Function at 0x40786a
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set environment variable
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x6ccd44]
xor eax, ebp
mov dword [ebp + 0xdc], eax
mov eax, dword [ebp + 0xe8]
and dword [ebp - 0x78], 0
push ebx
push esi
push edi
push str.__DUMMY__
mov edi, edx
mov dword [ebp - 0x68], eax
mov ebx, ecx
mov dword [ebp - 0x7c], edi
push 0x6d0a28
mov dword [ebp - 0x64], ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp + 0xec]
xor esi, esi
mov dword [ebp - 0x80], eax
test edi, edi
jle 0x407955
mov eax, dword [ebp - 0x68]
mov ecx, str._recovery
mov eax, dword [eax + esi*4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4078ed
test dl, dl
je 0x4078e9
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4078ed
add eax, 2
add ecx, 2
test dl, dl
jne 0x4078cd
xor eax, eax
jmp 0x4078f4
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x4078ff
or dword [ebx + 0x54], 0x40
and dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x68]
mov ecx, str._nocertstore
mov eax, dword [eax + esi*4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40792a
test dl, dl
je 0x407926
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40792a
add eax, 2
add ecx, 2
test dl, dl
jne 0x40790a
xor eax, eax
jmp 0x407931
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x40794c
and dword [ebp - 0x80], eax
push str._Not_using_Certificate_Store__n
call fcn.00401109
xor eax, eax
inc eax
pop ecx
mov dword [ebx + 0xa24], eax
inc esi
cmp esi, edi
jl 0x4078c2
xor esi, esi
test edi, edi
jle 0x407af9
mov eax, dword [ebp - 0x68]
mov ecx, 0x6d0a6c
mov eax, dword [eax + esi*4]
mov edx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40799c
cmp byte [ebp - 0x51], 0
je 0x407998
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x40799c
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x40796c
xor ecx, ecx
jmp 0x4079a1
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407aec
mov edx, eax
mov ecx, 0x6d0a78
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x4079e0
cmp byte [ebp - 0x51], 0
je 0x4079dc
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x4079e0
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x4079b0
xor ecx, ecx
jmp 0x4079e5
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407aec
mov edx, eax
mov ecx, 0x6d0a84
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407a24
cmp byte [ebp - 0x51], 0
je 0x407a20
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407a24
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x4079f4
xor ecx, ecx
jmp 0x407a29
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407aec
mov edx, eax
mov ecx, 0x6d0a94
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407a68
cmp byte [ebp - 0x51], 0
je 0x407a64
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407a68
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x407a38
xor ecx, ecx
jmp 0x407a6d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407aec
mov edx, eax
mov ecx, 0x6d0aa4
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407aa8
cmp byte [ebp - 0x51], 0
je 0x407aa4
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407aa8
add ecx, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x407a78
xor ecx, ecx
jmp 0x407aad
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x407aec
mov ecx, 0x6d0ab0
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x407ad6
test dl, dl
je 0x407ad2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x407ad6
add ecx, 2
add eax, 2
test dl, dl
jne 0x407ab6
xor eax, eax
jmp 0x407add
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x407aec
inc esi
cmp esi, edi
jl 0x40795f
jmp 0x407af9
push 0
xor ecx, ecx
call fcn.0048b094
pop ecx
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x407b1b
push 0
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d0abc
call fcn.00402f85
pop ecx
mov ecx, eax
call fcn.0048b094
pop ecx
mov dword [ebx + 0x24], eax
mov ecx, dword [ebp - 0x7c]
xor eax, eax
and dword [ebp - 0x6c], eax
xor esi, esi
and dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], esi
test ecx, ecx
jle 0x407e33
mov eax, dword [ebp - 0x68]
cmp dword [eax + esi*4], 0
jne 0x407b47
and dword [ebp - 0x74], 0
jmp 0x407b5c
push 0x1000
push dword [eax + esi*4]
call fcn.005ea5b0
pop ecx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x68]
pop ecx
mov esi, dword [eax + esi*4]
mov ecx, 0x6d0ac0
mov edx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x407b86
test al, al
je 0x407b82
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x407b86
add ecx, 2
add edx, 2
test al, al
jne 0x407b66
xor eax, eax
jmp 0x407b8d
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov ecx, dword [ebp - 0x6c]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov eax, 0x6d0ac8
mov dword [ebp - 0x6c], ecx
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407bc2
test dl, dl
je 0x407bbe
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407bc2
add eax, 2
add ecx, 2
test dl, dl
jne 0x407ba2
xor eax, eax
jmp 0x407bc9
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x407c04
mov ecx, esi
mov eax, 0x6d0ad4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407bf7
test dl, dl
je 0x407bf0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407bf7
add eax, 2
add ecx, 2
test dl, dl
jne 0x407bd4
xor edx, edx
xor eax, eax
inc edx
jmp 0x407bfe
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
test eax, eax
jne 0x407c09
jmp 0x407c07
xor edx, edx
inc edx
mov edi, edx
mov eax, 0x6d0ae4
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x407c2e
test cl, cl
je 0x407c2a
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x407c2e
add eax, 2
add esi, 2
test cl, cl
jne 0x407c0e
xor eax, eax
jmp 0x407c32
sbb eax, eax
or eax, edx
test eax, eax
jne 0x407c52
mov ecx, dword [ebx + 0x24]
push 5
pop edi
push eax
push edx
push 0x6d0af0
push 0xd
mov edx, str._localService
call fcn.0048a582
add esp, 0x10
mov eax, dword [ebp - 0x68]
mov esi, dword [ebp - 0x60]
mov edx, dword [eax + esi*4]
mov ecx, edx
mov eax, 0x6d0b04
mov bl, byte [eax]
cmp bl, byte [ecx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407c92
cmp byte [ebp - 0x51], 0
je 0x407c8e
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x407c92
add eax, 2
add ecx, 2
cmp byte [ebp - 0x51], 0
jne 0x407c62
xor eax, eax
jmp 0x407c99
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x407ccd
mov eax, 0x6d0b10
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x407cc2
test cl, cl
je 0x407cbe
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x407cc2
add eax, 2
add edx, 2
test cl, cl
jne 0x407ca2
xor eax, eax
jmp 0x407cc9
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x407cef
mov ecx, dword [ebx + 0x24]
mov edx, str._deleteData
push 2
pop eax
mov edi, eax
xor eax, eax
push 0
inc eax
push eax
push 0x6d0b20
push 0xb
call fcn.0048a582
add esp, 0x10
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + esi*4]
mov eax, 0x6d0b30
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407d1a
test dl, dl
je 0x407d16
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407d1a
add eax, 2
add ecx, 2
test dl, dl
jne 0x407cfa
xor eax, eax
jmp 0x407d21
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
mov edx, dword [ebp - 0x74]
test eax, eax
push 2
pop eax
cmove edi, eax
xor eax, eax
inc eax
push eax
mov eax, dword [ebp - 0x68]
push 0x6d0b3c
mov ecx, dword [eax + esi*4]
call fcn.00487d81
pop ecx
pop ecx
mov esi, eax
push 2
pop eax
cmp esi, eax
jle 0x407e1e
mov ecx, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x60]
push 0x6d0b40
push dword [ecx + eax*4]
call fcn.005e3050
add esp, 0xc
test eax, eax
jne 0x407e1e
cmp esi, 0xa
jne 0x407dd8
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
push 8
push str.readonly
push 2
mov eax, dword [ecx + eax*4]
pop ecx
add eax, ecx
push eax
call fcn.005e3050
add esp, 0xc
test eax, eax
jne 0x407dd8
mov ecx, dword [ebp - 0x68]
inc eax
push eax
mov eax, dword [ebp - 0x60]
push 0x6d0b50
mov eax, dword [ecx + eax*4]
add eax, 0xb
push eax
call fcn.005e3050
add esp, 0xc
test eax, eax
jne 0x407dd8
inc eax
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x58], eax
je 0x407dde
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d0b54
call fcn.00402f85
pop ecx
mov ecx, dword [ebx + 0x24]
mov edx, eax
call fcn.0048b112
cmp dword [ebx + 0x24], 0
jne 0x407deb
push 0
xor ecx, ecx
call fcn.0048b094
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x68]
push 0
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebx + 0x24]
sub eax, esi
dec eax
push eax
lea eax, [edx + 1]
add edx, 2
add eax, esi
push eax
lea eax, [esi - 2]
push eax
call fcn.0048a582
mov eax, dword [ebp - 0x70]
add esp, 0x10
inc eax
mov dword [ebp - 0x70], eax
jmp 0x407e21
mov eax, dword [ebp - 0x70]
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x7c]
inc esi
mov dword [ebp - 0x60], esi
cmp esi, ecx
jl 0x407b38
sub ecx, eax
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x7c], ecx
jne 0x407e4b
push 0
xor ecx, ecx
call fcn.0048b094
pop ecx
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x24]
cmp dword [eax], 0
je 0x407ecc
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..mshx
call fcn.00402f85
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407289
test eax, eax
jne 0x407ecc
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d0b60
call fcn.00402f85
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407289
test eax, eax
jne 0x407ecc
mov edx, str.mesh_linumshx
mov ecx, ebx
call fcn.00407289
test eax, eax
jne 0x407ecc
mov edx, str.mesh_limshx
mov ecx, ebx
call fcn.00407289
test eax, eax
jne 0x407ecc
xor edx, edx
mov ecx, ebx
call fcn.0040709a
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6d0b84
call fcn.00402f85
pop ecx
mov edx, eax
mov ecx, ebx
call fcn.00407289
cmp dword [ebx + 0xa24], 0
mov esi, 0x400
jne 0x407f00
push esi
push 0x6d0b8c
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.nocertstore
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
mov dword [ebx + 0xa24], eax
cmp dword [ebp - 0x6c], 0
je 0x407f46
push dword [ebx]
push 0x40778a
push 0
push dword [ebx + 0x1c]
push 0
push 0
push dword [ebx]
push 0
call fcn.00475d69
xor edx, edx
mov ecx, eax
call fcn.00476205
add esp, 0x20
mov edx, str.require__agentStatus_.start___
push 0xe08
push ecx
mov ecx, eax
call fcn.004172fe
xor eax, eax
pop ecx
inc eax
jmp 0x409590
test edi, edi
je 0x408139
push dword [ebx]
push 0x40778a
push 0
push dword [ebx + 0x1c]
push 0
push 0
push dword [ebx]
push 0
call fcn.00475d69
xor edx, edx
mov ecx, eax
call fcn.00476205
mov esi, eax
push ebx
mov ecx, esi
call fcn.00402f45
add esp, 0x24
mov edx, 0x6d0bc8
push 0xe08
push ecx
mov ecx, esi
call fcn.004172fe
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.00418ce1
test eax, eax
je 0x4095af
sub edi, 1
je 0x40807d
sub edi, 1
je 0x407fcb
sub edi, 3
je 0x40807d
mov ecx, esi
call fcn.00458f36
mov esi, 0x400
jmp 0x408153
push 0xe08
push ecx
mov edx, str.require_agent_installer__
mov ecx, esi
call fcn.004172fe
push str.fullUninstall
or edx, 0xffffffff
mov ecx, esi
call fcn.00417a62
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.00418950
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.0047ad02
or edx, 0xffffffff
mov ecx, esi
call fcn.00417298
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.00416899
add esp, 0x14
test eax, eax
je 0x40812a
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6d0c98
call fcn.00419a31
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x408058
test cl, cl
je 0x408054
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x408058
add eax, edx
add edi, edx
test cl, cl
jne 0x40803a
mov eax, ebx
jmp 0x40805f
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x40812a
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.00419a31
push eax
push 0x6d0cc4
jmp 0x408122
push 0xe08
push ecx
mov edx, 0x6d0c14
mov ecx, esi
call fcn.004172fe
push str.fullInstall
or edx, 0xffffffff
mov ecx, esi
call fcn.00417a62
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.00418950
mov edx, dword [ebx + 0x24]
mov ecx, esi
call fcn.0047ad02
or edx, 0xffffffff
mov ecx, esi
call fcn.00417298
xor eax, eax
xor ebx, ebx
push ebx
mov ecx, esi
lea edx, [eax + 1]
call fcn.00416899
add esp, 0x14
test eax, eax
je 0x40812a
push ebx
or edx, 0xffffffff
mov ecx, esi
mov edi, 0x6d0c3c
call fcn.00419a31
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x408106
test cl, cl
je 0x408102
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x408106
add eax, edx
add edi, edx
test cl, cl
jne 0x4080e8
mov eax, ebx
jmp 0x40810d
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x40812a
push ebx
or edx, 0xffffffff
mov ecx, esi
call fcn.00419a31
push eax
push 0x6d0c68
call fcn.00401109
add esp, 0xc
mov ecx, esi
call fcn.0041b762
xor eax, eax
inc eax
jmp 0x409591
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4094e5
cmp dword [eax], 0
jne 0x408153
cmp dword [ebp - 0x58], 0
je 0x4094e5
mov edx, dword [ebx]
call fcn.0048e3c5
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4081a9
push esi
push 0x6d0d3c
mov dword [eax + 0x103c], 0x4077b1
mov dword [eax + 0x1040], ebx
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.semaphoreTrack
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
je 0x4081a9
and dword [0x72a1a8], 0
mov dword [0x72a314], 0x407821
and dword [ebp - 0x58], 0
lea eax, [ebp - 0x6c]
push eax
push 0xf003f
push 0
push 0x6d0d5c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408218
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push eax
push 0x6d0d7c
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40820f
cmp dword [ebp - 0x58], eax
jbe 0x40820f
push 0x6d0d88
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40820f
push str.NodeID_will_reset__because_ResetNodeID_key_was_found_in_registry
call fcn.00488afe
xor eax, eax
inc eax
pop ecx
mov dword [ebp - 0x78], eax
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push dword [ebx + 0x1c]
push eax
push eax
push dword [ebx]
push eax
call fcn.00475d69
xor edx, edx
mov ecx, eax
call fcn.00476205
add esp, 0x20
mov dword [ebp - 0x60], eax
mov edx, str.require_linux_pathfix____
push 0xf88
push ecx
mov ecx, eax
call fcn.004172fe
xor eax, eax
push esi
push 0x6d0df4
mov dword [ebx + 0xb38], eax
mov dword [ebx + 0xb3c], eax
mov dword [ebx + 0xb40], eax
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d0e04
push 0
push 0
push eax
call fcn.0048b62d
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4082f3
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x4082b5
push 0xfffffffffffffffe
pop eax
sub eax, esi
je 0x4082b5
cmp edi, 0xffffffef
jae 0x4082b5
push 0x1293
xor eax, eax
inc eax
push 0x6d0e14
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x4082b7
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.004811d1
push 0x400
push 0x6d0e2c
mov dword [ebx + 0xb4c], eax
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d0e3c
push esi
push dword [ebx + 0xb4c]
push eax
call fcn.0048b62d
add esp, 0x1c
jmp 0x4082fd
mov dword [ebx + 0xb4c], 0x6d0e4c
push 0x400
push 0x6d0e58
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d0e64
push 0
push 0
push eax
call fcn.0048b62d
mov esi, eax
add esp, 0x14
test esi, esi
je 0x408395
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x408357
push 0xfffffffffffffffe
pop ecx
sub ecx, esi
je 0x408357
cmp edi, 0xffffffef
jae 0x408357
push 0x12a1
xor eax, eax
inc eax
push 0x6d0e70
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x408359
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.004811d1
push 0x400
push 0x6d0e88
mov dword [ebx + 0xb50], eax
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d0e94
push esi
push dword [ebx + 0xb50]
push eax
call fcn.0048b62d
add esp, 0x1c
jmp 0x40839f
mov dword [ebx + 0xb50], str.MeshCentral
push dword [ebx + 0xb4c]
mov esi, dword [ebp - 0x60]
push str.require_service_manager_.manager.getService__s_.isMe___
push esi
call fcn.0041ac99
add esp, 0xc
or edx, 0xffffffff
mov ecx, esi
call fcn.00418e4c
push 0xe88
push ecx
mov edx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov ecx, esi
mov edi, eax
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x4083ee
push eax
push ecx
or edx, 0xffffffff
mov ecx, esi
call fcn.004183b4
pop ecx
pop ecx
mov dword [ebx + 0xb38], eax
push 0xe88
push ecx
mov edx, edi
mov ecx, esi
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x408413
or edx, 0xffffffff
mov ecx, esi
call fcn.00418ce1
mov dword [ebx + 0xb3c], eax
mov edi, 0xe88
mov edx, str.require_user_sessions_.isRoot___
push edi
push ecx
mov ecx, esi
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x40843c
or edx, 0xffffffff
mov ecx, esi
call fcn.00418ce1
mov dword [ebx + 0xb40], eax
cmp dword [ebx + 0xb3c], 0
jne 0x408528
cmp dword [ebx + 0xb54], 0
je 0x408528
push edi
push ecx
mov edx, str.require_util_service_check___
mov ecx, esi
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x408528
or edx, 0xffffffff
mov ecx, esi
call fcn.00418529
test eax, eax
mov ecx, 0x6b73b8
cmovne ecx, eax
call fcn.0041a31d
test al, 6
jne 0x408528
lea eax, [ebp - 0x58]
or edx, edx
push eax
mov ecx, esi
call fcn.00419a31
push eax
push dword [ebx + 0xb4c]
mov dword [ebp - 0x6c], eax
push str.Service_Name_Conflict:_Configured___s__but_is_actually___s_
call fcn.00488afe
mov ecx, dword [ebx + 0xb4c]
add esp, 0x10
call fcn.00481286
mov esi, dword [ebp - 0x58]
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x4084f1
push 0xfffffffffffffffe
pop eax
sub eax, esi
je 0x4084f1
cmp edi, 0xffffffef
jae 0x4084f1
push 0x12c8
xor eax, eax
inc eax
push 0x6d1094
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x4084f3
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.004811d1
push esi
push dword [ebp - 0x6c]
mov dword [ebx + 0xb4c], eax
mov ecx, eax
mov edx, dword [eax - 0x10]
call section..text
mov esi, dword [ebp - 0x60]
xor eax, eax
add esp, 0x10
mov edi, 0xe88
inc eax
mov dword [ebx + 0xb3c], eax
push 0x400
push 0x6d10ac
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.skipmaccheck
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x4086da
push edi
push ecx
mov edx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov ecx, esi
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x4086da
lea eax, [ebp - 0x58]
or edx, 0xffffffff
push eax
mov ecx, esi
call fcn.00418df8
mov edi, dword [ebp - 0x58]
mov esi, eax
mov dword [ebp - 0x70], esi
pop ecx
cmp edi, 0x13
jb 0x4086da
push 0x400
push 0x6d10cc
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d11d8
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x4085d1
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d11ec
push eax
push edi
push esi
push 0x11
call fcn.0048b1d2
add esp, 0x10
jmp 0x4086da
xor esi, esi
test edi, edi
jle 0x4086da
mov ebx, dword [ebp - 0x70]
push 0x13
lea eax, [esi + ebx]
push 0x6d1200
push eax
call fcn.005e3050
add esp, 0xc
test eax, eax
jne 0x4085fc
add esi, 0x13
cmp esi, edi
jl 0x4085de
mov ebx, dword [ebp - 0x64]
cmp esi, edi
jge 0x4086da
mov esi, dword [ebp - 0x58]
and dword [ebp - 0x6c], 0
lea eax, [esi + 1]
cmp eax, 0xffffffdb
jae 0x408625
lea eax, [esi + 0x25]
call fcn.005b4450
mov ecx, esp
lea eax, [esi + 1]
jmp 0x408627
xor ecx, ecx
xor edx, edx
inc edx
push edx
push 4
mov edx, eax
call fcn.004811d1
push 0x400
push 0x6d1214
mov dword [ebp - 0x74], eax
lea ecx, [eax + 4]
mov dword [eax], ecx
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1228
push esi
push dword [ebp - 0x74]
push eax
call fcn.0048b62d
add esp, 0x1c
test esi, esi
jle 0x4086ad
mov esi, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x58]
push 0x13
push str._00:00:00:00:00:00_
push esi
call fcn.005e3050
add esp, 0xc
test eax, eax
je 0x408691
mov ecx, dword [ebp - 0x70]
mov edx, edi
push 0x13
push esi
call fcn.00487d81
pop ecx
pop ecx
test eax, eax
jns 0x4086a3
mov eax, dword [ebp - 0x6c]
add esi, 0x13
add eax, 0x13
mov dword [ebp - 0x6c], eax
cmp eax, ebx
jl 0x40866a
jmp 0x4086a6
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
mov ebx, dword [ebp - 0x64]
jl 0x4086da
push dword [ebp - 0x74]
mov esi, dword [ebp - 0x70]
push esi
push str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
call fcn.00488afe
mov ecx, dword [ebx + 0x24]
xor eax, eax
push 0
push edi
inc eax
mov edx, str.LocalMacAddresses
push esi
push 0x11
mov dword [ebp - 0x78], eax
call fcn.0048b1d2
add esp, 0x1c
mov ecx, dword [ebp - 0x60]
call fcn.00458f36
xor edi, edi
inc edi
cmp dword [ebp - 0x78], edi
je 0x4086f5
mov ecx, ebx
call fcn.004033f0
test eax, eax
je 0x40870b
mov ecx, ebx
call fcn.004030a4
test eax, eax
je 0x40870b
push str.Certificate_error_r_n
call fcn.00401109
pop ecx
mov ecx, ebx
call fcn.00403783
test eax, eax
je 0x408721
push str.Certificate_validation_error_r_n
call fcn.00401109
pop ecx
and dword [ebp - 0x58], 0
mov edx, str..tag
push 0x1000
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00402f85
pop ecx
lea edx, [ebp - 0x58]
mov ecx, eax
call fcn.0047fa6a
mov esi, dword [ebp - 0x58]
mov ecx, dword [ebx + 0x24]
test esi, esi
je 0x408769
push 0
push eax
push esi
push 3
mov edx, 0x6d12d4
call fcn.0048b1d2
push edi
push esi
call fcn.005e7dd0
add esp, 0x18
jmp 0x408776
push 3
mov edx, 0x6d12d8
call fcn.0048bb79
pop ecx
mov ecx, dword [ebx + 0x24]
lea eax, [ebp - 0x34]
push 0xff
push eax
push 0xf
mov edx, str.ignoreProxyFile
call fcn.0048b62d
add esp, 0xc
test eax, eax
jne 0x4087ef
and dword [ebp - 0x58], eax
mov edx, str..proxy
push 0x400
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00402f85
pop ecx
lea edx, [ebp - 0x58]
mov ecx, eax
call fcn.0047fa6a
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x4087ef
mov ecx, dword [ebx + 0x24]
test eax, eax
jle 0x4087d9
push 0
push eax
push esi
push 8
mov edx, 0x6d12f4
call fcn.0048b1d2
add esp, 0x10
jmp 0x4087e6
push 8
mov edx, 0x6d1300
call fcn.0048bb79
pop ecx
push edi
push esi
call fcn.005e7dd0
pop ecx
pop ecx
and dword [ebp - 0x58], 0
mov esi, 0x400
push esi
push 0x6d130c
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1320
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
cmp eax, 4
jne 0x40884b
push esi
push 0x6d1334
call fcn.005ea5b0
push 4
lea ecx, [ebp - 0x58]
mov edx, str.AgentCapabilities
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048b62d
add esp, 0x14
push dword [ebp - 0x58]
call dword [sym.imp.WS2_32.dll_ntohl]
or dword [ebx + 0x54], eax
push dword [ebx + 0xb4c]
push 0x6d135c
push 0
push 0
call fcn.0040119b
mov esi, eax
add esp, 0x10
lea edi, [esi + 1]
cmp edi, 0xffffffff
jae 0x408894
push 0xfffffffffffffffe
pop ecx
sub ecx, esi
je 0x408894
cmp edi, 0xffffffef
jae 0x408894
push 0x133c
xor eax, eax
inc eax
push 0x6d1374
push eax
lea eax, [esi + 0x11]
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x408896
xor eax, eax
push 0
push 0
mov edx, edi
mov ecx, eax
call fcn.004811d1
push dword [ebx + 0xb4c]
mov edi, eax
push str.SoftwareOpen_Source_s
mov dword [ebp - 0x58], edi
push dword [edi - 0x10]
push edi
call fcn.0040119b
add esp, 0x18
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax + 1]
lea eax, [edi + edi]
cmp eax, 0xffffffef
jae 0x4088fd
push 0x133f
xor eax, eax
inc eax
push 0x6d13a4
push eax
lea eax, [edi*2 + 0x10]
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x4088ff
xor eax, eax
push 0
push 0
lea edx, [edi + edi]
mov ecx, eax
call fcn.004811d1
pop ecx
pop ecx
mov ecx, closesocket
mov dword [ebp - 0x78], eax
cmp edi, ecx
jae 0x408d8c
cmp esi, ecx
ja 0x408d8c
lea ecx, [edi + 1]
mov edx, esi
push ecx
mov ecx, dword [ebp - 0x58]
push eax
call fcn.00480c85
pop ecx
pop ecx
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebx + 0xb58]
push dword [ebp - 0x78]
neg eax
sbb eax, eax
add eax, reloc.WS2_32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x408d8c
and dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
test byte [ebx + 0x54], 0x40
push eax
push 0x30
pop edx
jne 0x408c94
lea ecx, [ebx + 0xae8]
call fcn.00486648
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, eax
pop ecx
test edx, edx
jle 0x4089da
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x4089da
xor eax, eax
test edx, edx
jle 0x4089b2
mov cl, byte [eax + esi]
cmp cl, 0x2b
jne 0x4089a4
mov byte [eax + esi], 0x40
jmp 0x4089ad
cmp cl, 0x2f
jne 0x4089ad
mov byte [eax + esi], 0x24
inc eax
cmp eax, edx
jl 0x408996
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d13bc
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005e7dd0
and dword [ebp - 0x60], 0
pop ecx
pop ecx
jmp 0x4089e4
push str.NodeId
push dword [ebp - 0x5c]
call edi
mov esi, 0x72f000
lea ecx, [ebx + 0x9c4]
push esi
push 0x30
pop edx
call fcn.0047f7e9
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4089fd
sub ecx, edx
xor eax, eax
push ecx
push esi
inc eax
push eax
push 0
push str.AgentHash
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x400
push 0x6d13d8
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d13e0
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
mov esi, 0x730000
test eax, eax
jne 0x408a53
push 0x6d13e8
jmp 0x408ae8
push 0x400
push 0x6d13f0
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d13f8
push 0x10000
push esi
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jle 0x408ae3
lea ecx, [ebp - 0x60]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00486648
mov edx, eax
pop ecx
test edx, edx
jle 0x408adc
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x408adc
xor ecx, ecx
test edx, edx
jle 0x408ab8
mov al, byte [ecx + esi]
cmp al, 0x2b
jne 0x408aab
mov byte [ecx + esi], 0x40
jmp 0x408ab3
cmp al, 0x2f
jne 0x408ab3
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, edx
jl 0x408a9e
push edx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d1400
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005e7dd0
pop ecx
pop ecx
jmp 0x408aed
push 0x6d1408
jmp 0x408ae8
push str.MeshId
push dword [ebp - 0x5c]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
push 0x1a
push 0x6d1418
inc eax
push eax
push 0
push str.CommitDate
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6d1440
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d144c
push 0x10000
push 0x730000
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x408b44
push 0x6d1458
push dword [ebp - 0x5c]
call edi
jmp 0x408b6b
mov ecx, 0x730000
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408b4c
sub ecx, edx
xor eax, eax
push ecx
push 0x730000
inc eax
push eax
push 0
push str.MeshServerUrl
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6d1478
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1484
push 0x10000
push 0x730000
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x408ba5
push 0x6d1490
push dword [ebp - 0x5c]
call edi
jmp 0x408bcc
mov ecx, 0x730000
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408bad
sub ecx, edx
xor eax, eax
push ecx
push 0x730000
inc eax
push eax
push 0
push str.MeshServerId
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6d14b0
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.WebProxy
push 0x10000
push 0x730000
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x408c06
push 0x6d14c8
push dword [ebp - 0x5c]
call edi
jmp 0x408c2d
mov ecx, 0x730000
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408c0e
sub ecx, edx
xor eax, eax
push ecx
push 0x730000
inc eax
push eax
push 0
push str.Proxy
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6d14d8
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d14dc
push 0x10000
push 0x730000
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x408c67
push 0x6d14e0
push dword [ebp - 0x5c]
call edi
jmp 0x408c8c
mov edi, 0x730000
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408c71
sub ecx, edx
xor eax, eax
push ecx
push edi
inc eax
push eax
push 0
push 0x6d14e4
push dword [ebp - 0x5c]
call esi
lea edi, [ebx + 0xae8]
jmp 0x408d01
lea edi, [ebx + 0xae8]
mov ecx, edi
call fcn.00486648
pop ecx
test eax, eax
jle 0x408cf3
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x408cf3
xor ecx, ecx
test eax, eax
jle 0x408ccf
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x408cc1
mov byte [ecx + esi], 0x40
jmp 0x408cca
cmp dl, 0x2f
jne 0x408cca
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, eax
jl 0x408cb3
push eax
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6d14e8
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005e7dd0
pop ecx
pop ecx
jmp 0x408d01
push str.DiagnosticAgentNodeId
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, 0x400
push esi
push 0x6d1518
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.SelfNodeCert
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x408d83
push esi
push 0x6d1538
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov esi, 0x72f000
push 0x1000
push esi
push eax
mov edx, 0x6d1540
call fcn.0048b62d
add esp, 0x14
test eax, eax
je 0x408d6c
cmp eax, 0x30
jne 0x408d6c
xor ecx, ecx
mov eax, dword [edi + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x408d6c
inc ecx
cmp ecx, 0xc
jne 0x408d5c
jmp 0x408d83
mov ecx, dword [ebx + 0x24]
mov edx, str.NodeID
push 0
push 0x30
push edi
push 6
call fcn.0048b1d2
add esp, 0x10
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x58]
call fcn.00481286
mov ecx, dword [ebp - 0x78]
call fcn.00481286
lea edx, [ebx + 0xa38]
cmp dword [edx], 0
push ecx
mov ecx, dword [ebx + 0x20]
jne 0x408db1
push 0
xor edx, edx
jmp 0x408db7
push dword [ebx + 0xa2c]
call fcn.0048efba
mov eax, dword [ebp - 0x80]
pop ecx
pop ecx
test eax, eax
je 0x408e4f
mov eax, dword [ebp - 0x7c]
xor esi, esi
inc esi
cmp eax, esi
je 0x408e4f
push 2
pop edi
cmp eax, edi
jne 0x408e48
mov eax, dword [ebp - 0x68]
mov edx, 0x6d1550
mov ecx, dword [eax + 4]
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408e15
cmp byte [ebp - 0x51], 0
je 0x408e11
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x64]
jne 0x408e15
add eax, edi
add edx, edi
cmp byte [ebp - 0x51], 0
jne 0x408de7
xor eax, eax
jmp 0x408e19
sbb eax, eax
or eax, esi
test eax, eax
je 0x408e4f
mov eax, 0x6d1554
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x408e40
test dl, dl
je 0x408e3c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x408e40
add ecx, edi
add eax, edi
test dl, dl
jne 0x408e22
xor eax, eax
jmp 0x408e44
sbb eax, eax
or eax, esi
test eax, eax
je 0x408e4f
xor eax, eax
jmp 0x409591
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..update.exe
call fcn.00402f85
pop ecx
mov ecx, eax
call fcn.0047fb51
push ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..corereset
call fcn.00402f85
mov dword [esp], 0x1000
mov edi, 0x72c000
push edi
push 0xffffffffffffffff
mov esi, eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push edi
call fcn.006049c0
pop ecx
pop ecx
test eax, eax
jne 0x408ec7
push 0x400
push 0x6d1574
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1580
push eax
call fcn.0048bb79
add esp, 0xc
mov ecx, esi
call fcn.0047fb51
cmp dword [ebx + 0x48], 0
mov esi, 0x400
jne 0x408ef6
push esi
push 0x6d158c
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1598
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
mov edi, eax
jmp 0x408ef8
xor edi, edi
push esi
push 0x6d15a4
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d15b0
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
je 0x408f87
push esi
push 0x6d15bc
call fcn.005ea5b0
push 0x10
lea ecx, [ebp + 0xcc]
mov edx, str.jsDebugPort
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048b62d
add esp, 0x14
lea ecx, [eax - 1]
cmp ecx, 0xe
ja 0x408f87
cmp eax, 0x10
jae 0x4095c1
lea ecx, [ebp + 0xcc]
mov byte [ebp + eax + 0xcc], 0
call fcn.00481362
test edx, edx
ja 0x408f7f
jb 0x408f72
cmp eax, 0x7fffffff
ja 0x408f7f
lea ecx, [ebp + 0xcc]
call fcn.0048138f
jmp 0x408f81
xor eax, eax
mov dword [ebx + 0x9b8], eax
xor esi, esi
push 0x400
inc esi
push 0x6d15d4
mov dword [ebx + 0x4c], esi
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.showModuleNames
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
mov dword [0x72a2bc], eax
cmp dword [ebx + 8], 0
je 0x409013
push dword [ebx]
push dword [ebx + 8]
call fcn.00402882
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0x6d15f4
call fcn.00417a62
mov ecx, dword [ebx + 8]
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
call fcn.00418950
mov ecx, dword [ebx + 8]
mov edx, str.Ready
call fcn.0041a93d
mov ecx, dword [ebx + 8]
mov edx, esi
push 0
call fcn.00416899
add esp, 0x14
test eax, eax
je 0x40900b
mov ecx, dword [ebx + 8]
call fcn.00458eb7
mov ecx, dword [ebx + 8]
call fcn.0041b762
xor eax, eax
cmp dword [ebx + 0x48], eax
jne 0x4091d0
push eax
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [ebx + 0x24]
push eax
push dword [ebx]
push eax
call fcn.00475d69
xor edx, edx
mov ecx, eax
call fcn.00476205
push ebx
mov ecx, eax
mov dword [ebx + 8], eax
call fcn.00402f45
mov ecx, dword [ebx + 8]
mov edx, 0x4075da
push ebx
call fcn.00458c3a
push 0x400
push 0x6d1604
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.coreDumpEnabled
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x3c
mov dword [ebx + 0x9bc], eax
test eax, eax
je 0x409097
push 0xf08
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
call fcn.004172fe
pop ecx
pop ecx
push 0x400
push 0x6d1624
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.finalizer_messages
push 0x1000
push 0x72f000
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
je 0x4090d6
mov eax, 0x72f000
push eax
call fcn.005e9bc0
pop ecx
mov dword [0x72a2dc], eax
cmp edi, 4
jle 0x4091d0
push 0x400
push 0x6d16cc
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.noUpdateCoreModule
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
je 0x409181
push str._CoreModule:_Update_Disabled_n
mov dword [ebx + 0x48], esi
call fcn.00401109
push 0
push 0
xor edx, edx
mov ecx, edi
call fcn.004814a9
push 0x400
push 0x6d1718
mov esi, eax
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1724
push edi
push esi
push eax
call fcn.0048b62d
mov ecx, dword [ebx + 8]
lea eax, [edi - 4]
push 0xd
push 0x6d1730
push eax
lea edx, [esi + 4]
call fcn.00476723
add esp, 0x2c
test eax, eax
jne 0x40916b
mov ecx, dword [ebx + 8]
call fcn.004767ac
test eax, eax
je 0x409173
mov ecx, dword [ebx + 8]
call fcn.0041b762
xor edi, edi
inc edi
push edi
push esi
call fcn.005e7dd0
pop ecx
pop ecx
jmp 0x4091d3
mov ecx, dword [ebx + 8]
lea edx, [ebp - 0x58]
sub esp, 0xc
mov dword [ebp - 0x58], ebx
call fcn.004592d9
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x9b4], eax
call fcn.0041ab48
mov edx, dword [ebx + 0x9b4]
mov ecx, dword [ebx + 8]
call fcn.0041b472
mov ecx, dword [ebx + 0x9b4]
call fcn.004585b9
mov ecx, dword [ebx + 8]
push eax
push 0xfffffffffffffffe
pop edx
call fcn.00417cb7
mov ecx, dword [ebx + 8]
add esp, 0x10
call fcn.0041b762
xor edi, edi
inc edi
mov esi, 0x400
push esi
push 0x6d1740
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d1748
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jle 0x409267
push esi
push 0x6d1750
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov esi, 0x72f000
push 0x1000
push esi
push eax
mov edx, str.exitPID
call fcn.0048b62d
add esp, 0x14
mov ecx, esi
call fcn.0048138f
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x409262
mov edx, 0x143a
mov ecx, 0x6d1760
call fcn.004834cd
mov ecx, dword [ebx]
mov edx, esi
push eax
push ebx
push 0x40779f
push 0xffffffffffffffff
call fcn.00483cc9
add esp, 0x10
mov esi, 0x400
push esi
push 0x6d1778
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.hideConsole
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jle 0x4092a4
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x4092a4
push 0xf88
push ecx
mov edx, str.require_win_console_.hide__
call fcn.004172fe
pop ecx
pop ecx
push esi
push 0x6d17b0
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, str.selfTest
push 0
push 0
push eax
call fcn.0048b62d
add esp, 0x14
test eax, eax
jne 0x4092d6
mov ecx, dword [ebx]
mov edx, 0x4075eb
push ebx
call fcn.004802b0
pop ecx
mov ecx, ebx
call fcn.00406d3e
push esi
push 0x6d17c8
call fcn.005ea5b0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6d17d4
push 0x1000
push 0x72f000
push eax
call fcn.0048b62d
add esp, 0x14
cmp eax, 5
jle 0x408131
mov edx, 0x72f000
mov ecx, 0x6d17e0
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x408131
movzx eax, byte [edx + 4]
cmp al, byte [ecx + 4]
jne 0x408131
push esi
push 0x6d17e8
call fcn.005ea5b0
push 0x1000
mov ecx, 0x72f000
mov edx, str.DiscoveryKey
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.0048b62d
mov esi, eax
add esp, 0x14
cmp esi, edi
jle 0x4093e7
lea eax, [ebp - 0x10]
push eax
call fcn.004a2d50
lea eax, [esi - 1]
mov esi, 0x72f000
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004a2e00
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004a2d40
push 0x1458
push 0x6d1808
push edi
push 0x20
call fcn.005e7f10
add esp, 0x28
mov dword [ebx + 0xb24], eax
test eax, eax
jne 0x4093db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1458
push esi
push edi
mov edx, 0x6d1820
xor ecx, ecx
call fcn.00488a50
push edi
push 0x6d1838
push 0x6d1850
call fcn.00401109
add esp, 0x18
push esi
jmp 0x4095bc
push 8
pop ecx
mov esi, 0x72f000
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp + 0xcc]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.004885c7
mov esi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
je 0x40942f
push 0x17
pop edi
push 0x425d
mov word [ebp - 0x50], di
call esi
mov word [ebp - 0x4e], ax
mov edx, str.FF02:0:0:0:0:0:0:FE
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.0048876f
pop ecx
push 2
pop edi
push 0x425d
mov word [ebp + 0xcc], di
call esi
mov word [ebp + 0xce], ax
mov edx, str.239.255.255.235
lea eax, [ebp + 0xd0]
mov ecx, edi
push eax
call fcn.0048876f
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0x425e
call fcn.0048087a
add esp, 0x18
mov dword [ebx + 0xb1c], eax
test eax, eax
jne 0x4094a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1470
mov edx, 0x6d1898
xor ecx, ecx
call fcn.00488a50
add esp, 0xc
jmp 0x408131
push ecx
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
call fcn.0048087a
add esp, 0x18
mov dword [ebx + 0xb20], eax
test eax, eax
jne 0x408131
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1474
mov edx, 0x6d18b0
jmp 0x409496
push 0
push 0
push 0x1235
xor edi, edi
push 0x6d0cc8
inc edi
push edi
push 0x20
call fcn.005e7f10
add esp, 0x10
mov ecx, eax
push 0x10
pop edx
call fcn.004811d1
mov esi, eax
mov eax, dword [ebp - 0x7c]
pop ecx
pop ecx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x80]
mov dword [esi], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x409533
call fcn.0048b17c
and dword [ebx + 0x24], 0
mov eax, dword [ebx + 0xb34]
cmp eax, 0xa
je 0x409584
inc eax
push eax
push str.Unable_to_open_database___d_10_..._r_n
call fcn.00401109
inc dword [ebx + 0xb34]
pop ecx
pop ecx
mov ecx, dword [ebx]
push 0
push 0x1249
push 0x6d0d24
push 0x405fea
push 0x407669
push 0x7d0
call fcn.00481a26
mov edx, esi
mov ecx, eax
call fcn.004868db
add esp, 0x18
mov eax, edi
jmp 0x409591
push str.Unable_to_open_database._r_n
call fcn.00401109
xor eax, eax
pop ecx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
call fcn.005b35b0
lea esp, [ebp + 0xe0]
pop ebp
ret
push str.___Administrator_permissions_needed..._n
call fcn.00401109
pop ecx
push 0
call fcn.005c3000
call fcn.005b3710
int3