Function at 0x1400c7ad8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa30
mov rax, qword [0x14030ef00]
xor rax, rsp
mov qword [rsp + 0xa20], rax
mov r14, rdx
movsxd rsi, ecx
mov dword [rsp + 0x68], esi
lea eax, [rsi + 1]
mov dword [rsp + 0x50], eax
lea rdi, [rsi*8 + 8]
mov eax, 0xffffffff
mov r13d, 0xffffffe7
cmp rax, rdi
jbe 0x1400c7b43
cmp rdi, r13
jae 0x1400c7b43
lea rcx, [rsi*8 + 0x20]
call fcn.1401ed1fc
xor ebx, ebx
jmp 0x1400c7b47
xor ebx, ebx
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14009fb24
mov rdi, rax
mov qword [rsp + 0x60], rax
mov r15, rsi
test esi, esi
jle 0x1400c7c1b
sub rax, r14
or r12, 0xffffffffffffffff
mov rdi, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x58], eax
movsxd r15, eax
mov eax, 0xffffffff
cmp r15, rax
jae 0x1400c7bbc
cmp r15, r13
jae 0x1400c7bbc
lea rcx, [r15 + 0x18]
call fcn.1401ed1fc
jmp 0x1400c7bbf
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.14009fb24
mov qword [rdi + r14], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add r14, 8
sub rsi, 1
jne 0x1400c7b75
mov rdi, qword [rsp + 0x60]
movsxd rsi, dword [rsp + 0x68]
mov r15, rsi
jmp 0x1400c7c1f
or r12, 0xffffffffffffffff
cmp esi, 1
jle 0x1400c7ff7
lea rdx, str._finstall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._funinstall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c7cb4
lea rdx, str._state
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c7cf3
mov rax, qword [rdi + 8]
mov qword [rdi + r15*8], rax
mov ecx, 0x1c
call fcn.1401ed1fc
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call fcn.14009fb24
mov qword [rdi + 8], rax
lea r8, [0x140275450]
mov rdx, qword [rax - 0x18]
mov rcx, rax
call fcn.140001114
mov esi, dword [rsp + 0x50]
cmp esi, 1
jle 0x1400c7ff7
lea rdx, str._licenses
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c7ff7
lea r15, str._n
mov rcx, r15
call fcn.14000105c
lea rcx, str._MeshCentral_MeshAgent:_Copyright_2006___2022_Intel_Corporation_n
call fcn.14000105c
lea rcx, str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.14000105c
lea r14, str._________________________________________________________________________________________n
mov rcx, r14
call fcn.14000105c
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.14000105c
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.14000105c
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.14000105c
lea rsi, str.____n
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.14000105c
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.14000105c
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.14000105c
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.14000105c
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.14000105c
lea rcx, str.___limitations_under_the_License._n_n
call fcn.14000105c
mov rcx, r15
call fcn.14000105c
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.14000105c
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.14000105c
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.14000105c
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.14000105c
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.14000105c
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.14000105c
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.14000105c
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.14000105c
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.14000105c
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.14000105c
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.14000105c
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.14000105c
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.14000105c
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.14000105c
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.14000105c
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.14000105c
lea rcx, str.___THE_SOFTWARE._n
call fcn.14000105c
mov rcx, r15
call fcn.14000105c
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.14000105c
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.14000105c
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.14000105c
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.14000105c
lea rsi, [0x140274af0]
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.14000105c
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.14000105c
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.14000105c
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.14000105c
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.14000105c
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.14000105c
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.14000105c
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.14000105c
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.14000105c
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.14000105c
mov rcx, rsi
call fcn.14000105c
lea rcx, str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.14000105c
lea rcx, str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.14000105c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9ca6
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
inc r14d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400c7fd6
jmp 0x1400c9ca6
mov r14, rbx
mov qword [rsp + 0x50], rbx
mov r15d, ebx
mov dword [rsp + 0x58], ebx
cmp esi, 1
jle 0x1400c8123
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8123
lea r8, str.Sep_18_2024
lea rdx, str.06:40:41
lea rcx, str.Compiled_on:__s___s_n
call fcn.14000105c
lea rdx, str.87975a8d185eca12152d5b923752a67b20420ff7
lea rcx, str.___Commit_Hash:__s_n
call fcn.14000105c
lea rdx, [0x140273e88]
lea rcx, str.___Commit_Date:__s_n
call fcn.14000105c
xor ecx, ecx
call fcn.1400e71f0
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.14000105c
mov edx, 4
lea rcx, str.Agent_ARCHID:__d_n
call fcn.14000105c
lea rcx, [rsp + 0x600]
lea rax, str.var__tmp__Detected_OS:___require_os_.Name__try_tmp________require_os_.arch____catch_x_console.log__tmp__if_process.platformwin32___tmprequire_win_authenticode_opus__process.execPath___if__tmp_null___tmp.url_null___tmprequire_win_authenticode_opus_.locked__tmp.url___if__tmp_null___console.log_LOCKED_to:____tmp.dns___console.log_______tmp.id______process.exit___
mov edx, 3
lea r13d, [rdx + 0x7d]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, r13
sub rdx, 1
jne 0x1400c80a6
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov r15d, 0x197
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], r15d
jmp 0x1400c8129
mov r13d, 0x80
cmp esi, 2
jle 0x1400c8272
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c81e5
mov qword [rsp + 0x50], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x50]
lea rdx, str._016llx
call fcn.14000f9cc
mov r8, qword [rsp + 0x50]
call fcn.1400a1f38
lea rdx, [0x14031c520]
lea rcx, [0x140271f8c]
call fcn.14000105c
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c81ae
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
inc ebx
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c8194
mov rcx, rdi
call fcn.14009fc04
xor eax, eax
mov rcx, qword [rsp + 0xa20]
xor rcx, rsp
call fcn.1401dbdb0
lea r11, [rsp + 0xa30]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp esi, 2
jle 0x1400c8272
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8272
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.14000f9cc
lea r8, [0x1400a08dc]
sub r8, qword [rsp + 0x50]
call fcn.1400a1f38
lea rdx, [0x14031c520]
lea rcx, [0x140271f8c]
call fcn.14000105c
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c81ae
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
inc ebx
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c8253
jmp 0x1400c81ae
test r14, r14
je 0x1400c827c
test r15d, r15d
jne 0x1400c82ea
mov r8d, 0x104
lea rdx, [rsp + 0x600]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x600]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x810]
call fcn.14008e844
mov r14, qword [rsp + 0x50]
mov r15d, dword [rsp + 0x58]
cmp esi, 1
jle 0x1400c838a
lea rdx, str._export
mov rcx, qword [rdi + 8]
call fcn.1401f8a70
test eax, eax
jne 0x1400c833c
test r15d, r15d
jne 0x1400c833c
xor edx, edx
lea rcx, str.require_code_utils_.expand_embedded:_true__process.exit___
call fcn.1400a9650
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c832c
mov r15d, ebx
jmp 0x1400c833c
mov edx, 0x1000
mov rcx, rax
call fcn.1401ecbac
mov r15d, eax
cmp esi, 1
jle 0x1400c838a
lea rdx, str._import
mov rcx, qword [rdi + 8]
call fcn.1401f8a70
test eax, eax
jne 0x1400c838a
test r15d, r15d
jne 0x1400c838a
xor edx, edx
lea rcx, str.require_code_utils_.shrink___process.exit___
call fcn.1400a9650
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c837a
mov r15d, ebx
jmp 0x1400c838a
mov edx, 0x1000
mov rcx, rax
call fcn.1401ecbac
mov r15d, eax
cmp esi, 2
jle 0x1400c8427
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401f8a70
test eax, eax
jne 0x1400c83d9
test r15d, r15d
jne 0x1400c83d9
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.1400a9650
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c83c9
mov r15d, ebx
jmp 0x1400c83d9
mov edx, 0x1000
mov rcx, rax
call fcn.1401ecbac
mov r15d, eax
cmp esi, 2
jle 0x1400c8427
lea rdx, str._b64exec
mov rcx, qword [rdi + 8]
call fcn.1401f8a70
test eax, eax
jne 0x1400c8427
test r15d, r15d
jne 0x1400c8427
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x1400c8405
mov rax, rbx
jmp 0x1400c840f
mov edx, 0x10000
call fcn.1401ecbac
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, qword [rdi + 0x10]
call fcn.1400a77c0
mov r15d, eax
mov r14, qword [rsp + 0x50]
cmp esi, 1
jle 0x1400c8a26
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c84b3
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402ebdb8]
movups xmmword [rsp + 0x610], xmm1
movups xmm0, xmmword [0x1402ebdc8]
movups xmmword [rsp + 0x620], xmm0
mov eax, dword [0x1402ebdd8]
mov dword [rsp + 0x630], eax
movzx eax, word [0x1402ebddc]
mov word [rsp + 0x634], ax
mov al, byte [0x1402ebdde]
mov byte [rsp + 0x636], al
mov r15d, gethostname
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str._name
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8541
movaps xmm0, xmmword [str.console.log_require__agentNodeId_.serviceName____process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ebe00]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ebe10]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ebe20]
movaps xmmword [rsp + 0x630], xmm1
movzx eax, word [0x1402ebe30]
mov word [rsp + 0x640], ax
mov al, byte [0x1402ebe32]
mov byte [rsp + 0x642], al
mov r15d, 0x42
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str.exstate
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8603
lea rdx, [rsp + 0x600]
lea rax, [0x140000000]
lea rcx, [rax + 0x2ebe40]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, r13
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, r13
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
mov rax, qword [rcx + 0x40]
mov qword [rdx + 0x40], rax
movzx eax, word [rcx + 0x48]
mov word [rdx + 0x48], ax
mov r15d, 0xc9
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c86b3
lea rdx, [rsp + 0x600]
lea rcx, [0x140000000]
lea rcx, [rcx + 0x2ebf10]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, r13
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, r13
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rdx + 0x28], eax
mov r15d, 0xab
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c86e8
lea rdx, [0x1402ebfbc]
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8781
lea rcx, [rsp + 0x600]
lea rax, [0x140000000]
lea rax, [rax + 0x2ebfd0]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, r13
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movzx eax, word [rax + 0x40]
mov word [rcx + 0x40], ax
mov r15d, 0xc1
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c87b2
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c882f
lea rax, [rsp + 0x600]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
mov edx, 2
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, r13
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
add rcx, r13
sub rdx, 1
jne 0x1400c87c6
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov r15d, 0x10f
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c8864
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c88e9
lea rcx, [rsp + 0x600]
lea rax, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
mov edx, 2
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, r13
sub rdx, 1
jne 0x1400c8878
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov r15d, 0x117
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str._agentHash
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8993
test r15d, r15d
jne 0x1400c8993
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ec320]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ec330]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ec340]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402ec350]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402ec360]
movaps xmmword [rsp + 0x650], xmm1
mov al, byte [0x1402ec370]
mov byte [rsp + 0x660], al
mov r15d, 0x60
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8a26
lea rdx, str._agentFullHash
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8a26
test r15d, r15d
jne 0x1400c8a26
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ec3a0]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ec3b0]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ec3c0]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402ec3d0]
movaps xmmword [rsp + 0x640], xmm0
mov al, byte [0x1402ec3e0]
mov byte [rsp + 0x650], al
mov r15d, 0x50
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 2
jne 0x1400c8ad4
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8ad4
movaps xmm0, xmmword [str.tryrequire__agentNodeId_.resetNodeId___catch_z_console.log_This_command_requires_admin.__process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ec410]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ec420]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ec430]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402ec440]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402ec450]
movaps xmmword [rsp + 0x650], xmm1
movaps xmm0, xmmword [0x1402ec460]
movaps xmmword [rsp + 0x660], xmm0
mov al, byte [0x1402ec470]
mov byte [rsp + 0x670], al
lea r15d, [rsi + 0x6e]
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8bbb
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8b48
movups xmm0, xmmword [str.require_agent_installer_.setfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402ec498]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402ec4a8]
movsd qword [rsp + 0x620], xmm0
movzx eax, word [0x1402ec4b0]
mov word [rsp + 0x628], ax
mov r15d, 0x29
mov edx, r15d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
cmp esi, 1
jle 0x1400c8bbb
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8bbb
movups xmm0, xmmword [str.require_agent_installer_.clearfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402ec4d8]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402ec4e8]
movsd qword [rsp + 0x620], xmm0
mov eax, dword [0x1402ec4f0]
mov dword [rsp + 0x628], eax
mov r13d, 0x2b
mov edx, r13d
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
mov r15d, r13d
jmp 0x1400c8bc1
mov r13d, 0x2b
cmp esi, 1
jle 0x1400c8c2c
lea rdx, str._checkfirewall
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8c2c
movups xmm0, xmmword [str.require_agent_installer_.checkfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402ec518]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402ec528]
movsd qword [rsp + 0x620], xmm0
mov eax, dword [0x1402ec530]
mov dword [rsp + 0x628], eax
mov rdx, r13
lea rcx, [rsp + 0x600]
call fcn.1400a9650
mov r14, rax
mov r15d, r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov r13d, 1
cmp esi, r13d
jle 0x1400c8f31
lea rdx, str._updaterversion
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8cb5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea r8d, [r13 + 1]
lea rdx, [0x1402ec548]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c81ae
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c8c95
jmp 0x1400c81ae
cmp esi, r13d
jle 0x1400c8f31
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8df3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14009fdfc
mov r15, rax
lea rax, [0x1400c7930]
mov qword [r15], rax
mov dword [r15 + 0x10], ebx
cmp esi, 2
jle 0x1400c8d13
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401ebc00
test eax, eax
mov eax, r13d
je 0x1400c8d15
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400c8d32
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401ebc00
test eax, eax
je 0x1400c8d4b
cmp esi, 3
jle 0x1400c8d52
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8d52
mov dword [0x140317360], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400c8d96
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400c8d96
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400c8dae
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400c8db4
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r15
call fcn.140011c6c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9ca6
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400c8dd2
jmp 0x1400c9ca6
cmp esi, r13d
jle 0x1400c8f31
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8f31
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14009fdfc
mov r15, rax
lea rax, [0x1400c7930]
mov qword [r15], rax
mov dword [r15 + 0x10], r13d
cmp esi, 2
jle 0x1400c8e51
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401ebc00
test eax, eax
mov eax, r13d
je 0x1400c8e53
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400c8e70
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401ebc00
test eax, eax
je 0x1400c8e89
cmp esi, 3
jle 0x1400c8e90
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401ebc00
test eax, eax
jne 0x1400c8e90
mov dword [0x140317360], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400c8ed4
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400c8ed4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400c8eec
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400c8ef2
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r15
call fcn.140011c6c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9ca6
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400c8f10
jmp 0x1400c9ca6
test r14, r14
jne 0x1400c9bb5
test esi, esi
jle 0x1400c8f55
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.1401ebc00
test eax, eax
je 0x1400c9bb5
cmp esi, r13d
jle 0x1400c9133
lea rdx, [0x140275450]
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c9bb5
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c9bb5
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c9bb5
cmp esi, r13d
jle 0x1400c9133
mov rax, qword [rdi + 8]
movabs rcx, 0x3a6574616470752d
cmp qword [rax], rcx
jne 0x1400c90f9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r15d, 0x400
mov ecx, r15d
call fcn.14009fdfc
mov r14, rax
mov rcx, qword [rdi + 8]
cmp byte [rcx + 8], 0x2a
jne 0x1400c902a
cmp esi, 2
jle 0x1400c8ff4
mov rax, qword [rdi + 0x10]
jmp 0x1400c8ffb
lea rax, str.null
lea r8, str.true
lea r9, str.false
cmp byte [rcx + 9], 0x53
cmove r9, r8
mov qword [rsp + 0x20], rax
lea r8, str.require_agent_installer_.update__s___s__
mov rdx, r15
mov rcx, r14
call fcn.140001114
jmp 0x1400c9081
cmp esi, 2
jle 0x1400c906f
lea rdx, [0x140275450]
mov rcx, qword [rdi + 0x10]
call fcn.1401f8a70
test eax, eax
je 0x1400c9057
lea rdx, str.connect
mov rcx, qword [rdi + 0x10]
call fcn.1401f8a70
test eax, eax
jne 0x1400c906f
mov r9, qword [rdi + 0x10]
lea r8, str.require_agent_installer_.update_false____s___
mov rdx, r15
mov rcx, r14
call fcn.140001114
jmp 0x1400c9081
lea r8, str.require_agent_installer_.update_true__
mov rdx, r15
mov rcx, r14
call fcn.140001114
mov r15d, eax
xor ecx, ecx
call fcn.14000a150
mov qword [0x140317fa0], rax
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r15d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000e6ec
mov rax, qword [0x140317fa0]
mov r14d, dword [rax + 0xdb4]
mov dword [rsp + 0x70], r14d
call fcn.14000ee44
mov qword [0x140317fa0], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9ca3
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c90d9
jmp 0x1400c9ca3
cmp esi, r13d
jle 0x1400c9133
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c9133
lea rcx, [rsp + 0x60]
call fcn.14001396c
test eax, eax
jle 0x1400c9b7c
mov rcx, qword [rsp + 0x60]
call fcn.1400c722c
jmp 0x1400c9b7c
mov r15d, ebx
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x600], rax
lea rax, [0x1400c7710]
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x610], rbx
mov qword [rsp + 0x618], rbx
mov dword [0x140318270], esi
mov qword [0x140318260], rdi
lea rcx, [rsp + 0x600]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400c9b7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400c9b7c
cmp esi, 2
jl 0x1400c9346
mov dword [rsp + 0x20], r13d
mov r9d, 3
lea r8, [0x1402757cc]
mov rdx, r12
mov rcx, qword [rdi + 8]
call fcn.1400a910c
test eax, eax
jne 0x1400c91e3
mov dword [rsp + 0x20], r13d
lea r9d, [rax + 4]
lea r8, str..zip
mov rdx, r12
mov rcx, qword [rdi + 8]
call fcn.1400a910c
test eax, eax
je 0x1400c9227
mov edx, r13d
lea rcx, [0x1400c7974]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.14000a150
mov qword [0x140317fa0], rax
mov dword [rax + 0xdfc], r13d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000e6ec
call fcn.14000ee44
mov qword [0x140317fa0], rbx
jmp 0x1400c9b7c
cmp esi, 2
jne 0x1400c9346
lea rdx, [0x1402ec614]
mov rcx, qword [rdi + 8]
call fcn.1401f8a70
test eax, eax
jne 0x1400c9346
mov r13d, 0x104
mov r8d, r13d
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x810]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.1400a0744
mov rsi, rax
mov rcx, rax
call fcn.1400a3c98
call fcn.140091514
mov rcx, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x600]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
call fcn.140092090
mov r15, rax
mov r14d, 0xe88
mov r9d, r14d
lea rdx, str.require_util_language_.current.toUpperCase__.split___.join____
mov rcx, rax
call fcn.14001cc0c
test eax, eax
jne 0x1400c931e
xor r8d, r8d
mov edx, r12d
mov rcx, r15
call fcn.14001f35c
mov rdx, rax
lea rcx, str.Current_Language:__s_n
call fcn.14000105c
mov rcx, r15
call fcn.140069dac
mov dword [rsi], 2
mov rcx, rsi
call fcn.1400a0978
mov rcx, rsi
call fcn.1400a3d48
mov esi, 1
mov r15d, esi
jmp 0x1400c9352
mov r14d, 0xe88
mov r13d, 0x104
cmp esi, 2
jne 0x1400c93b6
mov rcx, qword [rdi + 8]
mov rax, r12
inc rax
cmp byte [rcx + rax], bl
jne 0x1400c935e
cmp rax, 6
jbe 0x1400c93b6
mov r8d, 6
lea rdx, str._lang
call fcn.1401eaee0
test eax, eax
jne 0x1400c93b6
mov rcx, qword [rdi + 8]
mov rdx, r12
inc rdx
cmp byte [rcx + rdx], bl
jne 0x1400c9389
mov esi, 1
mov r9d, esi
lea r8, [0x140274af4]
call fcn.1400a91d4
movsxd rcx, eax
inc rcx
add rcx, qword [rdi + 8]
mov qword [0x140317fe0], rcx
cmp esi, 1
je 0x1400c94b4
lea rcx, str.Mesh_Agent_available_switches:_r_n
call fcn.14000105c
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.14000105c
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.14000105c
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.14000105c
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.14000105c
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.14000105c
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.14000105c
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.14000105c
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.14000105c
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.14000105c
lea rcx, str.___nodeid___________Return_the_current_agent_identifier._r_n
call fcn.14000105c
lea rcx, str.___info_____________Return_agent_version_information._r_n
call fcn.14000105c
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.14000105c
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.14000105c
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.14000105c
lea rcx, [0x140282eec]
call fcn.14000105c
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.14000105c
lea rcx, [0x140282eec]
call fcn.14000105c
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.14000105c
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.14000105c
jmp 0x1400c9b76
test r15d, r15d
jne 0x1400c9b76
mov r15, rbx
mov r8d, r13d
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rsp + 0x810]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.1400a0744
mov r13, rax
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.1400a3c98
call fcn.140091514
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1400c79ac]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x600]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, r13
xor r8d, r8d
xor edx, edx
call fcn.140092090
mov rsi, rax
mov r9d, r14d
lea rdx, str.require_win_authenticode_opus_.checkMSH___
mov rcx, rax
call fcn.14001cc0c
mov rcx, rsi
test eax, eax
jne 0x1400c9b4c
mov r9d, r14d
lea rdx, str.require_util_language_.current.toLowerCase__.split___.join____
call fcn.14001cc0c
test eax, eax
jne 0x1400c95a4
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.14001f35c
mov r15, rax
mov r9d, r14d
lea rdx, str._function_foo__return_JSON.parse__MSH__.translation______
mov rcx, rsi
call fcn.14001cc0c
test eax, eax
jne 0x1400c95db
lea r8, [0x1402ecbe4]
mov edx, r12d
mov rcx, rsi
call fcn.14001d89c
test eax, eax
je 0x1400c95db
mov r13d, 0xfffffffe
jmp 0x1400c97eb
mov rcx, rsi
call fcn.140020544
mov r14d, 7
mov r8d, r14d
lea rdx, str.Install
mov rcx, rsi
call fcn.14001ffb8
lea r8, str.install
lea r13d, [r14 - 9]
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
lea r8d, [r14 + 2]
lea rdx, [0x1402ecbf8]
mov rcx, rsi
call fcn.14001ffb8
lea r8, str.uninstall
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
mov r8d, r14d
lea rdx, [0x1402ecc18]
mov rcx, rsi
call fcn.14001ffb8
lea r8, str.connect
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
lea r8d, [r14 + 3]
lea rdx, str.Disconnect
mov rcx, rsi
call fcn.14001ffb8
lea r8, str.disconnect
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
lea r8d, [r14 - 1]
lea rdx, str.Update
mov rcx, rsi
call fcn.14001ffb8
lea r8, str.update
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
mov rcx, rsi
call fcn.140020574
lea r8d, [r14 + 6]
lea rdx, str.NOT_INSTALLED
mov rcx, rsi
call fcn.14001ffb8
mov edx, r13d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str.push
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8d, r12d
mov edx, r13d
mov rcx, rsi
call fcn.14001e49c
lea r14d, [r13 - 1]
mov edx, r14d
mov rcx, rsi
call fcn.14001e4f0
lea edx, [r13 + 3]
mov rcx, rsi
call fcn.14001c0ac
mov rcx, rsi
call fcn.140020f78
lea r8d, [r13 + 9]
lea rdx, str.RUNNING
mov rcx, rsi
call fcn.14001ffb8
mov edx, r13d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str.push
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8d, r12d
mov edx, r13d
mov rcx, rsi
call fcn.14001e49c
mov edx, r14d
mov rcx, rsi
call fcn.14001e4f0
lea edx, [r13 + 3]
mov rcx, rsi
call fcn.14001c0ac
mov rcx, rsi
call fcn.140020f78
lea r8d, [r13 + 0xd]
lea rdx, str.NOT_RUNNING
mov rcx, rsi
call fcn.14001ffb8
mov edx, r13d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str.push
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8d, r12d
mov edx, r13d
mov rcx, rsi
call fcn.14001e49c
mov edx, r14d
mov rcx, rsi
call fcn.14001e4f0
lea edx, [r13 + 3]
mov rcx, rsi
call fcn.14001c0ac
mov rcx, rsi
call fcn.140020f78
lea r8, str.status
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
lea r8, [0x1402ecbe4]
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
mov rax, qword [0x140317fe0]
test rax, rax
cmovne r15, rax
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.14001d89c
test eax, eax
jne 0x1400c98d5
test r15, r15
je 0x1400c982d
mov r8, r12
inc r8
cmp byte [r15 + r8], bl
jne 0x1400c9817
mov rdx, r15
mov rcx, rsi
call fcn.14001ffb8
jmp 0x1400c9835
mov rcx, rsi
call fcn.14001fe04
mov edx, r12d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str.split
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8d, r12d
mov edx, r13d
mov rcx, rsi
call fcn.14001e49c
mov r8d, 1
lea rdx, [0x1402e6f38]
mov rcx, rsi
call fcn.14001ffb8
mov edx, 1
mov rcx, rsi
call fcn.14001bf70
mov edx, r12d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str.shift
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8d, r12d
mov edx, r13d
mov rcx, rsi
call fcn.14001e49c
xor edx, edx
mov rcx, rsi
call fcn.14001bf70
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.14001f35c
mov r15, rax
mov edx, 0xfffffffc
mov rcx, rsi
call fcn.14001e4f0
mov r8, r15
mov edx, r12d
mov rcx, rsi
call fcn.14001d89c
lea r14, [0x1402ecbe4]
test eax, eax
cmovne r14, r15
mov eax, 0x65
cmp al, byte [r14]
jne 0x1400c990f
mov eax, WSASetLastError
cmp al, byte [r14 + 1]
jne 0x1400c990f
cmp bl, byte [r14 + 2]
je 0x1400c99a9
lea r8, [0x1402ecbe4]
mov edx, r12d
mov rcx, rsi
call fcn.14001d374
mov r8, r14
mov edx, r13d
mov rcx, rsi
call fcn.14001d374
mov r8d, reloc.WS2_32.dll_recv
mov edx, r13d
mov rcx, rsi
call fcn.14001dd20
jmp 0x1400c9989
mov edx, r13d
call fcn.14001e0ac
cmp dword [rax], 8
mov rcx, rbx
jne 0x1400c9956
mov rcx, qword [rax + 8]
lea rax, [rcx + 0x20]
neg rcx
sbb r8, r8
and r8, rax
mov edx, 0xfffffffc
mov rcx, rsi
call fcn.14001d89c
mov rcx, rsi
test eax, eax
jne 0x1400c9984
mov r8d, r13d
lea edx, [rax - 4]
call fcn.14001d570
jmp 0x1400c9989
call fcn.140020f78
mov r8d, 1
mov edx, r12d
mov rcx, rsi
call fcn.14001dd5c
mov rcx, rsi
test eax, eax
jne 0x1400c9942
lea edx, [rax + 3]
call fcn.140020d98
mov edx, r12d
mov rcx, rsi
call fcn.14001e0ac
test byte [rax], 8
jne 0x1400c99be
mov rax, rbx
jmp 0x1400c99c2
mov rax, qword [rax + 8]
mov qword [0x140317f98], rax
mov qword [0x140317fc8], rsi
mov qword [0x140317fa8], r14
mov rcx, rsi
call fcn.1400202a4
mov edx, r13d
mov rcx, rsi
call fcn.14001e4f0
lea r8, str._start_data
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
mov dword [rsp + 0x20], 6
mov r9d, 0x18075380
xor r8d, r8d
lea rdx, [0x1400c7a08]
mov rcx, rsi
call fcn.1400207c8
lea r8, str._start
mov edx, r13d
mov rcx, rsi
call fcn.14001d5f8
mov r9d, 0xe08
lea rdx, str.global.__msh___MSH__
mov rcx, rsi
call fcn.14001cc0c
lea r8, [0x1402e60bc]
mov edx, r12d
mov rcx, rsi
call fcn.14001d89c
mov rcx, rsi
test eax, eax
je 0x1400c9b2b
call fcn.140020ee4
mov r15d, 0xf08
mov r9d, r15d
lea rdx, str.global.ackJSON.parse_global.__msh.ack_
mov rcx, rsi
call fcn.14001cc0c
mov r9d, r15d
lea rdx, str.global.bcolorglobal.__msh.background
mov rcx, rsi
call fcn.14001cc0c
mov r9d, r15d
lea rdx, str.global.fcolorglobal.__msh.foreground
mov rcx, rsi
call fcn.14001cc0c
mov r9d, r15d
lea rdx, str.global.bimageglobal.__msh.image_global.__msh.image:default2_
mov rcx, rsi
call fcn.14001cc0c
mov r9, r14
mov r8, r14
lea rdx, str.global.ackTitle__global.ack.captions__s__global.ack.captions__s_.title:global.ack.captions_en_.title_
mov rcx, rsi
call fcn.1400204b4
mov r12d, 0x909
mov r9d, r12d
xor edx, edx
mov rcx, rsi
call fcn.14001cc0c
mov r9, r14
mov r8, r14
lea rdx, str.global.ackText__global.ack.captions__s__global.ack.captions__s_.caption:global.ack.captions_en_.caption_
mov rcx, rsi
call fcn.1400204b4
mov r9d, r12d
xor edx, edx
mov rcx, rsi
call fcn.14001cc0c
mov r9, r14
mov r8, r14
lea rdx, str.global.ackLink___text:_global.ack.captions__s_.linkText__url:_global.ack.captions__s_.linkUrl__if_global.ackLink.textnull__global.ackLink.urlnull_delete_global.ackLink_
mov rcx, rsi
call fcn.1400204b4
mov r9d, r12d
xor edx, edx
mov rcx, rsi
call fcn.14001cc0c
mov r9d, r15d
lea rdx, str.var_x__require_win_userconsent_.create_global.ackTitle__global.ackText____noCheck:_true__background:_global.bcolor__foreground:_global.fcolor__b64Image:_global.bimage__linkText:_global.ackLink__x.then_function_____global._OK__true_____x.pump.on_exit__function______start______
jmp 0x1400c9b3d
call fcn.140020ee4
mov r9d, 0xf08
lea rdx, str.global._OKtrue___start___
mov rcx, rsi
call fcn.14001cc0c
mov rcx, qword [rsp + 0x60]
jmp 0x1400c9b71
xor r8d, r8d
mov edx, r12d
call fcn.14001f35c
mov rdx, rax
lea rcx, str.Error:__s
call fcn.14000105c
mov rcx, rsi
call fcn.140069dac
mov rcx, r13
call fcn.1400a3d48
mov r13d, 1
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c81ae
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c9b95
jmp 0x1400c81ae
mov edx, r13d
lea rcx, [0x1400c7974]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r12d, ebx
mov dword [rsp + 0x6c], ebx
cmp esi, r13d
jle 0x1400c9bf2
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
mov ecx, 0x20
test eax, eax
cmove r12d, ecx
mov dword [rsp + 0x6c], r12d
mov ecx, r12d
call fcn.14000a150
mov qword [0x140317fa0], rax
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r15d
test r14, r14
jne 0x1400c9c3b
cmp esi, r13d
jle 0x1400c9c49
lea rdx, [0x140275450]
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
je 0x1400c9c3b
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401ebc00
test eax, eax
jne 0x1400c9c49
mov rax, qword [0x140317fa0]
mov dword [rax + 0xdfc], r13d
mov r8, rdi
mov edx, esi
mov rcx, qword [0x140317fa0]
call fcn.14000e6ec
mov rax, qword [0x140317fa0]
mov r14d, dword [rax + 0xdb4]
mov dword [rsp + 0x70], r14d
call fcn.14000ee44
mov qword [0x140317fa0], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9ca3
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14009fc04
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c9c88
mov ebx, r14d
mov rcx, rdi
call fcn.14009fc04
mov eax, ebx
jmp 0x1400c81b8