Function at 0x40ade6
Capabilities:
Reference wmi statements
Set current directory

Disassembly:
mov eax, 0x1444
call fcn.005b9060
mov eax, dword [0x6d1d44]
xor eax, esp
mov dword [esp + 0x1440], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1450]
lea ecx, [esp + 0x24]
push esi
mov esi, dword [0x74cc04]
push edi
mov dword [esp + 0x18], edx
xor edi, edi
push 1
push 4
mov edx, 0x400
call fcn.00484c1e
mov ebx, eax
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
cmp dword [ebx - 0xc], edi
jbe 0x40ae3e
mov eax, dword [ebx - 0x10]
add eax, 0x10
add eax, ebx
jmp 0x40ae40
xor eax, eax
mov dword [eax], esi
mov eax, dword [esi + 0x40]
test eax, eax
je 0x40ae4f
push 2
call eax
jmp 0x40ae55
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
cmp dword [esp + 0x18], 1
jne 0x40ae8d
mov eax, dword [ebp]
mov ecx, 0x6d7214
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ae84
test dl, dl
je 0x40ae80
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ae84
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ae64
xor eax, eax
jmp 0x40ae89
sbb eax, eax
or eax, 1
test eax, eax
je 0x40aee1
cmp dword [esp + 0x18], 2
jne 0x40af58
mov ecx, dword [ebp + 4]
mov edx, 0x6d721c
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [esp + 0x13], bl
mov ebx, dword [esp + 0x14]
jne 0x40aed8
cmp byte [esp + 0x13], 0
je 0x40aed4
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [esp + 0x13], bl
mov ebx, dword [esp + 0x14]
jne 0x40aed8
add eax, 2
add edx, 2
cmp byte [esp + 0x13], 0
jne 0x40aea2
xor eax, eax
jmp 0x40aedd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40aef8
mov edx, dword [esi + 0x18]
mov ecx, dword [esi]
call fcn.0047a84e
and dword [esi], edi
mov dword [esi + 0xd34], eax
jmp 0x40b44e
mov eax, str.__netinfo
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40af1d
test dl, dl
je 0x40af19
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40af1d
add ecx, 2
add eax, 2
test dl, dl
jne 0x40aefd
xor eax, eax
jmp 0x40af22
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40af58
lea ecx, [esp + 0x14]
call fcn.0040f56e
test eax, eax
jle 0x40b44e
push dword [esp + 0x14]
push str._s_r_n
call fcn.00401109
push 1
push dword [esp + 0x20]
call fcn.005ed680
add esp, 0x10
jmp 0x40b44e
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jne 0x40af96
push 0x800
lea eax, [esp + 0x454]
mov dword [esi + 0x1c], ebx
push eax
push ecx
mov byte [ebx], cl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
lea eax, [esp + 0x450]
push ecx
push ecx
push dword [ebx - 0x10]
push ebx
push 0xffffffffffffffff
push eax
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esi + 0x1c]
lea edx, [esi + 0xbc8]
call fcn.00403aa7
xor ebx, ebx
inc ebx
cmp dword [esp + 0x18], ebx
jle 0x40b050
cmp dword [ebp + ebx*4], edi
jne 0x40afbb
xor eax, eax
jmp 0x40afcb
push 0x1000
push dword [ebp + ebx*4]
call fcn.005f01d0
pop ecx
pop ecx
mov ecx, dword [ebp + ebx*4]
mov edx, eax
push 1
push 0x6d7238
call fcn.0048bd79
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
cmp eax, 2
jle 0x40b03c
push 2
push 0x6d723c
push dword [ebp + ebx*4]
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x40b03c
cmp dword [esp + 0x14], 0xf
jne 0x40b03c
mov eax, dword [ebp + ebx*4]
push 0xd
add eax, 2
push str.configUsesCWD
push eax
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x40b03c
mov eax, dword [ebp + ebx*4]
push 1
add eax, 0x10
push 0x6d7250
push eax
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x40b049
inc ebx
cmp ebx, dword [esp + 0x18]
jl 0x40afb1
jmp 0x40b050
mov dword [esi + 0x28], 1
push ecx
mov ecx, dword [esi + 0x1c]
mov edx, str..log
call fcn.00403127
pop ecx
xor edx, edx
mov ecx, eax
call fcn.0048bfc8
mov dword [0x74cbc4], eax
call fcn.004835e9
mov ecx, dword [esi]
mov edx, 0x407956
push esi
call fcn.0048501c
mov ecx, dword [ebp]
or edx, 0xffffffff
push 0x6d725c
call fcn.0048bdbe
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jle 0x40b0e6
push ebx
push dword [ebp]
push 0x10000
push 0x752940
call fcn.005e7660
add esp, 0x10
cmp ebx, 0x10000
jae 0x40b469
push 0x1000
mov byte [ebx + 0x752940], 0
mov ebx, 0x74e940
push ebx
push 0xffffffffffffffff
push 0x752940
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ebx, ebx
mov dword [esp + 0x20], esi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], eax
cmp dword [esi + 0x10], ebx
jne 0x40b40e
cmp dword [esp + 0x18], 2
push 3
pop eax
jl 0x40b14f
mov ecx, dword [ebp + 4]
or edx, 0xffffffff
push 1
push eax
push 0x6d7260
call fcn.0048bcb7
add esp, 0xc
test eax, eax
jne 0x40b40e
cmp dword [esp + 0x18], 2
jl 0x40b14f
mov ecx, dword [ebp + 4]
or edx, 0xffffffff
push 1
push 4
push 0x6d7264
call fcn.0048bcb7
add esp, 0xc
test eax, eax
jne 0x40b40e
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
push ebx
mov edx, 0x40adb8
call fcn.004850f9
pop ecx
pop ecx
mov ecx, dword [esi]
call fcn.00487e4a
mov dword [esi], ebx
cmp dword [esi + 0x24], ebx
je 0x40b436
cmp dword [esi + 0xb9c], ebx
je 0x40b401
cmp dword [esi + 0xd40], ebx
jne 0x40b2eb
call fcn.00479238
mov edx, dword [esi + 0x24]
mov ebp, eax
mov ecx, ebp
call fcn.0047e5ff
or edx, 0xffffffff
mov ecx, ebp
call fcn.00419b57
test eax, eax
je 0x40b2cf
or edx, 0xffffffff
mov ecx, ebp
call fcn.00417a2a
lea eax, [esp + 0x14]
or edx, 0xffffffff
push eax
mov ecx, ebp
call fcn.0041958a
mov ebx, dword [esp + 0x18]
xor edx, edx
pop ecx
mov dword [esp + 0x1c], eax
push 3
pop ecx
lea eax, [ebx*4 + 4]
div ecx
push 0xfffffffffffffffa
mov edi, eax
lea ecx, [ebx + 1]
pop eax
sub eax, edi
cmp ecx, eax
jae 0x40b23b
push 0xfffffffffffffffe
pop eax
lea ecx, [edi + 5]
sub eax, ebx
cmp ecx, eax
jae 0x40b23b
lea eax, [ebx + 6]
add eax, edi
cmp eax, 0xffffffef
jae 0x40b23b
test ecx, ecx
je 0x40b212
lea eax, [ebx + 0x16]
add eax, edi
cmp eax, 0xffffffef
jae 0x40b23b
xor eax, eax
cmp eax, ecx
push 0x1792
sbb eax, eax
and eax, 0x10
add eax, 0x16
push 0x6d726c
add eax, edi
add eax, ebx
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov ecx, eax
jmp 0x40b23d
xor ecx, ecx
lea eax, [edi + 5]
push 0
push eax
lea edx, [ebx + 1]
call fcn.00484c1e
mov edi, eax
pop ecx
pop ecx
cmp dword [edi - 0xc], 0
jbe 0x40b263
mov ecx, dword [edi - 0x10]
add ecx, 0x10
add ecx, edi
mov dword [esp + 0x14], ecx
jmp 0x40b268
and dword [esp + 0x14], 0
push ebx
push dword [esp + 0x20]
lea edx, [ebx + 1]
mov ecx, edi
call section..text
pop ecx
pop ecx
mov ecx, ebp
call fcn.0045bb3a
mov ecx, edi
cmp ebx, 0x7fffffff
jbe 0x40b2a6
call fcn.00484cd3
xor ebx, ebx
mov edi, ebx
cmp dword [esi + 0xba8], ebx
je 0x40b401
push str._Service_Parameters___ERROR
jmp 0x40b2e0
lea eax, [esp + 0x14]
mov edx, ebx
push eax
call fcn.0048a610
xor ebx, ebx
pop ecx
cmp dword [esi + 0xba8], ebx
je 0x40b401
push edi
push str._Service_Parameters____s
call fcn.0048cb75
pop ecx
jmp 0x40b2e5
cmp dword [esi + 0xba8], ebx
je 0x40b401
push str._Service_Parameters___NONE
call fcn.0048cb75
pop ecx
jmp 0x40b401
mov ebx, dword [esi + 0xd50]
mov ecx, str.meshagent
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b318
test dl, dl
je 0x40b314
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b318
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b2f8
xor eax, eax
jmp 0x40b31d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b3ff
mov edi, dword [ebx - 0x10]
xor edx, edx
push 3
pop ebp
push 0xfffffffffffffffa
lea eax, [edi*4 + 0x78]
div ebp
pop ecx
mov ebx, eax
lea edx, [edi + 0x1e]
sub ecx, ebx
cmp edx, ecx
jae 0x40b393
push 0xffffffffffffffe1
pop ecx
lea edx, [ebx + 5]
sub ecx, edi
cmp edx, ecx
jae 0x40b393
lea eax, [edi + 0x23]
add eax, ebx
cmp eax, 0xffffffef
jae 0x40b393
test edx, edx
je 0x40b368
lea eax, [edi + 0x33]
add eax, ebx
cmp eax, 0xffffffef
jae 0x40b393
xor eax, eax
cmp eax, edx
push 0x17ac
sbb eax, eax
add edi, 0x33
and eax, 0x10
push str...meshcore_agentcore.c
add eax, edi
add eax, ebx
push 1
push eax
call fcn.005ed7c0
add esp, 0x10
mov edi, eax
xor ebx, ebx
jmp 0x40b397
xor ebx, ebx
mov edi, ebx
mov eax, dword [esi + 0xd50]
xor edx, edx
push ebx
mov ecx, dword [eax - 0x10]
lea eax, [ecx*4 + 0x78]
div ebp
lea edx, [ecx + 0x1e]
mov ecx, edi
add eax, 5
push eax
call fcn.00484c1e
mov edi, eax
pop ecx
pop ecx
cmp dword [edi - 0xc], ebx
jbe 0x40b3d1
mov eax, dword [edi - 0x10]
add eax, 0x10
add eax, edi
mov dword [esp + 0x14], eax
jmp 0x40b3d5
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push dword [esi + 0xd50]
push str.____meshServiceName__s___
push dword [edi - 0x10]
push edi
call fcn.0040117f
add esp, 0x10
mov edx, eax
mov ecx, edi
call fcn.0048a610
jmp 0x40b2e5
xor ebx, ebx
mov ecx, dword [esi + 0x24]
call fcn.0048f331
mov dword [esi + 0x24], ebx
jmp 0x40b42b
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
push ebx
mov edx, 0x40ada3
call fcn.004850f9
pop ecx
pop ecx
mov ecx, dword [esi]
call fcn.00487e4a
mov dword [esi], ebx
test edi, edi
je 0x40b436
mov ecx, edi
call fcn.00484cd3
call fcn.004836c1
mov eax, dword [0x74cbc4]
test eax, eax
je 0x40b44e
push 1
push eax
call fcn.005ed680
pop ecx
pop ecx
mov ecx, dword [esp + 0x1450]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b8900
add esp, 0x1444
ret
call fcn.005b8a60
int3