Function at 0x140007e84
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x1b8], rbx
mov rax, qword [0x1402b1ed0]
xor rax, rbp
mov qword [rbp + 0x160], rax
xor edi, edi
mov r13d, edx
mov dword [rbp + 0x18], r9d
mov r15, r8
mov qword [rbp + 0x28], r8
mov rsi, rcx
mov dword [rbp + 0x20], r13d
mov ebx, edi
mov dword [rbp + 0x1c], edi
lea r12d, [rdi + 1]
movsxd r14, edx
test edx, edx
jle 0x140007f2b
mov rcx, qword [r15 + rbx*8]
lea rdx, str._recovery
call fcn.1401d0500
test eax, eax
jne 0x140007ef9
or dword [rsi + 0x90], 0x40
mov dword [rbp + 0x18], edi
mov rcx, qword [r15 + rbx*8]
lea rdx, str._nocertstore
call fcn.1401d0500
test eax, eax
jne 0x140007f23
lea rcx, str._Not_using_Certificate_Store__n
mov dword [rbp + 0x18], edi
call fcn.140001090
mov dword [rsi + 0xa64], r12d
add rbx, r12
cmp rbx, r14
jl 0x140007edb
mov ebx, edi
test r13d, r13d
jle 0x140007fc7
mov r14, r15
mov rdx, qword [r14]
lea rcx, str._finstall
call fcn.1401d0500
test eax, eax
je 0x140007fb9
mov rdx, qword [r14]
lea rcx, str._funinstall
call fcn.1401d0500
test eax, eax
je 0x140007fb9
mov rdx, qword [r14]
lea rcx, str._fullinstall
call fcn.1401d0500
test eax, eax
je 0x140007fb9
mov rdx, qword [r14]
lea rcx, str._fulluninstall
call fcn.1401d0500
test eax, eax
je 0x140007fb9
mov rdx, qword [r14]
lea rcx, str._install
call fcn.1401d0500
test eax, eax
je 0x140007fb9
mov rdx, qword [r14]
lea rcx, str._uninstall
call fcn.1401d0500
test eax, eax
je 0x140007fb9
add ebx, r12d
add r14, 8
cmp ebx, r13d
jl 0x140007f39
jmp 0x140007fc7
xor r8d, r8d
xor ecx, ecx
call fcn.140098e60
mov qword [rsi + 0x48], rax
cmp qword [rsi + 0x48], rdi
jne 0x140007fef
mov rcx, qword [rsi + 0x38]
lea rdx, [0x140249eb4]
xor r8d, r8d
call fcn.14000312c
mov rcx, rax
xor r8d, r8d
call fcn.140098e60
mov qword [rsi + 0x48], rax
mov eax, edi
mov ecx, edi
mov dword [rbp + 0x10], eax
mov r15d, edi
mov dword [rbp], ecx
mov r12d, edi
test r13d, r13d
jle 0x140008231
mov rbx, qword [rbp + 0x28]
mov qword [rbp + 0x50], r13
mov r13d, 1
cmp qword [rbx], rdi
jne 0x140008020
mov r14d, edi
jmp 0x140008030
mov rcx, qword [rbx]
mov edx, 0x1000
call fcn.1401c3c94
mov r14, rax
mov rdx, qword [rbx]
lea rcx, str._state
call fcn.1401d0500
mov rdx, qword [rbx]
lea rcx, str._finstall
test eax, eax
cmove r12d, r13d
call fcn.1401d0500
test eax, eax
je 0x14000806b
mov rdx, qword [rbx]
lea rcx, str._fullinstall
call fcn.1401d0500
test eax, eax
jne 0x14000806e
mov r15d, r13d
mov rdx, qword [rbx]
lea rcx, str._install
call fcn.1401d0500
test eax, eax
jne 0x1400080aa
mov rcx, qword [rsi + 0x48]
lea r9, [0x140249328]
mov qword [rsp + 0x28], rdi
lea r8d, [rax + 0xd]
lea rdx, str._localService
mov qword [rsp + 0x20], r13
lea r15d, [rax + 5]
call fcn.140098170
mov rdx, qword [rbx]
lea rcx, str._funinstall
call fcn.1401d0500
test eax, eax
je 0x1400080d0
mov rdx, qword [rbx]
lea rcx, str._fulluninstall
call fcn.1401d0500
test eax, eax
jne 0x1400080fb
mov rcx, qword [rsi + 0x48]
lea r9, [0x140249328]
mov r15d, 2
mov qword [rsp + 0x28], rdi
lea rdx, str._deleteData
mov qword [rsp + 0x20], r13
lea r8d, [r15 + 9]
call fcn.140098170
mov rdx, qword [rbx]
lea rcx, str._uninstall
call fcn.1401d0500
mov rcx, qword [rbx]
lea r8, [0x140249d14]
test eax, eax
movsxd rdx, r14d
mov eax, 2
mov r9, r13
cmove r15d, eax
call fcn.1400954ac
movsxd r13, eax
mov edx, 2
cmp r13d, edx
jle 0x140008213
mov rcx, qword [rbx]
mov r8d, edx
lea rdx, [0x140249edc]
call fcn.1401c3870
test eax, eax
jne 0x140008213
cmp r13d, 0xa
jne 0x1400081bd
mov rcx, qword [rbx]
lea r8d, [rax + 8]
add rcx, 2
lea rdx, str.readonly
call fcn.1401c3870
test eax, eax
jne 0x1400081bd
mov rcx, qword [rbx]
lea r8d, [r13 - 9]
add rcx, 0xb
lea rdx, [0x140249328]
call fcn.1401c3870
test eax, eax
jne 0x1400081bd
mov dword [rbp], 1
cmp qword [rsi + 0x48], rdi
je 0x1400081c3
mov rcx, qword [rsi + 0x38]
lea rdx, [0x140249eb4]
xor r8d, r8d
call fcn.14000312c
mov rcx, qword [rsi + 0x48]
mov rdx, rax
call fcn.140098f04
cmp qword [rsi + 0x48], rdi
jne 0x1400081d1
xor r8d, r8d
xor ecx, ecx
call fcn.140098e60
mov qword [rsi + 0x48], rax
mov rdx, qword [rbx]
lea eax, [r13 - 2]
sub r14d, r13d
mov qword [rsp + 0x28], rdi
dec r14d
movsxd r8, eax
movsxd rcx, r14d
lea r9, [rdx + 1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi + 0x48]
add r9, r13
add rdx, 2
call fcn.140098170
mov eax, dword [rbp + 0x10]
mov r13d, 1
add eax, r13d
mov dword [rbp + 0x10], eax
jmp 0x14000821c
mov eax, dword [rbp + 0x10]
mov r13d, 1
add rbx, 8
sub qword [rbp + 0x50], r13
jne 0x140008016
mov ecx, dword [rbp]
mov r13d, dword [rbp + 0x20]
sub r13d, eax
mov dword [rbp + 0x20], r13d
test r12d, r12d
je 0x14000829d
mov rbx, qword [rsi]
call fcn.1400811e0
mov rdx, qword [rsi + 0x38]
mov rcx, rax
mov qword [rsp + 0x48], rbx
lea rax, [0x140007dcc]
mov qword [rsp + 0x40], rax
mov r9, rbx
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400812ac
mov r9d, 0xe08
lea rdx, str.require__agentStatus_.start___
mov rcx, rax
call fcn.14001908c
mov eax, 1
jmp 0x140009af5
or r12, 0xffffffffffffffff
test r15d, r15d
je 0x140008414
mov rbx, qword [rsi]
call fcn.1400811e0
mov qword [rsp + 0x48], rbx
mov rcx, rax
lea rax, [0x140007dcc]
mov r9, rbx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov rax, qword [rsi + 0x38]
xor edx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400812ac
mov ebx, 0xe08
lea rdx, str.require_user_sessions_.isRoot___
mov r9d, ebx
mov rcx, rax
mov r14, rax
call fcn.14001908c
mov edx, r12d
mov rcx, r14
call fcn.14001a374
cmp dword [rax], 4
jne 0x14000831a
mov eax, dword [rax + 8]
jmp 0x14000831c
mov eax, edi
test eax, eax
je 0x140009b1e
sub r15d, 1
je 0x14000835e
sub r15d, 1
je 0x140008343
cmp r15d, 3
je 0x14000835e
mov rcx, r14
call fcn.14005fd48
jmp 0x14000842e
mov r9d, ebx
lea rdx, str.require_agent_installer__
mov rcx, r14
call fcn.14001908c
lea r8, str.fullUninstall
jmp 0x140008377
mov r9d, ebx
lea rdx, str.require_agent_installer__
mov rcx, r14
call fcn.14001908c
lea r8, str.fullInstall
mov edx, r12d
mov rcx, r14
call fcn.1400197c4
mov edx, 0xfffffffe
mov rcx, r14
call fcn.14001a764
mov rbx, qword [rsi + 0x48]
mov rcx, r14
call fcn.14001c7a0
mov r8, r14
lea rdx, [0x140086ef0]
mov rcx, rbx
call fcn.140098504
mov edx, r12d
mov rcx, r14
call fcn.140018fe0
mov edx, 1
mov rcx, r14
call fcn.1400185a4
test eax, eax
je 0x140008407
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.14001b62c
lea rdx, str.Process.exit___forced_script_termination
mov rcx, rax
call fcn.1401d0500
test eax, eax
je 0x140008407
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.14001b62c
mov rdx, rax
lea rcx, [0x140249fc4]
call fcn.140001090
mov rcx, r14
call fcn.14001d0d4
jmp 0x140008293
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140009a45
cmp qword [rax], rdi
jne 0x14000842e
test ecx, ecx
je 0x140009a45
mov rdx, qword [rsi]
call fcn.14009cbcc
mov qword [rsi + 0x40], rax
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140008458
lea rcx, [0x140007e00]
mov qword [rax + 0x1060], rsi
mov qword [rax + 0x1058], rcx
lea rax, [rbp + 0x10]
mov dword [rbp], edi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x14024a020]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400084e5
mov rcx, qword [rbp + 0x10]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetNodeId
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400084db
cmp dword [rbp], edi
jbe 0x1400084db
mov rcx, qword [rbp + 0x10]
lea rdx, str.ResetNodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1400084db
lea rcx, str.NodeID_will_reset__because_ResetNodeID_key_was_found_in_registry
call fcn.14009631c
mov dword [rbp + 0x1c], 1
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400811e0
mov r9, qword [rsi]
mov rcx, rax
mov rax, qword [rsi + 0x38]
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400812ac
mov r9d, 0xf88
mov qword [rbp + 0x10], rax
lea rdx, str.require_linux_pathfix____
mov rcx, rax
mov r15, rax
call fcn.14001908c
lea r13, str.meshServiceName
mov qword [rsi + 0xb9c], rdi
mov rcx, r13
mov dword [rsi + 0xba4], edi
mov edx, 0x400
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, r13
call fcn.1400994e4
movsxd r14, eax
mov r12d, 0xffffffff
mov eax, 0xffffffe7
test r14d, r14d
je 0x1400085e9
lea ecx, [r14 + 1]
movsxd rbx, ecx
cmp rbx, r12
jae 0x1400085a4
cmp r12, rbx
je 0x1400085a4
cmp rbx, rax
jae 0x1400085a4
lea rcx, [rbx + 0x18]
call fcn.1401c4328
jmp 0x1400085a7
mov rax, rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14008de4c
mov edx, 0x400
mov qword [rsi + 0xbb8], rax
mov rcx, r13
call fcn.1401c3c94
mov r9, qword [rsi + 0xbb8]
mov r8, rax
mov rcx, qword [rsi + 0x48]
mov rdx, r13
mov qword [rsp + 0x20], r14
call fcn.1400994e4
jmp 0x1400085f7
lea rax, str.Mesh_Agent
mov qword [rsi + 0xbb8], rax
lea r13, str.displayName
mov edx, 0x400
mov rcx, r13
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, r13
call fcn.1400994e4
movsxd r14, eax
test eax, eax
je 0x140008694
lea ecx, [r14 + 1]
movsxd rbx, ecx
cmp rbx, r12
jae 0x14000864f
cmp r12, rbx
je 0x14000864f
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x14000864f
lea rcx, [rbx + 0x18]
call fcn.1401c4328
jmp 0x140008652
mov rax, rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14008de4c
mov edx, 0x400
mov qword [rsi + 0xbc0], rax
mov rcx, r13
call fcn.1401c3c94
mov r9, qword [rsi + 0xbc0]
mov r8, rax
mov rcx, qword [rsi + 0x48]
mov rdx, r13
mov qword [rsp + 0x20], r14
call fcn.1400994e4
jmp 0x1400086a2
lea rax, str.MeshCentral
mov qword [rsi + 0xbc0], rax
mov r8, qword [rsi + 0xbb8]
lea rdx, str.require_service_manager_.manager.getService__s_.isMe___
mov rcx, r15
call fcn.14001c6d4
or edx, 0xffffffff
mov rcx, r15
call fcn.14001a374
mov rcx, rdi
cmp dword [rax], 8
jne 0x1400086cf
mov rcx, qword [rax + 8]
lea rax, [rcx + 0x20]
mov r14d, 0xe88
neg rcx
lea rdx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_procd:_return_7___case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
mov r9d, r14d
mov rcx, r15
sbb rbx, rbx
and rbx, rax
call fcn.14001908c
test eax, eax
jne 0x14000870c
xor r9d, r9d
or edx, 0xffffffff
mov rcx, r15
call fcn.14001a234
mov dword [rsi + 0xb9c], eax
mov r9d, r14d
mov rdx, rbx
mov rcx, r15
call fcn.14001908c
test eax, eax
jne 0x14000873b
or edx, 0xffffffff
mov rcx, r15
call fcn.14001a374
cmp dword [rax], 4
jne 0x140008733
mov eax, dword [rax + 8]
jmp 0x140008735
mov eax, edi
mov dword [rsi + 0xba0], eax
mov r9d, r14d
lea rdx, str.require_user_sessions_.isRoot___
mov rcx, r15
call fcn.14001908c
test eax, eax
jne 0x14000876e
or edx, 0xffffffff
mov rcx, r15
call fcn.14001a374
cmp dword [rax], 4
jne 0x140008766
mov eax, dword [rax + 8]
jmp 0x140008768
mov eax, edi
mov dword [rsi + 0xba4], eax
mov r9d, r14d
lea rdx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov rcx, r15
call fcn.14001908c
test eax, eax
jne 0x140008949
lea r8, [rbp]
or edx, 0xffffffff
mov rcx, r15
call fcn.14001ab00
mov r14, qword [rbp]
mov r12, rax
mov qword [rbp + 0x50], rax
cmp r14, 0x13
jb 0x140008943
lea rbx, str.LocalMacAddresses
mov edx, 0x400
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call fcn.1400994e4
movsxd r13, eax
test eax, eax
jne 0x1400087e6
mov rdx, rbx
jmp 0x140008924
mov ebx, edi
test r14d, r14d
jle 0x140008943
movsxd rcx, ebx
lea rdx, str._00:00:00:00:00:00_
add rcx, r12
mov r8d, reloc.WS2_32.dll_send
call fcn.1401c3870
test eax, eax
jne 0x140008815
add ebx, 0x13
cmp ebx, r14d
jl 0x1400087f1
cmp ebx, r14d
jge 0x140008943
lea eax, [r13 + 1]
mov ebx, edi
movsxd rdx, eax
mov eax, 0xffffffc7
cmp rdx, rax
jae 0x14000885e
lea rax, [rdx + 0x38]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140008848
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401bc6a0
sub rsp, rcx
lea rcx, [rsp + 0x50]
jmp 0x140008861
mov rcx, rdi
mov r9d, 1
lea r8d, [r9 + 7]
call fcn.14008de4c
mov edx, 0x400
mov qword [rbp], rax
lea rcx, [rax + 8]
mov qword [rax], rcx
lea rcx, str.LocalMacAddresses
call fcn.1401c3c94
mov r9, qword [rbp]
lea rdx, str.LocalMacAddresses
mov rcx, qword [rsi + 0x48]
mov r8, rax
mov qword [rsp + 0x20], r13
call fcn.1400994e4
test r13d, r13d
jle 0x140008903
mov r15, qword [rbp]
movsxd r12, ebx
lea rdx, str._00:00:00:00:00:00_
add r12, r15
mov r8d, reloc.WS2_32.dll_send
mov rcx, r12
call fcn.1401c3870
test eax, eax
je 0x1400088ee
mov r8, r12
movsxd rdx, r14d
mov r12, qword [rbp + 0x50]
mov r9d, reloc.WS2_32.dll_send
mov rcx, r12
call fcn.1400954ac
test eax, eax
jns 0x1400088fa
jmp 0x1400088f2
mov r12, qword [rbp + 0x50]
add ebx, 0x13
cmp ebx, r13d
jl 0x1400088b1
mov r15, qword [rbp + 0x10]
cmp ebx, r13d
jl 0x140008943
mov r8, qword [rbp]
lea rcx, str.NodeID_will_reset__MAC_Address_Mismatch:__s_____s
mov rdx, r12
call fcn.14009631c
lea rdx, str.LocalMacAddresses
mov dword [rbp + 0x1c], 1
mov rcx, qword [rsi + 0x48]
mov r9, r12
movsxd rax, r14d
mov r8d, reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140098ff0
mov r12d, 0xffffffff
mov rcx, r15
call fcn.14005fd48
cmp dword [rbp + 0x1c], 1
je 0x140008963
mov rcx, rsi
call fcn.140003734
test eax, eax
je 0x14000897b
mov rcx, rsi
call fcn.14000339c
test eax, eax
je 0x14000897b
lea rcx, str.Certificate_error_r_n
call fcn.140001090
mov rcx, rsi
call fcn.140003b30
test eax, eax
je 0x140008993
lea rcx, str.Certificate_validation_error_r_n
call fcn.140001090
mov rcx, qword [rsi + 0x38]
lea rdx, str..tag
xor r8d, r8d
mov qword [rbp + 0x50], rdi
call fcn.14000312c
mov rcx, rax
lea rdx, [rbp + 0x50]
mov r8d, 0x1000
call fcn.14008c0e0
mov rbx, qword [rbp + 0x50]
lea r15, [0x140248bc4]
mov rcx, qword [rsi + 0x48]
mov r8d, 3
mov rdx, r15
test rbx, rbx
je 0x1400089f7
cdqe
mov r9, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140098ff0
mov rcx, rbx
call fcn.1401c3c8c
jmp 0x1400089fc
call fcn.140099b44
mov rcx, qword [rsi + 0x48]
lea r9, [rbp + 0x60]
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x20], 0xff
lea rdx, str.ignoreProxyFile
call fcn.1400994e4
test eax, eax
jne 0x140008a92
mov rcx, qword [rsi + 0x38]
lea rdx, str..proxy
xor r8d, r8d
mov qword [rbp + 0x50], rdi
call fcn.14000312c
mov r14d, 0x400
lea rdx, [rbp + 0x50]
mov r8d, r14d
mov rcx, rax
call fcn.14008c0e0
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x140008a98
mov rcx, qword [rsi + 0x48]
mov r8d, 8
lea rdx, str.WebProxy
test eax, eax
jle 0x140008a83
cdqe
mov r9, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140098ff0
jmp 0x140008a88
call fcn.140099b44
mov rcx, rbx
call fcn.1401c3c8c
jmp 0x140008a98
mov r14d, 0x400
mov rcx, qword [rsi + 0x38]
lea rdx, str..mshx
xor r8d, r8d
call fcn.14000312c
mov rdx, rax
mov rcx, rsi
call fcn.140007684
test eax, eax
jne 0x140008b2a
mov rcx, qword [rsi + 0x38]
lea rdx, str..msh
xor r8d, r8d
call fcn.14000312c
mov rdx, rax
mov rcx, rsi
call fcn.140007684
test eax, eax
jne 0x140008b2a
lea rdx, str.mesh_linumshx
mov rcx, rsi
call fcn.140007684
test eax, eax
jne 0x140008b2a
lea rdx, str.mesh_limshx
mov rcx, rsi
call fcn.140007684
test eax, eax
jne 0x140008b2a
xor edx, edx
mov rcx, rsi
call fcn.140007478
mov rcx, qword [rsi + 0x38]
lea rdx, str..msh
xor r8d, r8d
call fcn.14000312c
mov rdx, rax
mov rcx, rsi
call fcn.140007684
lea rbx, str.AgentCapabilities
mov dword [rbp], edi
mov rcx, rbx
mov rdx, r14
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call fcn.1400994e4
cmp eax, 4
jne 0x140008b91
mov rdx, r14
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [rbp]
mov r8, rax
mov qword [rsp + 0x20], 4
mov rdx, rbx
call fcn.1400994e4
mov ecx, dword [rbp]
call qword [sym.imp.WS2_32.dll_ntohl]
or dword [rsi + 0x90], eax
mov r9, qword [rsi + 0xbb8]
lea r8, str.SoftwareOpen_Source_s
xor edx, edx
xor ecx, ecx
call fcn.140001138
movsxd rbx, eax
mov r13d, 0xffffffe7
lea rcx, [rbx + 1]
cmp rcx, r12
jae 0x140008bd7
mov eax, 0xfffffffe
cmp rax, rbx
je 0x140008bd7
cmp rcx, r13
jae 0x140008bd7
lea rcx, [rbx + 0x19]
call fcn.1401c4328
mov rcx, rax
jmp 0x140008bda
mov rcx, rdi
lea eax, [rbx + 1]
xor r9d, r9d
movsxd rdx, eax
xor r8d, r8d
call fcn.14008de4c
mov r9, qword [rsi + 0xbb8]
lea r8, str.SoftwareOpen_Source_s
mov rcx, rax
mov qword [rbp + 0x50], rax
mov r14, rax
mov rdx, qword [rax - 0x18]
call fcn.140001138
or r9d, 0xffffffff
mov dword [rsp + 0x28], edi
mov r8, r14
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc eax
movsxd r14, eax
lea rax, [r14 + r14]
cmp rax, r12
jae 0x140008c50
cmp r12, rax
je 0x140008c50
cmp rax, r13
jae 0x140008c50
lea rcx, [r14*2 + 0x18]
call fcn.1401c4328
jmp 0x140008c53
mov rax, rdi
mov rdx, r14
xor r9d, r9d
add rdx, rdx
xor r8d, r8d
mov rcx, rax
call fcn.14008de4c
mov r13, rax
mov eax, 0x7fffffff
cmp r14, rax
jae 0x14000919c
cmp rbx, rax
ja 0x14000919c
mov rcx, qword [rbp + 0x50]
lea r9d, [r14 + 1]
mov r8, r13
mov edx, ebx
call fcn.14008d8c0
mov eax, dword [rsi + 0xbc8]
lea r8, [rbp + 8]
neg eax
mov rdx, r13
sbb rcx, rcx
add rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000919c
test byte [rsi + 0x90], 0x40
lea r12, [rsi + 0xb38]
lea r14d, [rax + 0x30]
mov qword [rbp], rdi
mov rcx, r12
lea r8, [rbp]
mov edx, r14d
jne 0x14000907c
call fcn.140093b80
movsxd rdx, eax
test eax, eax
jle 0x140008d4b
mov rbx, qword [rbp]
test rbx, rbx
je 0x140008d4b
mov rcx, rdx
test eax, eax
jle 0x140008d1a
mov rax, rbx
cmp byte [rax], 0x2b
jne 0x140008d09
mov byte [rax], 0x40
jmp 0x140008d11
cmp byte [rax], 0x2f
jne 0x140008d11
mov byte [rax], 0x24
inc rax
sub rcx, 1
jne 0x140008cff
mov rcx, qword [rbp + 8]
mov r9d, 1
mov dword [rsp + 0x28], edx
xor r8d, r8d
lea rdx, str.NodeId
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.1401c3c8c
mov qword [rbp], rdi
jmp 0x140008d5c
mov rcx, qword [rbp + 8]
lea rdx, str.NodeId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rcx, [rsi + 0xa04]
mov rdx, r14
lea r8, [0x1402b9800]
call fcn.14008bef0
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], dil
jne 0x140008d76
mov rcx, qword [rbp + 8]
lea rdx, str.AgentHash
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.MeshID
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.MeshID
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
lea rbx, [0x1402ba800]
test eax, eax
je 0x140008e7e
mov edx, 0x400
lea rcx, str.MeshID
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.MeshID
mov r9, rbx
mov qword [rsp + 0x20], 0x10000
mov r8, rax
call fcn.1400994e4
test eax, eax
jle 0x140008e7e
lea r8, [rbp]
mov edx, eax
mov rcx, rbx
call fcn.140093b80
test eax, eax
jle 0x140008e7e
mov rbx, qword [rbp]
test rbx, rbx
je 0x140008e7e
movsxd rdx, eax
test eax, eax
jle 0x140008e51
mov rcx, rbx
cmp byte [rcx], 0x2b
jne 0x140008e40
mov byte [rcx], 0x40
jmp 0x140008e48
cmp byte [rcx], 0x2f
jne 0x140008e48
mov byte [rcx], 0x24
inc rcx
sub rdx, 1
jne 0x140008e36
mov rcx, qword [rbp + 8]
lea rdx, str.MeshId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.1401c3c8c
jmp 0x140008e8f
mov rcx, qword [rbp + 8]
lea rdx, str.MeshId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, 0x400
lea rcx, str.MeshServer
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rbx, [0x1402ba800]
mov r9, rbx
mov qword [rsp + 0x20], 0x10000
mov r8, rax
lea rdx, str.MeshServer
call fcn.1400994e4
test eax, eax
jne 0x140008ee2
mov rcx, qword [rbp + 8]
lea rdx, str.MeshServerUrl
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, 1
jmp 0x140008f14
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], dil
jne 0x140008ee6
mov rcx, qword [rbp + 8]
lea rdx, str.MeshServerUrl
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov ebx, 1
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.ServerID
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [0x1402ba800]
mov r8, rax
mov qword [rsp + 0x20], 0x10000
lea rdx, str.ServerID
call fcn.1400994e4
test eax, eax
jne 0x140008f5f
mov rcx, qword [rbp + 8]
lea rdx, str.MeshServerId
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140008f93
or rax, 0xffffffffffffffff
lea rcx, [0x1402ba800]
inc rax
cmp byte [rcx + rax], dil
jne 0x140008f6a
mov dword [rsp + 0x28], eax
lea rdx, str.MeshServerId
mov qword [rsp + 0x20], rcx
mov r9d, ebx
mov rcx, qword [rbp + 8]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
lea rcx, str.WebProxy
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [0x1402ba800]
mov r8, rax
mov qword [rsp + 0x20], 0x10000
lea rdx, str.WebProxy
call fcn.1400994e4
test eax, eax
jne 0x140008fde
mov rcx, qword [rbp + 8]
lea rdx, str.Proxy
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140009012
or rax, 0xffffffffffffffff
lea rcx, [0x1402ba800]
inc rax
cmp byte [rcx + rax], dil
jne 0x140008fe9
mov dword [rsp + 0x28], eax
lea rdx, str.Proxy
mov qword [rsp + 0x20], rcx
mov r9d, ebx
mov rcx, qword [rbp + 8]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x400
mov rcx, r15
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [0x1402ba800]
mov r8, rax
mov qword [rsp + 0x20], 0x10000
mov rdx, r15
call fcn.1400994e4
test eax, eax
jne 0x14000904a
mov rdx, r15
jmp 0x1400090e7
or rax, 0xffffffffffffffff
lea rcx, [0x1402ba800]
inc rax
cmp byte [rcx + rax], dil
jne 0x140009055
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 8]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1400090f1
call fcn.140093b80
test eax, eax
jle 0x1400090e0
mov rbx, qword [rbp]
test rbx, rbx
je 0x1400090e0
movsxd rdx, eax
test eax, eax
jle 0x1400090b3
mov rcx, rbx
cmp byte [rcx], 0x2b
jne 0x1400090a2
mov byte [rcx], 0x40
jmp 0x1400090aa
cmp byte [rcx], 0x2f
jne 0x1400090aa
mov byte [rcx], 0x24
inc rcx
sub rdx, 1
jne 0x140009098
mov rcx, qword [rbp + 8]
lea rdx, str.DiagnosticAgentNodeId
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.1401c3c8c
jmp 0x1400090f1
lea rdx, str.DiagnosticAgentNodeId
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r15d, 0x400
lea rcx, str.SelfNodeCert
mov edx, r15d
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.SelfNodeCert
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
test eax, eax
jne 0x140009190
lea rbx, str.NodeID
mov edx, r15d
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [0x1402b9800]
mov r8, rax
mov qword [rsp + 0x20], 0x1000
mov rdx, rbx
call fcn.1400994e4
cmp eax, r14d
jne 0x140009171
mov r8, r14
lea rdx, [0x1402b9800]
mov rcx, r12
call fcn.1401bd7b0
test eax, eax
je 0x140009190
mov rcx, qword [rsi + 0x48]
mov r9, r12
mov qword [rsp + 0x28], rdi
mov r8d, 6
mov rdx, rbx
mov qword [rsp + 0x20], r14
call fcn.140098ff0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400091a2
mov r15d, 0x400
mov rcx, qword [rbp + 0x50]
call fcn.14008df34
mov rcx, r13
call fcn.14008df34
mov rcx, qword [rsi + 0x40]
lea rdx, [rsi + 0xa88]
cmp qword [rdx], rdi
jne 0x1400091ca
xor r8d, r8d
xor edx, edx
jmp 0x1400091d1
mov r8, qword [rsi + 0xa70]
call fcn.14009da08
mov r12d, 1
cmp dword [rbp + 0x18], edi
je 0x140009226
mov eax, dword [rbp + 0x20]
cmp eax, r12d
je 0x140009226
lea ecx, [r12 + 1]
cmp eax, ecx
jne 0x140009af3
mov rbx, qword [rbp + 0x28]
lea rdx, [0x14024a4b8]
mov rcx, qword [rbx + 8]
call fcn.1401d0500
test eax, eax
je 0x140009226
mov rcx, qword [rbx + 8]
lea rdx, str.connect
call fcn.1401d0500
test eax, eax
jne 0x140009af3
mov rcx, qword [rsi + 0x38]
lea rdx, str..update.exe
xor r8d, r8d
call fcn.14000312c
mov rcx, rax
call fcn.14008c204
mov rcx, qword [rsi + 0x38]
lea rdx, str..corereset
xor r8d, r8d
call fcn.14000312c
lea r14, [0x1402b6800]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r14
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov rcx, r14
call fcn.1401ce898
lea r14, str.CoreModule
test eax, eax
jne 0x1400092b6
mov rdx, r15
mov rcx, r14
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
mov r8, rax
mov rdx, r14
call fcn.140099b44
mov rcx, rbx
call fcn.14008c204
cmp dword [rsi + 0x84], edi
jne 0x1400092e5
mov rdx, r15
mov rcx, r14
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, r14
call fcn.1400994e4
mov r13d, eax
jmp 0x1400092e8
mov r13d, edi
mov rdx, r15
lea rcx, str.webSocketMaskOverride
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.webSocketMaskOverride
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
lea rbx, str.jsDebugPort
mov dword [rsi + 0x9f8], eax
mov rcx, rbx
mov rdx, r15
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call fcn.1400994e4
test eax, eax
je 0x1400093a9
mov rdx, r15
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r9, [rbp + 0x50]
mov r8, rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, rbx
call fcn.1400994e4
lea ecx, [rax - 1]
cmp ecx, 0xe
ja 0x1400093a9
cdqe
cmp rax, 0x10
jae 0x140009b32
lea rcx, [rbp + 0x50]
mov byte [rbp + rax + 0x50], dil
call fcn.14008dfec
cmp rax, 0x7fffffff
ja 0x1400093a1
lea rcx, [rbp + 0x50]
call fcn.14008e01c
jmp 0x1400093a3
mov eax, edi
mov dword [rsi + 0x9fc], eax
mov rdx, r15
mov dword [rsi + 0x88], r12d
lea rcx, str.showModuleNames
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.showModuleNames
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
mov rcx, qword [rsi + 0x10]
mov r15d, 0xfffffffe
mov dword [0x1402b54e8], eax
test rcx, rcx
je 0x140009454
mov rdx, qword [rsi]
call fcn.1400029c0
mov rcx, qword [rsi + 0x10]
lea r8, str.emit
or edx, 0xffffffff
call fcn.1400197c4
mov rcx, qword [rsi + 0x10]
mov edx, r15d
call fcn.14001a764
mov rcx, qword [rsi + 0x10]
lea rdx, str.Ready
call fcn.14001c290
mov rcx, qword [rsi + 0x10]
mov edx, r12d
call fcn.1400185a4
test eax, eax
je 0x14000944b
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000944b
lea rdx, [0x140248248]
call fcn.14005fad8
mov rcx, qword [rsi + 0x10]
call fcn.14001d0d4
cmp dword [rsi + 0x84], edi
jne 0x14000973f
call fcn.1400811e0
mov r9, qword [rsi]
mov rcx, rax
mov rax, qword [rsi + 0x30]
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.1400812ac
mov r8, rsi
mov qword [rsi + 0x10], rax
mov rcx, rax
call fcn.1400030b0
mov rcx, qword [rsi + 0x10]
lea rdx, [0x140007b98]
mov r8, rsi
call fcn.14005f990
mov ebx, 0x400
lea rcx, str.coreDumpEnabled
mov edx, ebx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.coreDumpEnabled
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
mov dword [rsi + 0xa00], eax
test eax, eax
je 0x14000950f
mov rcx, qword [rsi + 0x10]
lea rdx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
mov r9d, 0xf08
call fcn.14001908c
cmp r13d, 4
jle 0x14000973f
mov rdx, rbx
lea rcx, str.noUpdateCoreModule
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.noUpdateCoreModule
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
test eax, eax
je 0x1400095e9
lea rcx, str._CoreModule:_Update_Disabled_n
mov dword [rsi + 0x84], r12d
call fcn.140001090
movsxd rbx, r13d
xor r9d, r9d
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call fcn.14008e120
mov edx, 0x400
lea rcx, str.CoreModule
mov r14, rax
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.CoreModule
mov r9, r14
mov qword [rsp + 0x20], rbx
mov r8, rax
call fcn.1400994e4
mov rcx, qword [rsi + 0x10]
lea r8d, [r13 - 4]
lea rdx, [r14 + 4]
mov dword [rsp + 0x20], reloc.WS2_32.dll_listen
lea r9, str.CoreModule.js
call fcn.140081a0c
test eax, eax
jne 0x1400095d3
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.140018500
test eax, eax
je 0x1400095dc
mov rcx, qword [rsi + 0x10]
call fcn.14001d0d4
mov rcx, r14
call fcn.1401c3c8c
jmp 0x14000973f
mov rbx, qword [rsi + 0x10]
mov rcx, rbx
mov qword [rbp + 0x50], rsi
call fcn.14001c4c0
lea r8, str.setTimeout
or edx, 0xffffffff
mov rcx, rbx
call fcn.1400197c4
mov edx, r15d
mov rcx, rbx
call fcn.14001a764
mov r9d, 0x18075380
mov dword [rsp + 0x20], 6
or r8d, 0xffffffff
lea rdx, [0x140060164]
mov rcx, rbx
call fcn.14001c9b8
mov edx, 0xea60
mov rcx, rbx
call fcn.14001c100
lea rdx, [0x140007c80]
mov rcx, rbx
call fcn.14001c3a4
mov rcx, rbx
call fcn.14001c7a0
mov r14, rdi
cmp qword [rbp + r14*8 + 0x50], rdi
je 0x1400096bd
lea r8, str.push
or edx, 0xffffffff
mov rcx, rbx
call fcn.1400197c4
mov edx, r15d
mov rcx, rbx
call fcn.14001a7a0
mov rdx, qword [rbp + r14*8 + 0x50]
mov rcx, rbx
call fcn.14001c3a4
mov edx, r12d
mov rcx, rbx
call fcn.1400185a4
test eax, eax
je 0x1400096ad
lea rdx, str.ILibDuktape_Timeout___Array.push__:
mov rcx, rbx
call fcn.14005fad8
mov rcx, rbx
call fcn.14001d0d4
add r14, r12
cmp r14, r12
jl 0x14000965e
mov edx, 4
mov rcx, rbx
call fcn.1400185a4
mov rcx, rbx
test eax, eax
je 0x1400096ea
lea rdx, str.ILibDuktape_Timeout___timeout__:
call fcn.14005fad8
mov rcx, rbx
call fcn.14001d0d4
mov rax, rdi
jmp 0x1400096fb
or edx, 0xffffffff
call fcn.14001a374
test byte [rax], 8
je 0x1400096e5
mov rax, qword [rax + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsi + 0x9f0], rax
call fcn.14001c544
mov rdx, qword [rsi + 0x9f0]
mov rcx, qword [rsi + 0x10]
call fcn.14001ce60
mov rcx, qword [rsi + 0x9f0]
call fcn.14005f0ec
mov rcx, qword [rsi + 0x10]
mov r8, rax
mov edx, r15d
call fcn.140019978
mov rcx, qword [rsi + 0x10]
call fcn.14001d0d4
mov r13d, 0x400
lea rbx, str.exitPID
mov edx, r13d
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call fcn.1400994e4
lea r14, str...meshcore_agentcore.c
test eax, eax
jle 0x1400097f5
mov edx, r13d
mov rcx, rbx
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea r15, [0x1402b9800]
mov r9, r15
mov qword [rsp + 0x20], 0x1000
mov r8, rax
mov rdx, rbx
call fcn.1400994e4
mov rcx, r15
call fcn.14008e01c
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400097fc
mov edx, 0x130f
mov rcx, r14
call fcn.1400900e4
mov rcx, qword [rsi]
lea r9, [0x140007de8]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140090a8c
jmp 0x1400097fc
lea r15, [0x1402b9800]
mov rdx, r13
lea rcx, str.hideConsole
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.hideConsole
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rax
call fcn.1400994e4
test eax, eax
jle 0x140009845
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140009845
mov r9d, 0xf88
lea rdx, str.require_win_console_.hide__
call fcn.14001908c
mov rcx, qword [rsi]
lea rdx, [0x140007ba4]
mov r8, rsi
call fcn.14008cb88
mov rcx, rsi
call fcn.1400070cc
mov rdx, r13
lea rcx, str.MeshServer
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.MeshServer
mov ebx, 0x1000
mov r9, r15
mov r8, rax
mov qword [rsp + 0x20], rbx
call fcn.1400994e4
cmp eax, 5
jle 0x140009a06
mov eax, dword [0x1402b9800]
cmp eax, dword [str.local]
jne 0x140009a06
mov al, byte [0x1402b9804]
cmp al, byte [0x1402497c8]
jne 0x140009a06
mov rdx, r13
lea rcx, str.DiscoveryKey
call fcn.1401c3c94
mov rcx, qword [rsi + 0x48]
lea rdx, str.DiscoveryKey
mov r9, r15
mov qword [rsp + 0x20], rbx
mov r8, rax
call fcn.1400994e4
mov ebx, eax
cmp eax, r12d
jle 0x140009942
lea rcx, [rbp + 0x60]
call fcn.1400b2b40
lea eax, [rbx - 1]
mov rdx, r15
movsxd r8, eax
lea rcx, [rbp + 0x60]
call fcn.1400b2bd0
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.1400b2b20
mov ecx, 0x20
call fcn.1401c4328
mov qword [rsi + 0xb80], rax
test rax, rax
je 0x140009b38
movups xmm0, xmmword [0x1402b9800]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402b9810]
movups xmmword [rax + 0x10], xmm1
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], eax
call fcn.140095bc4
mov r15d, 0x425d
test eax, eax
je 0x140009992
mov ebx, reloc.WS2_32.dll_socket
mov ecx, r15d
mov word [rbp + 0x30], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x38]
mov ecx, ebx
lea rdx, str.FF02:0:0:0:0:0:0:FE
mov word [rbp + 0x32], ax
call fcn.140095e18
mov ebx, 2
mov ecx, r15d
mov word [rbp + 0x50], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp + 0x54]
mov ecx, ebx
lea rdx, str.239.255.255.235
mov word [rbp + 0x52], ax
call fcn.140095e18
mov rcx, qword [rsi]
lea rax, [rbp + 0x30]
mov r8d, 0x425e
mov qword [rsp + 0x30], rsi
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14008d414
mov qword [rsi + 0xb70], rax
test rax, rax
jne 0x140009a0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x1342
mov r9d, 0xdb
mov dword [rsp + 0x20], eax
mov rdx, r14
xor ecx, ecx
call fcn.1400961f4
mov eax, r12d
jmp 0x140009af5
mov rcx, qword [rsi]
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rsi
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14008d414
mov qword [rsi + 0xb78], rax
test rax, rax
jne 0x140009a06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x1346
jmp 0x1400099f2
mov ecx, gethostname
call fcn.1401c4328
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea edx, [r9 + 0x20]
call fcn.14008de4c
mov rbx, rax
movsxd rcx, r13d
mov qword [rax + 8], rcx
movsxd rcx, dword [rbp + 0x18]
mov qword [rax], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x140009a90
call fcn.140098f8c
mov qword [rsi + 0x48], rdi
mov edx, dword [rsi + 0xb98]
cmp edx, 0xa
je 0x140009ae7
inc edx
lea rcx, str.Unable_to_open_database___d_10_..._r_n
call fcn.140001090
mov rax, qword [rsi]
inc dword [rsi + 0xb98]
test rax, rax
je 0x140009abe
mov rdi, qword [rax + 0x910]
lea rax, [0x1400061c4]
mov r8d, 0x7d0
lea r9, [0x140007c38]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call fcn.140093e8c
jmp 0x140008293
lea rcx, str.Unable_to_open_database._r_n
call fcn.140001090
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rbp
call fcn.1401bc130
mov rbx, qword [rbp + 0x1b8]
lea rsp, [rbp + 0x170]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.___Administrator_permissions_needed..._n
call fcn.140001090
xor ecx, ecx
call fcn.1401be828
int3
call fcn.1401bc25c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xfe
mov ebx, 0x132a
mov r9d, edi
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov rdx, r14
xor ecx, ecx
call fcn.1400961f4
mov r8d, ebx
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
mov rdx, r14
call fcn.140001090
mov ecx, edi
call fcn.1401be828
int3