Function at 0x140004e20
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rdi
mov rax, qword [0x1401ff510]
xor rax, rbp
mov qword [rbp + 0x160], rax
xor esi, esi
mov dword [rbp + 8], r9d
mov r12d, r9d
mov r13, r8
mov r14d, edx
mov qword [rbp + 0x10], r8
mov rbx, rcx
mov dword [rbp + 0x18], edx
mov edi, esi
cmp qword [rcx + 0x40], rsi
jne 0x140004e99
mov rcx, qword [rcx + 0x30]
lea rdx, [0x1401d5bb8]
call fcn.140002508
mov rcx, rax
call fcn.140070614
mov qword [rbx + 0x40], rax
cmp qword [rbx + 0x40], rsi
jne 0x140004eb2
lea rcx, str.Unable_to_open_database._r_n
call fcn.140001090
xor eax, eax
jmp 0x14000599b
mov rdx, qword [rbx]
call fcn.140073598
mov qword [rbx + 0x38], rax
lea rdx, str.SoftwareOpen_SourceMeshAgent2
lea rax, [rbp + 0x20]
mov dword [rbp], esi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r15d, 1
test eax, eax
jne 0x140004f40
mov rcx, qword [rbp + 0x20]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetNodeId
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140004f36
cmp dword [rbp], esi
jbe 0x140004f36
mov rcx, qword [rbp + 0x20]
lea rdx, str.ResetNodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
cmove edi, r15d
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14005d904
mov r9, qword [rbx]
mov rcx, rax
mov rax, qword [rbx + 0x30]
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14005d98c
mov r9d, 0xe88
mov qword [rbp + 0x28], rax
lea rdx, str.function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret______getMac___
mov rcx, rax
mov r15, rax
call fcn.14000b394
test eax, eax
jne 0x1400050e3
lea r8, [rbp + 0x20]
or edx, 0xffffffff
mov rcx, r15
call fcn.14000cac4
lea rcx, str.LocalMacAddresses
mov edx, 0x400
mov r12, rax
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, eax
call fcn.140070830
movsxd r14, eax
test eax, eax
jne 0x140005004
mov eax, dword [rbp + 0x20]
lea rdx, str.LocalMacAddresses
mov rcx, qword [rbx + 0x40]
mov r9, r12
mov r8d, reloc.WS2_32.dll_recvfrom
mov dword [rsp + 0x20], eax
call fcn.1400706e4
jmp 0x1400050db
lea rax, [r14 + 0x38]
mov rdx, r14
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000501e
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14015cbf0
sub rsp, rcx
mov r9d, 1
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 7]
call fcn.140068a9c
mov edx, 0x400
mov qword [rbp], rax
mov rsi, rax
lea rcx, [rax + 8]
mov qword [rax], rcx
lea rcx, str.LocalMacAddresses
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
mov r9, rsi
mov dword [rsp + 0x20], r14d
mov r8d, eax
call fcn.140070830
mov r13, qword [rbp + 0x20]
xor esi, esi
test r14d, r14d
jle 0x1400050b6
mov r15, qword [rbp]
movsxd r8, esi
mov r9d, reloc.WS2_32.dll_send
add r8, r15
mov edx, r13d
mov rcx, r12
call fcn.14006d9ac
test eax, eax
jns 0x1400050ad
add esi, 0x13
cmp esi, r14d
jl 0x14000508a
mov r15, qword [rbp + 0x28]
cmp esi, r14d
jl 0x1400050d7
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
mov edi, 1
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8d, [rdi + 0x10]
call fcn.1400706e4
mov r13, qword [rbp + 0x10]
mov r14d, dword [rbp + 0x18]
mov r12d, dword [rbp + 8]
test r15, r15
je 0x1400050f1
mov rcx, qword [r15 + 0x40]
call fcn.14001cf14
cmp edi, 1
je 0x140005107
mov rcx, rbx
call fcn.1400028dc
xor r15d, r15d
test eax, eax
je 0x140005122
jmp 0x14000510a
xor r15d, r15d
mov rcx, rbx
call fcn.14000269c
test eax, eax
je 0x140005122
lea rcx, str.Certificate_error_r_n
call fcn.140001090
mov rcx, rbx
call fcn.140002a54
test eax, eax
je 0x14000513a
lea rcx, str.Certificate_validation_error_r_n
call fcn.140001090
mov rcx, qword [rbx + 0x30]
lea rdx, str..tag
mov qword [rbp + 0x10], r15
call fcn.140002508
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.14006718c
mov rdi, qword [rbp + 0x10]
lea rsi, [0x1401d58f4]
mov rcx, qword [rbx + 0x40]
mov r8d, 3
mov rdx, rsi
test rdi, rdi
je 0x14000518d
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.1400706e4
mov rcx, rdi
call fcn.140163938
jmp 0x140005192
call fcn.140070904
mov rcx, qword [rbx + 0x40]
lea r9, [rbp + 0x60]
mov r8d, reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x20], 0xff
lea rdx, str.ignoreProxyFile
call fcn.140070830
test eax, eax
jne 0x14000520d
mov rcx, qword [rbx + 0x30]
lea rdx, str..proxy
mov qword [rbp + 0x10], r15
call fcn.140002508
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.14006718c
mov rdi, qword [rbp + 0x10]
lea rdx, str.WebProxy
mov rcx, qword [rbx + 0x40]
mov r8d, 8
test rdi, rdi
je 0x140005208
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.1400706e4
mov rcx, rdi
call fcn.140163938
jmp 0x14000520d
call fcn.140070904
mov rcx, qword [rbx + 0x30]
lea rdx, str..mshx
call fcn.140002508
mov rdx, rax
mov rcx, rbx
call fcn.140004a14
test eax, eax
jne 0x14000526e
mov rcx, qword [rbx + 0x30]
lea rdx, str..msh
call fcn.140002508
mov rdx, rax
mov rcx, rbx
call fcn.140004a14
test eax, eax
jne 0x14000526e
mov rcx, rbx
call fcn.140004858
mov rcx, qword [rbx + 0x30]
lea rdx, str..msh
call fcn.140002508
mov rdx, rax
mov rcx, rbx
call fcn.140004a14
lea r8, [rbp]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareOpen_SourceMeshAgent2
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140005621
lea rcx, [rbx + 0x6d8]
mov qword [rbp + 8], r15
lea r8, [rbp + 8]
lea edx, [rax + 0x30]
call fcn.14006c348
movsxd rdx, eax
test eax, eax
jle 0x14000530b
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x14000530b
mov rcx, rdx
test eax, eax
jle 0x1400052da
mov rax, rdi
cmp byte [rax], 0x2b
jne 0x1400052c9
mov byte [rax], 0x40
jmp 0x1400052d1
cmp byte [rax], 0x2f
jne 0x1400052d1
mov byte [rax], 0x24
inc rax
sub rcx, 1
jne 0x1400052bf
mov rcx, qword [rbp]
mov r9d, 1
mov dword [rsp + 0x28], edx
xor r8d, r8d
lea rdx, str.NodeId
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.140163938
mov qword [rbp + 8], r15
jmp 0x14000531c
mov rcx, qword [rbp]
lea rdx, str.NodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rcx, [rbx + 0x5ac]
mov edx, 0x30
lea r8, [0x1402030c0]
call fcn.140066f88
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], r15b
jne 0x140005338
mov rcx, qword [rbp]
lea rdx, str.AgentHash
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, str.MeshID
mov edx, 0x400
mov rcx, rdi
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], r15d
mov rdx, rdi
call fcn.140070830
test eax, eax
je 0x140005437
mov edx, 0x400
mov rcx, rdi
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea r9, [0x1402040c0]
mov r8d, eax
mov dword [rsp + 0x20], 0x10000
mov rdx, rdi
call fcn.140070830
test eax, eax
jle 0x140005437
lea r8, [rbp + 8]
mov edx, eax
lea rcx, [0x1402040c0]
call fcn.14006c348
test eax, eax
jle 0x140005437
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x140005437
movsxd rdx, eax
test eax, eax
jle 0x14000540a
mov rcx, rdi
cmp byte [rcx], 0x2b
jne 0x1400053f9
mov byte [rcx], 0x40
jmp 0x140005401
cmp byte [rcx], 0x2f
jne 0x140005401
mov byte [rcx], 0x24
inc rcx
sub rdx, 1
jne 0x1400053ef
mov rcx, qword [rbp]
lea rdx, str.MeshId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.140163938
jmp 0x140005448
mov rcx, qword [rbp]
lea rdx, str.MeshId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, 0x400
lea rcx, str.MeshServer
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdi, [0x1402040c0]
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
lea rdx, str.MeshServer
call fcn.140070830
test eax, eax
jne 0x140005495
mov rcx, qword [rbp]
lea rdx, str.MeshServerUrl
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1400054c5
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x140005499
mov rcx, qword [rbp]
lea rdx, str.MeshServerUrl
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.ServerID
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdx, str.ServerID
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
call fcn.140070830
test eax, eax
jne 0x14000550b
mov rcx, qword [rbp]
lea rdx, str.MeshServerId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000553b
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x14000550f
mov rcx, qword [rbp]
lea rdx, str.MeshServerId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.WebProxy
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdx, str.WebProxy
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
call fcn.140070830
test eax, eax
jne 0x140005581
mov rcx, qword [rbp]
lea rdx, str.Proxy
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1400055b1
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x140005585
mov rcx, qword [rbp]
lea rdx, str.Proxy
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
mov rcx, rsi
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
mov r9, rdi
mov r8d, eax
mov dword [rsp + 0x20], 0x10000
mov rdx, rsi
call fcn.140070830
test eax, eax
jne 0x1400055eb
mov rcx, qword [rbp]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140005617
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x1400055ef
mov rcx, qword [rbp]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rbx + 0x610]
lea rdx, [rbx + 0x620]
mov rcx, qword [rbx + 0x38]
call fcn.140074178
mov eax, 2
test r12d, r12d
lea r12d, [rax - 1]
je 0x140005680
cmp r14d, r12d
je 0x140005680
cmp r14d, eax
jne 0x140004eab
mov rcx, qword [r13 + 8]
lea rdx, [0x1401d5dd0]
call fcn.14016d740
test eax, eax
je 0x140005680
mov rcx, qword [r13 + 8]
lea rdx, str.connect
call fcn.14016d740
test eax, eax
jne 0x140004eab
mov rcx, qword [rbx + 0x30]
lea rdx, str..update.exe
call fcn.140002508
test rax, rax
je 0x14000569d
mov rcx, rax
call fcn.14016b580
lea r14, str.CoreModule
mov r13d, 0x400
cmp dword [rbx + 0x58], r15d
jne 0x1400056d6
mov edx, r13d
mov rcx, r14
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], r15d
mov rdx, r14
call fcn.140070830
mov edi, eax
jmp 0x1400056d9
mov edi, r15d
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140005747
mov rdx, qword [rbx]
call fcn.140001e88
mov rcx, qword [rbx + 0x10]
lea r8, str.emit
or edx, 0xffffffff
call fcn.14000b7ec
mov rcx, qword [rbx + 0x10]
or r8d, 0xffffffff
lea edx, [r8 - 1]
call fcn.14000c71c
mov rcx, qword [rbx + 0x10]
lea rdx, str.Ready
call fcn.14000e1cc
mov rcx, qword [rbx + 0x10]
mov edx, r12d
call fcn.14000aa7c
test eax, eax
je 0x14000573e
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401d5438]
call fcn.140046018
mov rcx, qword [rbx + 0x10]
call fcn.14000ef10
cmp dword [rbx + 0x58], r15d
jne 0x140005861
call fcn.14005d904
mov r9, qword [rbx]
mov rcx, rax
mov rax, qword [rbx + 0x28]
xor r8d, r8d
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.14005d98c
mov r8, rbx
mov qword [rbx + 0x10], rax
mov rcx, rax
call fcn.1400024ac
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140004dc0]
mov r8, rbx
call fcn.140045f94
test edi, edi
jle 0x140005861
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.140068c34
mov rdx, r13
mov rcx, r14
mov rsi, rax
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
mov r9, rsi
mov r8d, eax
mov dword [rsp + 0x20], edi
mov rdx, r14
call fcn.140070830
mov rcx, qword [rbx + 0x10]
lea r8d, [rdi - 4]
lea rdx, [rsi + 4]
xor r9d, r9d
call fcn.14005e018
test eax, eax
jne 0x140005812
mov rcx, qword [rbx + 0x10]
call fcn.14005e0c8
test eax, eax
je 0x14000581b
mov rcx, qword [rbx + 0x10]
call fcn.14000ef10
mov rcx, rsi
call fcn.140163938
mov rdx, r13
lea rcx, str.noUpdateCoreModule
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea rdx, str.noUpdateCoreModule
xor r9d, r9d
mov dword [rsp + 0x20], r15d
mov r8d, eax
call fcn.140070830
test eax, eax
je 0x140005861
lea rcx, str._CoreModule:_Update_Disabled_n
mov dword [rbx + 0x58], r12d
call fcn.140001090
mov rcx, qword [rbx]
lea rdx, [0x140004dcc]
mov r8, rbx
call fcn.140067b50
mov rcx, rbx
call fcn.140004748
mov rdx, r13
lea rcx, str.MeshServer
call fcn.1401646ec
mov rcx, qword [rbx + 0x40]
lea r9, [0x1402030c0]
mov r8d, eax
mov dword [rsp + 0x20], 0x1000
lea rdx, str.MeshServer
call fcn.140070830
cmp eax, 5
jle 0x140005998
mov eax, dword [0x1402030c0]
cmp eax, dword [str.local]
jne 0x140005998
mov al, byte [0x1402030c4]
cmp al, byte [0x1401d5a48]
jne 0x140005998
xor eax, eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x50], eax
call fcn.14006df80
mov esi, 0x425d
test eax, eax
je 0x140005927
mov edi, reloc.WS2_32.dll_socket
mov ecx, esi
mov word [rbp + 0x38], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x40]
mov ecx, edi
lea rdx, str.FF02:0:0:0:0:0:0:FE
mov word [rbp + 0x3a], ax
call fcn.14006e1d4
mov edi, 2
mov ecx, esi
mov word [rbp + 0x28], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x2c]
mov ecx, edi
lea rdx, str.239.255.255.235
mov word [rbp + 0x2a], ax
call fcn.14006e1d4
mov rcx, qword [rbx]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.14006831c
mov qword [rbx + 0x710], rax
test rax, rax
jne 0x140005998
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0xdb
lea rdx, str...meshcore_agentcore.c
mov r8d, 0xaf5
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.14006e59c
mov eax, r12d
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.14015c600
mov rbx, qword [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1b0]
mov rdi, qword [rbp + 0x1b8]
lea rsp, [rbp + 0x170]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret