edx
push edi
lea eax, [esp + 0x1f8]
push str.ERROR:__Unable_to_connect_to_the_KServer_at__s_on_port__d._r_n_r_n
push eax
call fcn.0040dbb4
lea edi, [esp + 0x200]
add esp, 0x20
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ce91
mov ecx, 0x10
mov esi, str.Please_check_that_your_firewall__router__and_or_proxy_server_is_r_n
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1e0]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ceb1
mov ecx, dword [esp + 0x20]
sub eax, edx
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esp + eax + 0x1e8]
push str.allowing_outbound_TCP_connections_to__s_on_port__d._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1f0]
push ecx
push edx
call fcn.0040a0c0
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x28]
add esp, 0x18
cmp eax, ebx
je 0x40cefb
cmp esi, ebx
jne 0x40cf02
cmp dword [esp + 0x28], 5
jne 0x40cf5f
lea eax, [esp + 0x640]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cf10
sub eax, edx
dec eax
cmp eax, ebx
jl 0x40cf34
mov edi, edi
mov cl, byte [esp + eax + 0x640]
cmp cl, 0x5c
je 0x40cf34
cmp cl, 0x3a
je 0x40cf34
dec eax
jns 0x40cf20
push 0x78
push 0x50010
lea eax, [esp + eax + 0x649]
push eax
lea ecx, [esp + 0x1ec]
push ecx
push esi
call fcn.0040a1a0
add esp, 0x14
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x34], 0xffffffff
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x2c], ebx
je 0x40cfab
mov edx, dword [esp + 0x10]
push str.Removing_Remote_Administrator_server._r_n
push edx
call fcn.0040a0c0
call fcn.004052c0
mov eax, dword [esp + 0x18]
push 0x1e
push 0x50040
push str.Virtual_System_Administrator
push str.Remote_control_session_with_your_administrator_has_ended.
push eax
call fcn.0040a1a0
add esp, 0x1c
jmp 0x40cfb6
cmp dword [esp + 0x30], ebx
je 0x40cfb6
call fcn.00404d50
cmp byte [esp + 0x2800], bl
je 0x40d052
lea ecx, [esp + 0x2800]
push ecx
push 0x41bddc
mov edx, ecx
push str._r_n
push edx
call fcn.0040a450
mov al, byte [esp + 0x8c0]
add esp, 0x10
cmp al, bl
jne 0x40d02e
lea eax, [esp + 0x8b0]
push eax
push str.Agent_Title
push str._SERVER_COMMUNICATIONS_
call fcn.00408960
mov al, byte [esp + 0x8bc]
add esp, 0xc
cmp al, bl
jne 0x40d02e
mov ecx, 7
mov esi, str.Virtual_System_Administrator
lea edi, [esp + 0x8b0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
push 0x78
push 0x50040
lea ecx, [esp + 0x8b8]
push ecx
lea edx, [esp + 0x280c]
push edx
push eax
call fcn.0040a1a0
add esp, 0x14
push edi
call fcn.0040e24d
mov eax, dword [esp + 0x38]
add esp, 4
cmp eax, 0xffffffff
je 0x40d06f
push 1
push eax
call fcn.00404a90
add esp, 8
mov eax, dword [esp + 0x38]
cmp eax, 0xffffffff
je 0x40d083
push 1
push eax
call fcn.00404a90
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040a140
mov al, byte [esp + 0xbb4]
add esp, 4
cmp al, bl
je 0x40d264
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
mov eax, 0xfffff830
xor edx, edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov eax, 0xc
mov dword [esp + 0x54], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x78], eax
cmp byte [esp + 0x748], bl
mov dword [esp + 0x58], edx
mov ecx, 1
mov dword [esp + 0x5c], edx
mov dword [esp + 0x90], 0x44
mov dword [esp + 0xbc], 5
mov word [esp + 0xc0], bx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x60], edx
je 0x40d156
lea eax, [esp + 0xbb0]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d130
lea ecx, [esp + 0x748]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xbb4]
push 0x41c614
push edx
call fcn.0040dbb4
add esp, 0xc
lea eax, [esp + 0xbb0]
push 0x25
push eax
call fcn.0040e3c0
add esp, 8
test eax, eax
je 0x40d1b3
push 0xc80
lea ecx, [esp + 0x13dc]
push ecx
lea edx, [esp + 0xbb8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x40d1b3
cmp eax, 0x208
ja 0x40d1b3
xor eax, eax
jmp 0x40d1a0
mov cl, byte [esp + eax + 0x13d8]
mov byte [esp + eax + 0xbb0], cl
inc eax
cmp cl, bl
jne 0x40d1a0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x94]
push ecx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xbd0]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40d210
lea edx, [esp + 0xbb0]
push edx
lea eax, [esp + 0x1e4]
push str.Failed_to_start_the_cleanup_process__s._r_n
push eax
call fcn.0040dbb4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1ec]
push ecx
push edx
jmp 0x40d237
lea eax, [esp + 0xbb0]
push eax
lea ecx, [esp + 0x1e4]
push str.Successfully_started_the_cleanup_process__s._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040a0c0
mov eax, dword [esp + 0x68]
add esp, 0x14
cmp eax, ebx
je 0x40d24e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x40d25d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call esi
cmp dword [esp + 0x40], ebx
je 0x40d2d8
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1e4]
push str.Performing_FTP_cleanup_for_connection_to_port__d...
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1ec]
push eax
push ecx
call fcn.0040a0c0
mov eax, dword [esp + 0x28]
call fcn.0040ab80
lea edx, [esp + 0x1f4]
push str.Done._r_n
push edx
call fcn.0040dbb4
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x1fc]
push eax
push ecx
call fcn.0040a0c0
mov eax, dword [esp + 0x60]
add esp, 0x24
cmp eax, ebx
je 0x40d2d8
cmp dword [esp + 0x10], ebx
je 0x40d2d8
push 0x3a98
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x40d2ed
mov dword [esp + 0x748], 0x776f6e
jmp 0x40d330
cmp eax, 1
jne 0x40d31a
mov edx, dword [str.in_1_minute]
mov eax, dword [0x41bbcc]
mov ecx, dword [0x41bbd0]
mov dword [esp + 0x748], edx
mov dword [esp + 0x74c], eax
mov dword [esp + 0x750], ecx
jmp 0x40d330
push eax
lea edx, [esp + 0x74c]
push str.in__d_minutes
push edx
call fcn.0040dbb4
add esp, 0xc
lea eax, [esp + 0x748]
push eax
lea ecx, [esp + 0x1e4]
push str.This_relay_client_will_exit__s..._r_n
push ecx
call fcn.0040dbb4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1ec]
push edx
push eax
call fcn.0040a0c0
add esp, 0x14
push 0x1388
call esi
cmp dword [esp + 0x10], ebx
je 0x40d3c8
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jbe 0x40d3c8
cmp eax, 0x1179e
jbe 0x40d385
mov dword [esp + 0x1c], 0xffffffff
jmp 0x40d393
imul eax, eax, 0xea60
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x40d3c8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xea60
mov edi, edi
mov ecx, dword [esp + 0x10]
push 0x41c2c4
push ecx
call fcn.0040a0c0
mov eax, dword [esp + 0x24]
add esp, 8
cmp eax, edi
jbe 0x40d3c5
push edi
call esi
sub dword [esp + 0x1c], edi
jne 0x40d3a0
jmp 0x40d3c8
push eax
call esi
mov edx, dword [esp + 0x10]
push edx
call fcn.0040a0f0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10