Function at 0x40c370
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ada4
mov eax, dword fs:[0]
push eax
sub esp, 0x2f4
mov eax, dword [0x498e04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], 0
push str.NInstall::install____0__n
push 1
call fcn.00415200
add esp, 8
lea ecx, [ebp - 0x5c]
call fcn.00412f30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00418580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00418580
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00418580
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x268]
cmp dword [eax + 0xc0], 0
je 0x40c53e
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 4], 0
je 0x40c453
cmp dword [0x49a3e4], 0
je 0x40c437
push str.4.x_Agent
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c453
push str.4.x_version_Agent_is_removing_now..
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
call fcn.0040dd40
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40c4ad
cmp dword [0x49a3e4], 0
je 0x40c491
push 0x483070
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c4ad
push str.4.x_version_Agent_is_removing_now..
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48306c
lea edx, [ebp - 0x8c]
push edx
push str.NcdInstall2.exe
lea eax, [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x180
call fcn.00419230
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x270]
call fcn.00419230
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xfc]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
add ecx, 0x180
call fcn.00418810
push eax
lea ecx, [ebp - 0x8c]
call fcn.00418810
push eax
call fcn.0041a6b0
add esp, 8
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
call fcn.0040dbf0
test eax, eax
jne 0x40c5ae
push str.NInstall::install____1__writeCabFile___Fail_n
push 1
call fcn.00415200
add esp, 8
push 2
call fcn.0040b800
add esp, 4
mov dword [ebp - 0x100], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004186d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004186d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004186d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412f90
mov eax, dword [ebp - 0x100]
jmp 0x40d50c
mov edx, dword [ebp - 0x268]
cmp dword [edx + 4], 0
je 0x40c616
push 5
push 0
push 0x46f
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40c5fa
push 0x483010
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c616
push str.extract_files_from_compressed_file..
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.NInstall::install____2__n
push 1
call fcn.00415200
add esp, 8
mov ecx, dword [ebp - 0x268]
call fcn.0040de90
mov ecx, dword [ebp - 0x268]
call fcn.0040e160
mov ecx, dword [ebp - 0x268]
call fcn.0040e3e0
push str.NInstall::install____3__n
push 1
call fcn.00415200
add esp, 8
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40c6bd
push 0xa
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40c6a1
push 0x482f98
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c6bd
push str.check_up_installation_status..
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.nckill.exe
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp - 0x268]
add ecx, 0x180
call fcn.00419230
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x278], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x278]
call fcn.00418800
push eax
lea ecx, [ebp - 0x44]
call fcn.00418b10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x118]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
add ecx, 0x180
call fcn.00418810
push eax
lea ecx, [ebp - 0x44]
call fcn.00418810
push eax
call fcn.0041a6b0
add esp, 8
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40c75b
push 0x14
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
call fcn.0040db80
push str.NInstall::install____4__n
push 1
call fcn.00415200
add esp, 8
mov ecx, dword [ebp - 0x268]
call fcn.00410200
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40c7e8
push 0x19
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40c7cc
push 0x482f40
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c7e8
push str.copy_program_files..
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 0xa0]
mov dword [ebp - 0x27c], edx
cmp dword [ebp - 0x27c], 2
je 0x40c82f
mov eax, dword [ebp - 0x268]
add eax, 0x150
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x11c], esp
push eax
call fcn.00419080
mov dword [ebp - 0x280], eax
call fcn.0041e510
add esp, 0x18
jmp 0x40c85c
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x120], esp
push ecx
mov ecx, edx
call fcn.00419080
mov dword [ebp - 0x284], eax
call fcn.00411270
add esp, 0x18
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00418810
push eax
push str.NInstall::install____5__path:_s_n
push 1
call fcn.00415200
add esp, 0xc
push str.nc5.cab
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x180
call fcn.00419230
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x28c], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x28c]
call fcn.00418800
push eax
lea ecx, [ebp - 0x74]
call fcn.00418b10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x138]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
call fcn.0040b160
mov edx, dword [ebp - 0x268]
cmp dword [edx + 0x124], 0
je 0x40ca64
push str.Install
lea eax, [ebp - 0x168]
push eax
push 0x48e1f4
lea ecx, [ebp - 0x150]
push ecx
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00419230
mov dword [ebp - 0x290], eax
mov edx, dword [ebp - 0x290]
mov dword [ebp - 0x294], edx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x294]
call fcn.00419230
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x29c]
call fcn.00418800
push eax
lea ecx, [ebp - 0x24]
call fcn.00418b10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x168]
call fcn.004186d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x150]
call fcn.004186d0
push 0
lea ecx, [ebp - 0x24]
call fcn.00418810
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x48e1f4
lea ecx, [ebp - 0x1b0]
push ecx
push str.Install
lea edx, [ebp - 0x198]
push edx
push 0x48e1f4
lea eax, [ebp - 0x180]
push eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00419230
mov dword [ebp - 0x2a0], eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a4], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2a4]
call fcn.00419230
mov dword [ebp - 0x2a8], eax
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x2ac], edx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2ac]
call fcn.00419230
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x2b4]
call fcn.00418800
push eax
lea ecx, [ebp - 0x24]
call fcn.00418b10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1b0]
call fcn.004186d0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x198]
call fcn.004186d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x180]
call fcn.004186d0
jmp 0x40caba
push 0x48e1f4
lea ecx, [ebp - 0x1c8]
push ecx
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00419230
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], edx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2bc]
call fcn.00418800
push eax
lea ecx, [ebp - 0x24]
call fcn.00418b10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c8]
call fcn.004186d0
lea ecx, [ebp - 0x24]
call fcn.00418810
push eax
lea ecx, [ebp - 0x5c]
call fcn.00412fd0
mov eax, dword [ebp - 0x268]
add eax, 0x12c
push eax
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 0xfc]
push edx
lea ecx, [ebp - 0x74]
call fcn.00418810
push eax
lea ecx, [ebp - 0x5c]
call fcn.00413300
test eax, eax
jne 0x40ceb7
lea ecx, [ebp - 0x24]
call fcn.00418810
push eax
lea ecx, [ebp - 0x74]
call fcn.00418810
push eax
push str.NInstall::install____6__extractCabFile___Fail_src:_s_dst:_s__n
push 1
call fcn.00415200
add esp, 0x10
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x268]
cmp dword [eax + 0xfc], 0
je 0x40cdf0
lea ecx, [ebp - 0xa8]
call fcn.00418580
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00418ad0
push 0x48e1f4
lea ecx, [ebp - 0xa8]
call fcn.00419440
call fcn.0041b210
test eax, eax
je 0x40cbc2
push str.n5agent.exe
lea edx, [ebp - 0x1e4]
push edx
call fcn.00404ef0
add esp, 8
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c4], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x264]
or ecx, 1
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], edx
jmp 0x40cc06
push str.n5agent.exe
lea ecx, [ebp - 0x1fc]
call fcn.004185b0
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x264]
or ecx, 2
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2c8], edx
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00419400
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x264]
and edx, 2
je 0x40cc48
and dword [ebp - 0x264], 0xfffffffd
lea ecx, [ebp - 0x1fc]
call fcn.004186d0
mov dword [ebp - 4], 0xf
mov eax, dword [ebp - 0x264]
and eax, 1
je 0x40cc6c
and dword [ebp - 0x264], 0xfffffffe
lea ecx, [ebp - 0x1e4]
call fcn.004186d0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x200], esp
lea edx, [ebp - 0xa8]
push edx
call fcn.00419080
mov dword [ebp - 0x2d4], eax
call fcn.0041dec0
add esp, 0x1c
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00418ad0
push 0x48e1f4
lea ecx, [ebp - 0xa8]
call fcn.00419440
push str.n5start.exe
lea ecx, [ebp - 0xa8]
call fcn.00419440
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x204], esp
lea edx, [ebp - 0xa8]
push edx
call fcn.00419080
mov dword [ebp - 0x2dc], eax
call fcn.0041dec0
add esp, 0x1c
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00418ad0
push 0x48e1f4
lea ecx, [ebp - 0xa8]
call fcn.00419440
push str.n5client.exe
lea ecx, [ebp - 0xa8]
call fcn.00419440
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x208], esp
lea edx, [ebp - 0xa8]
push edx
call fcn.00419080
mov dword [ebp - 0x2e4], eax
call fcn.0041dec0
add esp, 0x1c
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xac], 1
jne 0x40cdbd
cmp dword [ebp - 0xb0], 1
jne 0x40cdbd
cmp dword [ebp - 0xb4], 1
jne 0x40cdbd
push str.NInstall::install____7__exist_important_modules_n
push 1
call fcn.00415200
add esp, 8
mov dword [ebp - 0x90], 1
jmp 0x40cde1
mov ecx, dword [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0xac]
push eax
push str.NInstall::install____8__ret_FALSE_n5agent.exe:_d__n5start.exe:_d__n5client.exe:_d_n
push 1
call fcn.00415200
add esp, 0x14
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa8]
call fcn.004186d0
cmp dword [ebp - 0x90], 0
jne 0x40ceb7
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 4], 0
je 0x40ce65
cmp dword [0x49a3e4], 0
je 0x40ce30
push 0
push 0x482948
push 0x482df0
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ce4c
push 0
push 0x482948
push str.decompression_error_has_occurred..
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x28
push 0
push 0x472
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 3
call fcn.0040b800
add esp, 4
mov dword [ebp - 0x20c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004186d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004186d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004186d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412f90
mov eax, dword [ebp - 0x20c]
jmp 0x40d50c
mov edx, dword [ebp - 0x268]
cmp dword [edx + 0x124], 0
je 0x40cf72
lea ecx, [ebp - 0xcc]
call fcn.00418580
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x268]
add eax, 0x150
push eax
lea ecx, [ebp - 0xcc]
call fcn.00418ad0
push 0x48e1f4
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0xcc]
call fcn.00419230
mov dword [ebp - 0x2ec], eax
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f0], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x2f0]
call fcn.00418800
push eax
lea ecx, [ebp - 0xcc]
call fcn.00418b10
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x224]
call fcn.004186d0
lea ecx, [ebp - 0xcc]
call fcn.00418810
push eax
lea ecx, [ebp - 0x24]
call fcn.00418810
push eax
mov ecx, dword [ebp - 0x268]
call fcn.0040c2d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcc]
call fcn.004186d0
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40cf97
push 0x28
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
call fcn.0040d970
lea ecx, [ebp - 0x74]
call fcn.00418810
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x44]
call fcn.00418810
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 0x11c]
push ecx
mov ecx, dword [ebp - 0x268]
call fcn.0040b810
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40d095
mov edx, dword [ebp - 0x268]
cmp dword [edx + 4], 0
je 0x40d04d
cmp dword [0x49a3e4], 0
je 0x40d018
push 0
push 0x482948
push 0x482da8
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d034
push 0
push 0x482948
push str.Set_automatic_removal_has_failed.
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x28
push 0
push 0x472
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004186d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004186d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004186d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412f90
mov eax, dword [ebp - 0x228]
jmp 0x40d50c
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40d0fd
push 0x37
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40d0e1
push 0x482d6c
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40d0fd
push str.create_shortcut_icon..
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
call fcn.0040ece0
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 4], 0
je 0x40d170
push 0x3c
push 0
push 0x46f
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40d154
push str.Agent
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40d170
push str.make_initialization_Agent_program..
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x268]
cmp dword [edx + 0xc0], 0
je 0x40d288
mov eax, dword [ebp - 0x268]
cmp dword [eax + 0xc4], 0
je 0x40d288
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 4], 0
je 0x40d1d7
push 0x63
push 0
push 0x46f
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48e349
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40d1f9
push 0x1000
push 0x482948
push 0x482ce4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d210
push 0x1000
push 0x482948
push str.PC_Rebooting_is_required_after_uninstalling_4.x_Agent.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x268]
call fcn.0040d8f0
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40d240
push 0
push 0
push 0x471
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x22c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004186d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004186d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004186d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412f90
mov eax, dword [ebp - 0x22c]
jmp 0x40d50c
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x268]
cmp dword [eax + 0x9c], 0
jne 0x40d2b1
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 0xc8], 0
je 0x40d2c3
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call fcn.00415840
add esp, 4
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 0xc8], 0
je 0x40d345
mov edx, dword [ebp - 0x268]
cmp dword [edx + 4], 0
je 0x40d33a
push 0x5a
push 0
push 0x46f
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x49a3e4], 0
je 0x40d31e
push 0x482c8c
push 0
push 0x473
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40d33a
push str.install_remote_control_program..
push 0
push 0x473
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x268]
call fcn.00410450
mov eax, dword [ebp - 0x268]
cmp dword [eax + 4], 0
je 0x40d386
push 0x63
push 0
push 0x46f
mov ecx, dword [ebp - 0x268]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x48e349
push 0
push 0x473
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x268]
cmp dword [edx + 0x9c], 0
je 0x40d49a
lea ecx, [ebp - 0xe4]
call fcn.00418580
mov byte [ebp - 4], 0x14
call fcn.0041af90
test eax, eax
jne 0x40d40c
push 0x482c58
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00419230
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f8], ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x2f8]
call fcn.00418800
push eax
lea ecx, [ebp - 0xe4]
call fcn.00418b10
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x244]
call fcn.004186d0
jmp 0x40d465
push 0x482c48
lea edx, [ebp - 0x25c]
push edx
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00419230
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x300]
call fcn.00418800
push eax
lea ecx, [ebp - 0xe4]
call fcn.00418b10
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x25c]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
add ecx, 0x150
call fcn.00418810
push eax
lea ecx, [ebp - 0xe4]
call fcn.00418810
push eax
call fcn.0041aa00
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe4]
call fcn.004186d0
mov ecx, dword [ebp - 0x268]
cmp dword [ecx + 4], 0
je 0x40d4bf
push 0
push 0
push 0x471
mov edx, dword [ebp - 0x268]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.0040b800
add esp, 4
mov dword [ebp - 0x260], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004186d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004186d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004186d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00412f90
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret