Function at 0x1400ac228
Capabilities:
Query service status
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcb0
mov rax, qword [0x1402bff08]
xor rax, rsp
mov qword [rsp + 0xca0], rax
mov r14, rdx
movsxd rsi, ecx
mov dword [rsp + 0x60], esi
lea eax, [rsi + 1]
mov dword [rsp + 0x50], eax
lea rdi, [rsi*8 + 8]
mov eax, 0xffffffff
cmp rdi, rax
jae 0x1400ac298
cmp rax, rdi
je 0x1400ac298
mov r12d, 0xffffffe7
cmp rdi, r12
jae 0x1400ac29e
lea rcx, [rsi*8 + 0x20]
call fcn.1401cd1cc
xor ebx, ebx
jmp 0x1400ac2a2
mov r12d, 0xffffffe7
xor ebx, ebx
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14008e668
mov rdi, rax
mov qword [rsp + 0x70], rax
mov r13, rsi
test esi, esi
jle 0x1400ac379
sub rax, r14
mov rdi, rsi
or r15, 0xffffffffffffffff
mov rsi, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x58], eax
movsxd r13, eax
mov eax, 0xffffffff
cmp r13, rax
jae 0x1400ac31a
cmp r13, r12
jae 0x1400ac31a
lea rcx, [r13 + 0x18]
call fcn.1401cd1cc
jmp 0x1400ac31d
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call fcn.14008e668
mov qword [rsi + r14], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsp + 0x58]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add r14, 8
sub rdi, 1
jne 0x1400ac2d3
mov rdi, qword [rsp + 0x70]
movsxd rsi, dword [rsp + 0x60]
mov r13, rsi
jmp 0x1400ac37d
or r15, 0xffffffffffffffff
cmp esi, 1
jle 0x1400ac456
lea rdx, str._finstall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._funinstall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._fulluninstall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._fullinstall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._install
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._uninstall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ac412
lea rdx, str._state
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ac456
mov rax, qword [rdi + 8]
mov qword [rdi + r13*8], rax
mov ecx, 0x1c
call fcn.1401cd1cc
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 4]
mov edx, r12d
call fcn.14008e668
mov qword [rdi + 8], rax
lea r8, [0x140255c98]
mov rdx, qword [rax - 0x18]
mov rcx, rax
call fcn.140001148
mov esi, dword [rsp + 0x50]
jmp 0x1400ac45c
mov r12d, 4
mov r13d, 1
cmp esi, r13d
jle 0x1400ac814
lea rdx, str._licenses
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ac766
lea r15, str._n
mov rcx, r15
call fcn.140001090
lea rcx, str._MeshCentral_MeshAgent:_Copyright_2006___2020_Intel_Corporation_n
call fcn.140001090
lea rcx, str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.140001090
lea r14, str._________________________________________________________________________________________n
mov rcx, r14
call fcn.140001090
lea rcx, str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.140001090
lea rcx, str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.140001090
lea rcx, str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.140001090
lea rsi, str.____n
mov rcx, rsi
call fcn.140001090
lea rcx, str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.140001090
mov rcx, rsi
call fcn.140001090
lea rcx, str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.140001090
lea rcx, str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.140001090
lea rcx, str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.140001090
lea rcx, str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.140001090
lea rcx, str.___limitations_under_the_License._n_n
call fcn.140001090
mov rcx, r15
call fcn.140001090
lea rcx, str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.140001090
lea rcx, str.________________________https:__github.com_svaarala_duktape__n
call fcn.140001090
lea rcx, str.________________________http:__opensource.org_licenses_MIT__n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.140001090
lea rcx, str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.140001090
lea rcx, str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.140001090
lea rcx, str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.140001090
lea rcx, str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.140001090
lea rcx, str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.140001090
mov rcx, rsi
call fcn.140001090
lea rcx, str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.140001090
lea rcx, str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.140001090
mov rcx, rsi
call fcn.140001090
lea rcx, str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.140001090
lea rcx, str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.140001090
lea rcx, str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.140001090
lea rcx, str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.140001090
lea rcx, str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.140001090
lea rcx, str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.140001090
lea rcx, str.___THE_SOFTWARE._n
call fcn.140001090
mov rcx, r15
call fcn.140001090
lea rcx, str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.140001090
lea rcx, str._______________________________http:__www.zlib.net__n
call fcn.140001090
mov rcx, r14
call fcn.140001090
lea rcx, str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.140001090
lea rcx, str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.140001090
lea rcx, str.___arising_from_the_use_of_this_software._n
call fcn.140001090
lea rsi, [0x140255478]
mov rcx, rsi
call fcn.140001090
lea rcx, str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.140001090
lea rcx, str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.140001090
lea rcx, str.___freely__subject_to_the_following_restrictions_:_n
call fcn.140001090
mov rcx, rsi
call fcn.140001090
lea rcx, str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.140001090
lea rcx, str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.140001090
lea rcx, str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.140001090
lea rcx, str.______appreciated_but_is_not_required._n
call fcn.140001090
lea rcx, str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.140001090
lea rcx, str.______misrepresented_as_being_the_original_software._n
call fcn.140001090
lea rcx, str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.140001090
mov rcx, rsi
call fcn.140001090
lea rcx, str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.140001090
lea rcx, str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.140001090
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf4
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400ac745
jmp 0x1400adaf4
cmp esi, r13d
jle 0x1400ac814
lea rdx, str._info
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ac814
lea r8, str.Jan_13_2021
lea rdx, str.02:42:23
lea rcx, str.Compiled_on:__s___s_n
call fcn.140001090
lea rdx, str.0e5943192eeb50b37c8a777b5e195b0b741e3ef2
lea rcx, str.___Commit_Hash:__s_n
call fcn.140001090
lea rdx, str.2021_Jan_12_05:00:500200
lea rcx, str.___Commit_Date:__s_n
call fcn.140001090
xor ecx, ecx
call fcn.1400ca240
mov rdx, rax
lea rcx, str.Using__s_n
call fcn.140001090
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf4
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400ac7f3
jmp 0x1400adaf4
cmp esi, 2
jle 0x1400ac95f
lea rdx, str._faddr
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ac8d1
mov qword [rsp + 0x50], rbx
mov rcx, qword [rdi + 0x10]
add rcx, 2
lea r8, [rsp + 0x50]
lea rdx, str._016llx
call fcn.14000cd94
mov r8, qword [rsp + 0x50]
call fcn.14008fffc
lea rdx, [0x1402c7c20]
lea rcx, [0x14025367c]
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400ac89a
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400ac87f
mov rcx, rdi
call fcn.14008e748
xor eax, eax
mov rcx, qword [rsp + 0xca0]
xor rcx, rsp
call fcn.1401c0ed0
lea r11, [rsp + 0xcb0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp esi, 2
jle 0x1400ac95f
lea rdx, str._fdelta
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ac95f
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
lea rdx, str._lld
mov rcx, qword [rdi + 0x10]
call fcn.14000cd94
lea r8, [0x14008ef2c]
sub r8, qword [rsp + 0x50]
call fcn.14008fffc
lea rdx, [0x1402c7c20]
lea rcx, [0x14025367c]
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400ac89a
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400ac93f
jmp 0x1400ac89a
mov r8d, 0x104
lea rdx, [rsp + 0x880]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x208
lea rax, [rsp + 0xa90]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rsp + 0x880]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa90]
call fcn.14007ef20
cmp esi, 2
jle 0x1400aca14
lea rdx, str._exec
mov rcx, qword [rdi + 8]
call fcn.1401d9f70
test eax, eax
jne 0x1400aca14
mov r14d, dword [rsp + 0x58]
test r14d, r14d
jne 0x1400aca19
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.140096794
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400aca00
mov r14d, ebx
jmp 0x1400aca19
mov edx, 0x1000
mov rcx, qword [rsp + 0x50]
call fcn.1401ccb7c
mov r14, rax
jmp 0x1400aca19
mov r14d, dword [rsp + 0x58]
cmp esi, 2
jle 0x1400aca62
lea rdx, str._b64exec
mov rcx, qword [rdi + 8]
call fcn.1401d9f70
test eax, eax
jne 0x1400aca62
test r14d, r14d
jne 0x1400aca62
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x1400aca45
mov rax, rbx
jmp 0x1400aca53
mov edx, 0x10000
call fcn.1401ccb7c
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x50]
mov edx, eax
call fcn.140094c10
mov r14d, eax
cmp esi, r13d
jle 0x1400accc1
lea rdx, str._nodeid
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400acaf0
movups xmm0, xmmword [str.console.log_require__agentNodeId_____process.exit___]
movups xmmword [rsp + 0x600], xmm0
movups xmm1, xmmword [0x14029e9e8]
movups xmmword [rsp + 0x610], xmm1
movups xmm0, xmmword [0x14029e9f8]
movups xmmword [rsp + 0x620], xmm0
mov eax, dword [0x14029ea08]
mov dword [rsp + 0x630], eax
movzx eax, word [0x14029ea0c]
mov word [rsp + 0x634], ax
mov al, byte [0x14029ea0e]
mov byte [rsp + 0x636], al
mov r14d, gethostname
mov edx, r14d
lea rcx, [rsp + 0x600]
call fcn.140096794
mov qword [rsp + 0x50], rax
cmp esi, r13d
jle 0x1400accc1
lea rdx, str._name
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400acb80
movaps xmm0, xmmword [str.console.log_require__agentNodeId_.serviceName____process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x14029ea30]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x14029ea40]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x14029ea50]
movaps xmmword [rsp + 0x630], xmm1
movzx eax, word [0x14029ea60]
mov word [rsp + 0x640], ax
mov al, byte [0x14029ea62]
mov byte [rsp + 0x642], al
mov r14d, 0x42
mov edx, r14d
lea rcx, [rsp + 0x600]
call fcn.140096794
mov qword [rsp + 0x50], rax
cmp esi, r13d
jle 0x1400accc1
lea rdx, str._agentHash
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400acc2c
test r14d, r14d
jne 0x1400acc2c
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x14029ea90]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x14029eaa0]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x14029eab0]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x14029eac0]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm1, xmmword [0x14029ead0]
movaps xmmword [rsp + 0x650], xmm1
mov al, byte [0x14029eae0]
mov byte [rsp + 0x660], al
mov r14d, 0x60
mov edx, r14d
lea rcx, [rsp + 0x600]
call fcn.140096794
mov qword [rsp + 0x50], rax
cmp esi, r13d
jle 0x1400accc1
lea rdx, str._agentFullHash
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400accc1
test r14d, r14d
jne 0x1400accc1
movaps xmm0, xmmword [str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___]
movaps xmmword [rsp + 0x600], xmm0
movaps xmm1, xmmword [0x14029eb10]
movaps xmmword [rsp + 0x610], xmm1
movaps xmm0, xmmword [0x14029eb20]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm1, xmmword [0x14029eb30]
movaps xmmword [rsp + 0x630], xmm1
movaps xmm0, xmmword [0x14029eb40]
movaps xmmword [rsp + 0x640], xmm0
mov al, byte [0x14029eb50]
mov byte [rsp + 0x650], al
mov r14d, 0x50
mov edx, r14d
lea rcx, [rsp + 0x600]
call fcn.140096794
mov qword [rsp + 0x50], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp esi, r13d
jle 0x1400acfc5
lea rdx, str._updaterversion
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400acd49
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [0x14029eb68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400ac89a
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400acd29
jmp 0x1400ac89a
cmp esi, r13d
jle 0x1400acfc5
lea rdx, str._kvm0
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ace87
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14008e944
mov r15, rax
lea rax, [0x1400ac1b0]
mov qword [r15], rax
mov dword [r15 + 0x10], ebx
cmp esi, 2
jle 0x1400acda7
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401d9aec
test eax, eax
mov eax, r13d
je 0x1400acda9
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400acdc6
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401d9aec
test eax, eax
je 0x1400acddf
cmp esi, 3
jle 0x1400acde6
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401d9aec
test eax, eax
jne 0x1400acde6
mov dword [0x1402c35b0], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400ace2a
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400ace2a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400ace42
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400ace48
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r15
call fcn.14000eb4c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf4
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400ace66
jmp 0x1400adaf4
cmp esi, r13d
jle 0x1400acfc5
lea rdx, str._kvm1
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400acfc5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x20]
call fcn.14008e944
mov r15, rax
lea rax, [0x1400ac1b0]
mov qword [r15], rax
mov dword [r15 + 0x10], r13d
cmp esi, 2
jle 0x1400acee5
lea rdx, str._coredump
mov rcx, qword [rdi + 0x10]
call fcn.1401d9aec
test eax, eax
mov eax, r13d
je 0x1400acee7
mov eax, ebx
mov dword [r15 + 0x18], eax
cmp esi, 2
jle 0x1400acf04
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x10]
call fcn.1401d9aec
test eax, eax
je 0x1400acf1d
cmp esi, 3
jle 0x1400acf24
lea rdx, str._remotecursor
mov rcx, qword [rdi + 0x18]
call fcn.1401d9aec
test eax, eax
jne 0x1400acf24
mov dword [0x1402c35b0], r13d
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400acf68
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400acf68
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400acf80
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400acf86
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov rcx, r15
call fcn.14000eb4c
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf4
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400acfa4
jmp 0x1400adaf4
cmp qword [rsp + 0x50], rbx
jne 0x1400ad9fe
test esi, esi
jle 0x1400acfeb
lea rdx, str.__slave
mov rcx, qword [rdi]
call fcn.1401d9aec
test eax, eax
je 0x1400ad9fe
cmp esi, r13d
jle 0x1400ad4da
lea rdx, [0x140255c98]
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad9fe
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad9fe
lea rdx, str.__slave
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad9fe
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str.state
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad167
mov esi, ebx
mov r8d, r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x1400ad0c3
mov r8d, r12d
lea rdx, str.Mesh_Agent
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r15, rax
test rax, rax
je 0x1400ad0b5
lea rdx, [rsp + 0x600]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
cmovne esi, dword [rsp + 0x604]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ad0ba
mov esi, 0x64
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, r13d
jne 0x1400ad0d1
lea rcx, str.Stopped
jmp 0x1400ad131
cmp esi, 2
jne 0x1400ad0df
lea rcx, str.Start_Pending
jmp 0x1400ad131
cmp esi, 3
jne 0x1400ad0ed
lea rcx, str.Stop_Pending
jmp 0x1400ad131
cmp esi, r12d
jne 0x1400ad0fb
lea rcx, str.Running
jmp 0x1400ad131
cmp esi, 5
jne 0x1400ad109
lea rcx, str.Continue_Pending
jmp 0x1400ad131
cmp esi, 6
jne 0x1400ad117
lea rcx, str.Pause_Pending
jmp 0x1400ad131
cmp esi, 7
jne 0x1400ad125
lea rcx, str.Paused
jmp 0x1400ad131
cmp esi, 0x64
jne 0x1400ad136
lea rcx, str.Not_installed
call fcn.140001090
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400ad160
mov r14, rdi
mov rcx, qword [r14]
call fcn.14008e748
add ebx, r13d
lea r14, [r14 + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400ad145
mov ebx, esi
jmp 0x1400adaf4
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str.start
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad198
lea rdx, str._start
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad1d3
call fcn.1400ac030
test eax, eax
jne 0x1400ad1ad
lea rcx, str.Failed_to_start_mesh_agent
jmp 0x1400ad914
cmp eax, r13d
jne 0x1400ad1be
lea rcx, str.Started_the_mesh_agent
jmp 0x1400ad914
cmp eax, 2
jne 0x1400ad9c5
lea rcx, str.Mesh_agent_already_running
jmp 0x1400ad914
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad204
lea rdx, str._stop
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad223
call fcn.1400ac0ec
lea rcx, str.Stopped_mesh_agent
lea rdx, str.Failed_to_stop_mesh_agent
cmp eax, r13d
cmovne rcx, rdx
jmp 0x1400ad914
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str.restart
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ad254
lea rdx, str._restart
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad294
call fcn.1400ac0ec
call fcn.1400ac030
test eax, eax
jne 0x1400ad26e
lea rcx, str.Failed_to_restart_mesh_agent
jmp 0x1400ad914
cmp eax, r13d
jne 0x1400ad27f
lea rcx, str.Restarted_the_mesh_agent
jmp 0x1400ad914
cmp eax, 2
jne 0x1400ad9c5
lea rcx, str.Mesh_agent_failed_to_stop
jmp 0x1400ad914
cmp esi, r13d
jle 0x1400ad4da
mov rax, qword [rdi + 8]
movabs rcx, 0x3a6574616470752d
cmp qword [rax], rcx
jne 0x1400ad3e7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r15d, 0x400
mov ecx, r15d
call fcn.14008e944
mov r14, rax
mov rcx, qword [rdi + 8]
cmp byte [rcx + 8], 0x2a
jne 0x1400ad318
cmp esi, 2
jle 0x1400ad2e2
mov rax, qword [rdi + 0x10]
jmp 0x1400ad2e9
lea rax, str.null
lea r8, str.true
lea r9, str.false
cmp byte [rcx + 9], 0x53
cmove r9, r8
mov qword [rsp + 0x20], rax
lea r8, str.require_agent_installer_.update__s___s__
mov rdx, r15
mov rcx, r14
call fcn.140001148
jmp 0x1400ad36f
cmp esi, 2
jle 0x1400ad35d
lea rdx, [0x140255c98]
mov rcx, qword [rdi + 0x10]
call fcn.1401d9f70
test eax, eax
je 0x1400ad345
lea rdx, str.connect
mov rcx, qword [rdi + 0x10]
call fcn.1401d9f70
test eax, eax
jne 0x1400ad35d
mov r9, qword [rdi + 0x10]
lea r8, str.require_agent_installer_.update_false____s___
mov rdx, r15
mov rcx, r14
call fcn.140001148
jmp 0x1400ad36f
lea r8, str.require_agent_installer_.update_true__
mov rdx, r15
mov rcx, r14
call fcn.140001148
mov r15d, eax
xor ecx, ecx
call fcn.140007ff8
mov qword [0x1402c3750], rax
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r15d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000ba50
mov rax, qword [0x1402c3750]
mov r14d, dword [rax + 0xba4]
mov dword [rsp + 0x6c], r14d
call fcn.14000c39c
mov qword [0x1402c3750], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf1
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400ad3c7
jmp 0x1400adaf1
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str._netinfo
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad425
lea rcx, [rsp + 0x70]
call fcn.140010794
test eax, eax
jle 0x1400ad9c5
mov rcx, qword [rsp + 0x70]
call fcn.1400abc5c
jmp 0x1400ad9c5
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str._setfirewall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad47d
mov r8d, 0x104
lea rdx, [rsp + 0x670]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400abcb0
test eax, eax
je 0x1400ad4b5
lea rcx, [rsp + 0x670]
call fcn.1400ab9d8
lea rcx, [rsp + 0x670]
call fcn.1400ab54c
jmp 0x1400ad4ce
cmp esi, r13d
jle 0x1400ad4da
lea rdx, str._clearfirewall
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad4da
mov r8d, 0x104
lea rdx, [rsp + 0x670]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400abcb0
test eax, eax
jne 0x1400ad4c1
lea rcx, str.Must_run_as_administrator
jmp 0x1400ad914
lea rcx, [rsp + 0x670]
call fcn.1400ab9d8
lea rcx, str.Done
jmp 0x1400ad914
cmp esi, 2
jne 0x1400ad5b2
lea rdx, str._resetnodeid
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ad5b2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x1402557c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ad56f
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.ResetNodeId
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400ad562
lea rcx, str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.140001090
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ad57b
lea rcx, str.Error_writing_to_registry__try_running_as_administrator.
call fcn.140001090
mov r14d, ebx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf4
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add r14d, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp r14d, eax
jl 0x1400ad591
jmp 0x1400adaf4
mov r14d, ebx
lea rax, str.Mesh_Agent_background_service
mov qword [rsp + 0x600], rax
lea rax, [0x1400abea4]
mov qword [rsp + 0x608], rax
mov qword [rsp + 0x610], rbx
mov qword [rsp + 0x618], rbx
mov dword [0x1402c39c8], esi
mov qword [0x1402c39c0], rdi
lea rcx, [rsp + 0x600]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1400ad9c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x1400ad9c5
cmp esi, 2
jl 0x1400ad820
mov dword [rsp + 0x20], r13d
mov r9d, 3
lea r8, [0x140255f9c]
mov rdx, r15
mov rcx, qword [rdi + 8]
call fcn.1400963b8
test eax, eax
jne 0x1400ad661
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, str..zip
mov rdx, r15
mov rcx, qword [rdi + 8]
call fcn.1400963b8
test eax, eax
je 0x1400ad6a5
mov edx, r13d
lea rcx, [0x1400ac1f4]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
xor ecx, ecx
call fcn.140007ff8
mov qword [0x1402c3750], rax
mov dword [rax + 0xbdc], r13d
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14000ba50
call fcn.14000c39c
mov qword [0x1402c3750], rbx
jmp 0x1400ad9c5
cmp esi, 2
jne 0x1400ad820
lea rdx, [0x14029eea4]
mov rcx, qword [rdi + 8]
call fcn.1401d9f70
test eax, eax
jne 0x1400ad7bd
mov r8d, 0x104
lea rdx, [rsp + 0xa90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rsp + 0xa90]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call fcn.14008ed94
mov rsi, rax
mov rcx, rax
call fcn.140091a08
call fcn.1400818c4
mov rcx, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
call fcn.1400819ac
mov r14, rax
mov r9d, 0xe88
lea rdx, str.require_util_language_.current.toUpperCase__.split___.join____
mov rcx, rax
call fcn.1400197b0
test eax, eax
jne 0x1400ad799
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call fcn.14001be6c
mov rdx, rax
lea rcx, str.Current_Language:__s_n
call fcn.140001090
mov rcx, r14
call fcn.140060114
mov dword [rsi], 2
mov rcx, rsi
call fcn.14008efc8
mov rcx, rsi
call fcn.140091abc
mov esi, r13d
mov r14d, r13d
cmp esi, 2
jne 0x1400ad820
mov rcx, qword [rdi + 8]
mov rax, r15
inc rax
cmp byte [rcx + rax], bl
jne 0x1400ad7c9
cmp rax, 6
jbe 0x1400ad820
mov r8d, 6
lea rdx, str._lang
call fcn.1401cca10
test eax, eax
jne 0x1400ad820
mov rcx, qword [rdi + 8]
inc r15
cmp byte [rcx + r15], bl
jne 0x1400ad7f1
mov rdx, r15
mov r9, r13
lea r8, [0x14025547c]
call fcn.140096480
movsxd rcx, eax
inc rcx
add rcx, qword [rdi + 8]
mov qword [0x1402c3768], rcx
mov esi, r13d
cmp esi, r13d
je 0x1400ad91e
lea rcx, str.Mesh_Agent_available_switches:_r_n
call fcn.140001090
lea rcx, str.__run_______________Start_as_a_console_agent._r_n
call fcn.140001090
lea rcx, str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.140001090
lea rcx, str.__start_____________Start_the_service._r_n
call fcn.140001090
lea rcx, str.__restart___________Restart_the_service._r_n
call fcn.140001090
lea rcx, str.__stop______________Stop_the_service._r_n
call fcn.140001090
lea rcx, str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.140001090
lea rcx, str.___signcheck________Perform_self___check._r_n
call fcn.140001090
lea rcx, str.___install__________Install_the_service_from_this_location._r_n
call fcn.140001090
lea rcx, str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.140001090
lea rcx, str.___nodeid_t_t_tReturn_the_current_agent_identifier._r_n
call fcn.140001090
lea rcx, str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.140001090
lea rcx, str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.140001090
lea rcx, str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.140001090
lea rcx, str.___licenses_________View_the_software_license_details._r_n
call fcn.140001090
lea rcx, [0x14026278c]
call fcn.140001090
lea rcx, str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.140001090
lea rcx, [0x14026278c]
call fcn.140001090
lea rcx, str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.140001090
lea rcx, str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.140001090
jmp 0x1400ad9c5
test r14d, r14d
jne 0x1400ad9c5
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov r8d, 0x800
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14, rbx
test rax, rax
je 0x1400ad971
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x1400ad971
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test r14, r14
je 0x1400ad989
mov ecx, 2
call r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400ad98f
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov dword [rsp + 0x50], 8
mov dword [rsp + 0x54], 0xc000
lea rcx, [rsp + 0x50]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400adc94]
xor r8d, r8d
lea edx, [r8 + 0x67]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400ac89a
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400ad9de
jmp 0x1400ac89a
mov edx, r13d
lea rcx, [0x1400ac1f4]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop
mov r15d, ebx
mov dword [rsp + 0x68], ebx
cmp esi, r13d
jle 0x1400ada3b
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
mov ecx, 0x20
test eax, eax
cmove r15d, ecx
mov dword [rsp + 0x68], r15d
mov ecx, r15d
call fcn.140007ff8
mov qword [0x1402c3750], rax
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x20], rcx
mov dword [rax + 0x28], r14d
test rcx, rcx
jne 0x1400ada89
cmp esi, r13d
jle 0x1400ada97
lea rdx, [0x140255c98]
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
je 0x1400ada89
lea rdx, str.connect
mov rcx, qword [rdi + 8]
call fcn.1401d9aec
test eax, eax
jne 0x1400ada97
mov rax, qword [0x1402c3750]
mov dword [rax + 0xbdc], r13d
mov r8, rdi
mov edx, esi
mov rcx, qword [0x1402c3750]
call fcn.14000ba50
mov rax, qword [0x1402c3750]
mov r14d, dword [rax + 0xba4]
mov dword [rsp + 0x6c], r14d
call fcn.14000c39c
mov qword [0x1402c3750], rbx
mov rax, qword [rdi - 0x18]
shr rax, 3
test eax, eax
jle 0x1400adaf1
mov rsi, rdi
mov rcx, qword [rsi]
call fcn.14008e748
add ebx, r13d
lea rsi, [rsi + 8]
mov rax, qword [rdi - 0x18]
shr rax, 3
cmp ebx, eax
jl 0x1400adad6
mov ebx, r14d
mov rcx, rdi
call fcn.14008e748
mov eax, ebx
jmp 0x1400ac8a4