Function at 0x1400c776c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa30
mov rax, qword [0x14030cf00]
xor rax, rsp
mov qword [rsp + 0xa20], rax
mov r15, rdx
movsxd r14, ecx
mov dword [rsp + 0x68], r14d
lea eax, [r14 + 1]
mov dword [rsp + 0x50], eax
movsxd rcx, eax
lea rdi, [rcx*8]
mov eax, 0xffffffff
cmp rax, rdi
jbe 0x1400c77db
mov eax, 0xffffffe7
cmp rdi, rax
jae 0x1400c77db
lea rcx, [rcx*8 + 0x18]
call fcn.1401ea40c
xor ebx, ebx
jmp 0x1400c77df
xor ebx, ebx
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14009faa0
mov rdi, rax
mov qword [rsp + 0x78], rax
mov r12, r14
mov esi, 1
test r14d, r14d
jle 0x1400c78c5
sub rax, r15
mov qword [rsp + 0x58], r14
or r13, 0xffffffffffffffff
mov edi, 0xffffffe7
mov r14, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r13d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x60], eax
movsxd r12, eax
mov eax, 0xffffffff
cmp r12, rax
jae 0x1400c7865
cmp r12, rdi
jae 0x1400c7865
lea rcx, [r12 + 0x18]
call fcn.1401ea40c
jmp 0x1400c7868
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rax
call fcn.14009faa0
mov qword [r15 + r14], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add r15, 8
sub qword [rsp + 0x58], rsi
jne 0x1400c781d
mov rdi, qword [rsp + 0x78]
movsxd r14, dword [rsp + 0x68]
mov r12, r14
jmp 0x1400c78c9
or r13, 0xffffffffffffffff
cmp r14d, esi
jle 0x1400c7ca2
lea rdx, str._finstall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._funinstall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c795e
lea rdx, str._state
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c799e
mov rax, qword [rdi + 8]
mov qword [rdi + r12*8], rax
mov ecx, 0x1c
call fcn.1401ea40c
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call fcn.14009faa0
mov qword [rdi + 8], rax
lea r8, [0x140272320]
mov rdx, qword [rax - 0x18]
mov rcx, rax
call fcn.140001114
mov r14d, dword [rsp + 0x50]
cmp r14d, esi
jle 0x1400c7ca2
lea rdx, str._licenses
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c7ca2
lea r12, str._n
mov rcx, r12
call fcn.14000105c
lea rcx, str._MeshCentral_MeshAgent:_Copyright_2006___2022_Intel_Corporation_n
call fcn.14000105c
lea rcx, str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.14000105c
lea r15, str._________________________________________________________________________________________n
mov rcx, r15
call fcn.14000105c
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.14000105c
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.14000105c
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.14000105c
lea r14, str.____n
mov rcx, r14
call fcn.14000105c
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.14000105c
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.14000105c
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.14000105c
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.14000105c
lea rcx, str.___limitations_under_the_License._n_n
call fcn.14000105c
mov rcx, r12
call fcn.14000105c
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.14000105c
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.14000105c
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.14000105c
mov rcx, r15
call fcn.14000105c
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.14000105c
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.14000105c
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.14000105c
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.14000105c
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.14000105c
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.14000105c
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.14000105c
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.14000105c
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.14000105c
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.14000105c
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.14000105c
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.14000105c
lea rcx, str.___THE_SOFTWARE._n
call fcn.14000105c
mov rcx, r12
call fcn.14000105c
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.14000105c
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.14000105c
mov rcx, r15
call fcn.14000105c
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.14000105c
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.14000105c
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.14000105c
lea r14, [0x1402719c0]
mov rcx, r14
call fcn.14000105c
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.14000105c
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.14000105c
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.14000105c
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.14000105c
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.14000105c
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.14000105c
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.14000105c
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.14000105c
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.14000105c
mov rcx, r14
call fcn.14000105c
lea rcx, str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.14000105c
lea rcx, str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.14000105c
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c992a
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400c7c81
jmp 0x1400c992a
mov r15, rbx
mov qword [rsp + 0x50], rbx
mov r12d, ebx
mov dword [rsp + 0x60], ebx
cmp r14d, esi
jle 0x1400c7dcc
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c7dcc
lea r8, str.Dec_10_2024
lea rdx, str.13:38:22
lea rcx, str.Compiled_on:__s___s_n
call fcn.14000105c
lea rdx, str.105da7dbfae9b32d5be67bbe12b1dee5fda400c9
lea rcx, str.___Commit_Hash:__s_n
call fcn.14000105c
lea rdx, str.2024_Nov_4_15:23:540000
lea rcx, str.___Commit_Date:__s_n
call fcn.14000105c
xor ecx, ecx
call fcn.1400e52c0
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.14000105c
mov edx, 4
lea rcx, str.Agent_ARCHID:__d_n
call fcn.14000105c
lea rcx, [rsp + 0x600]
lea rax, str.var__tmp__Detected_OS:___require_os_.Name__try_tmp________require_os_.arch____catch_x_console.log__tmp__if_process.platformwin32___tmprequire_win_authenticode_opus__process.execPath___if__tmp_null___tmp.url_null___tmprequire_win_authenticode_opus_.locked__tmp.url___if__tmp_null___console.log_LOCKED_to:____tmp.dns___console.log_______tmp.id______process.exit___
mov edx, 0x80
lea r8d, [rdx - 0x7d]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, rdx
sub r8, 1
jne 0x1400c7d51
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov r12d, 0x197
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], r12d
cmp r14d, 2
jle 0x1400c7f17
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c7e89
mov qword [rsp + 0x58], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x58]
lea rdx, str._016llx
call fcn.14000f9fc
mov r8, qword [rsp + 0x58]
call fcn.1400a1ea0
lea rdx, [0x14031a480]
lea rcx, [0x14026eeac]
call fcn.14000105c
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c7e52
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c7e38
mov rcx, rdi
call fcn.14009fb80
xor eax, eax
mov rcx, qword [rsp + 0xa20]
xor rcx, rsp
call fcn.1401d9e80
lea r11, [rsp + 0xa30]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp r14d, 2
jle 0x1400c7f17
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c7f17
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x58]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.14000f9fc
lea r8, [0x1400a084c]
sub r8, qword [rsp + 0x58]
call fcn.1400a1ea0
lea rdx, [0x14031a480]
lea rcx, [0x14026eeac]
call fcn.14000105c
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c7e52
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c7ef8
jmp 0x1400c7e52
test r15, r15
je 0x1400c7f21
test r12d, r12d
jne 0x1400c7f8f
mov r8d, 0x104
lea rdx, [rsp + 0x600]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x600]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x810]
call fcn.14008e818
mov r15, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x60]
cmp r14d, esi
jle 0x1400c802f
lea rdx, str._export
mov rcx, qword [rdi + 8]
call fcn.1401f5c80
test eax, eax
jne 0x1400c7fe1
test r12d, r12d
jne 0x1400c7fe1
xor edx, edx
lea rcx, str.require_code_utils_.expand_embedded:_true__process.exit___
call fcn.1400a95b4
mov r15, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c7fd1
mov rax, rbx
jmp 0x1400c7fde
mov edx, 0x1000
mov rcx, rax
call fcn.1401e9dbc
mov r12d, eax
cmp r14d, esi
jle 0x1400c802f
lea rdx, str._import
mov rcx, qword [rdi + 8]
call fcn.1401f5c80
test eax, eax
jne 0x1400c802f
test r12d, r12d
jne 0x1400c802f
xor edx, edx
lea rcx, str.require_code_utils_.shrink___process.exit___
call fcn.1400a95b4
mov r15, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c801f
mov rax, rbx
jmp 0x1400c802c
mov edx, 0x1000
mov rcx, rax
call fcn.1401e9dbc
mov r12d, eax
cmp r14d, 2
jle 0x1400c80ce
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401f5c80
test eax, eax
jne 0x1400c807f
test r12d, r12d
jne 0x1400c807f
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.1400a95b4
mov r15, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400c806f
mov rax, rbx
jmp 0x1400c807c
mov edx, 0x1000
mov rcx, rax
call fcn.1401e9dbc
mov r12d, eax
cmp r14d, 2
jle 0x1400c80ce
lea rdx, str._b64exec
mov rcx, qword [rdi + 8]
call fcn.1401f5c80
test eax, eax
jne 0x1400c80ce
test r12d, r12d
jne 0x1400c80ce
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x1400c80ac
mov rax, rbx
jmp 0x1400c80b6
mov edx, 0x10000
call fcn.1401e9dbc
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, qword [rdi + 0x10]
call fcn.1400a7728
mov r12d, eax
mov r15, qword [rsp + 0x50]
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c815a
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402ea3e8]
movups xmmword [rsp + 0x610], xmm1
movups xmm0, xmmword [0x1402ea3f8]
movups xmmword [rsp + 0x620], xmm0
mov eax, dword [0x1402ea408]
mov dword [rsp + 0x630], eax
movzx eax, word [0x1402ea40c]
mov word [rsp + 0x634], ax
mov al, byte [0x1402ea40e]
mov byte [rsp + 0x636], al
mov r12d, gethostname
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str._name
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c81e8
movaps xmm0, xmmword [str.console.log_require__agentNodeId_.serviceName____process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ea430]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ea440]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ea450]
movaps xmmword [rsp + 0x630], xmm1
movzx eax, word [0x1402ea460]
mov word [rsp + 0x640], ax
mov al, byte [0x1402ea462]
mov byte [rsp + 0x642], al
mov r12d, 0x42
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str.exstate
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c82af
lea rdx, [rsp + 0x600]
lea rax, [0x140000000]
lea rcx, [rax + 0x2ea470]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov eax, 0x80
add rdx, rax
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
mov rax, qword [rcx + 0x40]
mov qword [rdx + 0x40], rax
movzx eax, word [rcx + 0x48]
mov word [rdx + 0x48], ax
mov r12d, 0xc9
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8364
lea rdx, [rsp + 0x600]
lea rcx, [0x140000000]
lea rcx, [rcx + 0x2ea540]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov eax, 0x80
add rdx, rax
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rdx + 0x28], eax
mov r12d, 0xab
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c8399
lea rdx, [0x1402ea5ec]
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8435
lea rcx, [rsp + 0x600]
lea rax, [0x140000000]
lea rax, [rax + 0x2ea600]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov edx, 0x80
add rcx, rdx
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movzx eax, word [rax + 0x40]
mov word [rcx + 0x40], ax
lea r12d, [rdx + 0x41]
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c846a
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c84eb
lea rax, [rsp + 0x600]
lea rcx, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
mov edx, 0x80
lea r8d, [rdx - 0x7e]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, rdx
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
add rcx, rdx
sub r8, 1
jne 0x1400c8482
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov r12d, 0x10f
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c8520
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c85a9
lea rcx, [rsp + 0x600]
lea rax, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
mov edx, 0x80
lea r8d, [rdx - 0x7e]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rax, rdx
sub r8, 1
jne 0x1400c8538
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
mov r12d, 0x117
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str._agentHash
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8653
test r12d, r12d
jne 0x1400c8653
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ea950]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ea960]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ea970]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402ea980]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402ea990]
movaps xmmword [rsp + 0x650], xmm1
mov al, byte [0x1402ea9a0]
mov byte [rsp + 0x660], al
mov r12d, 0x60
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c86e6
lea rdx, str._agentFullHash
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c86e6
test r12d, r12d
jne 0x1400c86e6
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402ea9d0]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402ea9e0]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402ea9f0]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402eaa00]
movaps xmmword [rsp + 0x640], xmm0
mov al, byte [0x1402eaa10]
mov byte [rsp + 0x650], al
mov r12d, 0x50
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, 2
jne 0x1400c8795
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8795
movaps xmm0, xmmword [str.tryrequire__agentNodeId_.resetNodeId___catch_z_console.log_This_command_requires_admin.__process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x1402eaa40]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x1402eaa50]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x1402eaa60]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x1402eaa70]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x1402eaa80]
movaps xmmword [rsp + 0x650], xmm1
movaps xmm0, xmmword [0x1402eaa90]
movaps xmmword [rsp + 0x660], xmm0
mov al, byte [0x1402eaaa0]
mov byte [rsp + 0x670], al
lea r12d, [r14 + 0x6e]
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c88e9
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8809
movups xmm0, xmmword [str.require_agent_installer_.setfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402eaac8]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402eaad8]
movsd qword [rsp + 0x620], xmm0
movzx eax, word [0x1402eaae0]
mov word [rsp + 0x628], ax
mov r12d, 0x29
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c88e9
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c887b
movups xmm0, xmmword [str.require_agent_installer_.clearfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402eab08]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402eab18]
movsd qword [rsp + 0x620], xmm0
mov eax, dword [0x1402eab20]
mov dword [rsp + 0x628], eax
mov r12d, 0x2b
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
cmp r14d, esi
jle 0x1400c88e9
lea rdx, str._checkfirewall
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c88e9
movups xmm0, xmmword [str.require_agent_installer_.checkfirewall___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x1402eab48]
movups xmmword [rsp + 0x610], xmm1
movsd xmm0, qword [0x1402eab58]
movsd qword [rsp + 0x620], xmm0
mov eax, dword [0x1402eab60]
mov dword [rsp + 0x628], eax
mov r12d, 0x2b
mov edx, r12d
lea rcx, [rsp + 0x600]
call fcn.1400a95b4
mov r15, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp r14d, esi
jle 0x1400c8bf1
lea rdx, str._updaterversion
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c896d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [0x1402eab78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c7e52
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c894e
jmp 0x1400c7e52
cmp r14d, esi
jle 0x1400c8bf1
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8aaf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14009fd78
mov r12, rax
lea rax, [0x1400c75e4]
mov qword [r12], rax
mov dword [r12 + 0x10], ebx
cmp r14d, 2
jle 0x1400c89cd
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401e8e10
test eax, eax
mov eax, esi
je 0x1400c89cf
mov eax, ebx
mov dword [r12 + 0x18], eax
cmp r14d, 2
jle 0x1400c89ee
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401e8e10
test eax, eax
je 0x1400c8a08
cmp r14d, 3
jle 0x1400c8a0e
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8a0e
mov dword [0x140315360], esi
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov r15, rbx
test rax, rax
je 0x1400c8a52
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400c8a52
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, rbx
test r15, r15
je 0x1400c8a6a
mov ecx, 2
call r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400c8a70
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r12
call fcn.140011c98
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c992a
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400c8a8e
jmp 0x1400c992a
cmp r14d, esi
jle 0x1400c8bf1
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8bf1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14009fd78
mov r12, rax
lea rax, [0x1400c75e4]
mov qword [r12], rax
mov dword [r12 + 0x10], esi
cmp r14d, 2
jle 0x1400c8b0f
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401e8e10
test eax, eax
mov eax, esi
je 0x1400c8b11
mov eax, ebx
mov dword [r12 + 0x18], eax
cmp r14d, 2
jle 0x1400c8b30
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401e8e10
test eax, eax
je 0x1400c8b4a
cmp r14d, 3
jle 0x1400c8b50
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8b50
mov dword [0x140315360], esi
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov r15, rbx
test rax, rax
je 0x1400c8b94
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400c8b94
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, rbx
test r15, r15
je 0x1400c8bac
mov ecx, 2
call r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400c8bb2
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r12
call fcn.140011c98
mov r15d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c992a
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add r15d, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r15d, eax
jl 0x1400c8bd0
jmp 0x1400c992a
test r15, r15
jne 0x1400c983b
test r14d, r14d
jle 0x1400c8c16
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.1401e8e10
test eax, eax
je 0x1400c983b
cmp r14d, esi
jle 0x1400c8df6
lea rdx, [0x140272320]
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c983b
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c983b
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c983b
cmp r14d, esi
jle 0x1400c8df6
mov rax, qword [rdi + 8]
movabs rcx, 0x3a6574616470752d
cmp qword [rax], rcx
jne 0x1400c8dbc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r12d, 0x400
mov ecx, r12d
call fcn.14009fd78
mov r15, rax
mov rcx, qword [rdi + 8]
cmp byte [rcx + 8], 0x2a
jne 0x1400c8cec
cmp r14d, 2
jle 0x1400c8cb6
mov rax, qword [rdi + 0x10]
jmp 0x1400c8cbd
lea rax, str.null
lea r8, str.true
lea r9, str.false
cmp byte [rcx + 9], 0x53
cmove r9, r8
mov qword [rsp + 0x20], rax
lea r8, str.require_agent_installer_.update__s___s__
mov rdx, r12
mov rcx, r15
call fcn.140001114
jmp 0x1400c8d44
cmp r14d, 2
jle 0x1400c8d32
lea rdx, [0x140272320]
mov rcx, qword [rdi + 0x10]
call fcn.1401f5c80
test eax, eax
je 0x1400c8d1a
lea rdx, str.connect
mov rcx, qword [rdi + 0x10]
call fcn.1401f5c80
test eax, eax
jne 0x1400c8d32
mov r9, qword [rdi + 0x10]
lea r8, str.require_agent_installer_.update_false____s___
mov rdx, r12
mov rcx, r15
call fcn.140001114
jmp 0x1400c8d44
lea r8, str.require_agent_installer_.update_true__
mov rdx, r12
mov rcx, r15
call fcn.140001114
mov r12d, eax
xor ecx, ecx
call fcn.14000a160
mov qword [0x140315f88], rax
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], r12d
mov r8, rdi
mov edx, r14d
mov rcx, rax
call fcn.14000e71c
mov rax, qword [0x140315f88]
mov r15d, dword [rax + 0xdb4]
mov dword [rsp + 0x70], r15d
call fcn.14000ee74
mov qword [0x140315f88], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9927
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c8d9d
jmp 0x1400c9927
cmp r14d, esi
jle 0x1400c8df6
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c8df6
lea rcx, [rsp + 0x78]
call fcn.140013994
test eax, eax
jle 0x1400c9803
mov rcx, qword [rsp + 0x78]
call fcn.1400c7164
jmp 0x1400c9803
mov r12d, ebx
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x600], rax
lea rax, [0x1400c7464]
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x610], rbx
mov qword [rsp + 0x618], rbx
mov dword [0x140316218], r14d
mov qword [0x140316210], rdi
lea rcx, [rsp + 0x600]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400c9803
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400c9803
cmp r14d, 2
jl 0x1400c9008
mov dword [rsp + 0x20], esi
mov r9d, 3
lea r8, [0x14027269c]
mov rdx, r13
mov rcx, qword [rdi + 8]
call fcn.1400a9074
test eax, eax
jne 0x1400c8ea6
mov dword [rsp + 0x20], esi
lea r9d, [rax + 4]
lea r8, str..zip
mov rdx, r13
mov rcx, qword [rdi + 8]
call fcn.1400a9074
test eax, eax
je 0x1400c8ee9
mov edx, esi
lea rcx, [0x1400c7628]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.14000a160
mov qword [0x140315f88], rax
mov dword [rax + 0xdfc], esi
mov r8, rdi
mov edx, r14d
mov rcx, rax
call fcn.14000e71c
call fcn.14000ee74
mov qword [0x140315f88], rbx
jmp 0x1400c9803
cmp r14d, 2
jne 0x1400c9008
lea rdx, [0x1402eac44]
mov rcx, qword [rdi + 8]
call fcn.1401f5c80
test eax, eax
jne 0x1400c9008
mov r14d, 0x104
mov r8d, r14d
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x810]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.1400a06b4
mov r14, rax
mov rcx, rax
call fcn.1400a3c08
call fcn.1400914e8
mov rcx, rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x600]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, r14
xor r8d, r8d
xor edx, edx
call fcn.140092064
mov r12, rax
mov r15d, 0xe88
mov r9d, r15d
lea rdx, str.require_util_language_.current.toUpperCase__.split___.join____
mov rcx, rax
call fcn.14001cc34
test eax, eax
jne 0x1400c8fe1
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call fcn.14001f384
mov rdx, rax
lea rcx, str.Current_Language:__s_n
call fcn.14000105c
mov rcx, r12
call fcn.140069da8
mov dword [r14], 2
mov rcx, r14
call fcn.1400a08e8
mov rcx, r14
call fcn.1400a3cb8
mov r14d, esi
mov r12d, esi
jmp 0x1400c900e
mov r15d, 0xe88
cmp r14d, 2
jne 0x1400c9071
mov rcx, qword [rdi + 8]
mov rax, r13
inc rax
cmp byte [rcx + rax], bl
jne 0x1400c901b
cmp rax, 6
jbe 0x1400c9071
mov r8d, 6
lea rdx, str._lang
call fcn.1401e80f0
test eax, eax
jne 0x1400c9071
mov rcx, qword [rdi + 8]
mov rdx, r13
inc rdx
cmp byte [rcx + rdx], bl
jne 0x1400c9046
mov r9, rsi
lea r8, [0x1402719c4]
call fcn.1400a913c
movsxd rcx, eax
inc rcx
add rcx, qword [rdi + 8]
mov qword [0x140315fb0], rcx
mov r14d, esi
cmp r14d, esi
je 0x1400c916f
lea rcx, str.Mesh_Agent_available_switches:_r_n
call fcn.14000105c
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.14000105c
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.14000105c
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.14000105c
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.14000105c
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.14000105c
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.14000105c
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.14000105c
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.14000105c
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.14000105c
lea rcx, str.___nodeid___________Return_the_current_agent_identifier._r_n
call fcn.14000105c
lea rcx, str.___info_____________Return_agent_version_information._r_n
call fcn.14000105c
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.14000105c
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.14000105c
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.14000105c
lea rcx, [0x14027fe3c]
call fcn.14000105c
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.14000105c
lea rcx, [0x14027fe3c]
call fcn.14000105c
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.14000105c
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.14000105c
jmp 0x1400c9803
test r12d, r12d
jne 0x1400c9803
mov r12, rbx
mov r14d, 0x104
mov r8d, r14d
lea rdx, [rsp + 0x810]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x810]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.1400a06b4
mov r14, rax
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.1400a3c08
call fcn.1400914e8
mov rcx, rax
mov qword [rsp + 0x48], r14
lea rax, [0x1400c7660]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x600]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, r14
xor r8d, r8d
xor edx, edx
call fcn.140092064
mov r14, rax
mov r9d, r15d
lea rdx, str.require_win_authenticode_opus_.checkMSH___
mov rcx, rax
call fcn.14001cc34
mov rcx, r14
test eax, eax
jne 0x1400c97d7
mov r9d, r15d
lea rdx, str.require_util_language_.current.toLowerCase__.split___.join____
call fcn.14001cc34
test eax, eax
jne 0x1400c9265
xor r8d, r8d
mov edx, r13d
mov rcx, r14
call fcn.14001f384
mov r12, rax
mov r9d, r15d
lea rdx, str._function_foo__return_JSON.parse__MSH__.translation______
mov rcx, r14
call fcn.14001cc34
test eax, eax
jne 0x1400c929c
lea r8, [0x1402eb214]
mov edx, r13d
mov rcx, r14
call fcn.14001d8c4
test eax, eax
je 0x1400c929c
mov r15d, 0xfffffffe
jmp 0x1400c94a5
mov rcx, r14
call fcn.140020580
mov r8d, 7
lea rdx, str.Install
mov rcx, r14
call fcn.14001fff4
lea r8, str.install
mov r15d, 0xfffffffe
mov edx, r15d
mov rcx, r14
call fcn.14001d620
lea r8d, [r15 + 0xb]
lea rdx, [0x1402eb228]
mov rcx, r14
call fcn.14001fff4
lea r8, str.uninstall
mov edx, r15d
mov rcx, r14
call fcn.14001d620
lea r8d, [r15 + 9]
lea rdx, [0x1402eb248]
mov rcx, r14
call fcn.14001fff4
lea r8, str.connect
mov edx, r15d
mov rcx, r14
call fcn.14001d620
lea r8d, [r15 + 0xc]
lea rdx, str.Disconnect
mov rcx, r14
call fcn.14001fff4
lea r8, str.disconnect
mov edx, r15d
mov rcx, r14
call fcn.14001d620
lea r8d, [r15 + 8]
lea rdx, str.Update
mov rcx, r14
call fcn.14001fff4
lea r8, str.update
mov edx, r15d
mov rcx, r14
call fcn.14001d620
mov rcx, r14
call fcn.1400205b0
lea r8d, [r15 + 0xf]
lea rdx, str.NOT_INSTALLED
mov rcx, r14
call fcn.14001fff4
mov edx, r15d
mov rcx, r14
call fcn.14001e518
lea r8, str.push
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8d, r13d
mov edx, r15d
mov rcx, r14
call fcn.14001e4c4
lea edx, [r15 - 1]
mov rcx, r14
call fcn.14001e518
mov edx, esi
mov rcx, r14
call fcn.14001c0d4
mov rcx, r14
call fcn.140020f9c
lea r8d, [r15 + 9]
lea rdx, str.RUNNING
mov rcx, r14
call fcn.14001fff4
mov edx, r15d
mov rcx, r14
call fcn.14001e518
lea r8, str.push
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8d, r13d
mov edx, r15d
mov rcx, r14
call fcn.14001e4c4
lea edx, [r15 - 1]
mov rcx, r14
call fcn.14001e518
mov edx, esi
mov rcx, r14
call fcn.14001c0d4
mov rcx, r14
call fcn.140020f9c
lea r8d, [r15 + 0xd]
lea rdx, str.NOT_RUNNING
mov rcx, r14
call fcn.14001fff4
mov edx, r15d
mov rcx, r14
call fcn.14001e518
lea r8, str.push
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8d, r13d
mov edx, r15d
mov rcx, r14
call fcn.14001e4c4
lea edx, [r15 - 1]
mov rcx, r14
call fcn.14001e518
mov edx, esi
mov rcx, r14
call fcn.14001c0d4
mov rcx, r14
call fcn.140020f9c
lea r8, str.status
mov edx, r15d
mov rcx, r14
call fcn.14001d620
lea r8, [0x1402eb214]
mov edx, r15d
mov rcx, r14
call fcn.14001d620
mov rax, qword [0x140315fb0]
test rax, rax
cmovne r12, rax
mov r8, r12
mov edx, r13d
mov rcx, r14
call fcn.14001d8c4
test eax, eax
jne 0x1400c9589
test r12, r12
je 0x1400c94e7
mov r8, r13
inc r8
cmp byte [r12 + r8], bl
jne 0x1400c94d1
mov rdx, r12
mov rcx, r14
call fcn.14001fff4
jmp 0x1400c94ef
mov rcx, r14
call fcn.14001fe40
mov edx, r13d
mov rcx, r14
call fcn.14001e518
lea r8, str.split
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8d, r13d
mov edx, r15d
mov rcx, r14
call fcn.14001e4c4
mov r8, rsi
lea rdx, [0x1402e5538]
mov rcx, r14
call fcn.14001fff4
mov edx, esi
mov rcx, r14
call fcn.14001bf98
mov edx, r13d
mov rcx, r14
call fcn.14001e518
lea r8, str.shift
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8d, r13d
mov edx, r15d
mov rcx, r14
call fcn.14001e4c4
xor edx, edx
mov rcx, r14
call fcn.14001bf98
xor r8d, r8d
mov edx, r13d
mov rcx, r14
call fcn.14001f384
mov r12, rax
mov edx, 0xfffffffc
mov rcx, r14
call fcn.14001e518
mov r8, r12
mov edx, r13d
mov rcx, r14
call fcn.14001d8c4
lea r15, [0x1402eb214]
test eax, eax
cmovne r15, r12
mov eax, 0x65
cmp al, byte [r15]
jne 0x1400c95c3
mov eax, WSASetLastError
cmp al, byte [r15 + 1]
jne 0x1400c95c3
cmp bl, byte [r15 + 2]
je 0x1400c9661
lea r8, [0x1402eb214]
mov edx, r13d
mov rcx, r14
call fcn.14001d39c
mov r8, r15
mov r12d, 0xfffffffe
mov edx, r12d
mov rcx, r14
call fcn.14001d39c
lea r8d, [r12 + 0x12]
mov edx, r12d
mov rcx, r14
call fcn.14001dd48
jmp 0x1400c9642
mov edx, r12d
call fcn.14001e0d4
cmp dword [rax], 8
mov rcx, rbx
jne 0x1400c960f
mov rcx, qword [rax + 8]
lea rax, [rcx + 0x20]
neg rcx
sbb r8, r8
and r8, rax
mov edx, 0xfffffffc
mov rcx, r14
call fcn.14001d8c4
mov rcx, r14
test eax, eax
jne 0x1400c963d
mov r8d, r12d
lea edx, [rax - 4]
call fcn.14001d598
jmp 0x1400c9642
call fcn.140020f9c
mov r8d, esi
mov edx, r13d
mov rcx, r14
call fcn.14001dd84
mov rcx, r14
test eax, eax
jne 0x1400c95fb
lea edx, [rax + 3]
call fcn.140020dbc
jmp 0x1400c9667
mov r12d, 0xfffffffe
mov rcx, r14
call fcn.1400202e0
mov edx, r12d
mov rcx, r14
call fcn.14001e518
lea r8, str._start_data
mov edx, r12d
mov rcx, r14
call fcn.14001d620
mov dword [rsp + 0x20], 6
mov r9d, 0x18075380
xor r8d, r8d
lea rdx, [0x1400c76bc]
mov rcx, r14
call fcn.1400207fc
lea r8, str._start
mov edx, r12d
mov rcx, r14
call fcn.14001d620
mov r9d, 0xe08
lea rdx, str.global.__msh___MSH__
mov rcx, r14
call fcn.14001cc34
lea r8, [0x1402e466c]
mov edx, r13d
mov rcx, r14
call fcn.14001d8c4
mov rcx, r14
test eax, eax
je 0x1400c97bb
call fcn.140020f08
mov r12d, 0xf08
mov r9d, r12d
lea rdx, str.global.ackJSON.parse_global.__msh.ack_
mov rcx, r14
call fcn.14001cc34
mov r9d, r12d
lea rdx, str.global.bcolorglobal.__msh.background
mov rcx, r14
call fcn.14001cc34
mov r9d, r12d
lea rdx, str.global.fcolorglobal.__msh.foreground
mov rcx, r14
call fcn.14001cc34
mov r9d, r12d
lea rdx, str.global.bimageglobal.__msh.image_global.__msh.image:default2_
mov rcx, r14
call fcn.14001cc34
mov r9, r15
mov r8, r15
lea rdx, str.global.ackTitle__global.ack.captions__s__global.ack.captions__s_.title:global.ack.captions_en_.title_
mov rcx, r14
call fcn.1400204f0
mov r13d, 0x909
mov r9d, r13d
xor edx, edx
mov rcx, r14
call fcn.14001cc34
mov r9, r15
mov r8, r15
lea rdx, str.global.ackText__global.ack.captions__s__global.ack.captions__s_.caption:global.ack.captions_en_.caption_
mov rcx, r14
call fcn.1400204f0
mov r9d, r13d
xor edx, edx
mov rcx, r14
call fcn.14001cc34
mov r9, r15
mov r8, r15
lea rdx, str.global.ackLink___text:_global.ack.captions__s_.linkText__url:_global.ack.captions__s_.linkUrl__if_global.ackLink.textnull__global.ackLink.urlnull_delete_global.ackLink_
mov rcx, r14
call fcn.1400204f0
mov r9d, r13d
xor edx, edx
mov rcx, r14
call fcn.14001cc34
mov r9d, r12d
lea rdx, str.var_x__require_win_userconsent_.create_global.ackTitle__global.ackText____noCheck:_true__background:_global.bcolor__foreground:_global.fcolor__b64Image:_global.bimage__linkText:_global.ackLink__x.then_function_____global._OK__true_____x.pump.on_exit__function______start______
jmp 0x1400c97cd
call fcn.140020f08
mov r9d, 0xf08
lea rdx, str.global._OKtrue___start___
mov rcx, r14
call fcn.14001cc34
jmp 0x1400c97f9
xor r8d, r8d
mov edx, r13d
call fcn.14001f384
mov rdx, rax
lea rcx, str.Error:__s
call fcn.14000105c
mov rcx, r14
call fcn.140069da8
mov rcx, qword [rsp + 0x58]
call fcn.1400a3cb8
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c7e52
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c981c
jmp 0x1400c7e52
mov edx, esi
lea rcx, [0x1400c7628]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r13d, ebx
mov dword [rsp + 0x6c], ebx
cmp r14d, esi
jle 0x1400c9877
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
mov ecx, 0x20
test eax, eax
cmove r13d, ecx
mov dword [rsp + 0x6c], r13d
mov ecx, r13d
call fcn.14000a160
mov qword [0x140315f88], rax
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], r12d
test r15, r15
jne 0x1400c98c0
cmp r14d, esi
jle 0x1400c98cd
lea rdx, [0x140272320]
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
je 0x1400c98c0
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401e8e10
test eax, eax
jne 0x1400c98cd
mov rax, qword [0x140315f88]
mov dword [rax + 0xdfc], esi
mov r8, rdi
mov edx, r14d
mov rcx, qword [0x140315f88]
call fcn.14000e71c
mov rax, qword [0x140315f88]
mov r15d, dword [rax + 0xdb4]
mov dword [rsp + 0x70], r15d
call fcn.14000ee74
mov qword [0x140315f88], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400c9927
mov r14, rdi
mov rcx, qword [r14]
call fcn.14009fb80
add ebx, esi
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400c990d
mov ebx, r15d
mov rcx, rdi
call fcn.14009fb80
mov eax, ebx
jmp 0x1400c7e5c