Function at 0x49b5a6
Capabilities:
Persist via application shimming
Set registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x940]
sub esp, 0x940
push 0xfffffffffffffffe
push 0x6c62b0
push 0x5b6980
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6ccd44]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x93c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x948]
mov dword [ebp - 0x38], edi
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x24], eax
mov ecx, edi
shl ecx, 2
lea esi, [ecx + 4]
push 0xfffffffffffffffb
pop eax
sub eax, ecx
je 0x49b622
cmp esi, 0xffffffef
jae 0x49b622
lea eax, [edi*4 + 0x14]
push eax
call fcn.005eae30
pop ecx
xor ebx, ebx
jmp 0x49b626
xor ebx, ebx
mov eax, ebx
push ebx
push ebx
mov edx, esi
mov ecx, eax
call fcn.004811d1
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0x34], esi
test edi, edi
jle 0x49b6b7
mov esi, dword [ebp - 0x24]
sub eax, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edi
mov edi, eax
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jae 0x49b682
or ecx, 0xffffffff
sub ecx, eax
je 0x49b682
cmp eax, 0xffffffef
jae 0x49b682
add eax, 0x10
push eax
call fcn.005eae30
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
jmp 0x49b684
mov ecx, ebx
push ebx
push ebx
mov edx, eax
call fcn.004811d1
pop ecx
pop ecx
mov dword [edi + esi], eax
push ebx
push ebx
push dword [ebp - 0x24]
push eax
push 0xffffffffffffffff
push dword [esi]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esi, 4
sub dword [ebp - 0x2c], 1
jne 0x49b649
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x49baa2
push str._finstall
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push str._funinstall
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push 0x725f28
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push 0x725f38
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push str._install
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push str._uninstall
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49b745
push str._state
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49b777
mov eax, dword [esi + 4]
mov dword [esi + edi*4], eax
push ebx
push ebx
push 0x14
call fcn.005eae30
pop ecx
push 4
pop edx
mov ecx, eax
call fcn.004811d1
mov dword [esi + 4], eax
push 0x725f68
push dword [eax - 0x10]
push eax
call fcn.0040117f
add esp, 0x14
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 1
jle 0x49baa2
push str._licenses
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49baa2
push 0x725f78
call fcn.00401109
mov dword [esp], str._MeshCentral_MeshAgent:_Copyright_2006___2020_Intel_Corporation_n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_Ylianst_MeshAgent__n
call fcn.00401109
mov dword [esp], 0x7260d8
call fcn.00401109
mov dword [esp], str.___Licensed_under_the_Apache_License__Version_2.0__the__License____n
call fcn.00401109
mov dword [esp], str.___you_may_not_use_this_file_except_in_compliance_with_the_License._n
call fcn.00401109
mov dword [esp], str.___You_may_obtain_a_copy_of_the_License_at_n
call fcn.00401109
mov dword [esp], 0x726238
call fcn.00401109
mov dword [esp], str.___http:__www.apache.org_licenses_LICENSE_2.0_n
call fcn.00401109
mov dword [esp], 0x726240
call fcn.00401109
mov dword [esp], str.___Unless_required_by_applicable_law_or_agreed_to_in_writing__software_n
call fcn.00401109
mov dword [esp], str.___distributed_under_the_License_is_distributed_on_an__AS_IS__BASIS__n
call fcn.00401109
mov dword [esp], str.___WITHOUT_WARRANTIES_OR_CONDITIONS_OF_ANY_KIND__either_express_or_implied._n
call fcn.00401109
mov dword [esp], str.___See_the_License_for_the_specific_language_governing_permissions_and_n
call fcn.00401109
mov dword [esp], str.___limitations_under_the_License._n_n
call fcn.00401109
mov dword [esp], 0x726370
call fcn.00401109
mov dword [esp], str._Duktape_Javascript_Engine:_Copyright__c__2013_2019_by_Duktape_authors__see_AUTHORS.rst__n
call fcn.00401109
mov dword [esp], str.________________________https:__github.com_svaarala_duktape__n
call fcn.00401109
mov dword [esp], str.________________________http:__opensource.org_licenses_MIT__n
call fcn.00401109
mov dword [esp], 0x726520
call fcn.00401109
mov dword [esp], str.___Permission_is_hereby_granted__free_of_charge__to_any_person_obtaining_a_copy_n
call fcn.00401109
mov dword [esp], str.___of_this_software_and_associated_documentation_files_the__Software____to_deal_n
call fcn.00401109
mov dword [esp], str.___in_the_Software_without_restriction__including_without_limitation_the_rights_n
call fcn.00401109
mov dword [esp], str.___to_use__copy__modify__merge__publish__distribute__sublicense__and___or_sell_n
call fcn.00401109
mov dword [esp], str.___copies_of_the_Software__and_to_permit_persons_to_whom_the_Software_is_n
call fcn.00401109
mov dword [esp], str.___furnished_to_do_so__subject_to_the_following_conditions_:_n
call fcn.00401109
mov dword [esp], 0x7267ec
call fcn.00401109
mov dword [esp], str.___The_above_copyright_notice_and_this_permission_notice_shall_be_included_in_n
call fcn.00401109
mov dword [esp], str.___all_copies_or_substantial_portions_of_the_Software._n
call fcn.00401109
mov dword [esp], str.____n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE_IS_PROVIDED__AS_IS___WITHOUT_WARRANTY_OF_ANY_KIND__EXPRESS_OR_n
call fcn.00401109
mov dword [esp], str.___IMPLIED__INCLUDING_BUT_NOT_LIMITED_TO_THE_WARRANTIES_OF_MERCHANTABILITY__n
call fcn.00401109
mov dword [esp], str.___FITNESS_FOR_A_PARTICULAR_PURPOSE_AND_NONINFRINGEMENT.IN_NO_EVENT_SHALL_THE_n
call fcn.00401109
mov dword [esp], str.___AUTHORS_OR_COPYRIGHT_HOLDERS_BE_LIABLE_FOR_ANY_CLAIM__DAMAGES_OR_OTHER_n
call fcn.00401109
mov dword [esp], str.___LIABILITY__WHETHER_IN_AN_ACTION_OF_CONTRACT__TORT_OR_OTHERWISE__ARISING_FROM__n
call fcn.00401109
mov dword [esp], str.___OUT_OF_OR_IN_CONNECTION_WITH_THE_SOFTWARE_OR_THE_USE_OR_OTHER_DEALINGS_IN_n
call fcn.00401109
mov dword [esp], str.___THE_SOFTWARE._n
call fcn.00401109
mov dword [esp], str._n
call fcn.00401109
mov dword [esp], str.ZLIB_Data_Compression_Library:_Copyright__c__1995_2017_Jean_loup_Gailly_and_Mark_Adler_n
call fcn.00401109
mov dword [esp], str._______________________________http:__www.zlib.net__n
call fcn.00401109
mov dword [esp], str._________________________________________________________________________________________n
call fcn.00401109
mov dword [esp], str.___This_software_is_provided_as_is__without_any_express_or_implied_n
call fcn.00401109
mov dword [esp], str.___warranty.In_no_event_will_the_authors_be_held_liable_for_any_damages_n
call fcn.00401109
mov dword [esp], str.___arising_from_the_use_of_this_software._n
call fcn.00401109
mov dword [esp], 0x7263cc
call fcn.00401109
mov dword [esp], str.___Permission_is_granted_to_anyone_to_use_this_software_for_any_purpose__n
call fcn.00401109
mov dword [esp], str.___including_commercial_applications__and_to_alter_it_and_redistribute_it_n
call fcn.00401109
mov dword [esp], str.___freely__subject_to_the_following_restrictions_:_n
call fcn.00401109
mov dword [esp], 0x72657c
call fcn.00401109
mov dword [esp], str.___1._The_origin_of_this_software_must_not_be_misrepresented__you_must_not_n
call fcn.00401109
mov dword [esp], str.______claim_that_you_wrote_the_original_software.If_you_use_this_software_n
call fcn.00401109
mov dword [esp], str.______in_a_product__an_acknowledgment_in_the_product_documentation_would_be_n
call fcn.00401109
mov dword [esp], str.______appreciated_but_is_not_required._n
call fcn.00401109
mov dword [esp], str.___2._Altered_source_versions_must_be_plainly_marked_as_such__and_must_not_be_n
call fcn.00401109
mov dword [esp], str.______misrepresented_as_being_the_original_software._n
call fcn.00401109
mov dword [esp], str.___3._This_notice_may_not_be_removed_or_altered_from_any_source_distribution._n
call fcn.00401109
mov dword [esp], 0x7265fc
call fcn.00401109
mov dword [esp], str.___Jean___loup_Gailly________Mark_Adler_n
call fcn.00401109
mov dword [esp], str.___jloup_gzip.org____________madler_alumni.caltech.edu_n
call fcn.00401109
pop ecx
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49ba63
mov ecx, esi
call fcn.00481286
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x93c]
xor ecx, ebp
call fcn.005b35b0
lea esp, [ebp + 0x940]
pop ebp
ret
mov ecx, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
cmp edi, 1
jle 0x49bb58
push str._info
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bb58
push str.Aug_30_2021
push str.13:53:51
push str.Compiled_on:__s___s_n
call fcn.00401109
push str.f4b1a7daa7bad99bda1eb62d0756d80792327a44
push str.___Commit_Hash:__s_n
call fcn.00401109
push 0x726adc
push str.___Commit_Date:__s_n
call fcn.00401109
push ebx
call fcn.004b7e00
push eax
push str.Using__s_n
call fcn.00401109
push 3
push str.Agent_ARCHID:__d_n
call fcn.00401109
add esp, 0x30
push 0x18
pop ecx
mov esi, str.console.log_Detected_OS:___require_os_.Name_______require_os_.arch____process.exit___
lea edi, [ebp + 0x8d8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x60
pop edx
lea ecx, [ebp + 0x8d8]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0x60
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
cmp edi, 2
jle 0x49bc48
push str._faddr
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bbcc
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push 0x726d44
mov eax, dword [esi + 8]
add eax, 2
push eax
call fcn.0040baf9
push ebx
push dword [ebp - 0x24]
call fcn.004827f0
push 0x72f000
push 0x726d94
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49bbb4
jmp 0x49ba76
cmp edi, 2
jle 0x49bc48
push str._fdelta
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bc48
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
push eax
push str._lld
push dword [esi + 8]
call fcn.0040baf9
mov ecx, 0x4819a3
xor eax, eax
sub ecx, dword [ebp - 0x28]
sbb eax, dword [ebp - 0x24]
push eax
push ecx
call fcn.004827f0
push 0x72f000
push 0x726dec
call fcn.00401109
add esp, 0x1c
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49bc30
jmp 0x49ba76
cmp dword [ebp - 0x30], 0
je 0x49bc55
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49bcaa
push 0x104
lea eax, [ebp + 0x734]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push 0x208
lea eax, [ebp + 0x324]
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0x734]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp + 0x324]
call fcn.00473b22
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x49bd9c
mov edx, str._exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x49bceb
cmp byte [ebp - 0x19], 0
je 0x49bce7
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x49bceb
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x49bcbb
mov ecx, ebx
jmp 0x49bcf0
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x49bd22
test eax, eax
jne 0x49bd22
xor edx, edx
mov ecx, dword [esi + 8]
call fcn.00487fca
mov ecx, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
test ecx, ecx
jne 0x49bd12
mov eax, ebx
jmp 0x49bd1f
push 0x1000
push ecx
call fcn.005ea5b0
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp edi, 2
jle 0x49bd9c
mov edx, str._b64exec
mov ecx, dword [esi + 4]
mov al, byte [ecx]
mov byte [ebp - 0x19], al
cmp al, byte [edx]
mov eax, dword [ebp - 0x20]
jne 0x49bd5f
cmp byte [ebp - 0x19], 0
je 0x49bd5b
mov al, byte [ecx + 1]
mov byte [ebp - 0x19], al
cmp al, byte [edx + 1]
mov eax, dword [ebp - 0x20]
jne 0x49bd5f
add ecx, 2
add edx, 2
cmp byte [ebp - 0x19], 0
jne 0x49bd2f
mov ecx, ebx
jmp 0x49bd64
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x49bd9c
test eax, eax
jne 0x49bd9c
cmp dword [esi + 8], eax
jne 0x49bd75
mov eax, ebx
jmp 0x49bd84
push 0x10000
push dword [esi + 8]
call fcn.005ea5b0
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
push ecx
mov edx, eax
mov ecx, dword [esi + 8]
call fcn.00486768
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
cmp edi, 1
jle 0x49be75
push str._nodeid
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bde4
push 0xd
pop ecx
mov esi, str.console.log_require__agentNodeId_____process.exit___
lea edi, [ebp + 0x904]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x36
pop esi
mov dword [ebp - 0x20], esi
mov edx, esi
lea ecx, [ebp + 0x904]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x49be75
push str._name
mov eax, dword [ebp - 0x34]
push dword [eax + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49be2f
push 0x10
pop ecx
mov esi, str.console.log_require__agentNodeId_.serviceName____process.exit___
lea edi, [ebp + 0x8f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x42
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x8f8]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x49be75
push str.state
mov esi, dword [ebp - 0x34]
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49be78
push 0x2b
pop ecx
mov esi, str.tryconsole.log_require_service_manager_.manager.getService_require__agentNodeId_.serviceName___.status.state__catch_z_console.log_NOT_INSTALLED___process.exit___
lea edi, [ebp + 0x890]
rep movsd dword es:[edi], dword [esi]
mov eax, 0xab
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x890]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
cmp edi, 1
jle 0x49bf2d
push str.start
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49bea7
push str._start
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bed4
push 0x30
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.start___console.log_Service_Started__catch_z_console.log_Failed_to_start_service__process.exit___
lea edi, [ebp + 0x878]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0xc1
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x878]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x49bf2d
push str.stop
mov esi, dword [ebp - 0x34]
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49bf02
push str._stop
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bf30
push 0x44
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.stop__.then_function_m_console.log_Service_Stopped__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_stop_service__process.exit___
lea edi, [ebp + 0x82c]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x10f
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x82c]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
cmp edi, 1
jle 0x49bfd6
push str.restart
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49bf5f
push str._restart
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bf8a
push 0x46
pop ecx
mov esi, str.tryrequire_service_manager_.manager.getService_require__agentNodeId_.serviceName___.restart__.then_function_m_console.log_Service_Restarted__process.exit_____function_m_console.log_m__process.exit_____catch_z_console.log_Failed_to_restart_service__process.exit___
lea edi, [ebp + 0x824]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x117
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x824]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
cmp edi, 1
jle 0x49bfd6
push str._agentHash
mov esi, dword [ebp - 0x34]
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49bfd9
cmp dword [ebp - 0x20], eax
jne 0x49bfd9
push 0x18
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex_.substring_0_16___process.exit___
lea edi, [ebp + 0x8d8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x60
pop edx
lea ecx, [ebp + 0x8d8]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x60
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
cmp edi, 1
jle 0x49c020
push str._agentFullHash
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c020
cmp dword [ebp - 0x20], eax
jne 0x49c020
push 0x14
pop ecx
mov esi, str.console.log_getSHA384FileHash_process.execPath_.toString_hex___process.exit___
lea edi, [ebp + 0x8e8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x50
pop eax
mov dword [ebp - 0x20], eax
mov edx, eax
lea ecx, [ebp + 0x8e8]
call fcn.00487fca
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x38]
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, dword [ebp - 0x34]
cmp edi, 1
jle 0x49c2b8
push str._updaterversion
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c088
push ebx
lea eax, [ebp - 0x24]
push eax
push 2
push 0x7271e4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49c070
jmp 0x49ba76
cmp edi, 1
jle 0x49c2b8
push str._kvm0
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c19d
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.004814a9
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov dword [eax], 0x49b55b
mov dword [eax + 8], ebx
cmp edi, 2
jle 0x49c0df
push 0x72747c
push dword [esi + 8]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c0df
xor ecx, ecx
inc ecx
jmp 0x49c0e1
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x49c0ff
push 0x7274dc
push dword [esi + 8]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49c117
cmp edi, 3
jle 0x49c121
push 0x7274ec
push dword [esi + 0xc]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c121
mov dword [0x72a190], 1
push 0x800
push ebx
push 0x7274fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x49c159
push 0x727508
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x49c15d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49c16a
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49c170
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x24]
call fcn.0040d2e6
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49c185
jmp 0x49ba76
cmp edi, 1
jle 0x49c2b8
push str._kvm1
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c2b8
push ebx
push ebx
xor edx, edx
push 0x10
pop ecx
call fcn.004814a9
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov dword [eax], 0x49b55b
mov dword [eax + 8], 1
cmp edi, 2
jle 0x49c1f8
push str._coredump
push dword [esi + 8]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c1f8
xor ecx, ecx
inc ecx
jmp 0x49c1fa
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], ecx
cmp edi, 2
jle 0x49c218
push 0x727534
push dword [esi + 8]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49c230
cmp edi, 3
jle 0x49c23a
push str._remotecursor
push dword [esi + 0xc]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c23a
mov dword [0x72a190], 1
push 0x800
push ebx
push 0x727554
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x49c272
push 0x727560
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x49c276
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49c283
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49c289
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push dword [ebp - 0x24]
call fcn.0040d2e6
mov edi, ebx
test dword [esi - 0x10], 0xfffffffc
jbe 0x49cb12
mov ecx, dword [esi + edi*4]
call fcn.00481286
inc edi
mov eax, dword [esi - 0x10]
shr eax, 2
cmp edi, eax
jl 0x49c2a0
jmp 0x49cb12
cmp dword [ebp - 0x30], 0
jne 0x49ca3d
test edi, edi
jle 0x49c2dc
push 0x727578
push dword [esi]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49ca3d
cmp edi, 1
jle 0x49c5df
push 0x727580
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49ca3d
push 0x727584
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49ca3d
push str.__slave
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49ca3d
cmp edi, 1
jle 0x49c5df
mov ecx, dword [esi + 4]
mov edx, str._update:
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x49c4ef
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x49c4ef
push ebx
push ebx
xor edx, edx
mov ecx, 0x400
call fcn.004814a9
pop ecx
pop ecx
mov edx, eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [esi + 4]
cmp byte [ecx + 8], 0x2a
jne 0x49c3ac
cmp edi, 2
jle 0x49c379
mov eax, dword [esi + 8]
jmp 0x49c37e
mov eax, str.null
push eax
mov eax, str.true
mov dword [ebp - 0x24], str.false
cmp byte [ecx + 9], 0x53
cmovne eax, dword [ebp - 0x24]
push eax
push str.require_agent_installer_.update__s___s__
push 0x400
push edx
call fcn.0040117f
add esp, 0x14
jmp 0x49c462
cmp edi, 2
jle 0x49c44f
mov ecx, 0x7275fc
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x2c]
jne 0x49c3ed
cmp byte [ebp - 0x19], 0
je 0x49c3e9
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x2c]
jne 0x49c3ed
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x49c3bd
mov eax, ebx
jmp 0x49c3f2
sbb eax, eax
or eax, 1
test eax, eax
je 0x49c437
mov ecx, 0x727600
mov eax, dword [esi + 8]
mov dl, byte [eax]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx]
mov edx, dword [ebp - 0x2c]
jne 0x49c42e
cmp byte [ebp - 0x19], 0
je 0x49c42a
mov dl, byte [eax + 1]
mov byte [ebp - 0x19], dl
cmp dl, byte [ecx + 1]
mov edx, dword [ebp - 0x2c]
jne 0x49c42e
add eax, 2
add ecx, 2
cmp byte [ebp - 0x19], 0
jne 0x49c3fe
mov eax, ebx
jmp 0x49c433
sbb eax, eax
or eax, 1
test eax, eax
jne 0x49c44f
push dword [esi + 8]
push str.require_agent_installer_.update_false____s___
push 0x400
push edx
call fcn.0040117f
add esp, 0x10
jmp 0x49c462
push str.require_agent_installer_.update_true__
push 0x400
push edx
call fcn.0040117f
add esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
xor ecx, ecx
call fcn.004073f4
mov dword [0x72a344], eax
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x14], ecx
push esi
mov edx, edi
call fcn.0040a806
pop ecx
mov eax, dword [0x72a344]
mov edi, dword [eax + 0xb30]
mov dword [ebp - 0x44], edi
call fcn.0040ae8f
mov dword [0x72a344], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x49cb10
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49c4ba
jmp 0x49cb10
cmp edi, 1
jle 0x49c5df
push str._netinfo
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c528
lea ecx, [ebp - 0x24]
call fcn.0040ee00
test eax, eax
jle 0x49ca12
push dword [ebp - 0x24]
call fcn.0049b1b9
jmp 0x49c9a4
cmp edi, 1
jle 0x49c5df
push str._setfirewall
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c58b
mov edi, 0x104
push edi
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0049b1e3
test eax, eax
jne 0x49c56b
push 0x727684
jmp 0x49c99f
lea ecx, [ebp + 0x52c]
call fcn.0049af7e
lea ecx, [ebp + 0x52c]
call fcn.0049aba6
push 0x7276a0
jmp 0x49c99f
cmp edi, 1
jle 0x49c5df
push str._clearfirewall
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c5df
mov edi, 0x104
push edi
lea eax, [ebp + 0x52c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0049b1e3
test eax, eax
jne 0x49c5ca
push str.Must_run_as_administrator
jmp 0x49c99f
lea ecx, [ebp + 0x52c]
call fcn.0049af7e
push str.Done
jmp 0x49c99f
cmp edi, 2
jne 0x49c687
push str._resetnodeid
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49c687
lea eax, [ebp - 0x24]
push eax
push 0x20206
push ebx
push str.SoftwareOpen_SourceMeshAgent2
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49c655
mov dword [ebp - 0x40], 1
push 4
lea eax, [ebp - 0x40]
push eax
push 4
push ebx
push str.ResetNodeId
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x49c64a
push str.NodeID_will_be_reset_next_time_the_Mesh_Agent_service_is_started.
call fcn.00401109
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49c660
push str.Error_writing_to_registry__try_running_as_administrator.
call fcn.00401109
pop ecx
mov edi, ebx
test dword [esi - 0x10], 0xfffffffc
jbe 0x49cb12
mov ecx, dword [esi + edi*4]
call fcn.00481286
inc edi
mov eax, dword [esi - 0x10]
shr eax, 2
cmp edi, eax
jl 0x49c66f
jmp 0x49cb12
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], str.Mesh_Agent_background_service
mov dword [ebp - 0x50], 0x49b361
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [0x72adac], edi
mov dword [0x72ada8], esi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x49ca12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x427
jne 0x49ca12
cmp edi, 2
jl 0x49c8b9
push 1
push 3
push 0x727798
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.00487cbf
add esp, 0xc
test eax, eax
jne 0x49c70c
push 1
push 4
push str..zip
or edx, 0xffffffff
mov ecx, dword [esi + 4]
call fcn.00487cbf
add esp, 0xc
test eax, eax
je 0x49c76d
push 1
push 0x49b581
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.004073f4
mov dword [0x72a344], eax
mov dword [eax + 0xb58], 1
push esi
mov edx, edi
call fcn.0040a806
pop ecx
call fcn.0040ae8f
mov dword [0x72a344], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x49ca12
cmp edi, 2
jne 0x49c8b9
mov ecx, 0x7277a4
mov eax, dword [esi + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x49c79e
test dl, dl
je 0x49c79a
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x49c79e
add eax, 2
add ecx, 2
test dl, dl
jne 0x49c77e
mov eax, ebx
jmp 0x49c7a3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x49c85f
mov edi, 0x104
push edi
lea eax, [ebp + 0x324]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp + 0x838]
push eax
or edx, 0xffffffff
lea ecx, [ebp + 0x324]
call fcn.00480bd7
pop ecx
pop ecx
xor ecx, ecx
call fcn.0048185f
mov edi, eax
mov ecx, edi
call fcn.00483e99
push edi
push ebx
push ebx
lea eax, [ebp + 0x838]
push eax
push ebx
push ebx
push edi
push ebx
call fcn.00475d69
xor edx, edx
mov ecx, eax
call fcn.00476205
add esp, 0x20
mov dword [ebp - 0x24], eax
push 0xe88
push ecx
mov edx, str.require_util_language_.current.toUpperCase__.split___.join____
mov ecx, eax
call fcn.004172fe
pop ecx
pop ecx
test eax, eax
jne 0x49c83b
push ebx
or edx, 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.00419a31
push eax
push str.Current_Language:__s_n
call fcn.00401109
add esp, 0xc
mov ecx, dword [ebp - 0x24]
call fcn.00458f36
mov dword [edi], 2
mov ecx, edi
call fcn.00481a5b
mov ecx, edi
call fcn.00483f2a
xor eax, eax
inc eax
mov edi, eax
mov dword [ebp - 0x24], eax
cmp edi, 2
jne 0x49c8b9
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49c86a
sub ecx, edx
cmp ecx, 6
jbe 0x49c8b9
push 6
push str._lang
push dword [esi + 4]
call fcn.005e3050
add esp, 0xc
test eax, eax
jne 0x49c8b9
mov ecx, dword [esi + 4]
mov edx, ecx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x49c896
sub edx, edi
push 1
push 0x7277b4
call fcn.00487d81
pop ecx
pop ecx
inc eax
add eax, dword [esi + 4]
mov dword [0x72a350], eax
xor edi, edi
inc edi
cmp edi, 1
je 0x49c9a7
push str.Mesh_Agent_available_switches:_r_n
call fcn.00401109
mov dword [esp], str.__run_______________Start_as_a_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__connect___________Start_as_a_temporary_console_agent._r_n
call fcn.00401109
mov dword [esp], str.__start_____________Start_the_service._r_n
call fcn.00401109
mov dword [esp], str.__restart___________Restart_the_service._r_n
call fcn.00401109
mov dword [esp], str.__stop______________Stop_the_service._r_n
call fcn.00401109
mov dword [esp], str.__state_____________Display_the_running_state_of_the_service._r_n
call fcn.00401109
mov dword [esp], str.___signcheck________Perform_self___check._r_n
call fcn.00401109
mov dword [esp], str.___install__________Install_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___uninstall________Remove_the_service_from_this_location._r_n
call fcn.00401109
mov dword [esp], str.___nodeid_t_t_tReturn_the_current_agent_identifier._r_n
call fcn.00401109
mov dword [esp], str.___resetnodeid______Reset_the_NodeID_next_time_the_service_is_started._r_n
call fcn.00401109
mov dword [esp], str.___fulluninstall____Stop_agent_and_clean_up_the_program_files_location._r_n
call fcn.00401109
mov dword [esp], str.___fullinstall______Copy_agent_into_program_files__install_and_launch._r_n
call fcn.00401109
mov dword [esp], 0x727a94
call fcn.00401109
mov dword [esp], str.____________________The_following_switches_can_be_specified_after__fullinstall:_r_n
call fcn.00401109
mov dword [esp], 0x727ae4
call fcn.00401109
mov dword [esp], str._______WebProxy_http:__proxyhost:port_______Specify_an_HTTPS_proxy._r_n
call fcn.00401109
mov dword [esp], str._______agentName_alternate_name_____________Specify_an_alternate_name_to_be_provided_by_the_agent._r_n
call fcn.00401109
pop ecx
jmp 0x49ca12
cmp dword [ebp - 0x24], 0
jne 0x49ca12
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x800
push ebx
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
mov eax, ebx
test edi, edi
je 0x49c9eb
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x49c9ef
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, ebx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x49c9fc
push 2
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49ca02
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push ebx
push 0x49cc23
push ebx
push 0x67
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call dword [sym.imp.ole32.dll_CoUninitialize]
test dword [esi - 0x10], 0xfffffffc
jbe 0x49ba76
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49ca25
jmp 0x49ba76
push 1
push 0x49b581
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 4], ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ecx
cmp edi, 1
jle 0x49ca73
push 0x727594
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
mov ecx, ebx
push 0x20
pop edx
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x3c], ecx
call fcn.004073f4
mov ecx, eax
mov dword [0x72a344], ecx
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0x14], eax
test edx, edx
jne 0x49cac1
cmp edi, 1
jle 0x49cacb
push 0x72759c
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
je 0x49cabb
push 0x7275a0
push dword [esi + 4]
call fcn.00608d30
pop ecx
pop ecx
test eax, eax
jne 0x49cacb
mov ecx, dword [0x72a344]
mov dword [ecx + 0xb58], 1
push esi
mov edx, edi
call fcn.0040a806
pop ecx
mov eax, dword [0x72a344]
mov edi, dword [eax + 0xb30]
mov dword [ebp - 0x44], edi
call fcn.0040ae8f
mov dword [0x72a344], ebx
mov dword [ebp - 4], 0xfffffffe
test dword [esi - 0x10], 0xfffffffc
jbe 0x49cb10
mov ecx, dword [esi + ebx*4]
call fcn.00481286
inc ebx
mov eax, dword [esi - 0x10]
shr eax, 2
cmp ebx, eax
jl 0x49cafd
mov ebx, edi
mov ecx, esi
call fcn.00481286
mov eax, ebx
jmp 0x49ba7f