Function at 0x403590
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Get disk information
Get file attributes
Get session user name
Query environment variable
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd04
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x190], bl
mov ecx, 0x41
lea edi, [esp + 0x191]
rep stosd dword es:[edi], eax
mov byte [esp + 0x5d0], bl
mov ecx, 0x41
lea edi, [esp + 0x5d1]
rep stosd dword es:[edi], eax
mov byte [esp + 0x298], bl
mov ecx, 0x45
lea edi, [esp + 0x299]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x3b0], bl
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 0x45
lea edi, [esp + 0x3b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x7e0], bl
mov ecx, 0x22
lea edi, [esp + 0x7e1]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x3e], eax
push str.KaseyaClientSetupSingleInstance
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
push 1
mov ecx, 0x50
lea edi, [esp + 0x58]
push ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x18], ebx
mov word [esp + 0x48], bx
mov word [esp + 0x56], ax
rep stosd dword es:[edi], eax
call esi
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [esp + 0x18], eax
je 0x40367a
cmp eax, 5
je 0x40367a
cmp edi, ebx
jne 0x4036be
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.KaseyaClientSetupSingleInstance
push 1
push ebx
call esi
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
mov dword [esp + 0x18], esi
je 0x4057e5
cmp esi, 5
je 0x4057e5
cmp edi, ebx
je 0x4057dd
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x4c8]
rep stosd dword es:[edi], eax
push 0x105
lea ecx, [esp + 0x4cc]
push ecx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x40372c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d:_Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_modules_current_location_could_not_be_determined.
push 0x41c2a8
mov dword [esp + 0x24], eax
call fcn.00409214
mov edx, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
add esp, 0xc
push 0x50010
push edx
push 0x41c2a8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x4057be
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403732
sub eax, edx
add eax, 0x8a
push eax
call fcn.00408d52
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x14], edi
jne 0x40377a
mov edx, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
push 0x50010
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nof_insufficient_memory.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x4057be
lea edx, [esp + 0x4c8]
push 0x416b68
push edx
call fcn.004090d8
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4037d8
call fcn.0040968e
mov eax, dword [eax]
push eax
push str.Error__d:_Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0x41c2a8
call fcn.00409214
mov ecx, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
add esp, 0xc
push 0x50010
push ecx
push 0x41c2a8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
mov ebx, esi
jmp 0x404eff
push 2
push 0xffffffffffffff80
push esi
call fcn.00409033
push esi
push 0x80
lea ecx, [esp + 0x7f4]
push 1
push ecx
call fcn.00408c5f
add esp, 0x1c
cmp eax, 0x80
je 0x403843
call fcn.0040968e
mov edx, dword [eax]
push edx
push str.Error__d:_Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_embedded_arguments_could_not_be_read_from_the_package.
push 0x41c2a8
call fcn.00409214
mov eax, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
add esp, 0xc
push 0x50010
push eax
push 0x41c2a8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
mov ebx, esi
jmp 0x404eff
push esi
call fcn.00408db0
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x7e4]
push eax
push ecx
push str._s__s
push edi
call fcn.00409214
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00406b80
add esp, 0x1c
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x40389c
mov eax, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_parameters_could_not_be_initialized.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
jmp 0x4057be
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x4c8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x105
lea eax, [esp + 0x4cc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [esp + 0xc]
test eax, eax
mov eax, dword [esi + 0x25c]
jg 0x403943
cmp eax, ebx
jne 0x403947
cmp dword [esi + 0x260], ebx
je 0x4038fc
cmp dword [esi + 0x258], ebx
jne 0x4038fc
mov ecx, dword [esi + 0x2d8]
push 0x50010
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_installation_package_could_not_determine_its_name_or_location.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc]
push str.Installation_package_could_not_determine_its_name_or_location.
push eax
push 3
push 1
push edx
mov dword [esp + 0x2c], eax
call fcn.00408840
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.004033c0
mov eax, dword [esp + 0x34]
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, ebx
je 0x4039bc
lea eax, [esp + 0x4c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403951
sub eax, edx
dec eax
cmp eax, ebx
jl 0x403974
nop
mov cl, byte [esp + eax + 0x4c8]
cmp cl, 0x5c
je 0x403974
cmp cl, 0x3a
je 0x403974
dec eax
jns 0x403960
cmp dword [esi + 0x258], ebx
jne 0x403992
mov edx, dword [esi + 0x2d4]
push edx
lea ebx, [esp + eax + 0x4cd]
call fcn.004026a0
add esp, 4
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 3
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x403a7c
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 1
jne 0x403a15
cmp dword [eax + 0xc], ebx
jne 0x403a15
cmp dword [eax + 0x258], ebx
jne 0x4039fe
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.The_Kaseya_Virtual_System_Adminstrator_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator__or_download_WinSock2_for_Windows_95_at_nhttp:__www.microsoft.com_windows95_downloads_contents_wuadmintools_s_wunetworkingtools_w95sockets2_default.asp___nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x14]
push 3
push 1
push eax
jmp 0x403a4a
cmp dword [eax + 0x258], ebx
jne 0x403a35
mov ecx, dword [eax + 0x2d8]
push 0x50010
push ecx
push str.The_Kaseya_Virtual_System_Adminstrator_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push eax
push 3
push 1
push edx
call fcn.00408840
add esp, 0x14
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 0xffffffe6
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x14]
cmp eax, 1
jne 0x403aba
cmp dword [ecx + 0xc], ebx
jne 0x403bda
push ecx
call fcn.00403240
add esp, 4
test eax, eax
je 0x403bda
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
jmp 0x40545c
cmp eax, 2
jne 0x403b6c
xor eax, eax
mov ecx, 0x208
mov edi, 0x41c2a8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0x416680
push 0x80000002
lea esi, [esp + 0x2c]
mov ebx, 0x41c2a8
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsKServer.exe
mov dword [esp + 0x2c], 0x820
call fcn.00402a60
add esp, 0xc
test eax, eax
jne 0x403bd8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x403b31
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.The_Agent_cannot_be_installed_on_the_same_system_with_a_Kaseya_Virtual_System_Administrator_Server._nThis_installation_will_abort_now.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Cannot_install_agent_on_machine_with_Kaseya_Server_installed.
push 0xffffffffffffffe8
push 3
push 3
push eax
call fcn.00408840
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.004033c0
add esp, 0x1c
mov eax, 0xffffffe8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Unknown_operating_system_version.
push 0xffffffffffffffe7
push 2
push 3
push ecx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x24c]
add esp, 0x14
cmp ecx, ebx
jne 0x403bda
cmp dword [eax + 0x258], ebx
jne 0x403bae
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.The_Kaseya_Virtual_System_Adminstrator_Agent_cannot_be_installed_because_this_ninstallation_program_cannot_determine_the_which_OS_is_on_this_system._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 0xffffffe7
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x190]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x194]
push edx
push str.TEMP
stosb byte es:[edi], al
call esi
cmp eax, ebx
jle 0x403c84
cmp eax, 0x104
jae 0x403c84
cmp byte [esp + 0x190], bl
je 0x403c84
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c23
sub eax, edx
cmp byte [esp + eax + 0x18f], 0x5c
jne 0x403c50
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c40
sub eax, edx
mov byte [esp + eax + 0x18f], bl
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403c84
test al, 0x10
je 0x403c84
lea edi, [esp + 0x190]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403c70
mov cx, word [0x416464]
mov word [edi], cx
jmp 0x403c95
xor eax, eax
lea edi, [esp + 0x190]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
cmp byte [esp + 0x190], bl
jne 0x403d49
push 0x104
lea edx, [esp + 0x194]
push edx
push 0x416460
call esi
cmp eax, ebx
jle 0x403d38
cmp eax, 0x104
jae 0x403d38
cmp byte [esp + 0x190], bl
je 0x403d38
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403cd8
sub eax, edx
cmp byte [esp + eax + 0x18f], 0x5c
jne 0x403d05
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403cf5
sub eax, edx
mov byte [esp + eax + 0x18f], bl
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403d38
test al, 0x10
je 0x403d38
lea edi, [esp + 0x190]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403d24
mov cx, word [0x416464]
mov word [edi], cx
jmp 0x403d49
xor eax, eax
lea edi, [esp + 0x190]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x6d8]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
push edx
stosw word es:[edi], ax
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x6e4]
mov eax, str.SystemCurrentControlSetServicesVxDKaseya
mov dword [esp + 0x2c], 0x105
call fcn.00402a60
add esp, 0xc
xor esi, esi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x403e32
cmp dword [eax + 0x244], esi
mov dword [esp + 0x28], esi
jne 0x403e32
cmp dword [eax + 0x248], esi
je 0x403fa8
cmp dword [eax + 0x258], esi
jne 0x403fa8
mov eax, dword [eax + 0x2d8]
push 0x50024
push eax
push str.The_Virtual_System_Administrator_Agent_is_already_installed._nDo_you_want_to_reinstall_the_Virtual_System_Administrator_Agent_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x403e20
mov ecx, dword [esp + 0xc]
push str.Re_installation_of_the_Virtual_System_Administrator_Agent_was_stopped_by_the_user.
push 0xffffffffffffffe3
push 1
push 3
push ecx
call fcn.00408840
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x2d8]
add esp, 0x14
push 0x50040
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_stopped.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
jmp 0x403ff4
mov eax, dword [esp + 0xc]
mov dword [eax + 0x244], 1
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x258], esi
jne 0x403e5e
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x4c]
push ecx
push esi
push edx
push 0x402f70
push esi
push esi
call fcn.00409332
add esp, 0x18
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 0x208
mov edi, 0x41c2a8
rep stosd dword es:[edi], eax
push 0x81f
lea eax, [esp + 0x4cc]
push eax
push 0x41c2a8
mov dword [0x41c0a4], 0xf
call fcn.004090f0
push 0x416340
push 0x41c2a8
call fcn.00405a00
add esp, 0x14
cmp eax, esi
je 0x40559c
push 0x41c2a8
mov byte [eax + 2], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x40559c
cmp eax, esi
je 0x40559c
lea ecx, [esp + 0x4c8]
push str.Temporary_Internet_Files
push ecx
call fcn.00405a00
add esp, 8
test eax, eax
je 0x403efc
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x403efc
cmp dword [eax + 8], 4
jne 0x403efc
cmp dword [eax + 0x98], esi
je 0x40559c
lea edx, [esp + 0x4c8]
push 0x416b68
push edx
call fcn.004090d8
mov edi, eax
add esp, 8
cmp edi, esi
mov dword [esp + 0x1c], edi
jne 0x404014
mov eax, dword [0x41c0a0]
cmp eax, esi
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x403f4d
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], esi
call fcn.0040968e
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Installation_package_could_not_be_accessed.
push eax
push 3
push 1
push ecx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x403f99
cmp dword [eax + 0x258], esi
jne 0x403f99
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x404efb
push str.The_Virtual_System_Administrator_Agent_is_already_installed._Re_installation_of_the_Virtual_System_Administrator_Agent_was_terminated.
push 0xffffffffffffffe3
push 1
push 3
push eax
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x258]
add esp, 0x14
cmp ecx, esi
jne 0x403fea
cmp dword [eax + 0x250], esi
jne 0x403fea
mov ecx, dword [eax + 0x2d8]
push 0x50040
push ecx
push str.The_Virtual_System_Administrator_Agent_is_already_installed._Re_installation_of_the_Virtual_System_Administrator_Agent_was_terminated.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 0xffffffe3
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x50]
push edx
push edi
call fcn.00407fc0
lea eax, [esp + 0x58]
push eax
push edi
call fcn.00408040
add esp, 0x10
test eax, eax
jge 0x4040b6
mov eax, dword [0x41c0a0]
cmp eax, esi
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x404063
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], esi
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.Failed_to_read_setup_file_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x404ef1
cmp dword [eax + 0x258], esi
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_setup_file_could_not_be_read_from_the_installation_package.
push esi
jmp 0x404eeb
lea eax, [esp + 0x78]
push str.KAgentSilent.exe
push eax
call fcn.004127e4
add esp, 8
test eax, eax
je 0x404151
mov eax, dword [0x41c0a0]
cmp eax, esi
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x4040fe
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], esi
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.Failed_to_find_setup_file_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x404ef1
cmp dword [eax + 0x258], esi
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push esi
jmp 0x404eeb
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x298]
rep stosd dword es:[edi], eax
mov cl, byte [esp + eax + 0x190]
mov byte [esp + eax + 0x298], cl
inc eax
test cl, cl
jne 0x404161
lea edi, [esp + 0x298]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404180
mov eax, dword [str.KAgentSilent.exe]
mov ecx, dword [0x41611c]
mov edx, dword [0x416120]
mov dword [edi], eax
mov eax, dword [0x416124]
mov dword [edi + 4], ecx
mov cl, byte [0x416128]
mov dword [edi + 8], edx
lea edx, [esp + 0x298]
mov dword [edi + 0xc], eax
push 0x416048
push edx
mov byte [edi + 0x10], cl
call fcn.004090d8
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x4042a3
lea eax, [esp + 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40421a
test al, 1
je 0x40421a
push 0x80
lea ecx, [esp + 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x298]
push 0x416048
push edx
call fcn.004090d8
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x4042a3
mov eax, dword [0x41c0a0]
cmp eax, esi
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x404248
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], esi
call fcn.0040968e
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push 1
push ecx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x404294
cmp dword [eax + 0x258], esi
jne 0x404294
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x404efb
mov ecx, 0x208
xor eax, eax
mov edi, 0x41c2a8
rep stosd dword es:[edi], eax
mov cl, byte [eax + str.KAgentSilent.exe]
mov byte [eax + 0x41c2a8], cl
inc eax
test cl, cl
jne 0x4042b1
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x258], 1
jne 0x4042e5
mov edi, 0x41c2a8
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4042d5
mov edx, dword [0x415f6c]
mov dword [edi], edx
mov eax, 0x41c2a8
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4042f0
add esi, 0x135
sub eax, edx
push esi
lea eax, [eax + 0x41c2a8]
push str.__a__PATH__s
push eax
call fcn.00409214
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0x5c3a43
mov ecx, dword [ecx + 0x2dc]
add esp, 0xc
test ecx, ecx
je 0x4043a4
cmp byte [ecx], 0x22
mov eax, 0x41c2a8
lea esi, [eax + 1]
je 0x404358
jmp 0x404340
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404340
push ecx
sub eax, esi
push str.__INSTALLDIR__s_
lea edx, [eax + 0x41c2a8]
push edx
jmp 0x40436e
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404358
push ecx
sub eax, esi
push str.__INSTALLDIR_s
lea eax, [eax + 0x41c2a8]
push eax
call fcn.00409214
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x2dc]
add esp, 0xc
push 0x3a
push edx
call fcn.004095d0
add esp, 8
test eax, eax
je 0x4043a4
mov al, byte [eax - 1]
cmp al, 0x61
mov byte [esp + 0x2c], al
jl 0x4043a4
cmp al, 0x7a
jg 0x4043a4
and al, 0xdf
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405511
test al, 0x10
je 0x405511
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x18c]
push ebx
push ecx
mov edi, 1
push edi
push edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], 0xffffffff
call fcn.00408b2a
push ebx
mov esi, eax
call fcn.00408db0
mov eax, dword [esp + 0x194]
add esp, 0x14
cmp esi, eax
je 0x40448f
mov eax, dword [0x41c0a0]
test eax, eax
mov dword [0x41b088], edi
mov dword [0x41c0a4], 0x65
je 0x404432
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], 0
call fcn.0040968e
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push edi
push ecx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x404480
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x404480
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x404efb
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x50]
push edx
push eax
call fcn.00408040
add esp, 8
test eax, eax
jge 0x40452e
mov eax, dword [0x41c0a0]
test eax, eax
mov dword [0x41b088], edi
mov dword [0x41c0a4], 0x65
je 0x4044d9
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], 0
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push edi
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x404ef1
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push 0
jmp 0x404eeb
lea eax, [esp + 0x78]
push str.KaseyaD.ini
push eax
call fcn.004127e4
add esp, 8
test eax, eax
je 0x4045cd
mov eax, dword [0x41c0a0]
test eax, eax
mov dword [0x41b088], edi
mov dword [0x41c0a4], 0x65
je 0x404578
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], 0
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.Failed_to_find_configuration_file_from_the_installation_package.
push ecx
push 3
push edi
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x404ef1
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push 0
jmp 0x404eeb
xor eax, eax
nop
mov cl, byte [esp + eax + 0x190]
mov byte [esp + eax + 0x5d0], cl
inc eax
test cl, cl
jne 0x4045d0
lea edi, [esp + 0x5d0]
dec edi
jmp 0x4045f0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4045f0
mov eax, dword [str.KaseyaD.ini]
mov ecx, dword [0x415e48]
mov edx, dword [0x415e4c]
mov dword [edi], eax
lea eax, [esp + 0x5d0]
mov dword [edi + 4], ecx
push 0x416048
push eax
mov dword [edi + 8], edx
call fcn.004090d8
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
jne 0x4046de
lea ecx, [esp + 0x5d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404677
test al, 1
je 0x404677
push 0x80
lea edx, [esp + 0x5d4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x5d0]
push 0x416048
push eax
call fcn.004090d8
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4046de
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x64
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, ebx
je 0x404ef1
cmp dword [eax + 0x258], ebx
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push ebx
jmp 0x404eeb
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x18c]
push esi
push eax
push 1
push ecx
call fcn.00408b2a
push esi
mov edi, eax
call fcn.00408db0
mov eax, dword [esp + 0x194]
add esp, 0x14
cmp edi, eax
je 0x404778
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x64
call fcn.0040968e
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push 1
push eax
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, ebx
je 0x404769
cmp dword [eax + 0x258], ebx
jne 0x404769
mov ecx, dword [eax + 0x2d8]
push 0x10
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x404efb
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x5d0]
push ecx
push edx
mov dword [0x41b088], 0x1f4
mov dword [0x41c0a4], 0x5f
call fcn.00406f10
add esp, 8
cmp eax, 0xfffffffe
mov dword [esp + 0x18], eax
je 0x404807
cmp eax, 0xffffffe9
je 0x404807
cmp eax, ebx
je 0x404807
push str.The_configuration_file_could_not_be_accessed.
push eax
mov eax, dword [esp + 0x14]
push 3
push 3
push eax
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, ebx
je 0x4047f8
cmp dword [eax + 0x258], ebx
jne 0x4047f8
mov ecx, dword [eax + 0x2d8]
push 0x50010
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_file_contents_could_not_be_accessed.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x404e09
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x4048c3
cmp dword [eax + 8], 4
jb 0x4048c3
cmp dword [eax + 0x98], ebx
jne 0x4048c3
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x298]
rep stosd dword es:[edi], eax
push 0x117
lea ecx, [esp + 0x4cc]
push ecx
lea edx, [esp + 0x2a0]
push edx
call fcn.004090f0
xor eax, eax
mov ecx, 0x208
mov edi, 0x41c2a8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
add ecx, 0x135
push ecx
lea edx, [esp + 0x2ac]
push edx
push str._s__PATH__s__s
push 0x41c2a8
call fcn.00409214
mov esi, dword [esp + 0x30]
add esp, 0x20
cmp esi, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
je 0x404a5c
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404a5c
cmp dword [esp + 0x28], ebx
jne 0x4048d5
cmp dword [eax + 0x240], ebx
je 0x404a52
cmp dword [eax + 0x23c], ebx
je 0x404a52
push ebx
push eax
call fcn.004083c0
mov eax, dword [esp + 0x14]
push eax
call fcn.00402500
add esp, 0xc
cmp eax, ebx
je 0x4049c9
cmp eax, 0xffffffff
jne 0x404989
mov eax, dword [0x41c0a0]
cmp eax, ebx
mov dword [0x41c0a4], 0x65
je 0x40492a
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], ebx
mov ecx, dword [esp + 0xc]
push str.User_canceled_the_installation.
push 0xffffffffffffffff
push 1
push 3
push ecx
call fcn.00408840
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x2d8]
add esp, 0x14
push 0x50040
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_terminated_because_nthe_required_configuration_parameters_were_not_entered.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Configuration_parameters_are_missing_and_the__s_switch_was_used.
push eax
mov eax, dword [esp + 0x14]
push 1
push 3
push eax
call fcn.00408840
mov ebx, dword [esp + 0x30]
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x24]
push edx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.004033c0
add esp, 0x1c
mov eax, 0xffffffed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x5d0]
push eax
push ecx
call fcn.00407b50
add esp, 8
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x404a5c
mov edx, dword [esp + 0xc]
push str.Installation_of_the_Virtual_System_Administrator_Agent_terminated.
push eax
push 1
push 3
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x258]
add esp, 0x14
cmp ecx, ebx
jne 0x404dff
mov eax, dword [0x41c0a0]
cmp eax, ebx
mov dword [0x41c0a4], 0x65
je 0x404a37
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], ebx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x2d8]
push 0x50040
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_terminated_because_nthe_configuration_could_not_be_updated.
push ebx
jmp 0x404df9
push ebx
push eax
call fcn.004083c0
add esp, 8
xor edi, edi
mov edi, edi
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x10]
push eax
push 0x41c2a8
lea ecx, [esp + 0x2a4]
push ecx
push edx
call fcn.00407260
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffec
mov dword [esp + 0x18], esi
jne 0x404aa2
cmp edi, 4
jge 0x404ac2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x404a60
cmp esi, 0xfffffff4
jne 0x404b4e
mov eax, dword [esp + 0xc]
push eax
call fcn.00402590
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x404a60
mov esi, eax
mov eax, dword [0x41c0a0]
cmp eax, ebx
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x404af0
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], ebx
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x260], ebx
je 0x404d64
cmp dword [eax + 0x258], ebx
jne 0x404d64
cmp esi, 1
jne 0x404cd1
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x48]
movzx ecx, word [esp + 0x4a]
mov eax, 0x3b
sub eax, edx
imul eax, eax, 0x3e8
add eax, ecx
cmp eax, 0x2710
jae 0x404c95
mov eax, 0x2710
jmp 0x404ca1
cmp esi, ebx
jne 0x404ac2
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x6d8]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
push edx
stosw word es:[edi], ax
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x6e4]
mov eax, str.SystemCurrentControlSetServicesVxDKaseya
mov dword [0x41b088], 0x64
mov dword [0x41c0a4], 0x63
mov dword [esp + 0x2c], 0x105
call fcn.00402a60
mov esi, eax
xor edi, edi
add esp, 0xc
cmp esi, edi
mov ebx, 1
jne 0x405477
cmp dword [esp + 0x24], ebx
jne 0x405477
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x405477
cmp eax, 0x105
jae 0x405477
lea eax, [esp + 0x6d8]
push str.AgentKaseyaD.ini
push eax
call fcn.00405a00
add esp, 8
test eax, eax
jne 0x404e2a
mov eax, dword [0x41c0a0]
cmp eax, edi
mov dword [0x41b088], ebx
mov dword [0x41c0a4], 0x65
je 0x404c24
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], edi
lea ecx, [esp + 0x6d8]
push str.KServerKaseyaD.ini
push ecx
call fcn.00405a00
add esp, 8
test eax, eax
je 0x404db1
mov edx, dword [esp + 0xc]
push str.The_Kaseya_Server_is_already_installed_on_this_machine.
push 0xffffffffffffffe8
push 3
push 3
push edx
mov dword [esp + 0x2c], 0xffffffe8
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x404dff
cmp dword [eax + 0x258], edi
jne 0x404dff
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_na_Kaseya_Server_is_already_installed_on_this_machine.
jmp 0x404df8
cmp eax, 0xd6d8
jbe 0x404ca1
mov eax, 0xd6d8
mov edx, dword [esp + 0xc]
push ebx
push eax
push str.The_Virtual_System_Administrator_Agent_installation_has_been_scheduled._n_nPlease_wait_up_to_one_minute_for_the_installation_to_proceed.
push edx
call fcn.00402600
mov eax, dword [esp + 0x1c]
add esp, 0x10
push str.The_installation_package_is_re_running_under_an_authorized_account
push esi
push 1
push 3
push eax
call fcn.00408840
add esp, 0x14
jmp 0x404dff
cmp esi, 0xffffffec
jne 0x404d0a
mov eax, dword [eax + 0x2d8]
push 0x50040
push eax
push str.The_installation_package_containing_the_Virtual_System_Administrator_Agent_failed_to_run_nbecause_the_Windows_NT_Task_Scheduler_is_not_running.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.The_installation_package_containing_the_Virtual_System_Administrator_Agent_failed_to_run.
push esi
push 3
push 3
push eax
call fcn.00408840
add esp, 0x14
jmp 0x404dff
cmp esi, 0xffffffff
jne 0x404d43
mov ecx, dword [eax + 0x2d8]
push 0x50040
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_terminated_because_nthe_required_credentials_were_missing_or_incorrect._User_cancelled_the_nthe_installation..
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
push 3
push eax
call fcn.00408840
add esp, 0x14
jmp 0x404dff
cmp esi, 2
je 0x404d64
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.The_installation_package_containing_the_Virtual_System_Administrator_Agent_failed_to_run.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
cmp esi, 1
je 0x404cb9
cmp esi, 2
je 0x404cb9
cmp esi, 0xffffffed
jne 0x404d93
push str.The_credentials_contained_in_the_installation_package_were_incorrect_or_missing._Virtual_System_Administrator_Agent_failed_to_run.
push esi
push 3
push 3
push eax
call fcn.00408840
add esp, 0x14
jmp 0x404dff
cmp esi, 0xffffffff
jne 0x404cf2
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
push 3
push eax
call fcn.00408840
add esp, 0x14
jmp 0x404dff
mov ecx, dword [esp + 0xc]
push str.The_ConfigurationFile_registry_key_could_not_be_installed.
push 0xfffffffffffffffd
push 3
push 3
push ecx
mov dword [esp + 0x2c], 0xfffffffd
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x404dff
cmp dword [eax + 0x258], edi
jne 0x404dff
mov edx, dword [eax + 0x2d8]
push 0x50010
push edx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_due_to_an_error_nthat_prevented_proper_installation_of_the_ConfigurationFile_registry_key.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ebx, dword [esp + 0x24]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x28], edi
jne 0x404e40
mov edx, dword [esp + 0xc]
cmp dword [edx + 0x240], edi
je 0x404f1f
lea eax, [esp + 0x6d8]
push eax
call fcn.00409593
lea ecx, [esp + 0x6dc]
push ecx
lea edx, [esp + 0x5d8]
push edx
call fcn.00409565
mov esi, eax
lea eax, [esp + 0x2a4]
push eax
call fcn.00409593
add esp, 0x10
cmp esi, edi
je 0x404f1f
mov eax, dword [0x41c0a0]
cmp eax, edi
mov dword [0x41b088], ebx
mov dword [0x41c0a4], 0x65
je 0x404ea6
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], edi
call fcn.0040968e
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_moved_to_the_installation_directory.
push ecx
push 3
push ebx
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x404ef1
cmp dword [eax + 0x258], edi
jne 0x404ef1
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_configuration_file_could_not_be_moved_to_the_installation_directory.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
mov ebx, dword [esp + 0x24]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
add esp, 8
call fcn.0040968e
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x298]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push str.Path
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x2a4]
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAgentmon.exe
mov dword [esp + 0x2c], 0x117
call fcn.00402a60
add esp, 0xc
test eax, eax
je 0x404fce
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x404f91
mov ecx, dword [eax + 0x2d8]
push 0x50010
push ecx
push str.The_installation_path_for_the_Virtual_System_Administrator_Agent_cannot_be_found_n_nThe_Kaseya_Agent_cannot_be_started.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Cannot_launch_the_agent_because_the_path_could_not_be_found.
push 0xffffffffffffffe4
push 3
push 3
push eax
call fcn.00408840
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.004033c0
add esp, 0x1c
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov cl, byte [esp + eax + 0x298]
mov byte [esp + eax + 0x190], cl
inc eax
test cl, cl
jne 0x404fd0
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x50]
push ecx
push ebx
call fcn.00408040
add esp, 8
test eax, eax
jne 0x4051f2
lea ecx, [ecx]
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x3b0]
rep stosd dword es:[edi], eax
cmp byte [esp + 0x78], 0x5c
je 0x4050a5
cmp byte [esp + 0x79], 0x3a
je 0x4050a5
xor eax, eax
jmp 0x405030
mov cl, byte [esp + eax + 0x190]
mov byte [esp + eax + 0x3b0], cl
inc eax
test cl, cl
jne 0x405030
lea eax, [esp + 0x3b0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405050
sub eax, edx
mov edx, 0x117
sub edx, eax
push edx
lea eax, [esp + 0x3b4]
push 0x416464
push eax
call fcn.00409430
lea eax, [esp + 0x3bc]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405080
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x3b8]
push eax
call fcn.00409430
jmp 0x4050bc
push 0x117
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x3b8]
push edx
call fcn.004090f0
lea eax, [esp + 0x3bc]
add esp, 0xc
push eax
call fcn.00405cb0
lea ecx, [esp + 0x3b4]
push 0x416048
push ecx
call fcn.004090d8
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40513b
lea edx, [esp + 0x3b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40512c
test al, 1
je 0x40512c
push 0x80
lea eax, [esp + 0x3b4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x3b0]
push 0x416048
push ecx
call fcn.004090d8
mov esi, eax
add esp, 8
test esi, esi
jne 0x40513b
lea edx, [esp + 0x3b0]
push edx
push str.WARNING:_Unable_to_open_the_file__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
jmp 0x40517a
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x18c]
push esi
push eax
push 1
push ecx
call fcn.00408b2a
push esi
mov edi, eax
call fcn.00408db0
mov eax, dword [esp + 0x194]
add esp, 0x14
cmp edi, eax
je 0x4051dc
lea edx, [esp + 0x3b0]
push edx
push str.WARNING:_Unable_to_write_the_file_content_to__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea eax, [esp + 0x910]
push eax
call fcn.00409214
call fcn.0040968e
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x914]
push ecx
push edx
push 3
push 1
push eax
call fcn.00408840
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x260]
add esp, 0x20
test ecx, ecx
je 0x4051dc
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4051dc
mov ecx, dword [eax + 0x2d8]
push 0x50010
push ecx
lea edx, [esp + 0x910]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.00408040
add esp, 8
test eax, eax
je 0x405000
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x64
je 0x405353
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x870]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x870]
push ecx
mov dword [esp + 0x874], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x405353
cmp dword [esp + 0x880], 2
jne 0x405353
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0xb10]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0xb14]
push eax
mov dword [esp + 0x28], 0x1ff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x405353
mov al, byte [esp + 0xb10]
test al, al
je 0x405353
lea ecx, [esp + 0xb10]
push str.SYSTEM
push ecx
call fcn.004127e4
add esp, 8
test eax, eax
je 0x405353
xor eax, eax
jmp 0x4052c0
mov cl, byte [esp + eax + 0x298]
mov byte [esp + eax + 0x190], cl
inc eax
test cl, cl
jne 0x4052c0
lea eax, [esp + 0x298]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4052e0
sub eax, edx
mov edx, 0x117
sub edx, eax
push edx
lea eax, [esp + 0x29c]
push str.KaUsrTsk.exe
push eax
call fcn.00409430
push 0
push 0
lea ecx, [esp + 0x2ac]
push 0x415378
push ecx
call fcn.00403420
add esp, 0x1c
test eax, eax
je 0x405337
mov edx, dword [esp + 0xc]
push str.Failed_to_launch_the_service_helper_task.
push eax
push 3
push 3
push edx
call fcn.00408840
add esp, 0x14
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x190]
mov byte [esp + eax + 0x298], cl
inc eax
test cl, cl
jne 0x405340
lea eax, [esp + 0x298]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405360
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x29c]
push str.AgentMon.exe
push edx
call fcn.00409430
mov ecx, dword [esp + 0x18]
push 0
push 0
push str.agentmon.exe
lea eax, [esp + 0x2b0]
push eax
push ecx
call fcn.00407260
add esp, 0x20
test eax, eax
je 0x4053bc
mov edx, dword [esp + 0xc]
push str.Cannot_launch_the_agent.
push eax
push 3
push 3
push edx
call fcn.00408840
add esp, 0x14
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x260]
test ecx, ecx
je 0x4053f9
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4053f9
mov ecx, dword [eax + 0x254]
test ecx, ecx
jne 0x4053f9
mov ecx, dword [eax + 0x2d4]
push 1
push 0x7530
push ecx
push eax
call fcn.00402600
mov eax, dword [esp + 0x1c]
add esp, 0x10
mov ecx, dword [0x41c0a0]
test ecx, ecx
mov dword [0x41c0a4], 0x65
je 0x405428
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0xc]
mov dword [0x41c0a0], 0
mov ecx, dword [eax + 0x254]
test ecx, ecx
je 0x405452
call fcn.00402ea0
test eax, eax
je 0x405452
mov edx, dword [esp + 0xc]
push str.Attempt_to_reboot_the_system_failed.
push eax
push 3
push 1
push edx
call fcn.00408840
add esp, 0x14
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x41c0a0]
cmp eax, edi
mov dword [0x41b088], ebx
mov dword [0x41c0a4], 0x65
je 0x4054a1
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], edi
mov edx, dword [esp + 0xc]
push str.Installation_of_the_Virtual_System_Administrator_Agent_Failed.
push esi
push 3
push ebx
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x4054e5
cmp dword [eax + 0x258], edi
jne 0x4054e5
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_Failed
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 0xfffffffd
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movsx eax, byte [esp + 0x2c]
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_target_installation_drive___c:__could_not_be_found_on_this_computer.
push 0x41c2a8
call fcn.00409214
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x2d8]
add esp, 0xc
push 0x50010
push edx
push 0x41c2a8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [esp + 0x2c]
push eax
push str.Cannot_install_agent_on_machine_because_the_target_installation_drive___c:__is_missing.
push 0x41c2a8
call fcn.00409214
mov ecx, dword [esp + 0x18]
push 0x41c2a8
push 0xffffffffffffffe2
push 3
push 3
push ecx
call fcn.00408840
mov ebx, dword [esp + 0x3c]
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x3c]
lea esi, [esp + 0x38]
call fcn.004033c0
add esp, 0x28
mov eax, 0xffffffe2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x4c8]
push 0x5c
push ecx
call fcn.00409400
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x405659
mov eax, dword [0x41c0a0]
test eax, eax
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x4055e6
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], ebx
mov edx, dword [esp + 0xc]
push str.Failed_to_locate_the_installation_name_for_scheduling.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x40562f
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x40562f
mov eax, dword [eax + 0x2d8]
push 0x50010
push eax
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_name_of_the_installation_file_was_not_found.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, 0xffffffe4
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc ebx
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x190]
mov byte [esp + eax + 0x298], cl
inc eax
test cl, cl
jne 0x405660
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405677
lea edi, [esp + 0x298]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405688
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
lea eax, [esp + 0x29c]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x4d0]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x41c0a0]
test eax, eax
mov dword [0x41b088], 1
mov dword [0x41c0a4], 0x65
je 0x4056ec
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41c0a0], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x405715
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0xc]
xor eax, eax
mov dword [edx + 0x98], 1
mov ecx, 0x208
mov edi, 0x41c2a8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
push eax
push ebx
push str._s__s
push 0x41c2a8
call fcn.00409214
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0x41c2a8
lea ecx, [esp + 0x2b4]
push ecx
push edx
call fcn.00407260
add esp, 0x24
test eax, eax
mov dword [esp + 0x18], eax
je 0x4057b4
push str.Local_copy_of_the_installation_package_could_not_be_accessed.
push eax
mov eax, dword [esp + 0x14]
push 3
push 1
push eax
call fcn.00408840
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x4057b4
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4057b4
mov ecx, dword [eax + 0x2d8]
push 0x50010
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nthe_local_copy_of_the_installation_package_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.004033c0
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [str.Kaseya_Virtual_System_Administrator_Agent_Setup]
push 0x50010
push ecx
push str.Installation_of_the_Virtual_System_Administrator_Agent_failed_because_nanother_instance_of_this_installation_package_is_already_running.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp edi, ebx
je 0x40580f
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
push edx
call fcn.00406e20
lea eax, [esp + 0x54]
push eax
call fcn.00408010
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10