Function at 0x140004dd0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rdi
mov rax, qword [0x1401ff510]
xor rax, rbp
mov qword [rbp + 0x160], rax
xor esi, esi
mov dword [rbp + 8], r9d
mov r12d, r9d
mov r13, r8
mov r14d, edx
mov qword [rbp + 0x10], r8
mov rbx, rcx
mov dword [rbp + 0x18], edx
mov edi, esi
cmp qword [rcx + 0x40], rsi
jne 0x140004e49
mov rcx, qword [rcx + 0x30]
lea rdx, [0x1401d5bd8]
call fcn.1400024ec
mov rcx, rax
call fcn.14006fec4
mov qword [rbx + 0x40], rax
cmp qword [rbx + 0x40], rsi
jne 0x140004e62
lea rcx, str.Unable_to_open_database._r_n
call fcn.140001090
xor eax, eax
jmp 0x140005948
mov rdx, qword [rbx]
call fcn.140072e48
mov qword [rbx + 0x38], rax
lea rdx, str.SoftwareOpen_SourceMeshAgent2
lea rax, [rbp + 0x20]
mov dword [rbp], esi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r15d, 1
test eax, eax
jne 0x140004ef0
mov rcx, qword [rbp + 0x20]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetNodeId
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140004ee6
cmp dword [rbp], esi
jbe 0x140004ee6
mov rcx, qword [rbp + 0x20]
lea rdx, str.ResetNodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
cmove edi, r15d
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14005c968
mov r9, qword [rbx]
mov rcx, rax
mov rax, qword [rbx + 0x30]
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.14005c9a8
mov r9d, 0xe88
mov qword [rbp + 0x28], rax
lea rdx, str.function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret______getMac___
mov rcx, rax
mov r15, rax
call fcn.14000b318
test eax, eax
jne 0x140005093
lea r8, [rbp + 0x20]
or edx, 0xffffffff
mov rcx, r15
call fcn.14000ca48
lea rcx, str.LocalMacAddresses
mov edx, 0x400
mov r12, rax
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov r8d, eax
call fcn.1400700e0
movsxd r14, eax
test eax, eax
jne 0x140004fb4
mov eax, dword [rbp + 0x20]
lea rdx, str.LocalMacAddresses
mov rcx, qword [rbx + 0x40]
mov r9, r12
mov r8d, reloc.WS2_32.dll_recvfrom
mov dword [rsp + 0x20], eax
call fcn.14006ff94
jmp 0x14000508b
lea rax, [r14 + 0x38]
mov rdx, r14
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140004fce
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14015c3d0
sub rsp, rcx
mov r9d, 1
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 7]
call fcn.140068570
mov edx, 0x400
mov qword [rbp], rax
mov rsi, rax
lea rcx, [rax + 8]
mov qword [rax], rcx
lea rcx, str.LocalMacAddresses
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
mov r9, rsi
mov dword [rsp + 0x20], r14d
mov r8d, eax
call fcn.1400700e0
mov r13, qword [rbp + 0x20]
xor esi, esi
test r14d, r14d
jle 0x140005066
mov r15, qword [rbp]
movsxd r8, esi
mov r9d, reloc.WS2_32.dll_send
add r8, r15
mov edx, r13d
mov rcx, r12
call fcn.14006d328
test eax, eax
jns 0x14000505d
add esi, 0x13
cmp esi, r14d
jl 0x14000503a
mov r15, qword [rbp + 0x28]
cmp esi, r14d
jl 0x140005087
mov rcx, qword [rbx + 0x40]
lea rdx, str.LocalMacAddresses
mov edi, 1
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8d, [rdi + 0x10]
call fcn.14006ff94
mov r13, qword [rbp + 0x10]
mov r14d, dword [rbp + 0x18]
mov r12d, dword [rbp + 8]
test r15, r15
je 0x1400050a1
mov rcx, qword [r15 + 0x40]
call fcn.14001ce98
cmp edi, 1
je 0x1400050b7
mov rcx, rbx
call fcn.1400028a0
xor r15d, r15d
test eax, eax
je 0x1400050d2
jmp 0x1400050ba
xor r15d, r15d
mov rcx, rbx
call fcn.140002660
test eax, eax
je 0x1400050d2
lea rcx, str.Certificate_error_r_n
call fcn.140001090
mov rcx, rbx
call fcn.140002a18
test eax, eax
je 0x1400050ea
lea rcx, str.Certificate_validation_error_r_n
call fcn.140001090
mov rcx, qword [rbx + 0x30]
lea rdx, str..tag
mov qword [rbp + 0x10], r15
call fcn.1400024ec
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.1400660ac
mov rdi, qword [rbp + 0x10]
lea rsi, [0x1401d5914]
mov rcx, qword [rbx + 0x40]
mov r8d, 3
mov rdx, rsi
test rdi, rdi
je 0x14000513d
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.14006ff94
mov rcx, rdi
call fcn.1401630c0
jmp 0x140005142
call fcn.1400701b4
mov rcx, qword [rbx + 0x40]
lea r9, [rbp + 0x60]
mov r8d, reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x20], 0xff
lea rdx, str.ignoreProxyFile
call fcn.1400700e0
test eax, eax
jne 0x1400051bd
mov rcx, qword [rbx + 0x30]
lea rdx, str..proxy
mov qword [rbp + 0x10], r15
call fcn.1400024ec
mov rcx, rax
lea rdx, [rbp + 0x10]
call fcn.1400660ac
mov rdi, qword [rbp + 0x10]
lea rdx, str.WebProxy
mov rcx, qword [rbx + 0x40]
mov r8d, 8
test rdi, rdi
je 0x1400051b8
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.14006ff94
mov rcx, rdi
call fcn.1401630c0
jmp 0x1400051bd
call fcn.1400701b4
mov rcx, qword [rbx + 0x30]
lea rdx, str..mshx
call fcn.1400024ec
mov rdx, rax
mov rcx, rbx
call fcn.1400049c4
test eax, eax
jne 0x14000521e
mov rcx, qword [rbx + 0x30]
lea rdx, str..msh
call fcn.1400024ec
mov rdx, rax
mov rcx, rbx
call fcn.1400049c4
test eax, eax
jne 0x14000521e
mov rcx, rbx
call fcn.140004808
mov rcx, qword [rbx + 0x30]
lea rdx, str..msh
call fcn.1400024ec
mov rdx, rax
mov rcx, rbx
call fcn.1400049c4
lea r8, [rbp]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareOpen_SourceMeshAgent2
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400055d1
lea rcx, [rbx + 0x6d8]
mov qword [rbp + 8], r15
lea r8, [rbp + 8]
lea edx, [rax + 0x30]
call fcn.14006bd1c
movsxd rdx, eax
test eax, eax
jle 0x1400052bb
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x1400052bb
mov rcx, rdx
test eax, eax
jle 0x14000528a
mov rax, rdi
cmp byte [rax], 0x2b
jne 0x140005279
mov byte [rax], 0x40
jmp 0x140005281
cmp byte [rax], 0x2f
jne 0x140005281
mov byte [rax], 0x24
inc rax
sub rcx, 1
jne 0x14000526f
mov rcx, qword [rbp]
mov r9d, 1
mov dword [rsp + 0x28], edx
xor r8d, r8d
lea rdx, str.NodeId
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.1401630c0
mov qword [rbp + 8], r15
jmp 0x1400052cc
mov rcx, qword [rbp]
lea rdx, str.NodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rcx, [rbx + 0x5ac]
mov edx, gethostbyname
lea r8, [0x140203120]
call fcn.140065ea8
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], r15b
jne 0x1400052e8
mov rcx, qword [rbp]
lea rdx, str.AgentHash
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdi, str.MeshID
mov edx, 0x400
mov rcx, rdi
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], r15d
mov rdx, rdi
call fcn.1400700e0
test eax, eax
je 0x1400053e7
mov edx, 0x400
mov rcx, rdi
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea r9, [0x140204120]
mov r8d, eax
mov dword [rsp + 0x20], 0x10000
mov rdx, rdi
call fcn.1400700e0
test eax, eax
jle 0x1400053e7
lea r8, [rbp + 8]
mov edx, eax
lea rcx, [0x140204120]
call fcn.14006bd1c
test eax, eax
jle 0x1400053e7
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x1400053e7
movsxd rdx, eax
test eax, eax
jle 0x1400053ba
mov rcx, rdi
cmp byte [rcx], 0x2b
jne 0x1400053a9
mov byte [rcx], 0x40
jmp 0x1400053b1
cmp byte [rcx], 0x2f
jne 0x1400053b1
mov byte [rcx], 0x24
inc rcx
sub rdx, 1
jne 0x14000539f
mov rcx, qword [rbp]
lea rdx, str.MeshId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call fcn.1401630c0
jmp 0x1400053f8
mov rcx, qword [rbp]
lea rdx, str.MeshId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, 0x400
lea rcx, str.MeshServer
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdi, [0x140204120]
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
lea rdx, str.MeshServer
call fcn.1400700e0
test eax, eax
jne 0x140005445
mov rcx, qword [rbp]
lea rdx, str.MeshServerUrl
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140005475
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x140005449
mov rcx, qword [rbp]
lea rdx, str.MeshServerUrl
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.ServerID
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdx, str.ServerID
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
call fcn.1400700e0
test eax, eax
jne 0x1400054bb
mov rcx, qword [rbp]
lea rdx, str.MeshServerId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1400054eb
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x1400054bf
mov rcx, qword [rbp]
lea rdx, str.MeshServerId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.WebProxy
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdx, str.WebProxy
mov r9, rdi
mov dword [rsp + 0x20], 0x10000
mov r8d, eax
call fcn.1400700e0
test eax, eax
jne 0x140005531
mov rcx, qword [rbp]
lea rdx, str.Proxy
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140005561
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x140005535
mov rcx, qword [rbp]
lea rdx, str.Proxy
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
mov rcx, rsi
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
mov r9, rdi
mov r8d, eax
mov dword [rsp + 0x20], 0x10000
mov rdx, rsi
call fcn.1400700e0
test eax, eax
jne 0x14000559b
mov rcx, qword [rbp]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1400055c7
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], r15b
jne 0x14000559f
mov rcx, qword [rbp]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rbx + 0x610]
lea rdx, [rbx + 0x620]
mov rcx, qword [rbx + 0x38]
call fcn.140073a28
mov eax, 2
test r12d, r12d
lea r12d, [rax - 1]
je 0x140005630
cmp r14d, r12d
je 0x140005630
cmp r14d, eax
jne 0x140004e5b
mov rcx, qword [r13 + 8]
lea rdx, [0x1401d5df0]
call fcn.14016d040
test eax, eax
je 0x140005630
mov rcx, qword [r13 + 8]
lea rdx, str.connect
call fcn.14016d040
test eax, eax
jne 0x140004e5b
mov rcx, qword [rbx + 0x30]
lea rdx, str..update.exe
call fcn.1400024ec
test rax, rax
je 0x14000564d
mov rcx, rax
call fcn.14016a75c
lea r14, str.CoreModule
mov r13d, 0x400
cmp dword [rbx + 0x58], r15d
jne 0x140005686
mov edx, r13d
mov rcx, r14
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], r15d
mov rdx, r14
call fcn.1400700e0
mov edi, eax
jmp 0x140005689
mov edi, r15d
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400056f7
mov rdx, qword [rbx]
call fcn.140001e6c
mov rcx, qword [rbx + 0x10]
lea r8, str.emit
or edx, 0xffffffff
call fcn.14000b770
mov rcx, qword [rbx + 0x10]
or r8d, 0xffffffff
lea edx, [r8 - 1]
call fcn.14000c6a0
mov rcx, qword [rbx + 0x10]
lea rdx, str.Ready
call fcn.14000e150
mov rcx, qword [rbx + 0x10]
mov edx, r12d
call fcn.14000aa00
test eax, eax
je 0x1400056ee
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401d5458]
call fcn.140045514
mov rcx, qword [rbx + 0x10]
call fcn.14000ee94
cmp dword [rbx + 0x58], r15d
jne 0x14000580e
call fcn.14005c968
mov r9, qword [rbx]
mov rcx, rax
mov rax, qword [rbx + 0x28]
xor r8d, r8d
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.14005c9a8
mov r8, rbx
mov qword [rbx + 0x10], rax
mov rcx, rax
call fcn.140002490
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140004d70]
mov r8, rbx
call fcn.140045490
test edi, edi
jle 0x14000580e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.1400686a4
mov rdx, r13
mov rcx, r14
mov rsi, rax
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
mov r9, rsi
mov r8d, eax
mov dword [rsp + 0x20], edi
mov rdx, r14
call fcn.1400700e0
mov rcx, qword [rbx + 0x10]
lea r8d, [rdi - 4]
lea rdx, [rsi + 4]
call fcn.14005d034
test eax, eax
jne 0x1400057bf
mov rcx, qword [rbx + 0x10]
call fcn.14005d074
test eax, eax
je 0x1400057c8
mov rcx, qword [rbx + 0x10]
call fcn.14000ee94
mov rcx, rsi
call fcn.1401630c0
mov rdx, r13
lea rcx, str.noUpdateCoreModule
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea rdx, str.noUpdateCoreModule
xor r9d, r9d
mov dword [rsp + 0x20], r15d
mov r8d, eax
call fcn.1400700e0
test eax, eax
je 0x14000580e
lea rcx, str._CoreModule:_Update_Disabled_n
mov dword [rbx + 0x58], r12d
call fcn.140001090
mov rcx, qword [rbx]
lea rdx, [0x140004d7c]
mov r8, rbx
call fcn.140066a70
mov rcx, rbx
call fcn.1400046f8
mov rdx, r13
lea rcx, str.MeshServer
call fcn.140163e74
mov rcx, qword [rbx + 0x40]
lea r9, [0x140203120]
mov r8d, eax
mov dword [rsp + 0x20], 0x1000
lea rdx, str.MeshServer
call fcn.1400700e0
cmp eax, 5
jle 0x140005945
mov eax, dword [0x140203120]
cmp eax, dword [str.local]
jne 0x140005945
mov al, byte [0x140203124]
cmp al, byte [0x1401d5a68]
jne 0x140005945
xor eax, eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x50], eax
call fcn.14006d8fc
mov esi, 0x425d
test eax, eax
je 0x1400058d4
mov edi, reloc.WS2_32.dll_socket
mov ecx, esi
mov word [rbp + 0x38], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x40]
mov ecx, edi
lea rdx, str.FF02:0:0:0:0:0:0:FE
mov word [rbp + 0x3a], ax
call fcn.14006db50
mov edi, 2
mov ecx, esi
mov word [rbp + 0x28], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x2c]
mov ecx, edi
lea rdx, str.239.255.255.235
mov word [rbp + 0x2a], ax
call fcn.14006db50
mov rcx, qword [rbx]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.14006723c
mov qword [rbx + 0x710], rax
test rax, rax
jne 0x140005945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0xdb
lea rdx, str...meshcore_agentcore.c
mov r8d, 0xae5
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.14006ddcc
mov eax, r12d
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.14015bde0
mov rbx, qword [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1b0]
mov rdi, qword [rbp + 0x1b8]
lea rsp, [rbp + 0x170]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret