Function at 0x40e8d2
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6da8
call fcn.0047f270
mov eax, dword [0x4d4664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, 0x105
mov dword [ebp - 0x6d64], eax
push edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x6d2c], esi
push ebx
push eax
mov dword [ebp - 0x6cf8], 1
mov dword [ebp - 0x6d08], ebx
call fcn.00481190
push edi
lea eax, [ebp - 0x20c8]
push ebx
push eax
call fcn.00481190
push 0x50
lea eax, [ebp - 0x6b4]
push ebx
push eax
call fcn.00481190
push edi
lea eax, [ebp - 0x454]
push ebx
push eax
call fcn.00481190
push 0xc80
lea eax, [ebp - 0x1fc0]
push ebx
push eax
call fcn.00481190
xor ecx, ecx
mov dword [ebp - 0x6d24], 0x12c
xor eax, eax
mov dword [ebp - 0x6d48], ecx
lea edi, [ebp - 0x6d44]
mov dword [ebp - 0x6d00], ecx
stosd dword es:[edi], eax
or ebx, 0xffffffff
push 0x100
push ecx
mov dword [ebp - 0x6d10], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x6d0c], ebx
mov dword [ebp - 0x6d14], ecx
mov dword [ebp - 0x6d38], ecx
stosd dword es:[edi], eax
lea eax, [ebp - 0x123c]
push eax
mov dword [ebp - 0x6d20], ecx
mov dword [ebp - 0x6d18], ecx
call fcn.00481190
add esp, 0x48
mov dword [ebp - 0x6d04], ebx
xor edi, edi
mov dword [ebp - 0x6cf4], ebx
lea eax, [ebp - 0xe34]
push 0x410
push edi
push eax
call fcn.00481190
push 0x100
lea eax, [ebp - 0xf34]
push edi
push eax
call fcn.00481190
push 0x7a2
lea eax, [ebp - 0x6cec]
push edi
push eax
call fcn.00481190
push 0x105
mov dword [ebp - 0x6d1c], edi
lea eax, [ebp - 0x664]
mov dword [ebp - 0x6cf0], edi
push edi
push eax
call fcn.00481190
push 0x208
lea eax, [ebp - 0x113c]
push edi
push eax
call fcn.00481190
push 0x100
lea eax, [ebp - 0x7b4]
push edi
push eax
call fcn.00481190
add esp, 0x48
lea eax, [ebp - 0x653c]
push 0x4074
push edi
push eax
call fcn.00481190
push 0x100
lea eax, [ebp - 0x8b4]
push edi
push eax
call fcn.00481190
push 0x101
lea eax, [ebp - 0x1340]
mov dword [ebp - 0x6d30], edi
push edi
push eax
mov dword [ebp - 0x6d28], ebx
call fcn.00481190
push 0x68
lea eax, [ebp - 0xa24]
push edi
push eax
call fcn.00481190
push 0x105
lea eax, [ebp - 0x9bc]
mov dword [ebp - 0x6cfc], edi
push edi
push eax
mov dword [ebp - 0x6d34], edi
call fcn.00481190
push 0x41
lea eax, [ebp - 0x34c]
push edi
push eax
call fcn.00481190
add esp, 0x48
push str.KRlyCCon.log
call fcn.0040bcdf
mov dword [esp], 0x105
lea eax, [ebp - 0x55c]
push edi
push eax
call fcn.00481190
add esp, 0xc
lea eax, [ebp - 0x55c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, eax
mov ecx, edi
mov al, byte [ebp + ecx - 0x55c]
mov byte [ebp + ecx - 0x20c8], al
inc ecx
test al, al
jne 0x40eb01
test edx, edx
jle 0x40ee4d
lea eax, [ebp - 0x55c]
push 0x4a3770
push eax
call fcn.00489437
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40ee4a
push 2
push 0xfffff85e
push ebx
call fcn.0048f9dc
push ebx
push 0x7a2
lea eax, [ebp - 0x6cec]
push 1
push eax
call fcn.0048f672
add esp, 0x1c
cmp eax, 0x7a2
jne 0x40ee43
push 0x21
lea eax, [ebp - 0x6cec]
push str.Kaseya_Remote_Control_Data_Table
push eax
call fcn.00483043
add esp, 0xc
test eax, eax
je 0x40eba0
push 0x22
lea eax, [ebp - 0x6cec]
push str.Kaseya_Remote_Control_Relay_Table
push eax
call fcn.00483043
add esp, 0xc
test eax, eax
jne 0x40ee43
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x454]
mov edi, 0x104
push edi
push eax
push str.TEMP
call esi
test eax, eax
jle 0x40ebef
cmp eax, edi
jae 0x40ebef
lea ecx, [ebp - 0x454]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ebcb
sub ecx, edx
cmp byte [ebp + ecx - 0x455], 0x5c
je 0x40ec43
lea edi, [ebp - 0x454]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ebe5
jmp 0x40ec31
push edi
lea eax, [ebp - 0x454]
push eax
push 0x4a4448
call esi
test eax, eax
jle 0x40ec3c
cmp eax, edi
jae 0x40ec3c
lea ecx, [ebp - 0x454]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ec0f
sub ecx, edx
cmp byte [ebp + ecx - 0x455], 0x5c
je 0x40ec43
lea edi, [ebp - 0x454]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ec29
mov ax, word [0x4a2e40]
mov word [edi], ax
jmp 0x40ec43
mov byte [ebp - 0x454], 0
xor ecx, ecx
cmp byte [ebp - 0x454], cl
je 0x40ec62
mov al, byte [ebp + ecx - 0x454]
mov byte [ebp + ecx - 0x9bc], al
inc ecx
test al, al
jne 0x40ec4d
jmp 0x40ec74
mov al, byte [ecx + 0x4a34e4]
mov byte [ebp + ecx - 0x9bc], al
inc ecx
test al, al
jne 0x40ec62
push dword [ebp - 0x6cf0]
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x6cec]
push eax
push ebx
call fcn.0040abde
mov esi, dword [ebp - 0x6d2c]
add esp, 0x10
cmp eax, 0xfffffffd
je 0x40ecf6
cmp eax, 0xfffffffe
je 0x40ecba
cmp eax, 0xffffffff
jne 0x40ed16
lea eax, [ebp - 0x6cf0]
push eax
push esi
call fcn.0040b36d
push str.ERROR:_The_viewer_package_is_corrupted._The_table_header_is_invalid._Download_this_package_again._r_n
jmp 0x40ed08
lea eax, [ebp - 0x6cf0]
push eax
push esi
call fcn.0040b36d
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x308]
push str.ERROR:_Unable_to_extract_viewer_files_to_the_directory__s._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x1c
jmp 0x40ed16
lea eax, [ebp - 0x6cf0]
push eax
push esi
call fcn.0040b36d
push str.ERROR:_The_viewer_package_is_corrupted._Unable_to_read_viewer_files._Download_this_package_again._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x10
cmp byte [ebp - 0x6cc4], 0
je 0x40ee41
lea eax, [ebp - 0x6d08]
mov ecx, 0x100
push eax
lea eax, [ebp - 0x6d1c]
mov edi, 0x410
push eax
lea eax, [ebp - 0x6d34]
push eax
lea eax, [ebp - 0x6cfc]
push eax
lea eax, [ebp - 0x6d18]
push eax
lea eax, [ebp - 0x6d20]
push eax
lea eax, [ebp - 0x6d38]
push eax
lea eax, [ebp - 0x6d14]
push eax
push 0x68
lea eax, [ebp - 0xa24]
push eax
push 0x101
lea eax, [ebp - 0x1340]
push eax
push ecx
lea eax, [ebp - 0x8b4]
push eax
push 0x4074
lea eax, [ebp - 0x653c]
push eax
push ecx
lea eax, [ebp - 0x7b4]
push eax
push 0x208
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x6d28]
push eax
lea eax, [ebp - 0x6d30]
push eax
push ecx
lea eax, [ebp - 0xf34]
push eax
push edi
lea eax, [ebp - 0xe34]
push eax
lea eax, [ebp - 0x6d00]
push eax
lea eax, [ebp - 0x6d24]
push eax
lea eax, [ebp - 0x6cf4]
push eax
lea eax, [ebp - 0x6d04]
push eax
push ecx
lea eax, [ebp - 0x123c]
push eax
lea eax, [ebp - 0x6cc4]
push eax
call fcn.0040d79f
add esp, 0x84
cmp byte [ebp - 0xe34], 0
je 0x40ee41
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x6cec]
push eax
lea eax, [ebp - 0xe34]
push edi
push eax
call fcn.00408f09
add esp, 0x10
test eax, eax
je 0x40ee41
lea eax, [ebp - 0x6cf0]
push eax
push esi
call fcn.0040b36d
push str.Unexpected_error_occurred_while_creating_path_to_components_in_temp_directory._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x10
xor edi, edi
push ebx
call fcn.0048921e
pop ecx
or ebx, 0xffffffff
lea eax, [ebp - 0x6d08]
mov ecx, 0x100
push eax
lea eax, [ebp - 0x6d1c]
push eax
lea eax, [ebp - 0x6d34]
push eax
lea eax, [ebp - 0x6cfc]
push eax
lea eax, [ebp - 0x6d18]
push eax
lea eax, [ebp - 0x6d20]
push eax
lea eax, [ebp - 0x6d38]
push eax
lea eax, [ebp - 0x6d14]
push eax
push 0x68
lea eax, [ebp - 0xa24]
push eax
push 0x101
lea eax, [ebp - 0x1340]
push eax
push ecx
lea eax, [ebp - 0x8b4]
push eax
push 0x4074
lea eax, [ebp - 0x653c]
push eax
push ecx
lea eax, [ebp - 0x7b4]
push eax
push 0x208
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x6d28]
push eax
lea eax, [ebp - 0x6d30]
push eax
push ecx
lea eax, [ebp - 0xf34]
push eax
push 0x410
lea eax, [ebp - 0xe34]
push eax
lea eax, [ebp - 0x6d00]
push eax
lea eax, [ebp - 0x6d24]
push eax
lea eax, [ebp - 0x6cf4]
push eax
lea eax, [ebp - 0x6d04]
push eax
push ecx
lea eax, [ebp - 0x123c]
push eax
push dword [ebp - 0x6d64]
call fcn.0040d79f
lea ecx, [ebp - 0x123c]
add esp, 0x84
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ef27
sub ecx, edx
cmp ecx, 1
jb 0x4101c5
cmp dword [ebp - 0x6cf4], 0
jl 0x4101c5
cmp dword [ebp - 0x6d04], 0
jl 0x4101c5
cmp dword [ebp - 0x6d08], 0
jne 0x4101e9
cmp dword [ebp - 0x6d1c], 0
je 0x40ef81
cmp dword [ebp - 0x6cf0], 0
jne 0x40ef81
lea eax, [ebp - 0x6cf0]
push eax
push esi
call fcn.0040b36d
pop ecx
pop ecx
push dword [ebp - 0x6d00]
lea eax, [ebp - 0x308]
push str.Session_ID__d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x6548]
push eax
call fcn.0049063a
lea eax, [ebp - 0x6548]
push eax
call fcn.00490482
lea ecx, [ebp - 0x20c8]
add eax, 4
push ecx
push eax
push dword [ebp - 0x6d00]
lea eax, [ebp - 0x308]
push str.Processing_for_session_ID__d_started_on__.15s._r_nPath__s__r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x308]
push str.Temp_path___s__r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x44
mov eax, str.NULL
cmp byte [ebp - 0x9bc], 0
je 0x40f025
lea eax, [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x308]
push str.Concate_file_path___s__r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
movsx eax, byte [ebp - 0x9bc]
lea ecx, [ebp - 0x9bc]
neg eax
sbb eax, eax
and eax, ecx
push eax
call fcn.00402ea1
add esp, 0x18
test eax, eax
je 0x40f0ac
push eax
push str.Failed_to_initialize_crypto_function._Error:__d_r_n
lea eax, [ebp - 0x308]
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x6cf0]
call fcn.0040bf96
pop ecx
jmp 0x4101e2
mov eax, dword [0x4d65ac]
mov dword [ebp - 0x6d08], eax
lea eax, [ebp - 0xe34]
push str.rserv30
push eax
call fcn.00406c9b
mov esi, dword [ebp - 0x6d38]
pop ecx
pop ecx
test eax, eax
jne 0x40f2a8
cmp dword [ebp - 0x6d14], 0
jne 0x40f2a8
cmp dword [ebp - 0x6d18], 0
jne 0x40f2a8
lea eax, [ebp - 0xe34]
push str.awhost32
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
jne 0x40f289
test esi, esi
jne 0x40f289
lea eax, [ebp - 0xe34]
push str.winvnc
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
je 0x40f14e
push 4
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.WinVNC4.exe]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f137
jmp 0x40f2c5
lea eax, [ebp - 0xe34]
push str.kvncviewer
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
je 0x40f194
push 5
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.kVncViewer.exe]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f170
lea eax, [ebp - 0xf34]
push eax
call fcn.0040e6c6
pop ecx
jmp 0x40f2c5
lea eax, [ebp - 0xe34]
push str.vncviewer
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
je 0x40f1cd
push 5
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.VNCviewer.exe]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f1b6
jmp 0x40f2c5
lea eax, [ebp - 0xe34]
push str.KRCServer
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
je 0x40f23d
call sym.KRlyCCon.exe_kc_init
push 0x10
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.KRCServer]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f1f4
call fcn.00407b86
test eax, eax
je 0x40f21a
push eax
push str.Failed_to_create_mutex_Error:__d_r_n
jmp 0x40f06f
lea eax, [ebp - 0xf34]
push eax
push 0
call fcn.0040cc10
pop ecx
pop ecx
test eax, eax
je 0x40f2c5
push eax
push str.Failed_to_configure_the_KRC_Server._Error:__d_r_n
jmp 0x40f06f
cmp dword [ebp - 0x6d20], 0
lea eax, [ebp - 0xe34]
je 0x40f26c
push 8
pop edi
push 0x104
push eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x6cf8], edi
push eax
call fcn.00485910
add esp, 0xc
jmp 0x40f2c5
push 0x104
push eax
lea eax, [ebp - 0x664]
push eax
call fcn.00485910
mov edi, dword [ebp - 0x6cf8]
add esp, 0xc
jmp 0x40f2c5
push 6
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.Awhost32.exe]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f294
jmp 0x40f2c5
push 3
pop edi
mov dword [ebp - 0x6cf8], edi
xor ecx, ecx
mov al, byte [ecx + str.rserver3.exe]
mov byte [ebp + ecx - 0x664], al
inc ecx
test al, al
jne 0x40f2b3
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x308]
push str.This_relay_client_has_been_tasked_to_run__s_on_this_machine._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
cmp dword [ebp - 0x6d18], 0
je 0x40f33a
push str.Configuring_Remote_Administrator_server._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
push dword [ebp - 0x6d00]
lea eax, [ebp - 0x6b4]
push 0x4a3084
push eax
call fcn.004018a8
lea eax, [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x6b4]
push eax
call fcn.004080cd
add esp, 0x1c
jmp 0x40f3af
cmp dword [ebp - 0x6d14], 0
je 0x40f353
call fcn.0040e442
test eax, eax
je 0x40f3af
push str.RAdmin_is_not_properly_installed_on_this_machine._Unable_to_set_user_infomation._r_n
jmp 0x40f3a2
test esi, esi
je 0x40f3af
push str.awhost32.exe
call fcn.00405c04
pop ecx
test eax, eax
je 0x40f394
push dword [ebp - 0x6cf4]
lea eax, [ebp - 0x308]
push str.Awhost32.exe_is_already_running_and_waiting_for_connections_on_port__d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
jmp 0x40f3af
call fcn.0040e1d3
test eax, eax
je 0x40f3af
push str.pcAnywhere_is_not_properly_installed_on_this_machine._Unable_to_run_Awhost32.exe._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
mov ebx, dword [ebp - 0xe34]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x40f6ff
cmp dword [ebp - 0x6d30], 0
jne 0x40f3e9
push 2
push dword [ebp - 0x6cf4]
push str.127.0.0.1
call fcn.00408d5c
mov ebx, dword [ebp - 0xe34]
add esp, 0xc
jmp 0x40f3eb
xor eax, eax
test eax, eax
jg 0x40f6cc
cmp edi, 0x10
jne 0x40f438
push dword [ebp - 0x6cf4]
lea eax, [ebp - 0x308]
push str.Failed_to_ping_the_KRC_Server_on_port__d_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push 0
call fcn.0040c0c1
push dword [ebp - 0x6cf0]
call fcn.0040bf96
add esp, 0x18
call fcn.00402fe4
or eax, 0xffffffff
jmp 0x410589
push 0x44
lea eax, [ebp - 0x6da8]
push 0
push eax
call fcn.00481190
and dword [ebp - 0x6d50], 0
add esp, 0xc
and dword [ebp - 0x6d5c], 0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x6da8], 0x44
mov dword [ebp - 0x6d4c], ecx
mov dword [ebp - 0x6d58], ecx
push 0xc
pop eax
mov dword [ebp - 0x6d54], eax
mov dword [ebp - 0x6d60], eax
cmp bl, 0x22
je 0x40f516
lea eax, [ebp - 0xe34]
push str..exe
push eax
call fcn.00406c9b
pop ecx
pop ecx
test eax, eax
je 0x40f516
lea ecx, [eax + 4]
mov byte [ebp - 0x24c8], 0x22
lea ebx, [ebp - 0xe34]
xor edx, edx
mov edi, ebx
mov eax, ecx
sub eax, edi
inc edx
cmp ecx, ebx
sbb edi, edi
not edi
and edi, eax
je 0x40f4e0
xor esi, esi
mov al, byte [ebp + esi - 0xe34]
inc edx
mov byte [ebp + esi - 0x24c7], al
inc esi
cmp esi, edi
jne 0x40f4c6
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp + edx - 0x24c8], 0x22
sub edx, ecx
lea edx, [ebp + edx - 0x24c7]
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x40f4f1
xor ecx, ecx
mov al, byte [ebp + ecx - 0x24c8]
mov byte [ebp + ecx - 0xe34], al
inc ecx
test al, al
jne 0x40f4fd
mov edi, dword [ebp - 0x6cf8]
cmp byte [ebp - 0xf34], 0
je 0x40f54e
lea ecx, [ebp - 0xe34]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f528
lea eax, [ebp - 0xf34]
sub ecx, edx
push eax
lea eax, [ebp - 0xe34]
add eax, ecx
push 0x4a5288
push eax
call fcn.004018a8
add esp, 0xc
lea eax, [ebp - 0xe34]
push 0x25
push eax
call fcn.00482bc0
pop ecx
pop ecx
test eax, eax
je 0x40f59b
push 0xc80
lea eax, [ebp - 0x1fc0]
push eax
lea eax, [ebp - 0xe34]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x40f59b
cmp eax, 0x410
ja 0x40f59b
xor ecx, ecx
mov al, byte [ebp + ecx - 0x1fc0]
mov byte [ebp + ecx - 0xe34], al
inc ecx
test al, al
jne 0x40f588
lea eax, [ebp - 0x6d48]
push eax
lea eax, [ebp - 0x6da8]
push eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x6d60]
push eax
lea eax, [ebp - 0x6d54]
push eax
lea eax, [ebp - 0xe34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40f608
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe34]
push eax
lea eax, [ebp - 0x308]
push str.Failed_to_create_the_process_to_run__s.__Code:__d___r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x18
jmp 0x40f635
lea eax, [ebp - 0xe34]
push eax
lea eax, [ebp - 0x308]
push str.Successfully_created_the_process_to_run__s._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
push 0x1f4
call esi
cmp dword [ebp - 0x6d48], 0
je 0x40f651
push dword [ebp - 0x6d48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x6d44]
test ecx, ecx
je 0x40f6ff
mov eax, dword [ebp - 0x6d28]
test eax, eax
js 0x40f6c3
push 0
jne 0x40f671
push 0xffffffffffffffff
jmp 0x40f678
imul eax, eax, 0x3e8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x40f6bd
lea eax, [ebp - 0xe34]
push eax
push dword [ebp - 0x6d28]
lea eax, [ebp - 0x308]
push str.ERROR:_Timeout_expired_after__d_seconds_waiting_for___s__to_complete._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x18
push 0x2710
call esi
mov ecx, dword [ebp - 0x6d44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f6ff
push dword [ebp - 0x6cf4]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x308]
push str._s_is_already_running_and_waiting_for_connections_on_port__d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x18
cmp edi, 0x10
jne 0x40f764
push 0
call fcn.0040c87d
pop ecx
cmp eax, 1
jne 0x40f764
push dword [ebp - 0x6d08]
lea eax, [ebp - 0x34c]
push 0x41
push eax
push dword [ebp - 0x6d00]
call fcn.0040d16f
add esp, 0x10
test eax, eax
je 0x40f764
lea eax, [ebp - 0x308]
push str.Failed_to_set_the_KRC_Server_password._n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push 0
call fcn.0040c0c1
push dword [ebp - 0x6cf0]
call fcn.0040bf96
add esp, 0x14
jmp 0x40f42b
lea eax, [ebp - 0x123c]
push eax
call fcn.004088d8
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x40f7bc
lea eax, [ebp - 0x123c]
push eax
lea eax, [ebp - 0x308]
push str.Failed_to_resolve_the_VSA_server_IP___s._r_nExiting..._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
push 0x3a98
call esi
push dword [ebp - 0x6cf0]
call fcn.0040bf96
pop ecx
jmp 0x40f42b
lea eax, [ebp - 0x6d10]
push eax
push 0x3c
pop edi
push edi
push dword [ebp - 0x6d04]
push ebx
call fcn.0040877e
add esp, 0x10
test eax, eax
lea eax, [ebp - 0x308]
jne 0x40fbfa
push dword [ebp - 0x6d04]
push ebx
push str.Successfully_connected_to_the_VSA_server_at__s:_d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
mov eax, dword [ebp - 0x6d24]
add esp, 0x18
cmp eax, 0x1c20
jl 0x40f82d
add eax, 0x708
mov ecx, 0xe10
cdq
idiv ecx
push eax
push str.Starting_a__d_hour_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
jmp 0x40f846
cmp eax, 0x78
jl 0x40f840
add eax, 0x1e
cdq
idiv edi
push eax
push str.Starting_a__d_minute_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
jmp 0x40f846
push eax
push str.Starting_a__d_second_wait_for_a_response_from_the_relay_client_that_is_initiating_the_connection_for_this_remote_control_session...
lea eax, [ebp - 0x308]
push eax
call fcn.004018a8
add esp, 0xc
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
push dword [ebp - 0x6d24]
push dword [ebp - 0x6d00]
push dword [ebp - 0x6d10]
call fcn.004089b2
add esp, 0x14
test eax, eax
jne 0x40fb46
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x308]
push str.Done._r_nConnecting_to_the_remote_control_application__s_on_this_machine...
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
lea eax, [ebp - 0x6d0c]
push eax
push 2
push dword [ebp - 0x6cf4]
push str.127.0.0.1
call fcn.0040877e
mov esi, eax
add esp, 0x24
test esi, esi
je 0x40f970
push str.Retrying...
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
push 3
pop edi
test edi, edi
jle 0x40f925
push 0x4a25a0
push dword [ebp - 0x6cf0]
dec edi
call fcn.0040c0c1
lea eax, [ebp - 0x6d0c]
push eax
push 1
push dword [ebp - 0x6cf4]
push str.127.0.0.1
call fcn.0040877e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x40f8ee
test esi, esi
je 0x40f970
push dword [ebp - 0x6cf4]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x308]
push str.Failed._r_nThis_relay_client_failed_to_connect_to__s_locally_on_port__d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
or edi, 0xffffffff
mov dword [ebp - 0x6d0c], edi
jmp 0x40fd14
lea eax, [ebp - 0x6548]
push eax
call fcn.0049063a
lea eax, [ebp - 0x6548]
push eax
call fcn.00490482
add eax, 0xb
push eax
lea eax, [ebp - 0x308]
push str.Done._r_nStarting_the_relay_at__.8s_for_this
push eax
call fcn.004018a8
lea ecx, [ebp - 0x1340]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f9a9
sub ecx, edx
cmp ecx, 2
jl 0x40f9d0
lea edi, [ebp - 0x308]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f9be
mov esi, str.encrypted
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x308]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40f9d7
push 7
pop ecx
lea eax, [ebp - 0x308]
mov esi, str.remote_control_session..._r_n
push eax
push dword [ebp - 0x6cf0]
rep movsd dword es:[edi], dword [esi]
call fcn.0040c0c1
mov esi, dword [ebp - 0x6d34]
pop ecx
pop ecx
test esi, esi
je 0x40fa3e
push 1
call fcn.0040badc
pop ecx
cmp eax, 0xfffffffe
je 0x40fa2c
cmp eax, 1
je 0x40fa25
cmp eax, 2
jne 0x40fa3e
push str.SoftwareSASGeneration_policy_setting_already_enabled._r_n
jmp 0x40fa31
push str.Policy_setting_does_not_require_Ctl_Alt_Del._r_n
jmp 0x40fa31
push str.Failed_to_enable_SoftwareSASGeneration_policy._May_not_be_able_to_send_Ctl_Alt_Del._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
push dword [ebp - 0x6cf0]
lea eax, [ebp - 0x1340]
or edi, 0xffffffff
push eax
push dword [ebp - 0x6cf8]
push edi
push dword [ebp - 0x6cf4]
push 2
push dword [ebp - 0x6d0c]
push dword [ebp - 0x6d10]
push dword [ebp - 0x6d04]
push ebx
push dword [ebp - 0x6d00]
call fcn.004086ab
push dword [ebp - 0x6cf0]
call fcn.0040c0f9
push dword [ebp - 0x6d00]
call fcn.004087bf
push dword [ebp - 0x6cf0]
call fcn.0040c120
lea eax, [ebp - 0x6548]
push eax
call fcn.0049063a
lea eax, [ebp - 0x6548]
push eax
call fcn.00490482
add esp, 0x40
add eax, 0xb
push eax
lea eax, [ebp - 0x308]
push str.The_relay_session_has_terminated_at__.8s._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
test esi, esi
je 0x40fb34
push 2
call fcn.0040badc
pop ecx
cmp eax, 0xfffffffb
je 0x40fb22
cmp eax, 0xfffffffc
je 0x40fb1b
cmp eax, 0xfffffffd
je 0x40fb14
cmp eax, 3
je 0x40fb0d
cmp eax, 4
jne 0x40fb34
push str.Successfully_restored_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40fb27
push str.Successfully_removed_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40fb27
push str.Failed_to_remove_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40fb27
push str.Failed_to_restore_SoftwareSASGeneration_policy_setting._r_n
jmp 0x40fb27
push str.SoftwareSASGeneration_policy_setting_has_not_been_restored_because_it_has_changed_since_this_session_started._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
jmp 0x40fd14
cmp eax, 0x2bad2bad
jne 0x40fbb5
push 1
lea eax, [ebp - 0x308]
push str.Failed._r_n_r_n____ERROR:_This_viewer_package_version___d__is_obsolete._r_n___________Please_restart_the_remote_control_session_by_first_selecting_a_machine_from_the_Kaseya_Virtual_System_r_n___________Administrator_remote_control_web_page_and_then_run_download_the_viewer_package_again._r_n_r_nThis_package_will_exit_now..._r_n
push eax
call fcn.004018a8
add esp, 0xc
cmp dword [ebp - 0x6cf0], 0
jne 0x40fb86
push 0x10
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x308]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40fbeb
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
push 0x7530
call esi
push dword [ebp - 0x6cf0]
call fcn.0040bf96
and dword [ebp - 0x6cf0], 0
jmp 0x40fbea
test eax, eax
jle 0x40fbd9
cmp dword [ebp - 0x6d14], 0
jne 0x40fbcb
cmp dword [ebp - 0x6d18], 0
je 0x40fbd2
push 0x7530
call esi
push str.Done._r_nRelay_for_remote_control_session_is_not_required._r_n
jmp 0x40fbde
push str.Failed._r_nRelay_for_remote_control_session_failed_to_establish_a_connection_with_the_other_relay_client._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
pop ecx
pop ecx
push 0x2710
call esi
or edi, 0xffffffff
jmp 0x40fd14
push 0x4a2528
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
push dword [ebp - 0x6d04]
lea eax, [ebp - 0x308]
push ebx
push str.ERROR:__Unable_to_connect_to_the_KServer_at__s_on_port__d._r_n_r_n
push eax
call fcn.004018a8
lea edi, [ebp - 0x308]
add esp, 0x20
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fc39
push 0x10
pop ecx
mov esi, str.Please_check_that_your_firewall__router__and_or_proxy_server_is_r_n
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x308]
lea edx, [ecx + 1]
movsw word es:[edi], word [esi]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fc56
push dword [ebp - 0x6d04]
sub ecx, edx
lea eax, [ebp - 0x308]
push ebx
add eax, ecx
push str.allowing_outbound_TCP_connections_to__s_on_port__d._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x18
cmp dword [ebp - 0x6d1c], 0
je 0x40fca0
cmp dword [ebp - 0x6cf0], 0
jne 0x40fca9
cmp dword [ebp - 0x6cf8], 5
jne 0x40fd05
lea ecx, [ebp - 0x55c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fcb2
sub ecx, edx
jmp 0x40fccc
mov al, byte [ebp + ecx - 0x55c]
cmp al, 0x5c
je 0x40fcd1
cmp al, 0x3a
je 0x40fcd1
sub ecx, 1
jns 0x40fcbd
push 0x78
push 0x50010
lea eax, [ebp - 0x55b]
add eax, ecx
push eax
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c44d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
push 0xbb8
call esi
jmp 0x40fd0b
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
or edi, 0xffffffff
mov dword [ebp - 0x6d10], edi
cmp dword [ebp - 0x6d18], 0
je 0x40fd53
push str.Removing_Remote_Administrator_server._r_n
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
call fcn.00408096
push 0x1e
push 0x50040
push str.Virtual_System_Administrator
push str.Remote_control_session_with_your_administrator_has_ended.
push dword [ebp - 0x6cf0]
call fcn.0040c44d
add esp, 0x1c
jmp 0x40fd61
cmp dword [ebp - 0x6d14], 0
je 0x40fd61
call fcn.00408564
cmp byte [ebp - 0x653c], 0
je 0x40fdfa
lea eax, [ebp - 0x653c]
push eax
push 0x4a2528
push str._r_n
push eax
call fcn.00406b9a
add esp, 0x10
cmp byte [ebp - 0x8b4], 0
jne 0x40fdc7
lea eax, [ebp - 0x8b4]
push eax
push str.Agent_Title
push str._SERVER_COMMUNICATIONS_
call fcn.0040b654
add esp, 0xc
cmp byte [ebp - 0x8b4], 0
jne 0x40fdc7
xor ecx, ecx
mov al, byte [ecx + str.Virtual_System_Administrator]
mov byte [ebp + ecx - 0x8b4], al
inc ecx
test al, al
jne 0x40fdb5
lea eax, [ebp - 0x653c]
push 0x78
push eax
call fcn.0040b161
pop ecx
pop ecx
test eax, eax
jne 0x40fdfa
push 0x78
push 0x50040
lea eax, [ebp - 0x8b4]
push eax
lea eax, [ebp - 0x653c]
push eax
push 0
call fcn.0040c44d
add esp, 0x14
push ebx
call fcn.004856f7
pop ecx
cmp dword [ebp - 0x6d10], edi
je 0x40fe18
push 1
push dword [ebp - 0x6d10]
call fcn.00402ac5
pop ecx
pop ecx
cmp dword [ebp - 0x6d0c], edi
je 0x40fe2f
push 1
push dword [ebp - 0x6d0c]
call fcn.00402ac5
pop ecx
pop ecx
push dword [ebp - 0x6cf0]
call fcn.0040c120
xor ebx, ebx
pop ecx
cmp byte [ebp - 0x113c], bl
je 0x40ffd9
push 0x44
pop edi
push edi
lea eax, [ebp - 0x6da8]
push ebx
push eax
call fcn.00481190
add esp, 0xc
mov dword [ebp - 0x6da8], edi
mov eax, 0xfffff830
mov dword [ebp - 0x6d7c], 5
mov dword [ebp - 0x6d98], eax
lea edi, [ebp - 0x6d48]
mov dword [ebp - 0x6d94], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x6d50], ebx
mov word [ebp - 0x6d78], ax
inc ecx
push 0xc
pop eax
mov dword [ebp - 0x6d54], eax
mov dword [ebp - 0x6d60], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x6d4c], ecx
mov dword [ebp - 0x6d5c], ebx
mov dword [ebp - 0x6d58], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp byte [ebp - 0x7b4], bl
je 0x40fef4
lea ecx, [ebp - 0x113c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fece
lea eax, [ebp - 0x7b4]
sub ecx, edx
push eax
lea eax, [ebp - 0x113c]
add eax, ecx
push 0x4a5288
push eax
call fcn.004018a8
add esp, 0xc
lea eax, [ebp - 0x113c]
push 0x25
push eax
call fcn.00482bc0
pop ecx
pop ecx
test eax, eax
je 0x40ff41
push 0xc80
lea eax, [ebp - 0x1fc0]
push eax
lea eax, [ebp - 0x113c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x40ff41
cmp eax, 0x208
ja 0x40ff41
mov ecx, ebx
mov al, byte [ebp + ecx - 0x1fc0]
mov byte [ebp + ecx - 0x113c], al
inc ecx
test al, al
jne 0x40ff2e
lea eax, [ebp - 0x6d48]
push eax
lea eax, [ebp - 0x6da8]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6d60]
push eax
lea eax, [ebp - 0x6d54]
push eax
lea eax, [ebp - 0x113c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea eax, [ebp - 0x113c]
push eax
lea eax, [ebp - 0x308]
jne 0x40ff87
push str.Failed_to_start_the_cleanup_process__s._r_n
jmp 0x40ff8c
push str.Successfully_started_the_cleanup_process__s._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
cmp dword [ebp - 0x6d48], ebx
je 0x40ffbb
push dword [ebp - 0x6d48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6d44], ebx
je 0x40ffcf
push dword [ebp - 0x6d44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call esi
or edi, 0xffffffff
cmp dword [ebp - 0x6d20], 0
je 0x410055
push dword [ebp - 0x6cf4]
lea eax, [ebp - 0x308]
push str.Performing_FTP_cleanup_for_connection_to_port__d...
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
push dword [ebp - 0x6cf4]
call fcn.0040c751
lea eax, [ebp - 0x308]
push str.Done._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x28
cmp dword [ebp - 0x6d1c], 0
je 0x410055
cmp dword [ebp - 0x6cf0], 0
je 0x410055
push 0x3a98
call esi
mov eax, dword [ebp - 0x6cfc]
test eax, eax
jne 0x410075
mov ecx, ebx
mov al, byte [ecx + 0x4a5cf4]
mov byte [ebp + ecx - 0x7b4], al
inc ecx
test al, al
jne 0x410061
jmp 0x4100a5
cmp eax, 1
jne 0x410090
mov ecx, ebx
mov al, byte [ecx + str.in_1_minute]
mov byte [ebp + ecx - 0x7b4], al
inc ecx
test al, al
jne 0x41007c
jmp 0x4100a5
push eax
lea eax, [ebp - 0x7b4]
push str.in__d_minutes
push eax
call fcn.004018a8
add esp, 0xc
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x308]
push str.This_relay_client_will_exit__s..._r_n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
add esp, 0x14
push 0x1388
call esi
cmp dword [ebp - 0x6cf0], 0
je 0x410143
mov eax, dword [ebp - 0x6cfc]
test eax, eax
je 0x410143
cmp eax, 0x1179e
jbe 0x4100fb
mov dword [ebp - 0x6cfc], edi
jmp 0x41010b
imul eax, eax, 0xea60
mov dword [ebp - 0x6cfc], eax
test eax, eax
je 0x410143
push 0x4a25a0
push dword [ebp - 0x6cf0]
call fcn.0040c0c1
mov eax, 0xea60
pop ecx
pop ecx
cmp dword [ebp - 0x6cfc], eax
jbe 0x41013b
push eax
call esi
sub dword [ebp - 0x6cfc], 0xea60
jne 0x41010b
jmp 0x410143
push dword [ebp - 0x6cfc]
call esi
cmp dword [ebp - 0x6cf8], 0x10
jne 0x4101ab
push ebx
call fcn.0040c87d
pop ecx
cmp eax, 1
jne 0x4101ab
lea eax, [ebp - 0x34c]
push 0x41
push eax
call sym.KRlyCCon.exe_krc_auth_check
pop ecx
pop ecx
test eax, eax
jne 0x4101ab
push dword [ebp - 0x6d08]
lea eax, [ebp - 0x34c]
push 0x41
push eax
push ebx
call fcn.0040d16f
add esp, 0x10
test eax, eax
je 0x4101ab
lea eax, [ebp - 0x308]
push str.Failed_to_set_a_random_password_for_the_KRC_Server._n
push eax
call fcn.004018a8
lea eax, [ebp - 0x308]
push eax
push ebx
call fcn.0040c0c1
add esp, 0x10
jmp 0x4101ad
mov edi, ebx
push dword [ebp - 0x6cf0]
call fcn.0040bf96
pop ecx
call fcn.00402fe4
mov eax, edi
jmp 0x410589
cmp dword [ebp - 0x6d08], 0
jne 0x4101e9
cmp dword [ebp - 0x6cf0], 0
je 0x4101e2
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
jmp 0x410589
push 0x105
lea eax, [ebp - 0x55c]
push edi
push eax
call fcn.00481190
add esp, 0xc
lea eax, [ebp - 0x55c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x55c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41021a
sub ecx, edx
jmp 0x410234
mov al, byte [ebp + ecx - 0x55c]
cmp al, 0x5c
je 0x410239
cmp al, 0x3a
je 0x410239
sub ecx, 1
jns 0x410225
lea eax, [ebp - 0x55b]
add eax, ecx
push eax
lea eax, [ebp - 0x1fc0]
push str._s__s_ipAddr__p_portNumber__c_portNumber__i_sessionID__w_waitTimeSeconds___k_cryptoKey__n___________r____e____f____a_OR__b__app_cmd_string_____o_appOptionStr____l____g_appWaitSeconds__n___________x__exit_cmd_string_____y_exitOptionStr____mr____d____j____v____h_____n
push eax
call fcn.004018a8
lea edi, [ebp - 0x1fc0]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41025d
push 0xb
pop ecx
mov esi, str._s_ipAddr__relay_server_IP_address_or_name_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410277
push 0xc
pop ecx
mov esi, str._p_portNumber__relay_server_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410291
push 0xb
pop ecx
mov esi, str._c_portNumber__local_host_port_to_connect_to_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4102ad
push 8
pop ecx
mov esi, str._i_sessionID__relay_session_ID_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4102c7
push 0x16
pop ecx
mov esi, str._w_waitTime__seconds_to_wait_for_response_from_listener_relay_client_via_relay_server_n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4102e0
push 0x16
pop ecx
mov esi, str._k_cryptoKey__optional_crypto_key_for_this_session__maximum_of_128_bytes_of_hex_data__n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4102f9
push 0x14
pop ecx
mov esi, str._r__perform_optional_support_specific_to_RAdmin_server_application__R_Server._n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410312
push 0xe
pop ecx
mov esi, str.________R_Server_is_restarted_with_a_specific_password._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41032c
push 0x15
pop ecx
mov esi, str._e__perform_optional_support_specific_to_pcAnywhere_server_application__Awhost32._n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410345
push 0xf
pop ecx
mov esi, str.________Awhost32_is_run_with_Network.bhf_on_the_command_line._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410361
push 6
pop ecx
mov esi, str._f__FTP_server_support_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41037b
push 0xf
pop ecx
mov esi, str._mr__manual_remote_control_support_for_RAdmins_r_server.exe_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410397
push 0x11
pop ecx
mov esi, str._a__app_cmd_string___optional_application_command_line_string_to_run_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4103b3
push 0x17
pop ecx
mov esi, str._b__app_cmd_string___same_as__a_but_prepend_App_Paths_directory_location_to_application_name_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4103cf
push 0x14
pop ecx
mov esi, str._o__appOptionStr___option_string_to_pass_on_the_command_line_to_app__e.g.__8bit__n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4103eb
push 0x15
pop ecx
mov esi, str._l__always_run_application_specified_by__a_or__b._by_default_without_this_option__n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410404
push 0x18
pop ecx
mov esi, str.________the_application_is_run_only_if_the_port_specified_in__c_is_not_listening_for_connections._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410420
push 0x16
pop ecx
mov esi, str.________it_is_assumed_that_the_port_from__c_is_opened_by_the_application_from__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41043a
push 0x17
pop ecx
mov esi, str._g_appWaitSeconds__seconds_to_wait_for_completion_of_the_application_specified_by__a_or__b._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410455
push 0x1a
pop ecx
mov esi, str.________0_to_wait_forever._e.g._used_when_running_Windows_scripts_that_should_complete_before_proceeding._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410471
push 0x18
pop ecx
mov esi, str._x__exit_cmd_string___optional_application_command_line_string_to_run_when_relay_client_exits_n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41048a
push 0x11
pop ecx
mov esi, str._y__exitOptionStr___command_line_option_string_passed_to_exit_cmd_n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4104a3
push 0x12
pop ecx
mov esi, str._z__exitMsgStr___display_a_message_in_a_timed_dialog_box_for_2_minutes_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4104bd
push 0x12
pop ecx
mov esi, str._zt__exitDlgTitleStr___title_shown_in_window_frame_of_timed_dialog_box_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4104d7
push 0x14
pop ecx
mov esi, str.________if_none_specified__Agent_Title_attribute_value_in_KaseyaD.ini_is_used._n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4104f0
push 0x19
pop ecx
mov esi, str._d_exitDelayMinutes__minutes_to_delay_before_destroying_this_relay_clients_status_display_on_exit_n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41050a
push 0x13
pop ecx
mov esi, str._j__Enable_Ctl_Alt_Del_and_Software_Secure_Attention_Sequence_policy_helper_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410525
push 0xa
pop ecx
mov esi, str._v__verbose_output_into_status_dialog_n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41053e
push 6
pop ecx
mov esi, str._q__enable_detail_status_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1fc0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41055a
push 9
pop ecx
mov esi, str._h_or_____display_this_help_message_n
rep movsd dword es:[edi], dword [esi]
push 0x40
lea ecx, [ebp - 0x55c]
push ecx
lea ecx, [ebp - 0x1fc0]
movsw word es:[edi], word [esi]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f259
mov esp, ebp
pop ebp
ret 0x10