Function at 0x404500
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1274
call fcn.0041bb10
mov eax, dword [0x454670]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
xor ebx, ebx
push str.GlobaliNodeDamaInstallMtx
push ebx
push ebx
mov dword [ebp - 0x1268], ebx
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x126c], ebx
mov dword [ebp - 0x122c], 0xf
mov dword [ebp - 0x1230], ebx
mov byte [ebp - 0x1240], al
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [ebp - 0x1264], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1268], eax
cmp esi, ebx
je 0x4045bc
cmp eax, 0xb7
jne 0x4045bc
push str.Last_session_is_still_in.
call fcn.004013e8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x122c], 0x10
jb 0x40539e
mov eax, dword [ebp - 0x1240]
push eax
call fcn.0041a6fe
add esp, 4
jmp 0x40539e
push 0x21
lea ecx, [ebp - 0x48]
push ecx
push str.ClientId
push str.SOFTWAREiNodeDAM_Agent
push 0x80000002
call fcn.00401708
add esp, 0x14
test eax, eax
je 0x4045ee
lea eax, [ebp - 0x48]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4045e3
sub eax, edx
jne 0x40464b
lea edx, [ebp - 0x1268]
push edx
lea eax, [ebp - 0x1260]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov dword [ebp - 0x1260], 0x21
call fcn.00401505
add esp, 0xc
test eax, eax
jne 0x40464b
push str.Fail_1.
call fcn.004013e8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x122c], 0x10
jb 0x40539e
mov edx, dword [ebp - 0x1240]
push edx
call fcn.0041a6fe
add esp, 4
jmp 0x40539e
lea eax, [ebp - 0x48]
push eax
push str.ClientId
push str.SOFTWAREiNodeDAM_Agent
push 0x80000002
call fcn.004016e0
add esp, 0x10
test eax, eax
jne 0x40469f
push str.Fail_2
call fcn.004013e8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x122c], 0x10
jb 0x40539e
mov ecx, dword [ebp - 0x1240]
push ecx
call fcn.0041a6fe
add esp, 4
jmp 0x40539e
lea edx, [ebp - 0x48]
push edx
push str.ClientId
push str.SOFTWAREiNodeDAM_Agent
push 0x80000002
call fcn.004013fc
add esp, 0x10
test eax, eax
jne 0x4046c8
push str.Fail_21
jmp 0x40458c
lea ecx, [ebp - 0x48]
push ecx
push str.C:iNode_DAM_Agent_
lea edx, [ebp - 0x150]
push 0x44a780
push edx
call fcn.0041b190
push str.DamAgent.exe
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x1224]
push str._s_s
push ecx
call fcn.0041b190
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
add esp, 0x20
push str.GlobaliNodeDamaSrvMutex
push ebx
push 0x1f0001
call edi
cmp eax, ebx
je 0x404739
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x1224]
push edx
mov dword [ebp - 0x126c], 1
call fcn.00401636
add esp, 4
push str.C:iNode_DAM_Agent
call fcn.00401924
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test eax, eax
jne 0x404758
push ebx
push str.C:iNode_DAM_Agent
call esi
lea eax, [ebp - 0x150]
push eax
call fcn.00401924
add esp, 4
test eax, eax
jne 0x404775
push ebx
lea ecx, [ebp - 0x150]
push ecx
call esi
mov dword [ebp - 0x1260], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x126c], 0
je 0x4047c7
push str.Global_evnt_Rem_mon_switch_
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x4048eb
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.running.
call fcn.004013e8
add esp, 4
push 1
push str.H3C_DAM_Agent
call fcn.004015dc
push 1
push str.iNode_DAM_Agent
call fcn.004015dc
add esp, 0x10
xor esi, esi
push str.GlobaliNodeDamaSrvMutex
push 0
push 0x1f0001
inc esi
call edi
test eax, eax
je 0x404814
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32
call ebx
cmp esi, 0x12c
jb 0x4047e4
push str.Fail_3.1.
jmp 0x40537e
push str.DamAgent.exe
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0x1018]
push str._s_s
push eax
xor esi, esi
call fcn.0041b190
push str.DamAgentTray.exe
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0xf10]
push str._s_s
push edx
call fcn.0041b190
add esp, 0x20
lea eax, [ebp - 0x1018]
push eax
call fcn.00401636
add esp, 4
test eax, eax
jne 0x404879
lea ecx, [ebp - 0xf10]
push ecx
call fcn.00401636
add esp, 4
test eax, eax
je 0x40489c
cmp esi, 0x12c
jae 0x40489c
lea edx, [ebp - 0x150]
push 0x44ab74
push edx
call fcn.00401122
add esp, 8
push 0x32
inc esi
call ebx
jmp 0x404853
lea eax, [ebp - 0x1018]
push eax
call fcn.00401636
add esp, 4
test eax, eax
jne 0x4048c2
lea ecx, [ebp - 0xf10]
push ecx
call fcn.00401636
add esp, 4
test eax, eax
je 0x40491e
cmp dword [ebp - 0x1260], 0
jne 0x405379
push str.Fail_3.2___Try_Again.
call fcn.004013e8
add esp, 4
mov dword [ebp - 0x1260], 1
jmp 0x404781
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xe08]
push str.Fail_3_with_Err__u.
push edx
call fcn.0041b190
lea eax, [ebp - 0xe08]
push eax
call fcn.004013e8
mov ecx, dword [ebp - 0x1264]
add esp, 0x10
push ecx
jmp 0x40538d
call fcn.004018e8
push 0x103
lea eax, [ebp - 0xd87]
push 0
push eax
mov byte [ebp - 0xd88], 0
call fcn.0041b8c0
push 0x103
lea ecx, [ebp - 0xc83]
push 0
push ecx
mov byte [ebp - 0xc84], 0
call fcn.0041b8c0
push 0x104
lea edx, [ebp - 0x86c]
push 0
push edx
call fcn.0041b8c0
add esp, 0x24
push 0x104
lea eax, [ebp - 0x86c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x41
lea esi, [ebp - 0x86c]
lea edi, [ebp - 0xc84]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x86c]
push 0x5c
push ecx
call fcn.0041a710
inc eax
lea edx, [ebp - 0xd88]
add esp, 8
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4049b0
lea edx, [ebp - 0x1270]
push edx
lea eax, [ebp - 0x1274]
push eax
lea ecx, [ebp - 0xc84]
xor esi, esi
push ecx
mov dword [ebp - 0x1274], esi
mov dword [ebp - 0x1270], esi
call fcn.00401717
add esp, 0xc
test eax, eax
je 0x405359
cmp dword [ebp - 0x1274], esi
jne 0x405359
cmp dword [ebp - 0x1270], 0x64000
jbe 0x405359
push 1
lea edx, [ebp - 0x86c]
push 0x104
push edx
call fcn.004015af
add esp, 0xc
test eax, eax
jne 0x404a3c
push str.Fail_5.
call fcn.004013e8
mov eax, dword [ebp - 0x1264]
add esp, 4
push eax
jmp 0x40538d
push 0x64000
lea ecx, [ebp - 0x1268]
push ecx
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x86c]
push ecx
call fcn.004010a5
add esp, 0x14
test eax, eax
jne 0x404a8f
mov edx, dword [ebp - 0x1268]
push edx
lea eax, [ebp - 0x24]
push str.Fail_6_err_is__d
push eax
call fcn.0041b190
lea ecx, [ebp - 0x24]
push ecx
call fcn.004013e8
add esp, 0x10
jmp 0x405386
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._slog
push ecx
call fcn.0041b190
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._sSoftDlvrMng
push ecx
call fcn.0041b190
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._sdata
push ecx
call fcn.0041b190
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._s_resources
push ecx
call fcn.0041b190
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._s_resourcesen_us
push ecx
call fcn.0041b190
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x45c]
push str._s_resourceszh_cn
push ecx
call fcn.0041b190
add esp, 0xc
push 0
lea edx, [ebp - 0x45c]
push edx
call esi
push str.DamAgent.res
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x970]
push str._s_resourcesen_us_s
push ecx
call fcn.0041b190
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea edx, [ebp - 0x970]
push edx
call esi
push str.DamAgent_en.res
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x768]
push str._s_s
push ecx
call fcn.0041b190
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
add esp, 0x10
lea edx, [ebp - 0x970]
push edx
lea eax, [ebp - 0x768]
push eax
call edi
push str.DamAgent.res
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x970]
push str._s_resourceszh_cn_s
push edx
call fcn.0041b190
add esp, 0x10
lea eax, [ebp - 0x970]
push eax
call esi
push str.DamAgent_zh.res
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x768]
push str._s_s
push edx
call fcn.0041b190
add esp, 0x10
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x768]
push ecx
call edi
push 0x104
lea edx, [ebp - 0x664]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x664]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404c50
mov ecx, dword [str._system32]
mov edx, dword [0x44aa40]
mov dword [eax], ecx
mov cx, word [0x44aa44]
mov dword [eax + 4], edx
lea edx, [ebp - 0x150]
push edx
mov word [eax + 8], cx
lea eax, [ebp - 0x254]
push str._sDamAgent.exe
push eax
call fcn.0041b190
add esp, 0xc
call fcn.004016fe
test eax, eax
je 0x404cb2
push str.DamAgent64.exe
lea ecx, [ebp - 0x150]
push ecx
push str._s_s
lea edx, [ebp - 0x768]
push edx
jmp 0x404cca
push str.DamAgent32.exe
lea eax, [ebp - 0x150]
push eax
push str._s_s
lea ecx, [ebp - 0x768]
push ecx
call fcn.0041b190
add esp, 0x10
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x768]
push eax
call fcn.0041bad6
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x358]
push str._sDamAgent.exe
push edx
call fcn.0041b190
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x14
push 0
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x254]
push ecx
call esi
call fcn.004016fe
test eax, eax
je 0x404d3d
call fcn.004017a8
push 0
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x254]
push eax
call esi
call fcn.00401014
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x254]
push str._sDamAgentTray.exe
push edx
call fcn.0041b190
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x358]
push str._sDamAgentTray.exe
push ecx
call fcn.0041b190
add esp, 0x18
push 0
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x254]
push eax
call esi
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x254]
push str._s_svchost.exe
push edx
call fcn.0041b190
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x358]
push str._shssvchost.exe
push ecx
call fcn.0041b190
add esp, 0x18
push 0
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x254]
push eax
call esi
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x254]
push str._sAPIRead.exe
push edx
call fcn.0041b190
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x358]
push str._sAPIRead.exe
push ecx
call fcn.0041b190
add esp, 0x18
push 0
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x254]
push eax
call esi
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x254]
push str._sChkRead.dll
push edx
call fcn.0041b190
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x358]
push str._sChkRead.dll
push ecx
call fcn.0041b190
add esp, 0x18
push 0
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x254]
push eax
call esi
call fcn.004016fe
test eax, eax
je 0x404e76
call fcn.004017a8
push 0
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x254]
push edx
call esi
call fcn.00401014
push str.DamAgent.ini
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x111c]
push str._s_s
push ecx
call fcn.0041b190
add esp, 0x10
lea edx, [ebp - 0x111c]
push edx
push 1
push str.LvdunDlp
push str.MainInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, 0x10
cmp eax, 1
jne 0x405113
push str.components
push str.C:iNode_DAM_Agent_
lea eax, [ebp - 0xb80]
push 0x44a780
push eax
call fcn.0041b190
lea ecx, [ebp - 0xb80]
push ecx
call fcn.00401924
add esp, 0x14
test eax, eax
jne 0x404ef9
push eax
lea edx, [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x254]
push str._scomponents.zip
push ecx
call fcn.0041b190
lea edx, [ebp - 0x254]
push edx
call fcn.00401636
add esp, 0x10
test eax, eax
je 0x405075
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x125c]
call fcn.0040182f
push 8
push str.7za.exe
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 4
push str._x__
lea ecx, [ebp - 0x125c]
call fcn.0040181b
lea eax, [ebp - 0x254]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404f67
sub eax, edx
push eax
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 1
push 0x44a930
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 4
push str.__o_
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 0x13
push str.C:iNode_DAM_Agent_
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 4
push str.tmp_
lea ecx, [ebp - 0x125c]
call fcn.0040181b
push 3
push 0x44a91c
lea ecx, [ebp - 0x125c]
call fcn.0040181b
mov eax, dword [ebp - 0x125c]
cmp dword [ebp - 0x1248], edi
jae 0x404ff1
lea eax, [ebp - 0x125c]
push eax
call fcn.004013e8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1260], esp
push str.DamSetup
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.0040182f
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x125c]
push eax
call fcn.0040147e
add esp, 0x24
test eax, eax
je 0x405062
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], edi
jae 0x405040
lea eax, [ebp - 0x20]
push eax
call fcn.004013e8
mov eax, dword [ebp - 0x20]
add esp, 4
cmp dword [ebp - 0xc], edi
jae 0x405054
lea eax, [ebp - 0x20]
push str.Everything_is_Ok
push eax
call fcn.0041ba50
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.004016db
lea ecx, [ebp - 0x125c]
call fcn.004016db
push str.tmpcomponents
push str.C:iNode_DAM_Agent_
lea ecx, [ebp - 0xa78]
push 0x44a780
push ecx
call fcn.0041b190
lea edx, [ebp - 0xa78]
push edx
call fcn.004014ab
lea eax, [ebp - 0xa78]
push eax
call fcn.00401519
lea ecx, [ebp - 0xa78]
push ecx
call fcn.004013e8
lea edx, [ebp - 0xb80]
push edx
call fcn.004013e8
lea eax, [ebp - 0x1268]
push eax
push 5
lea ecx, [ebp - 0xb80]
push ecx
lea edx, [ebp - 0xa78]
push edx
call fcn.004011ef
add esp, 0x30
test eax, eax
jne 0x405118
mov eax, dword [ebp - 0x1268]
push eax
lea ecx, [ebp - 0x24]
push str.Fail_7_err_is__d
push ecx
call fcn.0041b190
lea edx, [ebp - 0x24]
push edx
call fcn.004013e8
mov eax, dword [ebp - 0x1264]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405118
call fcn.00401942
push str.H3C_DAM_Agent
call fcn.004010aa
push str.iNode_DAM_Agent
call fcn.004010aa
add esp, 8
push 0x64
call ebx
push 0x103
lea ecx, [ebp - 0x55f]
push 0
push ecx
mov byte [ebp - 0x560], 0
call fcn.0041b8c0
push str.DamAgent.exe
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0x560]
push str._s_s
push eax
call fcn.0041b190
lea ecx, [ebp - 0x560]
push ecx
call fcn.00401636
add esp, 0x20
test eax, eax
jne 0x4051e0
push 0xf
push str.szDamAgentPath
lea ecx, [ebp - 0x1240]
call fcn.00401253
lea eax, [ebp - 0x560]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405198
sub eax, edx
push eax
lea edx, [ebp - 0x560]
push edx
lea ecx, [ebp - 0x1240]
call fcn.0040181b
push 0x11
push str.__is_not_exist___
lea ecx, [ebp - 0x1240]
call fcn.0040181b
mov eax, dword [ebp - 0x1240]
cmp dword [ebp - 0x122c], edi
jae 0x4051da
lea eax, [ebp - 0x1240]
push eax
jmp 0x4052ec
push 0
push 0
push 0
lea eax, [ebp - 0x560]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xf
push str.szDamAgentPath
lea ecx, [ebp - 0x1240]
mov esi, eax
call fcn.00401253
lea eax, [ebp - 0x560]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405217
sub eax, edx
push eax
lea ecx, [ebp - 0x560]
push ecx
lea ecx, [ebp - 0x1240]
call fcn.0040181b
mov eax, esi
cdq
push edx
push eax
lea edx, [ebp - 0x125c]
push edx
call fcn.004018cf
push eax
lea eax, [ebp - 0x20]
push str.__hRet
push eax
call fcn.0040161d
add esp, 0x18
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x1240]
call fcn.00401690
lea ecx, [ebp - 0x20]
call fcn.004016db
lea ecx, [ebp - 0x125c]
call fcn.004016db
mov eax, dword [ebp - 0x1240]
cmp dword [ebp - 0x122c], edi
jae 0x40528d
lea eax, [ebp - 0x1240]
push eax
call fcn.004013e8
add esp, 4
cmp esi, 0x20
jge 0x4052aa
lea ecx, [ebp - 0x560]
push ecx
call fcn.0041b966
add esp, 4
xor esi, esi
lea edi, [esi + 4]
nop
lea edx, [ebp - 0x1260]
push edx
push str.iNode_DAM_Agent
mov dword [ebp - 0x1260], 0
call fcn.004014b5
add esp, 8
cmp dword [ebp - 0x1260], edi
je 0x405352
push 0x32
inc esi
call ebx
cmp esi, 0x4b0
jb 0x4052b0
push str.iNode_DAM_Agent_is_not_running___
call fcn.004013e8
add esp, 4
cmp dword [ebp - 0x126c], 0
je 0x405322
push str.Global_evnt_Rem_mon_switch_
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x405322
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1264]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1240]
call fcn.004016db
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b181
mov esp, ebp
pop ebp
ret 0x10
push str.iNode_DAM_Agent_is_running.
jmp 0x4052ec
push str.Fail_4.
call fcn.004013e8
mov ecx, dword [ebp - 0x1264]
add esp, 4
mov dword [ebp - 0x1268], 0x160
push ecx
jmp 0x40538d
push str.Fail_3.2.
call fcn.004013e8
add esp, 4
mov edx, dword [ebp - 0x1264]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1240]
call fcn.004016db
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041b181
mov esp, ebp
pop ebp
ret 0x10