Function at 0x405fe0
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Get disk information
Get file attributes
Get session user name
Query environment variable
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1abc
call fcn.0040d080
xor eax, eax
mov byte [esp + 0x5ec], al
push ebx
mov byte [esp + 0x2b8], al
push esi
push edi
mov ecx, 0x41
lea edi, [esp + 0x1b9]
mov byte [esp + 0x1b8], 0
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5f9]
rep stosd dword es:[edi], eax
mov ecx, 0x45
lea edi, [esp + 0x2c1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x4e0], 0
mov ecx, 0x45
lea edi, [esp + 0x4e1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x12b8], 0
mov ecx, 0x202
lea edi, [esp + 0x12b9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x4a], eax
xor esi, esi
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov ecx, 0x80
mov edi, 0x420090
mov word [esp + 0x56], ax
rep stosd dword es:[edi], eax
mov eax, dword [str.Kaseya_Agent]
cmp eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], esi
mov word [esp + 0x48], si
mov dword [esp + 0x5c], 0x4177ec
mov dword [esp + 0x60], str.KaUsrTsk.exe
mov dword [esp + 0x64], str.KaUpdHlp.exe
mov dword [esp + 0x68], str.kPrtPng.exe
mov dword [esp + 0x6c], str.psapi.dll
mov dword [esp + 0x70], str.sporder.dll
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
je 0x406135
cmp byte [eax], 0
je 0x406135
push 0x1f6
push eax
push 0x420090
call fcn.0040c810
mov edi, 0x420090
add esp, 0xc
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406110
mov ecx, dword [str._Setup]
mov dx, word [0x41a27c]
mov al, byte [0x41a27e]
mov dword [edi], ecx
mov word [edi + 4], dx
mov byte [edi + 6], al
jmp 0x40617b
mov ecx, dword [0x41a264]
mov edx, dword [0x41a268]
mov eax, dword [0x41a26c]
mov dword [0x420090], ecx
mov ecx, dword [0x41a270]
mov dword [0x420094], edx
mov dx, word [0x41a274]
mov dword [0x420098], eax
mov al, byte [0x41a276]
mov dword [0x42009c], ecx
mov word [0x4200a0], dx
mov byte [0x4200a2], al
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x3d8]
rep stosd dword es:[edi], eax
push 0x105
lea ecx, [esp + 0x3dc]
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x4061f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_modules_current_location_could_not_be_determined.
push 0x41f668
mov dword [esp + 0x30], eax
call fcn.0040c706
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405940
mov eax, dword [esp + 0x38]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406200
sub eax, edx
add eax, 0x80a
push eax
call fcn.0040c2e2
mov ebx, eax
add esp, 4
cmp ebx, esi
mov dword [esp + 0x14], ebx
jne 0x40624b
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x3d8]
push 0x41a1f4
push eax
call fcn.0040c668
mov esi, eax
add esp, 8
test esi, esi
jne 0x406334
call fcn.0040c96d
cmp dword [eax], 2
jne 0x4062ea
call fcn.00401ce0
test eax, eax
je 0x4062ea
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4062ea
push str.Wow64DisableWow64FsRedirection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ebx, ebx
mov dword [esp + 0x24], eax
je 0x4062df
test eax, eax
je 0x4062df
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
je 0x4062df
lea edx, [esp + 0x3d8]
push 0x41a1f4
push edx
call fcn.0040c668
mov esi, eax
mov eax, dword [esp + 0x24]
add esp, 8
push eax
call dword [esp + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp + 0x14]
test esi, esi
jne 0x406334
call fcn.0040c96d
mov ecx, dword [eax]
push ecx
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0x41f668
call fcn.0040c706
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405940
add esp, 0x14
call fcn.0040c96d
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 2
push 0xfffff800
push esi
call fcn.0040c5c3
push esi
push 0x800
lea ecx, [esp + 0x12cc]
push 1
push ecx
call fcn.0040c1ef
add esp, 0x1c
cmp eax, 0x800
je 0x4063a6
call fcn.0040c96d
mov edx, dword [eax]
push edx
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_embedded_arguments_could_not_be_read_from_the_package.
push 0x41f668
call fcn.0040c706
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x1c]
mov ebx, esi
push ecx
lea edi, [esp + 0x28]
lea esi, [esp + 0x24]
call fcn.00405940
add esp, 0x14
call fcn.0040c96d
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x201
push 0x420298
push esi
call fcn.00405b10
mov edi, eax
push esi
mov dword [esp + 0x2c], edi
call fcn.0040c340
add esp, 0x10
test edi, edi
je 0x4063da
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
jmp 0x407de3
lea ecx, [esp + 0x18]
push ecx
push 0x420298
call fcn.00405c60
mov edx, dword [ebp + 0x10]
push edx
lea eax, [esp + 0x12c4]
push eax
push str._s__s
push ebx
call fcn.0040c706
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.0040a080
add esp, 0x20
test eax, eax
mov dword [esp + 0x1c], eax
je 0x406454
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x407df3
push eax
call fcn.0040bf42
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.KaseyaClientSetupSingleInstance
push 1
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
call ebx
cmp eax, 0xb7
je 0x406483
cmp eax, 5
je 0x406483
test edi, edi
jne 0x4064c1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.KaseyaClientSetupSingleInstance
push 1
push 0
call esi
mov esi, eax
mov dword [esp + 0x10], esi
call ebx
cmp eax, 0xb7
mov dword [esp + 0x24], eax
je 0x408929
cmp eax, 5
je 0x408929
test esi, esi
je 0x408929
push 0x420298
lea ecx, [esp + 0xebc]
push str.Server_address:__s
push ecx
call fcn.0040c706
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xec4]
push edx
push 0
push 1
push 3
push eax
call fcn.0040bdd0
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0x324]
add esp, 0x20
test eax, eax
je 0x4065a6
mov cl, byte [eax]
test cl, cl
je 0x4065a6
cmp cl, 0x22
jne 0x406522
cmp byte [eax + 2], 0x3a
jne 0x406528
cmp cl, cl
je 0x4065a6
cmp byte [eax + 1], 0x3a
je 0x4065a6
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406557
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406557
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_the_specified_install_path_does_not_contain_a_drive_letter_designator.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0xc]
push str.Installation_package_failed_to_install_due_to_missing_drive_letter_specification_in_the_installation_path.
push 0xfffffffffffffff7
push 3
push 1
push edx
call fcn.0040bdd0
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x24]
push edx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405940
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x406598
push eax
call fcn.0040bf42
add esp, 4
mov eax, 0xfffffff7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edx + 0x31c]
test eax, eax
je 0x406605
cmp byte [eax], 0
je 0x406605
xor eax, eax
mov ecx, 0x80
mov edi, 0x420090
rep stosd dword es:[edi], eax
mov eax, dword [edx + 0x31c]
push 0x1f6
push eax
push 0x420090
call fcn.0040c810
mov edi, 0x420090
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4065e2
mov ecx, dword [str._Setup]
mov dx, word [0x41a27c]
mov al, byte [0x41a27e]
mov dword [edi], ecx
mov word [edi + 4], dx
mov byte [edi + 6], al
mov eax, 0x420090
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406610
sub eax, edx
add eax, 2
push eax
call fcn.0040c2e2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x320], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x320]
add esp, 4
test edx, edx
jne 0x4066be
mov ecx, dword [eax + 0x260]
test ecx, ecx
je 0x40666f
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x40666f
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_of_memory_allocation_failure.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Installation_package_failed_during_memory_allocation.
push 0xfffffffffffffff3
push 3
push 1
push eax
call fcn.0040bdd0
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x24]
push eax
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405940
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x4066b0
push eax
call fcn.0040bf42
add esp, 4
mov eax, 0xfffffff3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x420090
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4066c3
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x3d8]
rep stosd dword es:[edi], eax
push 0x105
lea ecx, [esp + 0x3dc]
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esp + 0xc]
test eax, eax
mov eax, dword [edx + 0x25c]
jg 0x406794
test eax, eax
jne 0x40679c
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406739
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406739
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_determine_its_name_or_location.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call ebx
mov edx, dword [esp + 0xc]
push str.Installation_package_could_not_determine_its_name_or_location.
push eax
push 3
push 1
push edx
mov dword [esp + 0x30], eax
call fcn.0040bdd0
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405940
mov eax, dword [esp + 0x34]
add esp, 0x1c
test eax, eax
je 0x407df3
push eax
call fcn.0040bf42
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x406822
lea eax, [esp + 0x3d8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4067a6
sub eax, esi
dec eax
js 0x4067c6
mov cl, byte [esp + eax + 0x3d8]
cmp cl, 0x5c
je 0x4067c6
cmp cl, 0x3a
je 0x4067c6
dec eax
jns 0x4067b2
mov ecx, dword [edx + 0x258]
test ecx, ecx
jne 0x4067e7
mov edx, dword [edx + 0x318]
push edx
lea eax, [esp + eax + 0x3dd]
push eax
call fcn.00404a80
add esp, 8
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406814
push eax
call fcn.0040bf42
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [edx + 0x328]
test al, al
jne 0x406883
mov eax, dword [edx + 0x260]
test eax, eax
je 0x406857
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x406857
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_doesnt_have_valid_instance_ID.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call ebx
push str.Installation_package_doesnt_have_valid_instance_ID.
push eax
push 3
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push 1
push eax
call fcn.0040bdd0
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x24]
push edx
jmp 0x406760
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x406950
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 1
jne 0x4068db
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4068db
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4068c8
push 0x50010
push 0x420090
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator__or_download_WinSock2_for_Windows_95_at_nhttp:__www.microsoft.com_windows95_downloads_contents_wuadmintools_s_wunetworkingtools_w95sockets2_default.asp___nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call ebx
push eax
mov eax, dword [esp + 0x14]
push 3
push 1
push eax
jmp 0x40690d
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4068fc
push 0x50010
push 0x420090
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call ebx
mov ecx, dword [esp + 0x10]
push eax
push 3
push 1
push ecx
call fcn.0040bdd0
add esp, 0x14
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406942
push eax
call fcn.0040bf42
add esp, 4
mov eax, 0xffffffe6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x14]
cmp ecx, 1
jne 0x4069b7
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x406a3e
push eax
call fcn.004057c0
add esp, 4
test eax, eax
je 0x406a3e
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4069ac
push eax
call fcn.0040bf42
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 2
je 0x406a3e
push str.Unknown_operating_system_version.
push 0xffffffffffffffe7
push 2
push 3
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x24c]
add esp, 0x14
test ecx, ecx
jne 0x406a3e
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x406a03
push 0x50010
push 0x420090
push str.The_Agent_cannot_be_installed_because_this_installation_nprogram_cannot_determine_the_which_OS_is_on_this_system._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x406a30
push eax
call fcn.0040bf42
add esp, 4
mov eax, 0xffffffe7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1b8]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x1bc]
push edx
push str.TEMP
stosb byte es:[edi], al
call esi
test eax, eax
jle 0x406af4
cmp eax, 0x104
jae 0x406af4
mov al, byte [esp + 0x1b8]
test al, al
je 0x406af4
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406a90
sub eax, edx
cmp byte [esp + eax + 0x1b7], 0x5c
jne 0x406ac0
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406ab0
sub eax, edx
mov byte [esp + eax + 0x1b7], cl
lea eax, [esp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406af4
test al, 0x10
je 0x406af4
lea edi, [esp + 0x1b8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406ae0
mov cx, word [0x4177a4]
mov word [edi], cx
jmp 0x406b05
xor eax, eax
lea edi, [esp + 0x1b8]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [esp + 0x1b8]
test al, al
jne 0x406bb9
push 0x104
lea edx, [esp + 0x1bc]
push edx
push 0x419abc
call esi
test eax, eax
jle 0x406ba8
cmp eax, 0x104
jae 0x406ba8
mov al, byte [esp + 0x1b8]
test al, al
je 0x406ba8
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b48
sub eax, edx
cmp byte [esp + eax + 0x1b7], 0x5c
jne 0x406b75
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b65
sub eax, edx
mov byte [esp + eax + 0x1b7], cl
lea eax, [esp + 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406ba8
test al, 0x10
je 0x406ba8
lea edi, [esp + 0x1b8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406b94
mov cx, word [0x4177a4]
mov word [edi], cx
jmp 0x406bb9
xor eax, eax
lea edi, [esp + 0x1b8]
mov ecx, 0x41
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edx, dword [esp + 0xc]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x700]
rep stosd dword es:[edi], eax
add edx, 0x328
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x8a4]
push str.SOFTWAREKaseyaAgent_s
push eax
mov dword [esp + 0x2c], 0x105
call fcn.0040c706
lea ecx, [esp + 0x30]
push ecx
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x38]
lea ebx, [esp + 0x718]
lea eax, [esp + 0x8b8]
call fcn.00404f70
add esp, 0x18
test eax, eax
jne 0x406c40
mov edx, dword [esp + 0xc]
push str.An_Agent_with_same_instance_ID_is_already_installed.
push eax
push 1
push 3
push edx
mov dword [esp + 0x44], 1
mov dword [esp + 0x3c], eax
call fcn.0040bdd0
add esp, 0x14
mov edi, dword [esp + 0x18]
test edi, edi
mov ebx, 1
je 0x406ce0
cmp byte [edi], 0
mov esi, edi
je 0x406cae
jmp 0x406c60
push str.Legacy
push esi
call fcn.0040c75e
add esp, 8
test eax, eax
je 0x406c8b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c77
sub eax, edx
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x406c60
jmp 0x406cae
mov eax, dword [esp + 0xc]
push str.Legacy_agent_is_installed_and_connects_to_the_same_server.
push 0
push ebx
push 3
push eax
call fcn.0040bdd0
add esp, 0x14
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x250]
test ecx, ecx
je 0x406cd7
push str.An_exisiting_agent_already_connects_to_the_same_server.
push 0
push ebx
push 3
push eax
call fcn.0040bdd0
add esp, 0x14
mov dword [esp + 0x28], 0
push edi
call fcn.0040bf42
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x406e45
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x244]
test ecx, ecx
jne 0x406d64
mov ecx, dword [eax + 0x248]
test ecx, ecx
je 0x4070ac
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4070ac
push 0x50024
push 0x420090
push str.The_Agent_is_already_installed._nDo_you_want_to_reinstall_the_Agent_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
mov ecx, dword [esp + 0xc]
jne 0x406d5e
push str.Re_installation_of_the_Agent_was_stopped_by_the_user.
push 0xffffffffffffffe3
push 1
push 3
push ecx
call fcn.0040bdd0
add esp, 0x14
push 0x50040
push 0x420090
push str.Installation_of_the_Agent_stopped.
jmp 0x4070e6
mov dword [ecx + 0x244], ebx
xor eax, eax
jmp 0x406d70
mov cl, byte [esp + eax + 0x700]
mov byte [esp + eax + 0x9a8], cl
inc eax
test cl, cl
jne 0x406d70
lea ecx, [esp + 0x9a8]
push 0x5c
push ecx
call fcn.0040c940
add esp, 8
test eax, eax
je 0x406d9d
mov byte [eax + 1], 0
mov dword [esp + 0x20], 6
xor ebx, ebx
jmp 0x406db0
xor eax, eax
jmp 0x406dc0
mov cl, byte [esp + eax + 0x9a8]
mov byte [esp + eax + 0x700], cl
inc eax
test cl, cl
jne 0x406dc0
mov eax, dword [esp + ebx*4 + 0x5c]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406de0
lea edi, [esp + 0x700]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406df1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x700]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406e33
test al, 3
je 0x406e33
push 0x80
lea eax, [esp + 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x20]
inc ebx
cmp ebx, eax
jl 0x406db0
mov ebx, 1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x406eda
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x44], edx
mov eax, dword [eax + 0x31c]
push 0
lea edx, [esp + 0x44]
push edx
push 0x405480
push 0
push 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], ebx
call fcn.0040cab8
mov edi, eax
add esp, 0x18
test edi, edi
je 0x406eda
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebx
mov eax, dword [esp + 0x44]
test eax, eax
mov esi, 0xc8
je 0x406ece
cmp esi, 0x3a98
jge 0x406ece
push 0xa
call ebx
mov eax, dword [esp + 0x44]
add esi, 0xa
test eax, eax
jne 0x406eb7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
xor eax, eax
mov ecx, 0x28a
mov edi, 0x41f668
rep stosd dword es:[edi], eax
push 0xa27
lea eax, [esp + 0x3dc]
push eax
push 0x41f668
mov dword [0x41f464], 0xf
call fcn.0040c810
push 0x419964
push 0x41f668
call fcn.00408b40
xor esi, esi
add esp, 0x14
cmp eax, esi
je 0x408706
push 0x41f668
mov byte [eax + 2], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x408706
cmp eax, esi
je 0x408706
lea ecx, [esp + 0x3d8]
push str.Temporary_Internet_Files
push ecx
call fcn.00408b40
add esp, 8
test eax, eax
je 0x406f7a
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x406f7a
cmp dword [eax + 8], 4
jne 0x406f7a
cmp dword [eax + 0x98], esi
je 0x408706
lea edx, [esp + 0x3d8]
push 0x41a1f4
push edx
call fcn.0040c668
mov edi, eax
add esp, 8
cmp edi, esi
mov dword [esp + 0x18], edi
jne 0x407118
call fcn.0040c96d
cmp dword [eax], 2
jne 0x40701e
call fcn.00401ce0
test eax, eax
je 0x40701e
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40701e
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebx
push str.Wow64RevertWow64FsRedirection
push esi
mov edi, eax
call ebx
test edi, edi
mov ebx, eax
je 0x40700e
test ebx, ebx
je 0x40700e
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40700e
lea ecx, [esp + 0x3d8]
push 0x41a1f4
push ecx
call fcn.0040c668
mov edx, dword [esp + 0x24]
add esp, 8
push edx
mov dword [esp + 0x1c], eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x18]
mov ebx, 1
xor esi, esi
cmp edi, esi
jne 0x407118
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x407052
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
call fcn.0040c96d
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Installation_package_could_not_be_accessed.
push eax
push 3
push ebx
push ecx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x40709b
cmp dword [eax + 0x258], esi
jne 0x40709b
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
jmp 0x408019
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0xffffffffffffffe3
push ebx
push 3
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x258]
add esp, 0x14
test ecx, ecx
jne 0x4070ee
mov ecx, dword [eax + 0x250]
test ecx, ecx
jne 0x4070ee
push 0x50040
push 0x420090
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
mov eax, 0xffffffe3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x78]
push ecx
push edi
call fcn.0040b540
lea edx, [esp + 0x80]
push edx
push edi
call fcn.0040b5c0
add esp, 0x10
test eax, eax
jge 0x4071be
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x407166
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
call fcn.0040c96d
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Failed_to_read_setup_file_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x4071af
cmp dword [eax + 0x258], esi
jne 0x4071af
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_read_from_the_installation_package.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x408015
lea ecx, [esp + 0xa0]
push str.KAgentSilent.exe
push ecx
call fcn.0040c75e
add esp, 8
test eax, eax
je 0x407251
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x407201
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
call fcn.0040c96d
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.Failed_to_find_setup_file_from_the_installation_package.
push edx
push 3
push ebx
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x40800b
cmp dword [eax + 0x258], esi
jne 0x40800b
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push esi
jmp 0x408005
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
test cl, cl
jne 0x407261
lea edi, [esp + 0x2c0]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407280
mov eax, dword [str.KAgentSilent.exe]
mov ecx, dword [0x4197b8]
mov edx, dword [0x4197bc]
mov dword [edi], eax
mov eax, dword [0x4197c0]
mov dword [edi + 4], ecx
mov cl, byte [0x4197c4]
mov dword [edi + 8], edx
lea edx, [esp + 0x2c0]
mov dword [edi + 0xc], eax
push 0x419700
push edx
mov byte [edi + 0x10], cl
call fcn.0040c668
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x4073a0
lea eax, [esp + 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40731e
test al, 3
je 0x40731e
push 0x80
lea ecx, [esp + 0x2c4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x2c0]
push 0x419700
push edx
call fcn.0040c668
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x4073a0
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x407348
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
call fcn.0040c96d
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, esi
je 0x407391
cmp dword [eax + 0x258], esi
jne 0x407391
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x408015
mov ecx, 0x28a
xor eax, eax
mov edi, 0x41f668
rep stosd dword es:[edi], eax
mov edi, edi
mov cl, byte [eax + str.KAgentSilent.exe]
mov byte [eax + 0x41f668], cl
inc eax
test cl, cl
jne 0x4073b0
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x258], ebx
jne 0x4073e3
mov edi, 0x41f668
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4073d3
mov ecx, dword [0x419644]
mov dword [edi], ecx
mov eax, 0x41f668
lea edx, [eax + 1]
jmp 0x4073f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4073f0
sub eax, edx
lea edx, [esi + 0x135]
push edx
add esi, 0x328
push esi
lea eax, [eax + 0x41f668]
push str.__a__k__g__s__l___s_
push eax
call fcn.0040c706
mov esi, dword [esp + 0x1c]
mov al, byte [esi + 0x3dc]
lea ecx, [esi + 0x3dc]
add esp, 0x10
test al, al
je 0x407459
mov eax, 0x41f668
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407437
push ecx
sub eax, esi
lea ecx, [eax + 0x41f668]
push str.__v___s_
push ecx
call fcn.0040c706
mov esi, dword [esp + 0x18]
add esp, 0xc
mov al, byte [esi + 0x33d]
test al, al
lea edx, [esi + 0x33d]
je 0x407493
mov eax, 0x41f668
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407471
push edx
sub eax, esi
lea edx, [eax + 0x41f668]
push str.__o___s_
push edx
call fcn.0040c706
mov esi, dword [esp + 0x18]
add esp, 0xc
mov al, byte [esi + 0x370]
test al, al
lea edx, [esi + 0x370]
je 0x4074d2
mov eax, 0x41f668
lea esi, [eax + 1]
jmp 0x4074b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4074b0
push edx
sub eax, esi
lea eax, [eax + 0x41f668]
push str.__p___s_
push eax
call fcn.0040c706
mov esi, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4074f8
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4074f8
mov edi, 0x41f668
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074e8
mov ecx, dword [0x419604]
mov dword [edi], ecx
mov eax, dword [esi + 0x3d8]
test eax, eax
je 0x407518
mov edi, 0x41f668
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407508
mov edx, dword [0x419600]
mov dword [edi], edx
mov eax, dword [esi + 0x3f8]
test eax, eax
je 0x407537
mov edi, 0x41f668
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407528
mov eax, dword [0x4195fc]
mov dword [edi], eax
mov dword [esp + 0x34], 0x5c3a43
mov eax, dword [esi + 0x324]
test eax, eax
je 0x4075be
push 0x3a
push eax
call fcn.0040cfc0
add esp, 8
test eax, eax
je 0x407571
mov al, byte [eax - 1]
cmp al, 0x61
mov byte [esp + 0x34], al
jl 0x407571
cmp al, 0x7a
jg 0x407571
and al, 0xdf
mov byte [esp + 0x34], al
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx + 0x324]
cmp byte [esi], 0x22
mov eax, 0x41f668
lea edx, [eax + 1]
je 0x4075a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407588
push esi
sub eax, edx
push str.__d___s_
lea edx, [eax + 0x41f668]
push edx
jmp 0x4075b6
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4075a0
push esi
sub eax, edx
push str.__d__s
lea eax, [eax + 0x41f668]
push eax
call fcn.0040c706
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40867e
test al, 0x10
je 0x40867e
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1b4]
push edi
push edx
mov ebx, 1
push ebx
push eax
mov dword [esp + 0x3c], 0x258
call fcn.0040c0ba
push edi
mov esi, eax
call fcn.0040c340
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp esi, eax
je 0x4076a7
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x40764c
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], 0
call fcn.0040c96d
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407698
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407698
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
jmp 0x408015
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b5c0
add esp, 8
test eax, eax
jge 0x407742
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x4076f1
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], 0
call fcn.0040c96d
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407698
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407698
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x407690
lea edx, [esp + 0xa0]
push str.KaseyaD.ini
push edx
call fcn.0040c75e
add esp, 8
test eax, eax
je 0x4077ea
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x40778f
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], 0
call fcn.0040c96d
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push str.Failed_to_find_configuration_file_from_the_installation_package.
push eax
push 3
push ebx
push ecx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x4077db
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x4077db
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x10]
push eax
jmp 0x408015
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x5f8], cl
inc eax
test cl, cl
jne 0x4077f0
lea edi, [esp + 0x5f8]
dec edi
jmp 0x407810
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407810
mov ecx, dword [str.KaseyaD.ini]
mov edx, dword [0x419518]
mov eax, dword [0x41951c]
mov dword [edi], ecx
lea ecx, [esp + 0x5f8]
mov dword [edi + 4], edx
push 0x419700
push ecx
mov dword [edi + 8], eax
call fcn.0040c668
mov esi, eax
add esp, 8
test esi, esi
jne 0x4078f1
lea edx, [esp + 0x5f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407895
test al, 3
je 0x407895
push 0x80
lea eax, [esp + 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x5f8]
push 0x419700
push ecx
call fcn.0040c668
mov esi, eax
add esp, 8
test esi, esi
jne 0x4078f1
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x64
call fcn.0040c96d
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push 1
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407981
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407981
push 0x50010
jmp 0x40796f
mov eax, dword [esp + 0x1a8]
mov ecx, dword [esp + 0x1b4]
push esi
push eax
push 1
push ecx
call fcn.0040c0ba
push esi
mov edi, eax
call fcn.0040c340
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp edi, eax
je 0x4079af
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x64
call fcn.0040c96d
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push 1
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407981
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407981
push 0x10
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
call fcn.0040c96d
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x5f8]
push eax
push ecx
mov dword [0x41e2f0], 0x1f4
mov dword [0x41f464], 0x5f
call fcn.0040a490
add esp, 8
cmp eax, 0xfffffffe
mov dword [esp + 0x1c], eax
je 0x407a3d
cmp eax, 0xffffffe9
je 0x407a3d
test eax, eax
je 0x407a3d
mov edx, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_accessed.
push eax
push 3
push 3
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x407dd5
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407dd5
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_contents_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407dd5
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 2
jne 0x407af9
cmp dword [eax + 8], 4
jb 0x407af9
mov ecx, dword [eax + 0x98]
test ecx, ecx
jne 0x407af9
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x2c0]
push 0x117
lea edx, [esp + 0x3dc]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x2c8]
push eax
call fcn.0040c810
mov edx, dword [esp + 0x18]
xor eax, eax
mov ecx, 0x28a
mov edi, 0x41f668
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
push ecx
add edx, 0x135
push edx
lea eax, [esp + 0x2d4]
push eax
push str._s__l__s__s
push 0x41f668
call fcn.0040c706
mov esi, dword [esp + 0x30]
xor ebx, ebx
add esp, 0x20
test esi, esi
mov dword [esp + 0x2c], ebx
je 0x407c93
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407c93
mov ecx, dword [esp + 0x28]
xor esi, esi
cmp ecx, esi
jne 0x407b0f
cmp dword [eax + 0x240], esi
je 0x407c89
cmp dword [eax + 0x23c], esi
je 0x407c89
push esi
push eax
call fcn.0040b940
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004048e0
add esp, 0xc
cmp eax, esi
je 0x407c00
cmp eax, 0xffffffff
jne 0x407bbd
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41f464], 0x65
je 0x407b64
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
mov edx, dword [esp + 0xc]
push str.User_canceled_the_installation.
push 0xffffffffffffffff
push 1
push 3
push edx
call fcn.0040bdd0
add esp, 0x14
push 0x50040
push 0x420090
push str.Installation_of_the_Agent_terminated_because_nthe_required_configuration_parameters_were_not_entered.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esp + 0xc]
push str.Configuration_parameters_are_missing_and_the__s_switch_was_used.
push eax
push 1
push 3
push edx
call fcn.0040bdd0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405940
add esp, 0x1c
mov eax, 0xffffffed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x5f8]
push edx
push eax
call fcn.0040b0d0
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x407c93
mov ecx, dword [esp + 0xc]
push str.Installation_of_the_Agent_terminated.
push eax
push 1
push 3
push ecx
call fcn.0040bdd0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x258]
add esp, 0x14
cmp eax, esi
jne 0x407dd5
mov eax, dword [0x41f460]
cmp eax, esi
mov dword [0x41f464], 0x65
je 0x407c6e
push esi
push esi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], esi
push 0x50040
push 0x420090
push str.Installation_of_the_Agent_terminated_because_nthe_configuration_could_not_be_updated.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407dd5
push esi
push eax
call fcn.0040b940
add esp, 8
xor edi, edi
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
push edx
push ebx
push 0x41f668
lea eax, [esp + 0x2cc]
push eax
push ecx
call fcn.0040a7e0
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffec
mov dword [esp + 0x1c], esi
jne 0x407cd3
cmp edi, 4
jge 0x407cef
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x407c95
cmp esi, 0xfffffff4
jne 0x407cef
mov edx, dword [esp + 0xc]
push edx
call fcn.00404970
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
je 0x407c95
mov esi, eax
mov eax, dword [esp + 0xc]
push str.Installation_process_returned.
push esi
push 1
push 3
push eax
call fcn.0040bdd0
add esp, 0x14
test esi, esi
je 0x407ead
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x65
je 0x407d42
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x260]
test ecx, ecx
je 0x407e77
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x407e77
cmp esi, 1
jne 0x407e00
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x54]
movzx ecx, word [esp + 0x56]
mov eax, 0x3b
sub eax, edx
imul eax, eax, 0x3e8
add eax, ecx
cmp eax, 0x2710
jae 0x407d9d
mov eax, 0x2710
jmp 0x407da9
cmp eax, 0xd6d8
jbe 0x407da9
mov eax, 0xd6d8
mov edx, dword [esp + 0xc]
push 0
push eax
push str.The_Agent_installation_has_been_scheduled._n_nPlease_wait_up_to_one_minute_for_the_installation_to_proceed.
push edx
call fcn.004049e0
mov eax, dword [esp + 0x1c]
add esp, 0x10
push str.The_installation_package_is_re_running_under_an_authorized_account
push esi
push 1
push 3
push eax
call fcn.0040bdd0
add esp, 0x14
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
lea ecx, [esp + 0xc]
push eax
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 0xffffffec
jne 0x407e2a
push 0x50040
push 0x420090
push str.The_installation_package_containing_the_Agent_failed_to_run_nbecause_the_Windows_NT_Task_Scheduler_is_not_running.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.The_installation_package_containing_the_Agent_failed_to_run.
push esi
push 3
jmp 0x407dca
cmp esi, 0xffffffff
jne 0x407e57
push 0x50040
push 0x420090
push str.Installation_of_the_Agent_terminated_because_nthe_required_credentials_were_missing_or_incorrect._User_cancelled_the_nthe_installation..
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
jmp 0x407dca
cmp esi, 2
je 0x407e77
push 0x50010
push 0x420090
push str.The_installation_package_containing_the_Agent_failed_to_run.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
cmp esi, 1
je 0x407dc2
cmp esi, 2
je 0x407dc2
cmp esi, 0xffffffed
jne 0x407e9b
push str.The_credentials_contained_in_the_installation_package_were_incorrect_or_missing._Agent_failed_to_run.
push esi
push 3
jmp 0x407dca
cmp esi, 0xffffffff
jne 0x407e20
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push esi
push 3
jmp 0x407dca
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x700]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
push edx
stosw word es:[edi], ax
push str.ConfigurationFile
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x70c]
lea eax, [esp + 0x8ac]
mov dword [0x41e2f0], 0x64
mov dword [0x41f464], 0x63
mov dword [esp + 0x2c], 0x105
call fcn.00404f70
mov esi, eax
xor edi, edi
add esp, 0xc
cmp esi, edi
mov ebx, 1
jne 0x4085e6
cmp dword [esp + 0x24], ebx
jne 0x4085e6
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4085e6
cmp eax, 0x105
jae 0x4085e6
cmp dword [esp + 0x28], edi
jne 0x407f4c
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x240], edi
je 0x408039
push edi
lea ecx, [esp + 0x704]
push ecx
lea edx, [esp + 0x600]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x407f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x407f73
xor esi, esi
lea eax, [esp + 0x5f8]
push eax
call fcn.0040cf85
lea ecx, [esp + 0x2c4]
push ecx
call fcn.0040cf85
add esp, 8
cmp esi, edi
je 0x408039
mov eax, dword [0x41f460]
cmp eax, edi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x407fc2
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], edi
call fcn.0040c96d
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
push str.The_configuration_file_could_not_be_moved_to_the_installation_directory.
push edx
push 3
push ebx
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x40800b
cmp dword [eax + 0x258], edi
jne 0x40800b
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_moved_to_the_installation_directory.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x10]
push edx
mov ebx, dword [esp + 0x20]
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
call fcn.0040c96d
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push str.Path
push 0x80000002
lea esi, [esp + 0x2c]
lea ebx, [esp + 0x2cc]
lea eax, [esp + 0x8ac]
mov dword [esp + 0x2c], 0x117
call fcn.00404f70
add esp, 0xc
test eax, eax
je 0x4080e7
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x258]
test eax, eax
jne 0x4080a3
push 0x50010
push 0x420090
push str.The_installation_path_for_the_Agent_cannot_be_found_n_nThe_Agent_cannot_be_started.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0xc]
push str.Cannot_launch_the_agent_because_the_path_could_not_be_found.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.0040bdd0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x30]
lea esi, [esp + 0x2c]
call fcn.00405940
add esp, 0x1c
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
xor eax, eax
jmp 0x4080f0
mov cl, byte [esp + eax + 0x2c0]
mov byte [esp + eax + 0x1b8], cl
inc eax
cmp cl, bl
jne 0x4080f0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b5c0
add esp, 8
test eax, eax
jne 0x40831f
lea ecx, [ecx]
xor eax, eax
mov ecx, 0x46
lea edi, [esp + 0x4e0]
rep stosd dword es:[edi], eax
cmp byte [esp + 0xa0], 0x5c
je 0x4081c8
cmp byte [esp + 0xa1], 0x3a
je 0x4081c8
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x4e0], cl
inc eax
cmp cl, bl
jne 0x408150
lea eax, [esp + 0x4e0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408170
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x4e4]
push 0x4177a4
push edx
call fcn.0040ce50
lea eax, [esp + 0x4ec]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4081a0
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x4e8]
push eax
call fcn.0040ce50
jmp 0x4081e2
push 0x117
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x4e8]
push edx
call fcn.0040c810
lea eax, [esp + 0x4ec]
add esp, 0xc
push eax
call fcn.00408e70
lea ecx, [esp + 0x4e4]
push 0x419700
push ecx
call fcn.0040c668
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x408269
lea edx, [esp + 0x4e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x408252
test al, 3
je 0x408252
push 0x80
lea eax, [esp + 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x4e0]
push 0x419700
push ecx
call fcn.0040c668
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x408269
lea edx, [esp + 0x4e0]
push edx
push str.WARNING:_Unable_to_open_the_file__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea eax, [esp + 0xab8]
push eax
jmp 0x4082b0
mov edx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1b4]
push esi
push edx
push 1
push eax
call fcn.0040c0ba
push esi
mov edi, eax
call fcn.0040c340
mov eax, dword [esp + 0x1bc]
add esp, 0x14
cmp edi, eax
je 0x408305
lea ecx, [esp + 0x4e0]
push ecx
push str.WARNING:_Unable_to_write_the_file_content_to__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea edx, [esp + 0xab8]
push edx
call fcn.0040c706
call fcn.0040c96d
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xabc]
push ecx
push edx
push 3
push 1
push eax
call fcn.0040bdd0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x260]
add esp, 0x20
cmp ecx, ebx
je 0x408305
cmp dword [eax + 0x258], ebx
jne 0x408305
push 0x50010
push 0x420090
lea ecx, [esp + 0xab8]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.0040b5c0
add esp, 8
test eax, eax
je 0x408120
cmp dword [esp + 0x28], ebx
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x64
je 0x4084d3
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x264], ebx
je 0x40839c
push 4
lea edx, [esp + 0x5c]
push edx
push 4
push str.EnableRemoteControl
lea eax, [esp + 0x8b0]
push eax
push 0x80000002
mov dword [esp + 0x70], ebx
call fcn.00408c60
add esp, 0x18
cmp eax, ebx
jne 0x408385
mov ecx, dword [esp + 0xc]
push str.Disabled_remote_control.
push eax
push 1
push 3
push ecx
jmp 0x408394
mov edx, dword [esp + 0xc]
push str.Failed_to_disable_remote_control.
push eax
push 2
push 3
push edx
call fcn.0040bdd0
add esp, 0x14
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x808]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x808]
push eax
mov dword [esp + 0x80c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4084d3
cmp dword [esp + 0x818], 2
jne 0x4084d3
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0xcb8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xcbc]
push edx
mov dword [esp + 0x28], 0x1ff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4084d3
cmp byte [esp + 0xcb8], bl
je 0x4084d3
lea eax, [esp + 0xcb8]
push str.SYSTEM
push eax
call fcn.0040c75e
add esp, 8
test eax, eax
je 0x4084d3
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x2c0]
mov byte [esp + eax + 0x1b8], cl
inc eax
cmp cl, bl
jne 0x408440
lea eax, [esp + 0x2c0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408460
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x2c4]
push 0x418d34
push edx
call fcn.0040ce50
push ebx
push ebx
lea eax, [esp + 0x2d4]
push str.KaUsrTsk.exe
push eax
call fcn.004059a0
add esp, 0x1c
cmp eax, ebx
je 0x4084b5
mov ecx, dword [esp + 0xc]
push str.Failed_to_launch_the_service_helper_task.
push eax
push 3
push 3
push ecx
call fcn.0040bdd0
add esp, 0x14
xor eax, eax
jmp 0x4084c0
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
cmp cl, bl
jne 0x4084c0
lea eax, [esp + 0x2c0]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4084e0
sub eax, edx
mov edx, 0x117
sub edx, eax
push edx
lea eax, [esp + 0x2c4]
push str.AgentMon.exe
push eax
call fcn.0040ce50
mov edx, dword [esp + 0x18]
push ebx
push ebx
push str.agentmon.exe
lea ecx, [esp + 0x2d8]
push ecx
push edx
call fcn.0040a7e0
add esp, 0x20
cmp eax, ebx
je 0x40853a
push str.Cannot_launch_the_agent.
push eax
mov eax, dword [esp + 0x14]
push 3
push 3
push eax
call fcn.0040bdd0
add esp, 0x14
mov eax, dword [0x41f460]
cmp eax, ebx
mov dword [0x41f464], 0x65
je 0x40855e
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], ebx
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x260], ebx
je 0x408595
cmp dword [eax + 0x258], ebx
jne 0x408595
cmp dword [eax + 0x254], ebx
jne 0x40859d
mov ecx, dword [eax + 0x318]
push 1
push 0x7530
push ecx
push eax
call fcn.004049e0
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp dword [eax + 0x254], ebx
je 0x4085bd
call fcn.004053b0
cmp eax, ebx
je 0x4085bd
mov edx, dword [esp + 0xc]
push str.Attempt_to_reboot_the_system_failed.
push eax
push 3
push 1
push edx
call fcn.0040bdd0
add esp, 0x14
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x41f460]
cmp eax, edi
mov dword [0x41e2f0], ebx
mov dword [0x41f464], 0x65
je 0x408610
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], edi
mov edx, dword [esp + 0xc]
push str.Installation_of_the_Agent_Failed.
push esi
push 3
push ebx
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
cmp ecx, edi
je 0x408652
cmp dword [eax + 0x258], edi
jne 0x408652
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_Failed
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movsx edx, byte [esp + 0x34]
push edx
push str.Installation_of_the_Agent_failed_because_nthe_target_installation_drive___c:__could_not_be_found_on_this_computer.
push 0x41f668
call fcn.0040c706
add esp, 0xc
push 0x50010
push 0x420090
push 0x41f668
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [esp + 0x34]
push eax
push str.Cannot_install_agent_on_machine_because_the_target_installation_drive___c:__is_missing.
push 0x41f668
call fcn.0040c706
mov ecx, dword [esp + 0x18]
push 0x41f668
push 0xffffffffffffffe2
push 3
push 3
push ecx
call fcn.0040bdd0
mov ebx, dword [esp + 0x38]
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x3c]
lea esi, [esp + 0x38]
call fcn.00405940
add esp, 0x28
mov eax, 0xffffffe2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x3d8]
push 0x5c
push ecx
call fcn.0040c940
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4087c1
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x65
je 0x408750
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], ebx
mov edx, dword [esp + 0xc]
push str.Failed_to_locate_the_installation_name_for_scheduling.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x408797
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x408797
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_name_of_the_installation_file_was_not_found.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
add esp, 8
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc ebx
xor eax, eax
jmp 0x4087d0
mov cl, byte [esp + eax + 0x1b8]
mov byte [esp + eax + 0x2c0], cl
inc eax
test cl, cl
jne 0x4087d0
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087e7
lea edi, [esp + 0x2c0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4087f8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
lea edx, [esp + 0x2c4]
push edx
lea eax, [esp + 0x3e0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x41f460]
test eax, eax
mov dword [0x41e2f0], 1
mov dword [0x41f464], 0x65
je 0x40885c
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41f460], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x408885
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
push ebx
mov dword [ecx + 0x98], 1
xor eax, eax
push str._s__s
mov ecx, 0x28a
mov edi, 0x41f668
push 0x41f668
rep stosd dword es:[edi], eax
call fcn.0040c706
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0x41f668
lea eax, [esp + 0x2dc]
push eax
push ecx
call fcn.0040a7e0
add esp, 0x24
test eax, eax
mov dword [esp + 0x1c], eax
je 0x408922
mov edx, dword [esp + 0xc]
push str.Local_copy_of_the_installation_package_could_not_be_accessed.
push eax
push 3
push 1
push edx
call fcn.0040bdd0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x260]
add esp, 0x14
test ecx, ecx
je 0x408922
mov ecx, dword [eax + 0x258]
test ecx, ecx
jne 0x408922
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nthe_local_copy_of_the_installation_package_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ebx, ebx
jmp 0x407dd9
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x258]
test eax, eax
jne 0x40894e
push 0x50010
push 0x420090
push str.Installation_of_the_Agent_failed_because_nanother_instance_of_this_installation_package_is_already_running.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebx, ebx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x18]
call fcn.00405940
mov eax, dword [esp + 0x2c]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10