Function at 0x408506
Capabilities:
Delete registry key
Set environment variable
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x6d9d44]
xor eax, ebp
mov dword [ebp + 0xdc], eax
and dword [ebp - 0x7c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xe8]
mov ebx, ecx
push str.__DUMMY__
push 0x6de5e8
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 0x70]
xor esi, esi
test eax, eax
jle 0x4085f4
mov eax, dword [ebp + 0xec]
mov dword [ebp - 0x80], eax
mov eax, dword [edi + esi*4]
mov ecx, str._recovery
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408587
test dl, dl
je 0x408583
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408587
add eax, 2
add ecx, 2
test dl, dl
jne 0x408567
xor eax, eax
jmp 0x40858e
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x40859c
or dword [ebx + 0x254], 0x40
and dword [ebp - 0x80], eax
mov eax, dword [edi + esi*4]
mov ecx, str._nocertstore
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4085c4
test dl, dl
je 0x4085c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4085c4
add eax, 2
add ecx, 2
test dl, dl
jne 0x4085a4
xor eax, eax
jmp 0x4085cb
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x4085e6
and dword [ebp - 0x80], eax
push str._Not_using_Certificate_Store__n
call fcn.00401109
xor eax, eax
inc eax
pop ecx
mov dword [ebx + 0xc28], eax
mov eax, dword [ebp - 0x70]
inc esi
cmp esi, eax
jl 0x40855f
jmp 0x4085fd
mov ecx, dword [ebp + 0xec]
mov dword [ebp - 0x80], ecx
xor esi, esi
test eax, eax
jle 0x40879f
mov eax, dword [edi + esi*4]
mov ecx, 0x6de62c
mov edx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408641
cmp byte [ebp - 0x51], 0
je 0x40863d
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408641
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x408611
xor ecx, ecx
jmp 0x408646
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x408792
mov edx, eax
mov ecx, 0x6de638
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408685
cmp byte [ebp - 0x51], 0
je 0x408681
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408685
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x408655
xor ecx, ecx
jmp 0x40868a
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x408792
mov edx, eax
mov ecx, 0x6de644
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x4086c9
cmp byte [ebp - 0x51], 0
je 0x4086c5
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x4086c9
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x408699
xor ecx, ecx
jmp 0x4086ce
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x408792
mov edx, eax
mov ecx, 0x6de654
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40870d
cmp byte [ebp - 0x51], 0
je 0x408709
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40870d
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x4086dd
xor ecx, ecx
jmp 0x408712
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x408792
mov edx, eax
mov ecx, 0x6de664
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40874d
cmp byte [ebp - 0x51], 0
je 0x408749
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40874d
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x40871d
xor ecx, ecx
jmp 0x408752
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x408792
mov ecx, 0x6de670
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40877b
test dl, dl
je 0x408777
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40877b
add ecx, 2
add eax, 2
test dl, dl
jne 0x40875b
xor eax, eax
jmp 0x408782
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x408792
inc esi
cmp esi, dword [ebp - 0x70]
jl 0x408607
jmp 0x40879f
push 0
xor ecx, ecx
call fcn.00493939
pop ecx
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4087c1
push 0
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6de67c
call fcn.00403315
pop ecx
mov ecx, eax
call fcn.00493939
pop ecx
mov dword [ebx + 0x24], eax
xor eax, eax
xor ecx, ecx
and dword [ebp - 0x60], eax
xor esi, esi
mov dword [ebp - 0x74], eax
xor edi, edi
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x6c], esi
test eax, eax
jle 0x408acf
mov esi, dword [ebp - 0x68]
cmp dword [esi + edi*4], 0
jne 0x4087ef
and dword [ebp - 0x78], 0
jmp 0x408801
push 0x1000
push dword [esi + edi*4]
call fcn.005f8590
pop ecx
pop ecx
mov dword [ebp - 0x78], eax
mov esi, dword [esi + edi*4]
mov ecx, 0x6de680
mov edx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40882b
test al, al
je 0x408827
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40882b
add ecx, 2
add edx, 2
test al, al
jne 0x40880b
xor eax, eax
jmp 0x408832
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov ecx, dword [ebp - 0x6c]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov eax, 0x6de688
mov dword [ebp - 0x6c], ecx
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408867
test dl, dl
je 0x408863
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408867
add eax, 2
add ecx, 2
test dl, dl
jne 0x408847
xor eax, eax
jmp 0x40886e
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x4088a9
mov ecx, esi
mov eax, 0x6de694
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40889c
test dl, dl
je 0x408895
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40889c
add eax, 2
add ecx, 2
test dl, dl
jne 0x408879
xor edx, edx
xor eax, eax
inc edx
jmp 0x4088a3
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
test eax, eax
jne 0x4088af
jmp 0x4088ac
xor edx, edx
inc edx
mov dword [ebp - 0x74], edx
mov eax, 0x6de6a4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4088d4
test cl, cl
je 0x4088d0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4088d4
add eax, 2
add esi, 2
test cl, cl
jne 0x4088b4
xor eax, eax
jmp 0x4088d8
sbb eax, eax
or eax, edx
test eax, eax
jne 0x4088fa
mov ecx, dword [ebx + 0x24]
push 5
pop esi
push eax
push edx
push 0x6de6b0
push 0xd
mov edx, str._localService
call fcn.00492dfa
add esp, 0x10
jmp 0x4088fd
mov esi, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x68]
mov eax, 0x6de6c4
mov edx, dword [ecx + edi*4]
mov ecx, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40893a
cmp byte [ebp - 0x51], 0
je 0x408936
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40893a
add eax, 2
add ecx, 2
cmp byte [ebp - 0x51], 0
jne 0x40890a
xor eax, eax
jmp 0x408941
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x408975
mov eax, 0x6de6d0
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x40896a
test cl, cl
je 0x408966
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x40896a
add eax, 2
add edx, 2
test cl, cl
jne 0x40894a
xor eax, eax
jmp 0x408971
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x408997
mov ecx, dword [ebx + 0x24]
mov edx, str._deleteData
push 2
pop eax
mov esi, eax
xor eax, eax
push 0
inc eax
push eax
push 0x6de6e0
push 0xb
call fcn.00492dfa
add esp, 0x10
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + edi*4]
mov eax, 0x6de6f0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4089c2
test dl, dl
je 0x4089be
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4089c2
add eax, 2
add ecx, 2
test dl, dl
jne 0x4089a2
xor eax, eax
jmp 0x4089c9
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov edx, dword [ebp - 0x78]
test eax, eax
push 2
pop eax
cmove esi, eax
xor eax, eax
inc eax
mov dword [ebp - 0x74], esi
push eax
mov eax, dword [ebp - 0x68]
push 0x6de6fc
mov ecx, dword [eax + edi*4]
call fcn.0048ec14
pop ecx
pop ecx
mov esi, eax
push 2
pop eax
cmp esi, eax
jle 0x408abd
push eax
mov eax, dword [ebp - 0x68]
push 0x6de700
push dword [eax + edi*4]
call fcn.005f0cf0
add esp, 0xc
test eax, eax
jne 0x408abd
cmp esi, 0xa
jne 0x408a7a
mov eax, dword [ebp - 0x68]
push 8
push str.readonly
push 2
mov eax, dword [eax + edi*4]
pop ecx
add eax, ecx
push eax
call fcn.005f0cf0
add esp, 0xc
test eax, eax
jne 0x408a7a
inc eax
push eax
mov eax, dword [ebp - 0x68]
push 0x6de710
mov eax, dword [eax + edi*4]
add eax, 0xb
push eax
call fcn.005f0cf0
add esp, 0xc
test eax, eax
jne 0x408a7a
inc eax
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x60], eax
je 0x408a80
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6de714
call fcn.00403315
pop ecx
mov ecx, dword [ebx + 0x24]
mov edx, eax
call fcn.004939be
cmp dword [ebx + 0x24], 0
jne 0x408a8d
push 0
xor ecx, ecx
call fcn.00493939
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebx + 0x24]
push 0
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x78]
sub eax, esi
dec eax
push eax
lea eax, [esi + 1]
add eax, edx
add edx, 2
push eax
lea eax, [esi - 2]
push eax
call fcn.00492dfa
mov ecx, dword [ebp - 0x58]
add esp, 0x10
inc ecx
mov dword [ebp - 0x58], ecx
jmp 0x408ac0
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x70]
inc edi
cmp edi, eax
jl 0x4087e0
mov esi, dword [ebp - 0x6c]
sub eax, ecx
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x70], eax
jne 0x408ae7
push 0
xor ecx, ecx
call fcn.00493939
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x24]
mov edi, 0x400
cmp dword [eax], 0
jne 0x408b18
push edi
push 0x6de718
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.readmsh
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x408b91
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..mshx
call fcn.00403315
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407e5e
test eax, eax
jne 0x408b91
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6de730
call fcn.00403315
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407e5e
test eax, eax
jne 0x408b91
mov edx, str.mesh_linumshx
mov ecx, ebx
call fcn.00407e5e
test eax, eax
jne 0x408b91
mov edx, str.mesh_limshx
mov ecx, ebx
call fcn.00407e5e
test eax, eax
jne 0x408b91
xor edx, edx
mov ecx, ebx
call fcn.00407c72
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6de754
call fcn.00403315
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407e5e
push edi
push 0x6de75c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6de768
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x408c1f
push edi
push 0x6de774
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.maxLogSize
push 0x1000
push 0x76f260
push eax
call fcn.00493ee4
add esp, 0x14
cmp eax, 0x1000
jae 0x408c1f
push 0xffffffffffffffff
push 0xffffffffffffffff
xorps xmm0, xmm0
mov edx, 0x76f260
push ecx
lea ecx, [ebp + 0xd4]
movlpd qword [ebp + 0xd4], xmm0
call fcn.004876f8
add esp, 0xc
test eax, eax
jne 0x408c1f
mov eax, dword [ebp + 0xd4]
mov dword [0x756898], eax
mov eax, dword [ebp + 0xd8]
mov dword [0x75689c], eax
xor ecx, ecx
cmp dword [ebx + 0xc28], ecx
jne 0x408c51
push edi
push 0x6de78c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.nocertstore
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
mov dword [ebx + 0xc28], eax
xor ecx, ecx
test esi, esi
je 0x408c91
push dword [ebx]
push 0x408425
push ecx
push dword [ebx + 0x1c]
push ecx
push ecx
push dword [ebx]
push ecx
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
add esp, 0x20
mov edx, str.require__agentStatus_.start___
push 0xe08
push ecx
mov ecx, eax
call fcn.004188ff
xor eax, eax
pop ecx
inc eax
jmp 0x40a499
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x408e7e
push dword [ebx]
push 0x408425
push ecx
push dword [ebx + 0x1c]
push ecx
push ecx
push dword [ebx]
push ecx
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
mov esi, eax
push ebx
mov ecx, esi
call fcn.004032d5
add esp, 0x24
mov edx, 0x6de7c8
push 0xe08
push ecx
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a2e2
test eax, eax
je 0x40a4b8
sub edi, 1
je 0x408dc2
sub edi, 1
je 0x408d10
sub edi, 3
je 0x408dc2
mov ecx, esi
call fcn.0045d31c
jmp 0x408e97
push 0xe08
push ecx
mov edx, str.require_agent_installer__
mov ecx, esi
call fcn.004188ff
push str.fullUninstall
or edx, 0xffffffff
mov ecx, esi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.00419f51
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.00480d97
or edx, 0xffffffff
mov ecx, esi
call fcn.00418899
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.00417e9a
add esp, 0x14
test eax, eax
je 0x408e6f
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6de898
call fcn.0041b03c
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x408d9d
test cl, cl
je 0x408d99
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x408d9d
add eax, edx
add edi, edx
test cl, cl
jne 0x408d7f
mov eax, ebx
jmp 0x408da4
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x408e6f
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.0041b03c
push eax
push 0x6de8c4
jmp 0x408e67
push 0xe08
push ecx
mov edx, 0x6de814
mov ecx, esi
call fcn.004188ff
push str.fullInstall
or edx, 0xffffffff
mov ecx, esi
call fcn.00419063
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.00419f51
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.00480d97
or edx, 0xffffffff
mov ecx, esi
call fcn.00418899
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.00417e9a
add esp, 0x14
test eax, eax
je 0x408e6f
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6de83c
call fcn.0041b03c
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x408e4b
test cl, cl
je 0x408e47
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x408e4b
add eax, edx
add edi, edx
test cl, cl
jne 0x408e2d
mov eax, ebx
jmp 0x408e52
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x408e6f
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.0041b03c
push eax
push 0x6de868
call fcn.00401109
add esp, 0xc
mov ecx, esi
call fcn.0041cd62
xor eax, eax
inc eax
jmp 0x40a49a
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x40a3f0
cmp dword [eax], ecx
jne 0x408e97
cmp dword [ebp - 0x60], 0
je 0x40a3f0
mov edx, dword [ebx]
call fcn.00496cf4
mov dword [ebx + 0x20], eax
mov edi, 0x400
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x408f54
push edi
push 0x6de93c
mov dword [eax + 0x1040], 0x40844c
mov dword [eax + 0x1044], ebx
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov esi, 0x76f260
push 0x1000
push esi
push eax
mov edx, str.enableILibRemoteLogging
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x408f1f
cmp eax, 0x1000
jae 0x40a4ca
mov byte [eax + 0x76f260], 0
mov edx, 0x6de96c
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00403315
pop ecx
push eax
mov ecx, esi
call fcn.004877e9
mov ecx, dword [ebx]
mov edx, eax
call fcn.00487c81
pop ecx
push edi
push 0x6de974
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.semaphoreTrack
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x408f54
and dword [0x769d68], 0
mov dword [0x76a4e4], 0x4084bc
mov eax, dword [ebx]
test eax, eax
je 0x408f5f
mov eax, dword [eax + 8]
jmp 0x408f61
xor eax, eax
mov ecx, dword [ebp - 0x68]
push dword [ecx]
push str.agentcore:_argv_0____s
push 2
pop ecx
push ecx
push 0x100
push eax
call fcn.004920d4
add esp, 0x14
xor eax, eax
push eax
push eax
push eax
push dword [ebx + 0x1c]
push eax
push eax
push dword [ebx]
push eax
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
add esp, 0x20
mov esi, eax
mov edx, str.require_linux_pathfix____
mov dword [ebp - 0x74], esi
push 0xf88
push ecx
mov ecx, esi
call fcn.004188ff
xor eax, eax
push edi
push 0x6de9c8
mov dword [ebx + 0xd3c], eax
mov dword [ebx + 0xd40], eax
mov dword [ebx + 0xd44], eax
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6de9d8
push 0
push 0
push eax
call fcn.00493ee4
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x40905d
lea ecx, [edi + 1]
cmp ecx, 0xffffffff
jae 0x40901f
push 0xfffffffffffffffe
pop eax
sub eax, edi
je 0x40901f
cmp ecx, 0xffffffef
jae 0x40901f
push 0x1394
xor eax, eax
inc eax
push 0x6de9e8
push eax
lea eax, [edi + 0x11]
push eax
call fcn.005f5ba0
add esp, 0x10
lea ecx, [edi + 1]
jmp 0x409021
xor eax, eax
push 0
mov edx, ecx
mov ecx, eax
push 0
call fcn.00487604
push 0x400
push 0x6dea00
mov dword [ebx + 0xd50], eax
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dea10
push edi
push dword [ebx + 0xd50]
push eax
call fcn.00493ee4
add esp, 0x1c
jmp 0x409067
mov dword [ebx + 0xd50], 0x6dea20
push 0x400
push 0x6dea2c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dea38
push 0
push 0
push eax
call fcn.00493ee4
mov edi, eax
add esp, 0x14
test edi, edi
je 0x409102
lea eax, [edi + 1]
cmp eax, 0xffffffff
jae 0x4090c6
push 0xfffffffffffffffe
pop ecx
sub ecx, edi
je 0x4090c6
cmp eax, 0xffffffef
jae 0x4090c6
push 0x13a2
xor eax, eax
inc eax
push 0x6dea44
push eax
lea eax, [edi + 0x11]
push eax
call fcn.005f5ba0
mov ecx, eax
add esp, 0x10
lea eax, [edi + 1]
jmp 0x4090c8
xor ecx, ecx
push 0
push 0
mov edx, eax
call fcn.00487604
push 0x400
push 0x6dea5c
mov dword [ebx + 0xd54], eax
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dea68
push edi
push dword [ebx + 0xd54]
push eax
call fcn.00493ee4
add esp, 0x1c
jmp 0x40910c
mov dword [ebx + 0xd54], str.MeshCentral
push dword [ebx + 0xd50]
push str.require_service_manager_.manager.getService__s_.isMe___
push esi
call fcn.0041c299
add esp, 0xc
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a44d
push 0xe88
push ecx
mov edx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov ecx, esi
mov edi, eax
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x409158
push eax
push ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.004199b5
pop ecx
pop ecx
mov dword [ebx + 0xd3c], eax
push 0xe88
push ecx
mov edx, edi
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x40917d
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a2e2
mov dword [ebx + 0xd40], eax
mov edi, 0xe88
mov edx, str.require_user_sessions_.isRoot___
push edi
push ecx
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4091a6
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a2e2
mov dword [ebx + 0xd44], eax
cmp dword [ebx + 0xd40], 0
jne 0x40928f
cmp dword [ebx + 0xd58], 0
je 0x40928f
push edi
push ecx
mov edx, str.require_util_service_check___
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x40928f
or edx, 0xffffffff
mov ecx, esi
call fcn.00419b2a
test eax, eax
mov ecx, 0x6c4428
cmovne ecx, eax
call fcn.0041b91d
test al, 6
jne 0x40928f
lea eax, [ebp - 0x60]
or edx, edx
push eax
mov ecx, esi
call fcn.0041b03c
push eax
push dword [ebx + 0xd50]
mov dword [ebp - 0x6c], eax
push str.Service_Name_Conflict:_Configured___s__but_is_actually___s_
call fcn.0048fa69
mov ecx, dword [ebx + 0xd50]
add esp, 0x10
call fcn.004876b9
mov edi, dword [ebp - 0x60]
lea ecx, [edi + 1]
cmp ecx, 0xffffffff
jae 0x40925e
push 0xfffffffffffffffe
pop eax
sub eax, edi
je 0x40925e
cmp ecx, 0xffffffef
jae 0x40925e
push 0x13c9
xor eax, eax
inc eax
push 0x6dec68
push eax
lea eax, [edi + 0x11]
push eax
call fcn.005f5ba0
add esp, 0x10
lea ecx, [edi + 1]
jmp 0x409260
xor eax, eax
push 0
mov edx, ecx
mov ecx, eax
push 0
call fcn.00487604
push edi
push dword [ebp - 0x6c]
mov dword [ebx + 0xd50], eax
mov ecx, eax
mov edx, dword [eax - 0x10]
call section..text
xor edi, edi
add esp, 0x10
inc edi
mov dword [ebx + 0xd40], edi
jmp 0x409292
xor edi, edi
inc edi
push dword [ebx + 0xd50]
push str.require__agentNodeId_.checkResetNodeId__s__
push esi
call fcn.0041c299
add esp, 0xc
xor edx, edx
push 0x889
push ecx
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, esi
test eax, eax
jne 0x4092e7
call fcn.0041ba1c
test eax, eax
je 0x4092fc
or edx, 0xffffffff
mov ecx, esi
call fcn.0041a2e2
test eax, eax
je 0x4092fc
push str.NodeID_will_reset__because_ResetNodeId_was_set_in_the_registry
mov dword [ebp - 0x7c], edi
call fcn.0048fa69
pop ecx
jmp 0x4092fc
push 0
call fcn.0041b03c
push eax
push str.Error_checking_ResetNodeId_in_registry:__s
call fcn.0048fa69
add esp, 0xc
push 0x400
push 0x6ded1c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.skipmaccheck
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x4094b9
push 0xe88
push ecx
mov edx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov ecx, esi
call fcn.004188ff
pop ecx
pop ecx
test eax, eax
jne 0x4094b9
lea eax, [ebp - 0x58]
or edx, 0xffffffff
push eax
mov ecx, esi
call fcn.0041a3f9
cmp dword [ebp - 0x58], 0x13
mov edi, eax
pop ecx
mov dword [ebp - 0x78], edi
jb 0x4094b9
push 0x400
push 0x6ded3c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dee48
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x4093a9
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dee5c
push eax
push dword [ebp - 0x58]
push edi
push 0x11
call fcn.00493a81
add esp, 0x10
jmp 0x4094b9
xor edi, edi
cmp dword [ebp - 0x58], edi
jle 0x4094b9
mov esi, dword [ebp - 0x78]
push 0x13
lea eax, [edi + esi]
push 0x6dee70
push eax
call fcn.005f0cf0
add esp, 0xc
test eax, eax
jne 0x4093d6
add edi, 0x13
cmp edi, dword [ebp - 0x58]
jl 0x4093b7
mov esi, dword [ebp - 0x74]
cmp edi, dword [ebp - 0x58]
jge 0x4094b9
mov edi, dword [ebp - 0x60]
and dword [ebp + 0xd8], 0
lea eax, [edi + 1]
cmp eax, 0xffffffdb
jae 0x409403
lea eax, [edi + 0x25]
call fcn.005c1c50
mov ecx, esp
lea eax, [edi + 1]
jmp 0x409405
xor ecx, ecx
xor edx, edx
inc edx
push edx
push 4
mov edx, eax
call fcn.00487604
push 0x400
push 0x6dee84
mov dword [ebp - 0x6c], eax
lea ecx, [eax + 4]
mov dword [eax], ecx
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6dee98
push edi
push dword [ebp - 0x6c]
push eax
call fcn.00493ee4
add esp, 0x1c
test edi, edi
jle 0x40948a
mov edi, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x60]
mov esi, dword [ebp + 0xd8]
push 0x13
push str._00:00:00:00:00:00_
push edi
call fcn.005f0cf0
add esp, 0xc
test eax, eax
je 0x409476
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x78]
push 0x13
push edi
call fcn.0048ec14
pop ecx
pop ecx
test eax, eax
jns 0x409480
add esi, 0x13
add edi, 0x13
cmp esi, ebx
jl 0x40944e
cmp esi, ebx
mov ebx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x74]
jl 0x4094b9
push dword [ebp - 0x6c]
mov edi, dword [ebp - 0x78]
push edi
push str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
call fcn.0048fa69
mov ecx, dword [ebx + 0x24]
xor eax, eax
push 0
push dword [ebp - 0x58]
inc eax
mov edx, str.LocalMacAddresses
push edi
push 0x11
mov dword [ebp - 0x7c], eax
call fcn.00493a81
add esp, 0x1c
mov ecx, esi
call fcn.0045d31c
xor edi, edi
inc edi
cmp dword [ebp - 0x7c], edi
je 0x4094d3
mov ecx, ebx
call fcn.004037ed
test eax, eax
je 0x4094e9
mov ecx, ebx
call fcn.00403436
test eax, eax
je 0x4094e9
push str.Certificate_error_r_n
call fcn.00401109
pop ecx
mov ecx, ebx
call fcn.00403bb9
test eax, eax
je 0x4094ff
push str.Certificate_validation_error_r_n
call fcn.00401109
pop ecx
and dword [ebp - 0x60], 0
mov edx, str..tag
push 0x1000
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00403315
pop ecx
lea edx, [ebp - 0x60]
mov ecx, eax
call fcn.00485e51
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebx + 0x24]
test esi, esi
je 0x409547
push 0
push eax
push esi
push 3
mov edx, 0x6def44
call fcn.00493a81
push edi
push esi
call fcn.005f5a60
add esp, 0x18
jmp 0x409554
push 3
mov edx, 0x6def48
call fcn.0049444e
pop ecx
mov ecx, dword [ebx + 0x24]
lea eax, [ebp - 0x34]
push 0xff
push eax
push 0xf
mov edx, str.ignoreProxyFile
call fcn.00493ee4
add esp, 0xc
test eax, eax
jne 0x4095cd
and dword [ebp - 0x60], eax
mov edx, str..proxy
push 0x400
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00403315
pop ecx
lea edx, [ebp - 0x60]
mov ecx, eax
call fcn.00485e51
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x4095cd
mov ecx, dword [ebx + 0x24]
test eax, eax
jle 0x4095b7
push 0
push eax
push esi
push 8
mov edx, 0x6def64
call fcn.00493a81
add esp, 0x10
jmp 0x4095c4
push 8
mov edx, 0x6def70
call fcn.0049444e
pop ecx
push edi
push esi
call fcn.005f5a60
pop ecx
pop ecx
and dword [ebp - 0x60], 0
mov esi, 0x400
push esi
push 0x6def7c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6def90
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
cmp eax, 4
jne 0x40962c
push esi
push 0x6defa4
call fcn.005f8590
push 4
lea ecx, [ebp - 0x60]
mov edx, str.AgentCapabilities
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00493ee4
add esp, 0x14
push dword [ebp - 0x60]
call dword [sym.imp.WS2_32.dll_ntohl]
or dword [ebx + 0x254], eax
push dword [ebx + 0xd50]
push 0x6defcc
push 0
push 0
call fcn.0040119b
mov esi, eax
add esp, 0x10
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x409675
push 0xfffffffffffffffe
pop ecx
sub ecx, esi
je 0x409675
cmp edi, 0xffffffef
jae 0x409675
push 0x144d
xor eax, eax
inc eax
push 0x6defe4
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005f5ba0
add esp, 0x10
jmp 0x409677
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.00487604
push dword [ebx + 0xd50]
mov edi, eax
push str.SoftwareOpen_Source_s
mov dword [ebp - 0x60], edi
push dword [edi - 0x10]
push edi
call fcn.0040119b
add esp, 0x18
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax + 1]
lea eax, [edi + edi]
cmp eax, 0xffffffef
jae 0x4096de
push 0x1450
xor eax, eax
inc eax
push 0x6df014
push eax
lea eax, [edi*2 + 0x10]
push eax
call fcn.005f5ba0
add esp, 0x10
jmp 0x4096e0
xor eax, eax
push 0
push 0
lea edx, [edi + edi]
mov ecx, eax
call fcn.00487604
pop ecx
pop ecx
mov ecx, bind
mov dword [ebp - 0x7c], eax
cmp edi, ecx
jae 0x409b70
cmp esi, ecx
ja 0x409b70
lea ecx, [edi + 1]
mov edx, esi
push ecx
mov ecx, dword [ebp - 0x60]
push eax
call fcn.00487094
pop ecx
pop ecx
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebx + 0xd6c]
push dword [ebp - 0x7c]
neg eax
sbb eax, eax
add eax, reloc.WS2_32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x409b70
and dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
test byte [ebx + 0x254], 0x40
push eax
push 0x30
pop edx
jne 0x409a78
lea ecx, [ebx + 0xcec]
call fcn.0048d3c2
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, eax
pop ecx
test edx, edx
jle 0x4097be
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x4097be
xor eax, eax
test edx, edx
jle 0x409796
mov cl, byte [eax + esi]
cmp cl, 0x2b
jne 0x409788
mov byte [eax + esi], 0x40
jmp 0x409791
cmp cl, 0x2f
jne 0x409791
mov byte [eax + esi], 0x24
inc eax
cmp eax, edx
jl 0x40977a
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6df02c
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005f5a60
and dword [ebp - 0x58], 0
pop ecx
pop ecx
jmp 0x4097c8
push str.NodeId
push dword [ebp - 0x5c]
call edi
mov esi, 0x76f260
lea ecx, [ebx + 0xbc8]
push esi
push 0x30
pop edx
call fcn.00485bd0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097e1
sub ecx, edx
xor eax, eax
push ecx
push esi
inc eax
push eax
push 0
push str.AgentHash
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x400
push 0x6df048
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df050
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
mov esi, 0x770260
test eax, eax
jne 0x409837
push 0x6df058
jmp 0x4098cc
push 0x400
push 0x6df060
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df068
push 0x10000
push esi
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jle 0x4098c7
lea ecx, [ebp - 0x58]
mov edx, eax
push ecx
mov ecx, esi
call fcn.0048d3c2
mov edx, eax
pop ecx
test edx, edx
jle 0x4098c0
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x4098c0
xor ecx, ecx
test edx, edx
jle 0x40989c
mov al, byte [ecx + esi]
cmp al, 0x2b
jne 0x40988f
mov byte [ecx + esi], 0x40
jmp 0x409897
cmp al, 0x2f
jne 0x409897
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, edx
jl 0x409882
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6df070
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005f5a60
pop ecx
pop ecx
jmp 0x4098d1
push 0x6df078
jmp 0x4098cc
push str.MeshId
push dword [ebp - 0x5c]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
push 0x19
push 0x6df088
inc eax
push eax
push 0
push str.CommitDate
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6df0b0
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df0bc
push 0x10000
push 0x770260
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x409928
push 0x6df0c8
push dword [ebp - 0x5c]
call edi
jmp 0x40994f
mov ecx, 0x770260
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409930
sub ecx, edx
xor eax, eax
push ecx
push 0x770260
inc eax
push eax
push 0
push str.MeshServerUrl
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6df0e8
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df0f4
push 0x10000
push 0x770260
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x409989
push 0x6df100
push dword [ebp - 0x5c]
call edi
jmp 0x4099b0
mov ecx, 0x770260
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409991
sub ecx, edx
xor eax, eax
push ecx
push 0x770260
inc eax
push eax
push 0
push str.MeshServerId
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6df120
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.WebProxy
push 0x10000
push 0x770260
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x4099ea
push 0x6df138
push dword [ebp - 0x5c]
call edi
jmp 0x409a11
mov ecx, 0x770260
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099f2
sub ecx, edx
xor eax, eax
push ecx
push 0x770260
inc eax
push eax
push 0
push str.Proxy
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6df148
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df14c
push 0x10000
push 0x770260
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x409a4b
push 0x6df150
push dword [ebp - 0x5c]
call edi
jmp 0x409a70
mov edi, 0x770260
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a55
sub ecx, edx
xor eax, eax
push ecx
push edi
inc eax
push eax
push 0
push 0x6df154
push dword [ebp - 0x5c]
call esi
lea edi, [ebx + 0xcec]
jmp 0x409ae5
lea edi, [ebx + 0xcec]
mov ecx, edi
call fcn.0048d3c2
pop ecx
test eax, eax
jle 0x409ad7
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x409ad7
xor ecx, ecx
test eax, eax
jle 0x409ab3
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x409aa5
mov byte [ecx + esi], 0x40
jmp 0x409aae
cmp dl, 0x2f
jne 0x409aae
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, eax
jl 0x409a97
push eax
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6df158
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005f5a60
pop ecx
pop ecx
jmp 0x409ae5
push str.DiagnosticAgentNodeId
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, 0x400
push esi
push 0x6df188
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.SelfNodeCert
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x409b67
push esi
push 0x6df1a8
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov esi, 0x76f260
push 0x1000
push esi
push eax
mov edx, 0x6df1b0
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x409b50
cmp eax, 0x30
jne 0x409b50
xor ecx, ecx
mov eax, dword [edi + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x409b50
inc ecx
cmp ecx, 0xc
jne 0x409b40
jmp 0x409b67
mov ecx, dword [ebx + 0x24]
mov edx, str.NodeID
push 0
push 0x30
push edi
push 6
call fcn.00493a81
add esp, 0x10
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x60]
call fcn.004876b9
mov ecx, dword [ebp - 0x7c]
call fcn.004876b9
lea edx, [ebx + 0xc3c]
cmp dword [edx], 0
push ecx
mov ecx, dword [ebx + 0x20]
jne 0x409b95
push 0
xor edx, edx
jmp 0x409b9b
push dword [ebx + 0xc30]
call fcn.0049791e
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
je 0x409c33
mov eax, dword [ebp - 0x70]
xor esi, esi
inc esi
cmp eax, esi
je 0x409c33
push 2
pop edi
cmp eax, edi
jne 0x409c2c
mov eax, dword [ebp - 0x68]
mov edx, 0x6df1c0
mov ecx, dword [eax + 4]
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x409bf9
cmp byte [ebp - 0x51], 0
je 0x409bf5
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x409bf9
add eax, edi
add edx, edi
cmp byte [ebp - 0x51], 0
jne 0x409bcb
xor eax, eax
jmp 0x409bfd
sbb eax, eax
or eax, esi
test eax, eax
je 0x409c33
mov eax, 0x6df1c4
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x409c24
test dl, dl
je 0x409c20
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x409c24
add ecx, edi
add eax, edi
test dl, dl
jne 0x409c06
xor eax, eax
jmp 0x409c28
sbb eax, eax
or eax, esi
test eax, eax
je 0x409c33
xor eax, eax
jmp 0x40a49a
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..update.exe
call fcn.00403315
pop ecx
mov ecx, eax
call fcn.00485f38
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..corereset
call fcn.00403315
mov dword [esp], 0x1000
mov edi, 0x76c260
push edi
push 0xffffffffffffffff
mov esi, eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push edi
call fcn.006125e0
mov edi, 0x400
pop ecx
pop ecx
test eax, eax
jne 0x409cac
push edi
push 0x6df1e4
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df1f0
push eax
call fcn.0049444e
add esp, 0xc
mov ecx, esi
call fcn.00485f38
cmp dword [ebx + 0x248], 0
jne 0x409cd9
push edi
push 0x6df1fc
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df208
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
mov esi, eax
jmp 0x409cdb
xor esi, esi
push edi
push 0x6df214
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df220
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x409d6a
push edi
push 0x6df22c
call fcn.005f8590
push 0x10
lea ecx, [ebp + 0xcc]
mov edx, str.jsDebugPort
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00493ee4
add esp, 0x14
lea ecx, [eax - 1]
cmp ecx, 0xe
ja 0x409d6a
cmp eax, 0x10
jae 0x40a4ca
lea ecx, [ebp + 0xcc]
mov byte [ebp + eax + 0xcc], 0
call fcn.00487795
test edx, edx
ja 0x409d62
jb 0x409d55
cmp eax, 0x7fffffff
ja 0x409d62
lea ecx, [ebp + 0xcc]
call fcn.004877c2
jmp 0x409d64
xor eax, eax
mov dword [ebx + 0xbb8], eax
xor edi, edi
push 0x400
inc edi
push 0x6df244
mov dword [ebx + 0x24c], edi
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.showModuleNames
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
mov dword [0x769f80], eax
cmp dword [ebx + 8], 0
je 0x409df9
push dword [ebx]
push dword [ebx + 8]
call fcn.00402b75
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0x6df264
call fcn.00419063
mov ecx, dword [ebx + 8]
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
call fcn.00419f51
mov ecx, dword [ebx + 8]
mov edx, str.Ready
call fcn.0041bf3d
mov ecx, dword [ebx + 8]
mov edx, edi
push 0
call fcn.00417e9a
add esp, 0x14
test eax, eax
je 0x409df1
mov ecx, dword [ebx + 8]
call fcn.0045d29d
mov ecx, dword [ebx + 8]
call fcn.0041cd62
xor eax, eax
cmp dword [ebx + 0x248], eax
jne 0x409ff9
push eax
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [ebx + 0x24]
push eax
push dword [ebx]
push eax
call fcn.0047b885
xor edx, edx
mov ecx, eax
call fcn.0047c10b
push ebx
mov ecx, eax
mov dword [ebx + 8], eax
call fcn.004032d5
mov ecx, dword [ebx + 8]
mov edx, 0x4081b8
push ebx
call fcn.0045d020
push 0x400
push 0x6df274
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.coreDumpEnabled
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x3c
mov dword [ebx + 0xbbc], eax
test eax, eax
je 0x409e80
push 0xf08
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
call fcn.004188ff
pop ecx
pop ecx
push 0x400
push 0x6df294
call fcn.005f8590
push 0x1000
mov ecx, 0x76f260
mov edx, str.finalizer_messages
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x409ec0
mov eax, 0x76f260
push eax
call fcn.005f7bd0
pop ecx
mov dword [0x76a4ac], eax
cmp esi, 4
jle 0x409ff9
push 0x400
push 0x6df33c
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.noUpdateCoreModule
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
je 0x409fa4
push str._CoreModule:_Update_Disabled_n
mov dword [ebx + 0x248], edi
call fcn.00401109
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.004878dc
push 0x400
push 0x6df388
mov edi, eax
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df394
push esi
push edi
push eax
call fcn.00493ee4
mov ecx, dword [ebx + 8]
lea eax, [esi - 4]
push 0xd
push 0x6df3a0
push eax
lea edx, [edi + 4]
call fcn.0047c63c
add esp, 0x2c
test eax, eax
jne 0x409f5c
mov ecx, dword [ebx + 8]
call fcn.0047c6c5
test eax, eax
je 0x409f96
mov eax, dword [ebx]
test eax, eax
je 0x409f67
mov esi, dword [eax + 8]
jmp 0x409f69
xor esi, esi
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0
call fcn.0041b03c
push eax
push 0x6df3b0
push 2
pop eax
push eax
push 0x4100
push esi
call fcn.004920d4
mov ecx, dword [ebx + 8]
add esp, 0x18
call fcn.0041cd62
xor eax, eax
inc eax
push eax
push edi
call fcn.005f5a60
pop ecx
pop ecx
jmp 0x409ff9
mov ecx, dword [ebx + 8]
lea edx, [ebp + 0xd8]
sub esp, 0xc
mov dword [ebp + 0xd8], ebx
call fcn.0045d6bf
mov ecx, dword [ebx + 8]
mov dword [ebx + 0xbb4], eax
call fcn.0041c148
mov edx, dword [ebx + 0xbb4]
mov ecx, dword [ebx + 8]
call fcn.0041ca72
mov ecx, dword [ebx + 0xbb4]
call fcn.0045c99f
mov ecx, dword [ebx + 8]
push eax
push 0xfffffffffffffffe
pop edx
call fcn.004192b8
mov ecx, dword [ebx + 8]
add esp, 0x10
call fcn.0041cd62
mov edi, 0x400
push edi
push 0x6df3d0
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df3d8
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jle 0x40a088
push edi
push 0x6df3e0
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov esi, 0x76f260
push 0x1000
push esi
push eax
mov edx, str.exitPID
call fcn.00493ee4
add esp, 0x14
mov ecx, esi
call fcn.004877c2
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40a088
mov edx, 0x154b
mov ecx, 0x6df3f0
call fcn.00489fe0
mov ecx, dword [ebx]
mov edx, esi
push eax
push ebx
push 0x40843a
push 0xffffffffffffffff
call fcn.0048a8ba
add esp, 0x10
push edi
push 0x6df408
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.hideConsole
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jle 0x40a0c5
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x40a0c5
push 0xf88
push ecx
mov edx, str.require_win_console_.hide__
call fcn.004188ff
pop ecx
pop ecx
push edi
push 0x6df440
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.selfTest
push 0
push 0
push eax
call fcn.00493ee4
add esp, 0x14
test eax, eax
jne 0x40a0f7
mov ecx, dword [ebx]
mov edx, 0x4081c9
push ebx
call fcn.0048669a
pop ecx
cmp dword [ebx + 0xbc4], 0
jne 0x40a10c
mov ecx, ebx
call fcn.004077e8
jmp 0x40a1ee
push edi
push 0x6df458
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df464
push 0
push 0
push eax
call fcn.00493ee4
mov esi, eax
add esp, 0x14
cmp esi, 4
jle 0x40a1d9
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.004878dc
push 0x400
push 0x6df470
mov edi, eax
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, 0x6df47c
push esi
push edi
push eax
call fcn.00493ee4
mov ecx, dword [ebx + 8]
lea eax, [esi - 4]
push 0xd
push 0x6df488
push eax
lea edx, [edi + 4]
call fcn.0047c63c
add esp, 0x28
test eax, eax
jne 0x40a18e
mov ecx, dword [ebx + 8]
call fcn.0047c6c5
test eax, eax
je 0x40a1c0
mov eax, dword [ebx]
test eax, eax
je 0x40a199
mov esi, dword [eax + 8]
jmp 0x40a19b
xor esi, esi
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0
call fcn.0041b03c
push eax
push str.Error_Executing_MeshCore:__s
push 2
pop eax
push eax
push 0x4100
push esi
call fcn.004920d4
add esp, 0x18
mov ecx, dword [ebx + 8]
call fcn.0041cd62
xor eax, eax
inc eax
push eax
push edi
call fcn.005f5a60
pop ecx
pop ecx
mov edi, 0x400
push 0xf88
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.console.log_Agent_running_in_Local_Debug_Mode__require_MeshAgent_.emit_Connected_1__
call fcn.004188ff
pop ecx
pop ecx
push edi
push 0x6df514
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov esi, 0x76f260
push 0x1000
push esi
push eax
mov edx, 0x6df520
call fcn.00493ee4
add esp, 0x14
cmp eax, 5
jle 0x408e76
mov eax, dword [esi]
mov ecx, 0x6df52c
cmp eax, dword [ecx]
jne 0x408e76
movzx eax, byte [esi + 4]
cmp al, byte [ecx + 4]
jne 0x408e76
push edi
push 0x6df534
call fcn.005f8590
mov ecx, dword [ebx + 0x24]
mov edx, str.DiscoveryKey
push 0x1000
push esi
push eax
call fcn.00493ee4
xor edi, edi
mov esi, eax
inc edi
add esp, 0x14
cmp esi, edi
jle 0x40a2f2
lea eax, [ebp - 0x10]
push eax
call fcn.004afc20
lea eax, [esi - 1]
mov esi, 0x76f260
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004afcd0
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004afc10
push 0x157c
push 0x6df554
push edi
push 0x20
call fcn.005f5ba0
add esp, 0x28
mov dword [ebx + 0xd28], eax
test eax, eax
jne 0x40a2e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x157c
push esi
push edi
mov edx, 0x6df56c
xor ecx, ecx
call fcn.0048f95e
push edi
push 0x6df584
push 0x6df59c
call fcn.00401109
add esp, 0x18
push esi
jmp 0x40a4c5
push 8
pop ecx
mov esi, 0x76f260
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp + 0xcc]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.0048f49a
mov esi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
je 0x40a33a
push 0x17
pop edi
push 0x425d
mov word [ebp - 0x50], di
call esi
mov word [ebp - 0x4e], ax
mov edx, str.FF02:0:0:0:0:0:0:FE
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.0048f637
pop ecx
push 2
pop edi
push 0x425d
mov word [ebp + 0xcc], di
call esi
mov word [ebp + 0xce], ax
mov edx, str.239.255.255.235
lea eax, [ebp + 0xd0]
mov ecx, edi
push eax
call fcn.0048f637
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0x425e
call fcn.00486c6d
add esp, 0x18
mov dword [ebx + 0xd20], eax
test eax, eax
jne 0x40a3b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1594
mov edx, 0x6df5e4
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
jmp 0x408e76
push ecx
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
call fcn.00486c6d
add esp, 0x18
mov dword [ebx + 0xd24], eax
test eax, eax
jne 0x408e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1598
mov edx, 0x6df5fc
jmp 0x40a3a1
push ecx
push ecx
push 0x1349
xor edi, edi
push 0x6de8c8
inc edi
push edi
push 0x20
call fcn.005f5ba0
add esp, 0x10
mov ecx, eax
push 0x10
pop edx
call fcn.00487604
mov esi, eax
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x80]
mov dword [esi], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x40a43c
call fcn.00493a2b
and dword [ebx + 0x24], 0
mov eax, dword [ebx + 0xd38]
cmp eax, 0xa
je 0x40a48d
inc eax
push eax
push str.Unable_to_open_database___d_10_..._r_n
call fcn.00401109
inc dword [ebx + 0xd38]
pop ecx
pop ecx
mov ecx, dword [ebx]
push 0
push 0x135d
push 0x6de924
push 0x406652
push 0x4082d1
push 0x7d0
call fcn.00488100
mov edx, esi
mov ecx, eax
call fcn.0048d655
add esp, 0x18
mov eax, edi
jmp 0x40a49a
push str.Unable_to_open_database._r_n
call fcn.00401109
xor eax, eax
pop ecx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
call fcn.005c0db0
lea esp, [ebp + 0xe0]
pop ebp
ret
push str.___Administrator_permissions_needed..._n
call fcn.00401109
pop ecx
push 0
call fcn.005d0820
call fcn.005c0f10
int3