Function at 0x4c92c0
Capabilities:
Copy file
Create directory
Delete directory
Delete registry key
Get common file path
Query service status
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x5b0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x1c], edx
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
call fcn.004c8720
test eax, eax
jne 0x4c931f
push str.Requires_administrator_permissions._r_n
call fcn.004010e0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4c932a
push str.Performing_uninstall..._r_n
jmp 0x4c932f
push str.Performing_install..._r_n
call fcn.004010e0
add esp, 4
call fcn.004c9160
xor ebx, ebx
nop
push 0x64
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4c93ac
push 0x10004
push str.Mesh_Agent
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4c9393
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push dword [esp + 0x20]
test eax, eax
cmovne esi, dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4c9398
mov esi, 0x64
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, 3
jne 0x4c93ac
cmp ebx, 0x190
jl 0x4c9340
mov ecx, str.Mesh_Agent
call fcn.004c8fc0
mov ecx, 0x620704
call fcn.004c8fc0
push 0x104
lea eax, [esp + 0x27c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, eax
lea eax, [esp + 0x149]
push eax
push 0
push 0
push 0x8026
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
je 0x4c9444
lea eax, [esp + 0x149]
mov byte [esp + 0x148], 0x22
push 0x12c
push eax
call fcn.0058cca6
mov ebx, eax
add esp, 8
cmp ebx, 0x104
ja 0x4c943b
push 0x26
mov edx, 0x12c
lea ecx, [esp + 0x14d]
push str.Mesh_AgentMeshAgent.exe___uninstall
sub edx, ebx
add ecx, ebx
call fcn.00401000
add esp, 8
add ebx, 0x19
mov dword [esp + 0x14], ebx
jmp 0x4c9446
xor ebx, ebx
cmp dword [esp + 0x10], 0
je 0x4c953c
cmp ebx, edi
jne 0x4c953c
mov esi, ebx
lea ecx, [esp + 0x278]
lea edx, [esp + 0x149]
sub esi, 4
jb 0x4c9481
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c9486
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c9470
cmp esi, 0xfffffffc
je 0x4c94ba
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c94b3
cmp esi, 0xfffffffd
je 0x4c94ba
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c94b3
cmp esi, 0xfffffffe
je 0x4c94ba
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4c94b3
cmp esi, 0xffffffff
je 0x4c94ba
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4c94ba
sbb eax, eax
or eax, 1
jmp 0x4c94bc
xor eax, eax
test eax, eax
jne 0x4c953c
lea eax, [esp + 0x488]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x12c
lea esi, [esp + 0x488]
sub edi, eax
add esi, eax
push 0xf
push 0x620a4c
mov edx, edi
mov ecx, esi
call fcn.00401000
lea eax, [esp + 0x490]
push eax
call fcn.00592c39
add esp, 0xc
lea eax, [esp + 0x488]
push 0
push eax
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1e
push str.MeshAgent.exe__fulluninstall
mov edx, edi
mov ecx, esi
call fcn.00401000
add esp, 8
lea ecx, [esp + 0x488]
xor edx, edx
jmp 0x4c9e44
mov edx, 1
lea ecx, [esp + 0x148]
call fcn.004c9200
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x620a7c
push reloc.WS2_32.dll_bind
call esi
push 0x620a9c
push reloc.WS2_32.dll_accept
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMeshCentralAgent
push reloc.WS2_32.dll_bind
call esi
cmp dword [esp + 0x10], 0
jne 0x4c95ee
cmp ebx, edi
jne 0x4c95ee
mov esi, ebx
lea ecx, [esp + 0x278]
lea edx, [esp + 0x149]
sub esi, 4
jb 0x4c95a8
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4c95b1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4c9597
cmp esi, 0xfffffffc
je 0x4c9dd6
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4c95ee
cmp esi, 0xfffffffd
je 0x4c9dd6
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4c95ee
cmp esi, 0xfffffffe
je 0x4c9dd6
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4c95ee
cmp esi, 0xffffffff
je 0x4c9dd6
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4c9dd6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov byte [esp + ebx + 0x149], 0
nop
push 0x64
call edi
lea eax, [esp + 0x149]
inc esi
push eax
call fcn.00592c39
add esp, 4
test eax, eax
je 0x4c9626
cmp eax, 0xffffffff
je 0x4c9626
cmp esi, 0x190
jl 0x4c9600
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x48]
call fcn.00401000
mov ebx, 0x101
lea ecx, [esp + esi + 0x45]
push 4
mov edx, ebx
push 0x620abc
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 5
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push str.mshx
sub edx, esi
call fcn.00401000
inc esi
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xfd
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 6
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x620ac8
sub edx, esi
call fcn.00401000
add esi, 2
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
cmp dword [esp + 0x10], 0
je 0x4c98dc
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x620ad0
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x620ad4
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
lea eax, [esp + 0x149]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xfc
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [ebx + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 3
mov edx, ebx
lea ecx, [esp + esi + 0x49]
push 0x620ad8
sub edx, esi
call fcn.00401000
add esp, 0x10
cmp esi, 0x104
jae 0x4c9e5e
lea eax, [esp + 0x40]
mov byte [esp + esi + 0x40], 0
push eax
call fcn.00592c39
add esp, 4
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x149]
push eax
mov byte [esp + edi + 0x13f], 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [esp + 0x10], 0
jne 0x4c9e49
push 0
lea eax, [esp + 0x14d]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c9968
call esi
cmp eax, 5
jne 0x4c9968
call esi
push eax
push 0
push 0x2ee
mov edx, 0x620adc
mov ecx, 0x620aec
call fcn.004b47e0
add esp, 0xc
call esi
push eax
push str.Access_denied__1_
push 0x620b14
call fcn.004010e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x149]
push 1
push eax
lea eax, [esp + 0x280]
mov byte [esp + edi + 0x143], 0x5c
push eax
xor edi, edi
call ebx
test eax, eax
jne 0x4c99ca
call esi
cmp eax, 5
je 0x4c9b7a
mov eax, edi
inc edi
cmp eax, 5
jg 0x4c9b34
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [esp + 0x14d]
push eax
lea eax, [esp + 0x280]
push eax
call ebx
test eax, eax
je 0x4c9990
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
cmp esi, 4
jl 0x4c9e49
lea eax, [esp + 0x278]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x388]
call fcn.00401000
mov edi, 0x101
lea ecx, [esp + esi + 0x385]
push 4
mov edx, edi
push 0x620bd8
sub edx, esi
call fcn.00401000
lea eax, [esp + 0x159]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 0x18
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [edi + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, edi
lea ecx, [esp + esi + 0x49]
push 0x620bdc
sub edx, esi
call fcn.00401000
add esp, 0x10
lea eax, [esp + 0x40]
push 1
push eax
lea eax, [esp + 0x388]
push eax
call ebx
cmp dword [esp + 0x18], 0
je 0x4c9bc9
lea eax, [esp + 0x149]
mov dword [esp + 0x10], 0
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
push esi
push eax
lea edx, [edi + 3]
lea ecx, [esp + 0x48]
call fcn.00401000
push 4
mov edx, edi
lea ecx, [esp + esi + 0x49]
push 0x620be0
sub edx, esi
call fcn.00401000
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x50]
add esp, 0x10
test esi, esi
jle 0x4c9bc0
push 0x620be4
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058bf3b
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4c9bc9
push eax
push esi
push 1
push dword [esp + 0x24]
call fcn.0058bc60
push dword [esp + 0x20]
call fcn.00588467
add esp, 0x14
jmp 0x4c9bc9
call esi
push eax
push 0
push 0x2f6
mov edx, 0x620b74
mov ecx, 0x620b84
call fcn.004b47e0
add esp, 0xc
call esi
push eax
push str.Error_copying_executable_file
push str.ILIBMSG:__s___d_._r_n
call fcn.004010e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
call esi
push eax
push 0
push 0x2f5
mov edx, 0x620b28
mov ecx, 0x620b38
call fcn.004b47e0
add esp, 0xc
call esi
push eax
push str.Access_denied__2_
push 0x620b60
call fcn.004010e0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
push eax
call fcn.00592c39
add esp, 4
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.0058cca6
mov esi, eax
add esp, 8
cmp esi, 4
jl 0x4c9e49
lea eax, [esp + 0x278]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x388]
call fcn.00401000
push 6
mov edx, edi
lea ecx, [esp + esi + 0x389]
push 0x620be8
sub edx, esi
call fcn.00401000
lea eax, [esp + 0x159]
push 0x12c
push eax
call fcn.0058cca6
mov esi, eax
add esp, 0x18
lea ecx, [esi - 4]
cmp ecx, 0xff
ja 0x4c9e49
lea eax, [esp + 0x149]
mov edx, 0x104
push esi
push eax
lea ecx, [esp + 0x48]
call fcn.00401000
push 6
sub edi, esi
lea ecx, [esp + esi + 0x49]
push 0x620bf0
mov edx, edi
call fcn.00401000
mov edi, dword [esp + 0x2c]
add esp, 0x10
test edi, edi
je 0x4c9cc3
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4c9cc3
push 0x620bf8
lea eax, [esp + 0x44]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058bf3b
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4c9dd2
push eax
push esi
push 1
push edi
call fcn.0058bc60
push dword [esp + 0x20]
call fcn.00588467
add esp, 0x14
jmp 0x4c9dd2
push 1
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x388]
push eax
call ebx
test eax, eax
jne 0x4c9dd2
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x4c9dd2
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x4c9dbc
push 0x7d0
push eax
push 0xfff
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], 0
push 0x6247a0
push eax
call fcn.00591fb8
add esp, 0x14
test eax, eax
jne 0x4c9db6
push 0x620bfc
push 0x6247a0
call fcn.005861d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4c9d60
push 0x620c04
push esi
call fcn.005861d0
add esp, 8
add esi, 6
test eax, eax
je 0x4c9d65
mov byte [eax], 0
jmp 0x4c9d65
mov esi, 0x6247a0
push 0x620c08
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0058bf3b
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x4c9db6
test esi, esi
jne 0x4c9d8c
xor ecx, ecx
jmp 0x4c9da0
push 0x1000
push esi
call fcn.0058cca6
mov ecx, eax
add esp, 8
mov eax, dword [esp + 0x10]
push eax
push ecx
push 1
push esi
call fcn.0058bc60
push dword [esp + 0x20]
call fcn.00588467
add esp, 0x14
push dword [esp + 0x2c]
call edi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4c9dc7
push eax
call edi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4c9dd2
push eax
call edi
mov ebx, dword [esp + 0x14]
call fcn.004c88f0
movq xmm0, qword [str.___install]
lea ecx, [esp + 0x148]
mov ax, word [0x620c14]
mov edx, 1
movq qword [esp + ebx + 0x149], xmm0
mov word [esp + ebx + 0x151], ax
movzx eax, byte [0x620c16]
mov byte [esp + ebx + 0x153], al
call fcn.004c9200
movq xmm0, qword [str.___start]
lea ecx, [esp + 0x148]
movzx eax, byte [0x620c20]
mov edx, 1
movq qword [esp + ebx + 0x149], xmm0
mov byte [esp + ebx + 0x151], al
call fcn.004c9200
mov ecx, dword [esp + 0x5bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
call fcn.00584b5c
int3