Function at 0x408550
Capabilities:
Check if file exists
Check mutex on windows
Check os version
Copy file
Create thread
Get common file path
Get disk information
Get file attributes
Get session user name
Query environment variable
Resolve function by parsing pe exports
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x1ffc
call fcn.004124f0
mov eax, dword [0x42cb90]
xor eax, esp
mov dword [esp + 0x1ff8], eax
mov eax, dword [esp + 0x2000]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2014]
push edi
xor ebx, ebx
push 0x104
lea ecx, [esp + 0x25d]
push ebx
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x264], bl
call fcn.0040eb90
push 0x104
lea edx, [esp + 0x6a9]
push ebx
push edx
mov byte [esp + 0x6b0], bl
call fcn.0040eb90
push 0x117
lea eax, [esp + 0x37d]
push ebx
push eax
mov byte [esp + 0x384], bl
call fcn.0040eb90
push 0x117
lea ecx, [esp + 0x5a9]
push ebx
push ecx
mov byte [esp + 0x5b0], bl
call fcn.0040eb90
push 0x809
lea edx, [esp + 0x1831]
push ebx
push edx
mov byte [esp + 0x1838], bl
call fcn.0040eb90
xor eax, eax
push 0x200
push ebx
push 0x42e910
mov dword [esp + 0x60], ebx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x58], ebx
mov word [esp + 0x90], bx
mov dword [esp + 0x92], eax
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov word [esp + 0x9e], ax
mov dword [esp + 0xa8], str.AgentMon.exe
mov dword [esp + 0xac], str.KaUsrTsk.exe
mov dword [esp + 0xb0], str.KaUpdHlp.exe
mov dword [esp + 0xb4], str.kPrtPng.exe
mov dword [esp + 0xb8], str.psapi.dll
mov dword [esp + 0xbc], str.sporder.dll
mov dword [esp + 0x64], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x74], ebx
call fcn.0040eb90
mov eax, dword [str.Kaseya_Agent]
add esp, 0x48
cmp eax, ebx
je 0x4086f8
cmp byte [eax], bl
je 0x4086f8
push 0x1f6
push eax
push 0x42e910
call fcn.0040f940
mov eax, 0x42e910
add esp, 0xc
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x4086d0
mov ecx, dword [str._Setup]
mov dx, word [0x426c00]
mov dword [eax], ecx
mov cl, byte [0x426c02]
mov word [eax + 4], dx
mov byte [eax + 6], cl
jmp 0x40873e
mov edx, dword [0x426be8]
mov eax, dword [0x426bec]
mov ecx, dword [0x426bf0]
mov dword [0x42e910], edx
mov edx, dword [0x426bf4]
mov dword [0x42e914], eax
mov ax, word [0x426bf8]
mov dword [0x42e918], ecx
mov cl, byte [0x426bfa]
mov dword [0x42e91c], edx
mov word [0x42e920], ax
mov byte [0x42e922], cl
call fcn.004122ef
cmp eax, 0x3a4
je 0x40875f
cmp eax, 0x3a8
je 0x40875f
cmp eax, 0x3b5
je 0x40875f
cmp eax, 0x3b6
jne 0x408784
push eax
lea edx, [esp + 0x8ac]
push 0x426be4
push edx
call fcn.0041025a
lea eax, [esp + 0x8b4]
push eax
push 2
call fcn.00411c7a
add esp, 0x14
push 0x140
lea ecx, [esp + 0x80]
push ebx
push ecx
call fcn.0040eb90
push 0x106
lea edx, [esp + 0x488]
push ebx
push edx
call fcn.0040eb90
add esp, 0x18
push 0x105
lea eax, [esp + 0x47c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jg 0x408801
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_modules_current_location_could_not_be_determined.
push 0x42dee8
call fcn.0041025a
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x20]
push edx
xor ebx, ebx
lea edi, [esp + 0x2c]
lea esi, [esp + 0x28]
call fcn.00407e40
add esp, 0x14
jmp 0x40b109
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408806
sub eax, edx
add eax, 0x80a
push eax
call fcn.0040f141
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x40884b
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
lea eax, [ebx + 0xe]
jmp 0x40b10b
lea edx, [esp + 0x478]
push 0x426b74
push edx
call fcn.0040f6c8
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40892c
call fcn.0041069a
cmp dword [eax], 2
jne 0x4088e6
call fcn.00403ac0
test eax, eax
je 0x4088e6
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4088e6
push str.Wow64DisableWow64FsRedirection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ebp, ebx
mov dword [esp + 0x28], eax
je 0x4088df
cmp eax, ebx
je 0x4088df
lea eax, [esp + 0x5c]
push eax
call ebp
test eax, eax
je 0x4088df
lea ecx, [esp + 0x478]
push 0x426b74
push ecx
call fcn.0040f6c8
mov edx, dword [esp + 0x64]
add esp, 8
push edx
mov esi, eax
call dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
jne 0x40892c
call fcn.0041069a
mov eax, dword [eax]
push eax
push str.Error__d:_Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0x42dee8
call fcn.0041025a
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x20]
push edx
xor ebx, ebx
lea edi, [esp + 0x2c]
lea esi, [esp + 0x28]
call fcn.00407e40
add esp, 0x14
call fcn.0041069a
mov eax, dword [eax]
jmp 0x40b10b
push ebx
lea eax, [esp + 0x80]
push eax
push esi
call fcn.0040de00
lea ecx, [esp + 0x88]
push ecx
push esi
call fcn.0040de80
add esp, 0x14
test eax, eax
jge 0x408978
mov ebx, esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
call fcn.0041069a
mov eax, dword [eax]
jmp 0x40b10b
mov eax, dword [esp + 0x1b8]
lea edx, [esp + 0x17fc]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
cmp cl, bl
jne 0x408988
mov ecx, dword [esp + 0x1ac]
push 0x201
add ecx, 0x130
push 0x42eb18
push esi
mov dword [0x42eb14], ecx
call fcn.00408000
push esi
mov ebp, eax
call fcn.0040f276
add esp, 0x10
cmp ebp, ebx
je 0x4089d5
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40b0f7
lea ecx, [esp + 0x1c]
push ecx
push 0x42eb18
call fcn.004081b0
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x20]
push edx
lea eax, [esp + 0x1808]
push eax
push str._s__s
push esi
call fcn.0041025a
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.0040c8c0
mov ebp, eax
add esp, 0x20
cmp ebp, ebx
je 0x408a4a
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40b109
push eax
call fcn.0040e862
add esp, 4
jmp 0x40b109
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.KaseyaClientSetupSingleInstance
push 1
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [esp + 0x14], ebp
call edi
cmp eax, 0xb7
je 0x408a78
cmp eax, 5
je 0x408a78
cmp ebp, ebx
jne 0x408ab4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.KaseyaClientSetupSingleInstance
push 1
push ebx
call esi
mov esi, eax
mov dword [esp + 0x14], esi
call edi
mov ebp, eax
cmp ebp, 0xb7
je 0x40b0cb
cmp ebp, 5
je 0x40b0cb
cmp esi, ebx
je 0x40b0cb
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [esp + 0xcfc]
push ecx
push ebx
call edi
lea edx, [esp + 0xcf8]
push edx
lea eax, [esp + 0x1000]
push str.Program_path:___s_
push eax
call fcn.0041025a
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1008]
push ecx
push ebx
push 1
push 3
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x58]
push eax
lea ecx, [esp + 0x1020]
push str.Command_line:___s_
push ecx
call fcn.0041025a
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x1028]
push edx
push ebx
push 1
push 3
push eax
call fcn.0040e6f0
add esp, 0x40
push 0x42eb18
lea ecx, [esp + 0x1000]
push str.Server_address:__s
push ecx
call fcn.0041025a
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1008]
push edx
push ebx
push 1
push 3
push eax
call fcn.0040e6f0
mov esi, dword [esp + 0x30]
add esp, 0x20
cmp dword [esi + 0x324], ebx
je 0x408c06
mov ecx, dword [esi + 0x324]
mov al, byte [ecx]
cmp al, bl
je 0x408c06
cmp al, 0x22
jne 0x408b8b
cmp byte [ecx + 2], 0x3a
jne 0x408b91
cmp al, al
je 0x408c06
cmp byte [ecx + 1], 0x3a
je 0x408c06
cmp dword [esi + 0x260], ebx
je 0x408bbb
cmp dword [esi + 0x258], ebx
jne 0x408bbb
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_the_specified_install_path_does_not_contain_a_drive_letter_designator.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x10]
push str.Installation_package_failed_to_install_due_to_missing_drive_letter_specification_in_the_installation_path.
push 0xfffffffffffffff7
push 3
push 1
push esi
call fcn.0040e6f0
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x28]
push edx
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.00407e40
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x408bfc
push eax
call fcn.0040e862
add esp, 4
mov eax, 0xfffffff7
jmp 0x40b10b
cmp dword [esi + 0x31c], ebx
je 0x408c76
mov eax, dword [esi + 0x31c]
cmp byte [eax], bl
je 0x408c76
push 0x200
push ebx
push 0x42e910
call fcn.0040eb90
mov ecx, dword [esi + 0x31c]
push 0x1f6
push ecx
push 0x42e910
call fcn.0040f940
mov eax, 0x42e910
add esp, 0x18
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x408c50
mov edx, dword [str._Setup]
mov cx, word [0x426c00]
mov dword [eax], edx
mov dl, byte [0x426c02]
mov word [eax + 4], cx
mov byte [eax + 6], dl
mov eax, 0x42e910
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408c80
sub eax, edx
add eax, 2
push eax
call fcn.0040f141
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x320], eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [eax + 0x320], ebx
jne 0x408d22
cmp dword [eax + 0x260], ebx
je 0x408cd7
cmp dword [eax + 0x258], ebx
jne 0x408cd7
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_of_memory_allocation_failure.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.Installation_package_failed_during_memory_allocation.
push 0xfffffffffffffff3
push 3
push 1
push eax
call fcn.0040e6f0
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x28]
push eax
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.00407e40
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x408d18
push eax
call fcn.0040e862
add esp, 4
mov eax, 0xfffffff3
jmp 0x40b10b
mov edx, dword [eax + 0x320]
mov ecx, 0x42e910
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x408d30
push 0x106
lea ecx, [esp + 0x47c]
push ebx
push ecx
call fcn.0040eb90
add esp, 0xc
push 0x105
lea edx, [esp + 0x47c]
push edx
push ebx
call edi
test eax, eax
mov esi, dword [esp + 0x10]
jg 0x408df7
cmp dword [esi + 0x25c], ebx
jne 0x408e03
cmp dword [esi + 0x260], ebx
je 0x408da2
cmp dword [esi + 0x258], ebx
jne 0x408da2
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_determine_its_name_or_location.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Installation_package_could_not_determine_its_name_or_location.
mov ebp, eax
mov eax, dword [esp + 0x14]
push ebp
push 3
push 1
push eax
call fcn.0040e6f0
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x28]
push edx
xor ebx, ebx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.00407e40
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x40b109
push eax
call fcn.0040e862
add esp, 4
jmp 0x40b109
cmp dword [esi + 0x25c], ebx
je 0x408e8e
lea eax, [esp + 0x478]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x408e10
sub eax, edx
add eax, 0xffffffff
cmp eax, ebx
jl 0x408e38
mov cl, byte [esp + eax + 0x478]
cmp cl, 0x5c
je 0x408e38
cmp cl, 0x3a
je 0x408e38
sub eax, 1
jns 0x408e22
cmp dword [esi + 0x258], ebx
jne 0x408e57
mov ecx, dword [esi + 0x318]
push ecx
lea edx, [esp + eax + 0x47d]
push edx
call fcn.00406ed0
add esp, 8
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x408e84
push eax
call fcn.0040e862
add esp, 4
mov eax, 3
jmp 0x40b10b
cmp byte [esi + 0x328], bl
jne 0x408eea
cmp dword [esi + 0x260], ebx
je 0x408ebc
cmp dword [esi + 0x258], ebx
jne 0x408ebc
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_doesnt_have_valid_instance_ID.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push str.Installation_package_doesnt_have_valid_instance_ID.
mov ebp, eax
push ebp
push 3
push 1
push edx
call fcn.0040e6f0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x28]
push ecx
jmp 0x408dcb
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x408fb3
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 1
jne 0x408f41
cmp dword [eax + 0xc], ebx
jne 0x408f41
cmp dword [eax + 0x258], ebx
jne 0x408f2a
push 0x50010
push 0x42e910
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator__or_download_WinSock2_for_Windows_95_at_nhttp:__www.microsoft.com_windows95_downloads_contents_wuadmintools_s_wunetworkingtools_w95sockets2_default.asp___nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push eax
push 3
push 1
push edx
jmp 0x408f74
cmp dword [eax + 0x258], ebx
jne 0x408f5f
push 0x50010
push 0x42e910
push str.The_Agent_must_be_installed_on_a_system_with_WinSock2._nThis_system_does_not_appear_to_meet_that_requirement._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Could_not_find_WinSock2.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x18]
push 3
push 1
push eax
call fcn.0040e6f0
add esp, 0x14
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x14]
push edx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x408fa9
push eax
call fcn.0040e862
add esp, 4
mov eax, 0xffffffe6
jmp 0x40b10b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
cmp ecx, 1
jne 0x409014
cmp dword [eax + 0xc], ebx
jne 0x40908e
push eax
call fcn.00407ca0
add esp, 4
test eax, eax
je 0x40908e
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x40900d
push eax
call fcn.0040e862
add esp, 4
xor eax, eax
jmp 0x40b10b
cmp ecx, 2
je 0x40908e
push str.Unknown_operating_system_version.
push 0xffffffffffffffe7
push 2
push 3
push eax
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x24c], ebx
jne 0x40908e
cmp dword [eax + 0x258], ebx
jne 0x409057
push 0x50010
push 0x42e910
push str.The_Agent_cannot_be_installed_because_this_installation_nprogram_cannot_determine_the_which_OS_is_on_this_system._nPlease_contact_your_system_administrator._nThis_installation_will_abort_now._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x409084
push eax
call fcn.0040e862
add esp, 4
mov eax, 0xffffffe7
jmp 0x40b10b
push 0x105
lea ecx, [esp + 0x25c]
push ebx
push ecx
call fcn.0040eb90
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
push 0x104
lea edx, [esp + 0x25c]
push edx
push str.TEMP
call esi
cmp eax, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jle 0x409166
cmp eax, 0x104
jae 0x409166
cmp byte [esp + 0x258], bl
je 0x409166
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4090f0
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
jne 0x409122
lea eax, [esp + 0x258]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x409110
sub eax, edx
mov byte [esp + eax + 0x257], bl
lea eax, [esp + 0x258]
push eax
call ebp
cmp eax, 0xffffffff
je 0x409156
test al, 0x10
je 0x409156
lea edi, [esp + 0x258]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x409140
mov cx, word [0x423eb4]
mov word [edi], cx
jmp 0x40917c
push 0x105
push ebx
lea edx, [esp + 0x260]
push edx
jmp 0x409174
push 0x105
push ebx
lea eax, [esp + 0x260]
push eax
call fcn.0040eb90
add esp, 0xc
cmp byte [esp + 0x258], bl
jne 0x409250
push 0x104
lea ecx, [esp + 0x25c]
push ecx
push 0x426480
call esi
cmp eax, ebx
jle 0x40923a
cmp eax, 0x104
jae 0x40923a
cmp byte [esp + 0x258], bl
je 0x40923a
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4091c7
sub eax, edx
cmp byte [esp + eax + 0x257], 0x5c
jne 0x4091f8
lea eax, [esp + 0x258]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4091e6
sub eax, edx
mov byte [esp + eax + 0x257], bl
lea edx, [esp + 0x258]
push edx
call ebp
cmp eax, 0xffffffff
je 0x40922a
test al, 0x10
je 0x40922a
lea edi, [esp + 0x258]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x409215
mov ax, word [0x423eb4]
mov word [edi], ax
jmp 0x409250
push 0x105
push ebx
lea ecx, [esp + 0x260]
push ecx
jmp 0x409248
push 0x105
push ebx
lea edx, [esp + 0x260]
push edx
call fcn.0040eb90
add esp, 0xc
push 0x106
lea eax, [esp + 0x7a4]
push ebx
push eax
call fcn.0040eb90
mov ecx, dword [esp + 0x1c]
add ecx, 0x328
push ecx
lea edx, [esp + 0x8f8]
push str.SOFTWAREKaseyaAgent_s
push edx
mov dword [esp + 0x38], 0x105
call fcn.0041025a
lea eax, [esp + 0x40]
push eax
push 0x80000002
lea esi, [esp + 0x40]
lea ecx, [esp + 0x7c0]
mov ebx, str.ConfigurationFile
lea eax, [esp + 0x908]
call fcn.004073f0
add esp, 0x20
xor ebx, ebx
test eax, eax
jne 0x4092f4
mov ecx, dword [esp + 0x10]
add ecx, 0x328
push ecx
push str.An_Agent_with_same_instance_ID___s__is_already_installed.
push 0x42dee8
mov dword [esp + 0x40], 1
mov dword [esp + 0x30], ebx
call fcn.0041025a
mov edx, dword [esp + 0x1c]
push 0x42dee8
push ebx
push 1
push 3
push edx
call fcn.0040e6f0
add esp, 0x20
mov edi, dword [esp + 0x1c]
cmp edi, ebx
je 0x40938d
cmp byte [edi], 0
mov esi, edi
je 0x409361
jmp 0x409310
push str.Legacy
push esi
call fcn.0041060f
add esp, 8
test eax, eax
je 0x40933e
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409327
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x409310
jmp 0x409361
mov eax, dword [esp + 0x10]
push str.Legacy_agent_is_installed_and_connects_to_the_same_server.
push ebx
push 1
push 3
push eax
call fcn.0040e6f0
add esp, 0x14
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x250], ebx
je 0x409384
push str.An_exisiting_agent_already_connects_to_the_same_server.
push ebx
push 1
push 3
push eax
call fcn.0040e6f0
add esp, 0x14
mov dword [esp + 0x24], ebx
push edi
call fcn.0040e862
add esp, 4
cmp dword [esp + 0x24], 0
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jne 0x40950e
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x244], 0
jne 0x409442
cmp dword [eax + 0x248], 0
je 0x409769
cmp dword [eax + 0x258], 0
jne 0x409769
push 0x50024
push 0x42e910
push str.The_Agent_is_already_installed._nDo_you_want_to_reinstall_the_Agent_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
mov ecx, dword [esp + 0x10]
jne 0x409438
push str.Re_installation_of_the_Agent_was_stopped_by_the_user.
push 0xffffffffffffffe3
push 1
push 3
push ecx
call fcn.0040e6f0
add esp, 0x14
push 0x50040
push 0x42e910
push str.Installation_of_the_Agent_stopped.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
lea eax, [ebx - 0x1d]
jmp 0x40b10b
mov dword [ecx + 0x244], 1
xor eax, eax
jmp 0x409450
mov cl, byte [esp + eax + 0x7a0]
mov byte [esp + eax + 0xbf0], cl
add eax, 1
test cl, cl
jne 0x409450
lea ecx, [esp + 0xbf0]
push 0x5c
push ecx
call fcn.004102e0
add esp, 8
test eax, eax
je 0x40947f
mov byte [eax + 1], 0
mov dword [esp + 0x20], 6
xor ebx, ebx
lea esp, [esp]
xor eax, eax
mov cl, byte [esp + eax + 0xbf0]
mov byte [esp + eax + 0x7a0], cl
add eax, 1
test cl, cl
jne 0x409492
mov eax, dword [esp + ebx*4 + 0x60]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4094b0
lea edi, [esp + 0x7a0]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4094c5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x7a0]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409505
test al, 3
je 0x409505
push 0x80
lea eax, [esp + 0x7a4]
push eax
call ebp
add ebx, 1
cmp ebx, dword [esp + 0x20]
jl 0x409490
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x258], 0
jne 0x4095a0
mov edx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edx
mov eax, dword [ecx + 0x31c]
lea ecx, [esp + 0x78]
push ecx
push 0
lea edx, [esp + 0x44]
push edx
push 0x407940
push 0
push 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], 1
call fcn.00410a25
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4095a0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebx
cmp dword [esp + 0x44], 0
mov esi, 0xc8
je 0x409599
cmp esi, 0x3a98
jge 0x409599
push 0xa
call ebx
add esi, 0xa
cmp dword [esp + 0x44], 0
jne 0x409583
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa28
push 0
push 0x42dee8
mov dword [0x42dce4], 0xf
call fcn.0040eb90
push 0xa27
lea eax, [esp + 0x488]
push eax
push 0x42dee8
call fcn.0040f940
push 0x426324
push 0x42dee8
call fcn.0040b310
add esp, 0x20
test eax, eax
je 0x40aec6
push 0x42dee8
mov byte [eax + 2], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x40aec6
test eax, eax
je 0x40aec6
lea ecx, [esp + 0x478]
push str.Temporary_Internet_Files
push ecx
call fcn.0040b310
add esp, 8
test eax, eax
je 0x409642
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 2
jne 0x409642
cmp dword [eax + 8], 4
jne 0x409642
cmp dword [eax + 0x98], 0
je 0x40aec6
lea edx, [esp + 0x478]
push 0x426b74
push edx
call fcn.0040f6c8
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x1c], ebx
jne 0x4097af
call fcn.0041069a
cmp dword [eax], 2
jne 0x4096e1
call fcn.00403ac0
test eax, eax
je 0x4096e1
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4096e1
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebp
push str.Wow64RevertWow64FsRedirection
push esi
mov edi, eax
call ebp
test edi, edi
mov ebp, eax
je 0x4096d6
test ebp, ebp
je 0x4096d6
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
je 0x4096d6
lea ecx, [esp + 0x478]
push 0x426b74
push ecx
call fcn.0040f6c8
mov edx, dword [esp + 0x38]
add esp, 8
push edx
mov dword [esp + 0x20], eax
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x4097af
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x409717
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], ebx
call fcn.0041069a
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.Installation_package_could_not_be_accessed.
push eax
push 3
push 1
push ecx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409762
cmp dword [eax + 0x258], 0
jne 0x409762
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_installation_package_could_not_be_accessed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ebx, ebx
jmp 0x408952
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
push 0xffffffffffffffe3
push 1
push 3
push eax
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x258], 0
jne 0x409414
cmp dword [eax + 0x250], 0
jne 0x409414
push 0x50040
push 0x42e910
push str.The_Agent_is_already_installed._Re_installation_of_the_Agent_was_terminated.
jmp 0x40940c
mov ecx, dword [0x42eb14]
push ecx
lea edx, [esp + 0x80]
push edx
push ebx
call fcn.0040de00
lea eax, [esp + 0x88]
push eax
push ebx
call fcn.0040de80
add esp, 0x14
test eax, eax
jge 0x40986b
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x409811
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.Failed_to_read_setup_file_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x40985c
cmp dword [eax + 0x258], 0
jne 0x40985c
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_read_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40895c
lea edx, [esp + 0xa4]
push str.KAgentSilent.exe
push edx
call fcn.0041060f
add esp, 8
test eax, eax
je 0x409914
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x4098bc
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.Failed_to_find_setup_file_from_the_installation_package.
push eax
push 3
push 1
push ecx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x408952
cmp dword [eax + 0x258], 0
jne 0x408952
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x408952
push 0x118
lea ecx, [esp + 0x364]
push 0
push ecx
call fcn.0040eb90
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x360], cl
add eax, 1
test cl, cl
jne 0x409930
lea eax, [esp + 0x360]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x409950
mov edx, dword [str.KAgentSilent.exe]
mov ecx, dword [0x426178]
mov dword [eax], edx
mov edx, dword [0x42617c]
mov dword [eax + 4], ecx
mov ecx, dword [0x426180]
mov dword [eax + 8], edx
mov dl, byte [0x426184]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], dl
lea eax, [esp + 0x360]
push 0x4260c0
push eax
call fcn.0040f6c8
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x409a80
lea ecx, [esp + 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4099ee
test al, 3
je 0x4099ee
push 0x80
lea edx, [esp + 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x360]
push 0x4260c0
push eax
call fcn.0040f6c8
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x409a80
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x409a22
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409a6d
cmp dword [eax + 0x258], 0
jne 0x409a6d
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40895c
push 0xa28
push 0
push 0x42dee8
call fcn.0040eb90
add esp, 0xc
xor eax, eax
jmp 0x409aa0
mov cl, byte [eax + str.KAgentSilent.exe]
mov byte [eax + 0x42dee8], cl
add eax, 1
test cl, cl
jne 0x409aa0
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x258], 1
jne 0x409ada
mov edi, 0x42dee8
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x409ac8
mov edx, dword [0x426004]
mov dword [edi], edx
mov eax, 0x42dee8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409ae2
lea ecx, [esi + 0x135]
push ecx
add esi, 0x328
sub eax, edx
push esi
lea edx, [eax + 0x42dee8]
push str.__a__k__g__s__l___s_
push edx
call fcn.0041025a
mov esi, dword [esp + 0x20]
lea ecx, [esi + 0x3dc]
add esp, 0x10
cmp byte [ecx], 0
je 0x409b4a
mov eax, 0x42dee8
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x409b26
push ecx
sub eax, esi
lea eax, [eax + 0x42dee8]
push str.__v___s_
push eax
call fcn.0041025a
mov esi, dword [esp + 0x1c]
add esp, 0xc
cmp byte [esi + 0x33d], 0
lea edx, [esi + 0x33d]
je 0x409b85
mov eax, 0x42dee8
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409b61
push edx
sub eax, esi
lea ecx, [eax + 0x42dee8]
push str.__o___s_
push ecx
call fcn.0041025a
mov esi, dword [esp + 0x1c]
add esp, 0xc
cmp byte [esi + 0x370], 0
lea edx, [esi + 0x370]
je 0x409bc4
mov eax, 0x42dee8
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409ba0
push edx
sub eax, esi
lea edx, [eax + 0x42dee8]
push str.__p___s_
push edx
call fcn.0041025a
mov esi, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x34], 0
jne 0x409bf1
cmp dword [esp + 0x2c], 0
je 0x409bf1
mov edi, 0x42dee8
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x409be0
mov eax, dword [0x425fc4]
mov dword [edi], eax
cmp dword [esi + 0x3d8], 0
je 0x409c14
mov edi, 0x42dee8
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x409c02
mov ecx, dword [0x425fc0]
mov dword [edi], ecx
cmp dword [esi + 0x3f8], 0
je 0x409c37
mov edi, 0x42dee8
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x409c25
mov edx, dword [0x425fbc]
mov dword [edi], edx
mov dword [esp + 0x250], 0x5c3a43
cmp dword [esi + 0x324], 0
je 0x409cd2
mov eax, dword [esi + 0x324]
push 0x3a
push eax
call fcn.0040f700
add esp, 8
test eax, eax
je 0x409c81
mov al, byte [eax - 1]
mov cl, al
sub cl, 0x61
cmp cl, 0x19
mov byte [esp + 0x250], al
ja 0x409c81
and al, 0xdf
mov byte [esp + 0x250], al
mov edx, dword [esp + 0x10]
mov esi, dword [edx + 0x324]
cmp byte [esi], 0x22
mov eax, 0x42dee8
lea edx, [eax + 1]
je 0x409cb2
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409c98
push esi
sub eax, edx
push str.__d___s_
lea eax, [eax + 0x42dee8]
push eax
jmp 0x409cca
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409cb2
push esi
sub eax, edx
push str.__d__s
lea ecx, [eax + 0x42dee8]
push ecx
call fcn.0041025a
add esp, 0xc
mov eax, 0x42dee8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409ce0
sub eax, edx
mov edx, eax
lea eax, [esp + 0x360]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409cf7
sub eax, esi
add eax, edx
cmp eax, 0x104
jbe 0x409d95
push str.__a
push 0x42dee8
call fcn.0040f7c0
mov esi, eax
add esp, 8
test esi, esi
je 0x409d95
mov edx, dword [esp + 0x10]
add edx, 0x3fc
push edx
push 0
push str.kprm
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
mov ecx, dword [esp + 0x10]
je 0x409d8e
add ecx, 0x3fc
push ecx
add esi, 4
push esi
call fcn.00401000
add esp, 8
test eax, eax
jne 0x409d81
mov edx, dword [esp + 0x10]
add edx, 0x3fc
push edx
push str._f___s_
push esi
call fcn.0041025a
add esp, 0xc
jmp 0x409d95
mov eax, dword [esp + 0x10]
mov byte [eax + 0x3fc], 0
jmp 0x409d95
mov byte [ecx + 0x3fc], 0
lea edx, [esp + 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ae3c
test al, 0x10
je 0x40ae3c
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x1b8]
push ebp
push eax
mov ebx, 1
push ebx
push ecx
mov dword [esp + 0x3c], 0x258
call fcn.0040edb9
push ebp
mov esi, eax
call fcn.0040f276
add esp, 0x14
cmp esi, dword [esp + 0x1ac]
je 0x409e7d
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], ebx
mov dword [0x42dce4], 0x65
je 0x409e20
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
push str.The_setup_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push ebx
push eax
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409e6a
cmp dword [eax + 0x258], 0
jne 0x409e6a
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_could_not_be_extracted_from_the_installation_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x14]
push edx
jmp 0x40895c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
push ecx
call fcn.0040de80
add esp, 8
test eax, eax
jge 0x409f16
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], ebx
mov dword [0x42dce4], 0x65
je 0x409ec7
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push edx
push 3
push ebx
push eax
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409e6a
cmp dword [eax + 0x258], 0
jne 0x409e6a
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x409e62
lea eax, [esp + 0xa4]
push str.KaseyaD.ini
push eax
call fcn.0041060f
add esp, 8
test eax, eax
je 0x409fb2
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], ebx
mov dword [0x42dce4], 0x65
je 0x409f63
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
call fcn.0041069a
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.Failed_to_find_configuration_file_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409a6d
cmp dword [eax + 0x258], 0
jne 0x409a6d
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_setup_file_was_not_found_at_the_end_of_the_installation_package.
jmp 0x409a65
xor eax, eax
jmp 0x409fc0
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x698], cl
add eax, ebx
test cl, cl
jne 0x409fc0
lea eax, [esp + 0x698]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x409fe0
mov edx, dword [str.KaseyaD.ini]
mov ecx, dword [0x425ec0]
mov dword [eax], edx
mov edx, dword [0x425ec4]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x698]
push 0x4260c0
push eax
call fcn.0040f6c8
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a0c7
lea ecx, [esp + 0x698]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a068
test al, 3
je 0x40a068
push 0x80
lea edx, [esp + 0x69c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x698]
push 0x4260c0
push eax
call fcn.0040f6c8
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a0c7
mov dword [0x42c618], ebx
mov dword [0x42dce4], 0x64
call fcn.0041069a
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push ebx
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409a6d
cmp dword [eax + 0x258], 0
jne 0x409a6d
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x409a65
mov edx, dword [esp + 0x1ac]
mov eax, dword [esp + 0x1b8]
push esi
push edx
push 1
push eax
call fcn.0040edb9
push esi
mov edi, eax
call fcn.0040f276
add esp, 0x14
cmp edi, dword [esp + 0x1ac]
je 0x40a150
mov dword [0x42c618], ebx
mov dword [0x42dce4], 0x64
call fcn.0041069a
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_extracted_from_the_installation_package.
push ecx
push 3
push 1
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], 0
je 0x409a6d
cmp dword [eax + 0x258], 0
jne 0x409a6d
push 0x10
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_extracted_from_the_installation_package.
jmp 0x409a65
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x698]
push edx
push eax
mov dword [0x42c618], 0x1f4
mov dword [0x42dce4], 0x5f
call fcn.0040ccd0
mov ebp, eax
add esp, 8
cmp ebp, 0xfffffffe
je 0x40a1df
cmp ebp, 0xffffffe9
je 0x40a1df
xor edi, edi
cmp ebp, edi
je 0x40a1e1
mov ecx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_accessed.
push ebp
push 3
push 3
push ecx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], edi
je 0x40a1cc
cmp dword [eax + 0x258], edi
jne 0x40a1cc
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_contents_could_not_be_accessed.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40b0f9
xor edi, edi
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 2
jne 0x40a2a0
cmp dword [eax + 8], 4
jb 0x40a2a0
cmp dword [eax + 0x98], edi
jne 0x40a2a0
push 0x118
lea ecx, [esp + 0x364]
push edi
push ecx
call fcn.0040eb90
push 0x117
lea edx, [esp + 0x488]
push edx
lea eax, [esp + 0x374]
push eax
call fcn.0040f940
push 0xa28
push edi
push 0x42dee8
call fcn.0040eb90
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
push ecx
add edx, 0x135
push edx
lea eax, [esp + 0x38c]
push eax
push str._s__l__s__s
push 0x42dee8
call fcn.0041025a
mov esi, dword [esp + 0x4c]
add esp, 0x38
xor ebx, ebx
cmp esi, edi
mov dword [esp + 0x2c], edi
je 0x40a434
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a434
cmp dword [esp + 0x24], edi
jne 0x40a2b2
cmp dword [eax + 0x240], edi
je 0x40a42a
cmp dword [eax + 0x23c], edi
je 0x40a42a
push edi
push eax
call fcn.0040e250
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00406d30
add esp, 0xc
cmp eax, edi
je 0x40a39b
cmp eax, 0xffffffff
jne 0x40a35c
mov eax, dword [0x42dce0]
cmp eax, edi
mov dword [0x42dce4], 0x65
je 0x40a307
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], edi
mov edx, dword [esp + 0x10]
push str.User_canceled_the_installation.
push 0xffffffffffffffff
push 1
push 3
push edx
call fcn.0040e6f0
add esp, 0x14
push 0x50040
push 0x42e910
push str.Installation_of_the_Agent_terminated_because_nthe_required_configuration_parameters_were_not_entered.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
or eax, 0xffffffff
jmp 0x40b10b
mov edx, dword [esp + 0x10]
push str.Configuration_parameters_are_missing_and_the__s_switch_was_used.
push eax
push 1
push 3
push edx
call fcn.0040e6f0
mov ebx, dword [esp + 0x30]
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.00407e40
add esp, 0x1c
mov eax, 0xffffffed
jmp 0x40b10b
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x698]
push edx
push eax
call fcn.0040d960
mov ebp, eax
add esp, 8
cmp ebp, edi
je 0x40a434
mov ecx, dword [esp + 0x10]
push str.Installation_of_the_Agent_terminated.
push ebp
push 1
push 3
push ecx
call fcn.0040e6f0
mov edx, dword [esp + 0x24]
add esp, 0x14
cmp dword [edx + 0x258], edi
jne 0x40a417
mov eax, dword [0x42dce0]
cmp eax, edi
mov dword [0x42dce4], 0x65
je 0x40a401
push edi
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], edi
push 0x50040
push 0x42e910
push str.Installation_of_the_Agent_terminated_because_nthe_configuration_could_not_be_updated.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40b0f9
push edi
push eax
call fcn.0040e250
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea esp, [esp]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push 0
push edx
push ebx
push 0x42dee8
lea eax, [esp + 0x370]
push eax
push ecx
call fcn.0040d050
mov ebp, eax
add esp, 0x18
cmp ebp, 0xffffffec
jne 0x40a47a
cmp esi, 4
jge 0x40a492
push 0x3e8
call edi
add esi, 1
jmp 0x40a440
cmp ebp, 0xfffffff4
jne 0x40a492
mov edx, dword [esp + 0x10]
push edx
call fcn.00406dc0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40a440
mov eax, dword [esp + 0x10]
push str.Installation_process_returned.
push ebp
mov edi, 1
push edi
push 3
push eax
call fcn.0040e6f0
add esp, 0x14
test ebp, ebp
je 0x40a630
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42c618], edi
mov dword [0x42dce4], 0x65
je 0x40a4e5
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x260], 0
je 0x40a5fb
cmp dword [eax + 0x258], 0
jne 0x40a5fb
cmp ebp, edi
jne 0x40a587
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x54]
movzx ecx, word [esp + 0x56]
mov eax, 0x3b
sub eax, edx
imul eax, eax, 0x3e8
add eax, ecx
cmp eax, 0x2710
jae 0x40a53d
mov eax, 0x2710
jmp 0x40a549
cmp eax, 0xd6d8
jbe 0x40a549
mov eax, 0xd6d8
mov edx, dword [esp + 0x10]
push 0
push eax
push str.The_Agent_installation_has_been_scheduled._n_nPlease_wait_up_to_one_minute_for_the_installation_to_proceed.
push edx
call fcn.00406e30
mov eax, dword [esp + 0x20]
add esp, 0x10
push str.The_installation_package_is_re_running_under_an_authorized_account
push ebp
push edi
push 3
push eax
call fcn.0040e6f0
mov ebx, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
jmp 0x40b0f9
cmp ebp, 0xffffffec
jne 0x40a5b1
push 0x50040
push 0x42e910
push str.The_installation_package_containing_the_Agent_failed_to_run_nbecause_the_Windows_NT_Task_Scheduler_is_not_running.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.The_installation_package_containing_the_Agent_failed_to_run.
push ebp
push 3
jmp 0x40a569
cmp ebp, 0xffffffff
jne 0x40a5db
push 0x50040
push 0x42e910
push str.Installation_of_the_Agent_terminated_because_nthe_required_credentials_were_missing_or_incorrect._User_cancelled_the_nthe_installation..
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push ebp
push 3
jmp 0x40a569
cmp ebp, 2
je 0x40a5fb
push 0x50010
push 0x42e910
push str.The_installation_package_containing_the_Agent_failed_to_run.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
cmp ebp, edi
je 0x40a562
cmp ebp, 2
je 0x40a562
cmp ebp, 0xffffffed
jne 0x40a61e
push str.The_credentials_contained_in_the_installation_package_were_incorrect_or_missing._Agent_failed_to_run.
push ebp
push 3
jmp 0x40a569
cmp ebp, 0xffffffff
jne 0x40a5a7
push str.Administrator_credentials_were_incorrect_and_the_user_canceled_the_installation.
push ebp
push 3
jmp 0x40a569
push 0x106
lea edx, [esp + 0x7a4]
push 0
push edx
mov dword [0x42c618], 0x64
mov dword [0x42dce4], 0x63
call fcn.0040eb90
lea eax, [esp + 0x34]
push eax
push 0x80000002
lea esi, [esp + 0x34]
lea ecx, [esp + 0x7b4]
mov ebx, str.ConfigurationFile
lea eax, [esp + 0x8fc]
mov dword [esp + 0x34], 0x105
call fcn.004073f0
mov esi, eax
xor ebx, ebx
add esp, 0x14
cmp esi, ebx
jne 0x40adaa
cmp dword [esp + 0x28], edi
jne 0x40adaa
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40adaa
cmp eax, 0x105
jae 0x40adaa
cmp dword [esp + 0x24], ebx
jne 0x40a6cc
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x240], ebx
je 0x40a79c
push ebx
lea edx, [esp + 0x7a4]
push edx
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40a6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40a6f3
xor esi, esi
lea ecx, [esp + 0x698]
push ecx
call fcn.00410ef5
lea edx, [esp + 0x364]
push edx
call fcn.00410ef5
add esp, 8
cmp esi, ebx
je 0x40a79c
mov eax, dword [0x42dce0]
cmp eax, ebx
mov dword [0x42c618], edi
mov dword [0x42dce4], 0x65
je 0x40a742
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], ebx
call fcn.0041069a
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push str.The_configuration_file_could_not_be_moved_to_the_installation_directory.
push eax
push 3
push edi
push ecx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40a789
cmp dword [eax + 0x258], ebx
jne 0x40a789
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_configuration_file_could_not_be_moved_to_the_installation_directory.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x14]
push eax
jmp 0x40895c
push 0x118
lea ecx, [esp + 0x364]
push ebx
push ecx
call fcn.0040eb90
lea edx, [esp + 0x34]
push edx
push 0x80000002
lea esi, [esp + 0x34]
lea ecx, [esp + 0x374]
mov ebx, str.Path
lea eax, [esp + 0x8fc]
mov dword [esp + 0x34], 0x117
call fcn.004073f0
add esp, 0x14
test eax, eax
je 0x40a848
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x258], 0
jne 0x40a808
push 0x50010
push 0x42e910
push str.The_installation_path_for_the_Agent_cannot_be_found_n_nThe_Agent_cannot_be_started.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push str.Cannot_launch_the_agent_because_the_path_could_not_be_found.
push 0xffffffffffffffe4
push 3
push 3
push ecx
call fcn.0040e6f0
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x30]
call fcn.00407e40
add esp, 0x1c
mov eax, 0xffffffe4
jmp 0x40b10b
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x360]
mov byte [esp + eax + 0x258], cl
add eax, edi
test cl, cl
jne 0x40a850
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x7c]
push ecx
push edx
call fcn.0040de80
add esp, 8
test eax, eax
jne 0x40aa9b
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ebx, [ebx]
push 0x118
lea eax, [esp + 0x584]
push 0
push eax
call fcn.0040eb90
add esp, 0xc
cmp byte [esp + 0xa4], 0x5c
je 0x40a94c
cmp byte [esp + 0xa5], 0x3a
je 0x40a94c
xor eax, eax
jmp 0x40a8d0
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x580], cl
add eax, 1
test cl, cl
jne 0x40a8d0
lea eax, [esp + 0x580]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a8f0
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x584]
push 0x423eb4
push edx
call fcn.00410dc0
lea eax, [esp + 0x58c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a922
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0xa8]
push edx
lea eax, [esp + 0x588]
push eax
call fcn.00410dc0
jmp 0x40a966
push 0x117
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x588]
push edx
call fcn.0040f940
lea eax, [esp + 0x58c]
add esp, 0xc
push eax
call fcn.0040b660
lea ecx, [esp + 0x584]
push 0x4260c0
push ecx
call fcn.0040f6c8
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a9e9
lea edx, [esp + 0x580]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a9d2
test al, 3
je 0x40a9d2
push 0x80
lea eax, [esp + 0x584]
push eax
call edi
lea ecx, [esp + 0x580]
push 0x4260c0
push ecx
call fcn.0040f6c8
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a9e9
lea edx, [esp + 0x580]
push edx
push str.WARNING:_Unable_to_open_the_file__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea eax, [esp + 0x9f4]
push eax
jmp 0x40aa2a
mov edx, dword [esp + 0x1ac]
mov eax, dword [esp + 0x1b8]
push esi
push edx
push 1
push eax
call fcn.0040edb9
push esi
mov ebx, eax
call fcn.0040f276
add esp, 0x14
cmp ebx, dword [esp + 0x1ac]
je 0x40aa7c
lea ecx, [esp + 0x580]
push ecx
push str.WARNING:_Unable_to_write_the_file_content_to__s_to_save_the_additional_custom_Agent_installation_file._Agent_installation_proceeding.
lea edx, [esp + 0x9f4]
push edx
call fcn.0041025a
call fcn.0041069a
mov edx, dword [eax]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x9f8]
push ecx
push edx
push 3
push 1
push eax
call fcn.0040e6f0
mov eax, dword [esp + 0x30]
add esp, 0x20
cmp dword [eax + 0x260], 0
je 0x40aa7c
cmp dword [eax + 0x258], 0
jne 0x40aa7c
push 0x50010
push 0x42e910
lea ecx, [esp + 0x9f4]
push ecx
push 0
call ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x7c]
push edx
push eax
call fcn.0040de80
add esp, 8
test eax, eax
je 0x40a890
mov edi, 1
cmp dword [esp + 0x24], 0
mov dword [0x42c618], edi
mov dword [0x42dce4], 0x64
je 0x40ac64
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x264], 0
je 0x40ab19
push 4
lea edx, [esp + 0x5c]
push edx
push 4
push str.EnableRemoteControl
lea eax, [esp + 0x8f8]
push eax
push 0x80000002
mov dword [esp + 0x70], 0
call fcn.0040b430
add esp, 0x18
test eax, eax
jne 0x40ab02
mov ecx, dword [esp + 0x10]
push str.Disabled_remote_control.
push eax
push edi
push 3
push ecx
jmp 0x40ab11
mov edx, dword [esp + 0x10]
push str.Failed_to_disable_remote_control.
push eax
push 2
push 3
push edx
call fcn.0040e6f0
add esp, 0x14
push 0x94
lea eax, [esp + 0x1c0]
push 0
push eax
call fcn.0040eb90
add esp, 0xc
lea ecx, [esp + 0x1bc]
push ecx
mov dword [esp + 0x1c0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40ac64
cmp dword [esp + 0x1cc], 2
jne 0x40ac64
push 0x200
lea edx, [esp + 0xe00]
push 0
push edx
call fcn.0040eb90
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xe00]
push ecx
mov dword [esp + 0x28], 0x1ff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40ac64
cmp byte [esp + 0xdfc], 0
je 0x40ac64
lea edx, [esp + 0xdfc]
push str.SYSTEM
push edx
call fcn.0041060f
add esp, 8
test eax, eax
je 0x40ac64
xor eax, eax
jmp 0x40abd0
mov cl, byte [esp + eax + 0x360]
mov byte [esp + eax + 0x258], cl
add eax, edi
test cl, cl
jne 0x40abd0
lea eax, [esp + 0x360]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40abf0
sub eax, edx
mov ecx, 0x117
sub ecx, eax
push ecx
lea edx, [esp + 0x364]
push 0x4256dc
push edx
call fcn.00410dc0
push 0
lea eax, [esp + 0x370]
push str.KaUsrTsk.exe
push eax
xor ebx, ebx
call fcn.00407ea0
add esp, 0x18
test eax, eax
je 0x40ac49
mov ecx, dword [esp + 0x10]
push str.Failed_to_launch_the_service_helper_task.
push eax
push 3
push 3
push ecx
call fcn.0040e6f0
add esp, 0x14
xor eax, eax
jmp 0x40ac50
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x360], cl
add eax, edi
test cl, cl
jne 0x40ac50
lea edi, [esp + 0x360]
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x40ac70
mov dx, word [0x423eb4]
lea eax, [esp + 0x360]
mov word [edi], dx
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40ac90
mov ecx, dword [str.AgentMon.exe]
mov edx, dword [0x423f00]
mov dword [eax], ecx
mov ecx, dword [0x423f04]
push 1
mov dword [eax + 4], edx
mov dl, byte [0x423f08]
push 0
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
push 0
mov byte [eax + 0xc], dl
push str.AgentMon.exe
lea eax, [esp + 0x370]
push eax
push ecx
call fcn.0040d050
add esp, 0x18
test eax, eax
je 0x40acf8
mov edx, dword [esp + 0x10]
push str.Cannot_launch_the_agent.
push eax
push 3
push 3
push edx
call fcn.0040e6f0
add esp, 0x14
mov eax, dword [0x42dce0]
test eax, eax
mov dword [0x42dce4], 0x65
je 0x40ad22
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], 0
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x260], 0
je 0x40ad5c
cmp dword [eax + 0x258], 0
jne 0x40ad5c
cmp dword [eax + 0x254], 0
jne 0x40ad65
mov ecx, dword [eax + 0x318]
push 1
push 0x7530
push ecx
push eax
call fcn.00406e30
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp dword [eax + 0x254], 0
je 0x40ad85
call fcn.00407840
test eax, eax
je 0x40ad85
mov edx, dword [esp + 0x10]
push str.Attempt_to_reboot_the_system_failed.
push eax
push 3
push 1
push edx
call fcn.0040e6f0
add esp, 0x14
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
xor eax, eax
jmp 0x40b10b
mov eax, dword [0x42dce0]
cmp eax, ebx
mov dword [0x42c618], edi
mov dword [0x42dce4], 0x65
je 0x40add4
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], ebx
mov edx, dword [esp + 0x10]
push str.Installation_of_the_Agent_Failed.
push esi
push 3
push edi
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40ae14
cmp dword [eax + 0x258], ebx
jne 0x40ae14
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_Failed
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
mov eax, 0xfffffffd
jmp 0x40b10b
movsx edx, byte [esp + 0x250]
push edx
push str.Installation_of_the_Agent_failed_because_nthe_target_installation_drive___c:__could_not_be_found_on_this_computer.
push 0x42dee8
call fcn.0041025a
add esp, 0xc
push 0x50010
push 0x42e910
push 0x42dee8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movsx eax, byte [esp + 0x250]
push eax
push str.Cannot_install_agent_on_machine_because_the_target_installation_drive___c:__is_missing.
push 0x42dee8
call fcn.0041025a
mov ecx, dword [esp + 0x1c]
push 0x42dee8
push 0xffffffffffffffe2
push 3
push 3
push ecx
call fcn.0040e6f0
mov ebx, dword [esp + 0x3c]
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x34]
push eax
lea edi, [esp + 0x40]
lea esi, [esp + 0x3c]
call fcn.00407e40
add esp, 0x28
mov eax, 0xffffffe2
jmp 0x40b10b
lea ecx, [esp + 0x478]
push 0x5c
push ecx
call fcn.004102e0
mov ebp, eax
xor ebx, ebx
add esp, 8
cmp ebp, ebx
jne 0x40af78
mov eax, dword [0x42dce0]
cmp eax, ebx
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x40af12
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], ebx
mov edx, dword [esp + 0x10]
push str.Failed_to_locate_the_installation_name_for_scheduling.
push 0xffffffffffffffe4
push 3
push 3
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40af54
cmp dword [eax + 0x258], ebx
jne 0x40af54
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_name_of_the_installation_file_was_not_found.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
lea eax, [ebx - 0x1c]
jmp 0x40b10b
add ebp, 1
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x258]
mov byte [esp + eax + 0x360], cl
add eax, 1
test cl, cl
jne 0x40af80
mov eax, ebp
mov edx, ebp
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40afa0
lea edi, [esp + 0x360]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x40afb5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push ebx
mov ecx, eax
lea edx, [esp + 0x364]
push edx
lea eax, [esp + 0x480]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x42dce0]
cmp eax, ebx
mov dword [0x42c618], 1
mov dword [0x42dce4], 0x65
je 0x40b014
push ebx
push ebx
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dce0], ebx
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x40b039
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
push 0xa28
push ebx
push 0x42dee8
mov dword [ecx + 0x98], 1
call fcn.0040eb90
mov edx, dword [esp + 0x24]
push edx
push ebp
push str._s__s
push 0x42dee8
call fcn.0041025a
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push 0x42dee8
lea eax, [esp + 0x38c]
push eax
push ecx
call fcn.0040d050
mov ebp, eax
add esp, 0x34
cmp ebp, ebx
je 0x40b0ed
mov edx, dword [esp + 0x10]
push str.Local_copy_of_the_installation_package_could_not_be_accessed.
push ebp
push 3
push 1
push edx
call fcn.0040e6f0
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x260], ebx
je 0x40b0ed
cmp dword [eax + 0x258], ebx
jne 0x40b0ed
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nthe_local_copy_of_the_installation_package_could_not_be_accessed.
jmp 0x40b0e6
mov edx, dword [esp + 0x10]
cmp dword [edx + 0x258], ebx
jne 0x40b0ed
push 0x50010
push 0x42e910
push str.Installation_of_the_Agent_failed_because_nanother_instance_of_this_installation_package_is_already_running.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
lea edi, [esp + 0x20]
lea esi, [esp + 0x1c]
call fcn.00407e40
add esp, 8
mov eax, ebp
mov ecx, dword [esp + 0x2008]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f6db
add esp, 0x1ffc
ret 0x10