Function at 0x405d4b
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x6b0d44]
xor eax, ebp
mov dword [ebp + 0xdc], eax
and dword [ebp - 0x7c], 0
mov eax, dword [ebp + 0xe8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x68], eax
mov ebx, ecx
mov dword [ebp - 0x78], edi
xor esi, esi
mov dword [ebp - 0x6c], ebx
test edi, edi
jle 0x405e2a
mov ecx, dword [ebp + 0xec]
mov dword [ebp - 0x74], ecx
jmp 0x405d98
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + esi*4]
mov ecx, str._recovery
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405dc0
test dl, dl
je 0x405dbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405dc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x405da0
xor eax, eax
jmp 0x405dc7
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x405dd2
or dword [ebx + 0x48], 0x40
and dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x68]
mov ecx, str._nocertstore
mov eax, dword [eax + esi*4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405dfd
test dl, dl
je 0x405df9
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405dfd
add eax, 2
add ecx, 2
test dl, dl
jne 0x405ddd
xor eax, eax
jmp 0x405e04
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x405e1f
and dword [ebp - 0x74], eax
push str._Not_using_Certificate_Store__n
call fcn.004010b4
xor eax, eax
inc eax
pop ecx
mov dword [ebx + 0xa18], eax
inc esi
cmp esi, edi
jl 0x405d95
jmp 0x405e33
mov eax, dword [ebp + 0xec]
mov dword [ebp - 0x74], eax
cmp dword [ebx + 0x24], 0
jne 0x405e53
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6b3d14
push 0
call fcn.00402962
mov ecx, eax
call fcn.00473ca4
pop ecx
mov dword [ebx + 0x24], eax
xor eax, eax
xor esi, esi
xor edi, edi
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x78], eax
jle 0x405fb2
mov eax, dword [ebp - 0x68]
cmp dword [eax + edi*4], 0
jne 0x405e72
xor eax, eax
jmp 0x405e81
push 0x1000
push dword [eax + edi*4]
call fcn.005d06e0
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov edx, eax
inc ecx
mov eax, dword [ebp - 0x68]
push ecx
push 0x6b3d18
mov ecx, dword [eax + edi*4]
call fcn.00470a09
pop ecx
pop ecx
push 2
pop ecx
mov dword [ebp - 0x60], eax
cmp eax, ecx
jle 0x405eee
mov eax, dword [ebp - 0x68]
push ecx
push 0x6b3d1c
push dword [eax + edi*4]
call fcn.005c9c50
add esp, 0xc
test eax, eax
jne 0x405eee
cmp dword [ebx + 0x24], eax
je 0x405eeb
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x60]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x58]
sub eax, ecx
dec eax
push eax
lea eax, [ecx + 1]
add eax, edx
add edx, 2
push eax
lea eax, [ecx - 2]
mov ecx, dword [ebx + 0x24]
push eax
call fcn.004732b2
add esp, 0xc
inc dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + edi*4]
mov edx, ecx
mov eax, 0x6b3d20
mov bl, byte [eax]
mov byte [ebp - 0x51], bl
cmp bl, byte [edx]
jne 0x405f21
test bl, bl
je 0x405f1d
mov bl, byte [eax + 1]
mov byte [ebp - 0x51], bl
cmp bl, byte [edx + 1]
jne 0x405f21
add eax, 2
add edx, 2
test bl, bl
jne 0x405efb
xor eax, eax
jmp 0x405f28
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
test eax, eax
mov edx, ecx
push 1
pop eax
cmove esi, eax
mov eax, 0x6b3d2c
mov bl, byte [eax]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x6c]
jne 0x405f67
cmp byte [ebp - 0x51], 0
je 0x405f63
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x6c]
jne 0x405f67
add eax, 2
add edx, 2
cmp byte [ebp - 0x51], 0
jne 0x405f37
xor eax, eax
jmp 0x405f6e
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
test eax, eax
je 0x405fa2
mov eax, 0x6b3d38
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405f97
test dl, dl
je 0x405f93
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405f97
add eax, 2
add ecx, 2
test dl, dl
jne 0x405f77
xor eax, eax
jmp 0x405f9e
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
jne 0x405fa5
push 2
pop esi
inc edi
cmp edi, dword [ebp - 0x78]
jl 0x405e65
mov eax, dword [ebp - 0x64]
mov edi, dword [ebp - 0x78]
sub edi, eax
mov dword [ebp - 0x78], edi
test esi, esi
je 0x40634a
push dword [ebx]
push 0x405d36
push 0
push dword [ebx + 0x1c]
push 0
push 0
push dword [ebx]
push 0
call fcn.00461883
xor edx, edx
mov ecx, eax
call fcn.0046195b
add esp, 0x20
mov edi, eax
mov edx, str.require_user_sessions_.isRoot___
push 0xe08
push ecx
mov ecx, edi
call fcn.0040e466
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, edi
call fcn.0040fcd6
test eax, eax
jne 0x406018
push str.___Administrator_permissions_needed..._n
call fcn.004010b4
pop ecx
xor esi, esi
sub esi, 1
je 0x40624a
sub esi, 1
je 0x4061a8
mov ecx, edi
call fcn.0044a5cf
mov edx, dword [ebx]
call fcn.00476680
and dword [ebp - 0x58], 0
mov dword [ebx + 0x20], eax
lea eax, [ebp - 0x64]
push eax
push 0xf003f
push 0
push 0x6b3ebc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060a3
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push eax
push 0x6b3edc
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40609a
cmp dword [ebp - 0x58], eax
jbe 0x40609a
push 0x6b3ee8
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x7c]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov dword [ebp - 0x7c], ecx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push dword [ebx + 0x1c]
push eax
push eax
push dword [ebx]
push eax
call fcn.00461883
xor edx, edx
mov ecx, eax
call fcn.0046195b
add esp, 0x20
mov edi, eax
mov edx, str.require_linux_pathfix____
mov dword [ebp - 0x60], edi
push 0xf88
push ecx
mov ecx, edi
call fcn.0040e466
and dword [ebx + 0xb1c], 0
mov esi, 0xe88
and dword [ebx + 0xb20], 0
mov edx, str._function_foo____var_f__require_service_manager_.manager.getServiceType____switch_f_case_windows:_return_10___case_launchd:_return_3___case_freebsd:_return_5___case_systemd:_return_1___case_init:_return_2___case_upstart:_return_4___default:_return_0_____
pop ecx
pop ecx
push esi
push ecx
mov ecx, edi
call fcn.0040e466
pop ecx
pop ecx
test eax, eax
jne 0x406115
push eax
push ecx
or edx, 0xffffffff
mov ecx, edi
call fcn.0040f3c9
pop ecx
pop ecx
mov dword [ebx + 0xb1c], eax
push esi
push ecx
mov edx, str.require_service_manager_.manager.getService_process.platformwin32_Mesh_Agent:meshagent_.isMe___
mov ecx, edi
call fcn.0040e466
pop ecx
pop ecx
test eax, eax
jne 0x406139
or edx, 0xffffffff
mov ecx, edi
call fcn.0040fcd6
mov dword [ebx + 0xb20], eax
push esi
push ecx
mov edx, str._function__getMac____var_ret____var_ni__require_os_.networkInterfaces____for__var_f_in_ni___for__var_i_in_ni_f____if_ni_f__i_.type__ethernet__ni_f__i_.type__wireless__ret______ni_f__i_.mac________return_ret_______
mov ecx, edi
call fcn.0040e466
pop ecx
pop ecx
test eax, eax
jne 0x4064db
lea eax, [ebp - 0x70]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.0040fdf0
mov esi, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
pop ecx
cmp esi, 0x13
jb 0x4064db
push 0x400
push 0x6b4024
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b40a4
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x4063e4
mov edx, 0x6b41b0
jmp 0x4064ca
push 0xe08
push ecx
mov edx, str.require_agent_installer__
mov ecx, edi
call fcn.0040e466
push str.fullUninstall
or edx, 0xffffffff
mov ecx, edi
call fcn.0040ebba
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.0040f945
xor ebx, ebx
xor edx, edx
push ebx
mov ecx, edi
call fcn.0040d9fa
add esp, 0x14
test eax, eax
je 0x40623e
push ebx
or edx, 0xffffffff
mov ecx, edi
mov esi, 0x6b3e30
call fcn.004109e7
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40621a
test cl, cl
je 0x406216
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40621a
add eax, edx
add esi, edx
test cl, cl
jne 0x4061fc
mov eax, ebx
jmp 0x406221
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x40623e
push ebx
or edx, 0xffffffff
mov ecx, edi
call fcn.004109e7
push eax
push 0x6b3e5c
call fcn.004010b4
add esp, 0xc
mov ecx, edi
call fcn.0041259d
jmp 0x407034
mov ecx, dword [ebx + 0x24]
xor edx, edx
push 0
call fcn.00473501
pop ecx
push 0
push 0
mov esi, eax
xor eax, eax
push 0xf99
push 0x6b3d94
inc eax
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.005ce020
add esp, 0x10
mov edx, esi
mov ecx, eax
call fcn.0046bf0b
mov ecx, dword [ebx + 0x24]
mov edx, eax
push esi
mov dword [ebp - 0x60], eax
call fcn.00473501
add esp, 0xc
mov edx, 0x6b3dac
push 0xe08
push ecx
mov ecx, edi
call fcn.0040e466
push str.fullInstall
or edx, 0xffffffff
mov ecx, edi
call fcn.0040ebba
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
mov ecx, edi
call fcn.0040f945
mov ebx, dword [ebp - 0x60]
mov ecx, edi
mov edx, ebx
call fcn.004117ba
xor eax, eax
mov ecx, edi
push 0
lea edx, [eax + 1]
call fcn.0040d9fa
add esp, 0x14
test eax, eax
je 0x406337
push 0
or edx, 0xffffffff
mov ecx, edi
mov esi, 0x6b3dd4
call fcn.004109e7
pop ecx
push 2
pop edx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x406312
test cl, cl
je 0x40630e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x406312
add eax, edx
add esi, edx
test cl, cl
jne 0x4062f4
xor eax, eax
jmp 0x406319
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x406337
push 0
or edx, 0xffffffff
mov ecx, edi
call fcn.004109e7
push eax
push 0x6b3e00
call fcn.004010b4
add esp, 0xc
mov ecx, edi
call fcn.0041259d
mov ecx, ebx
call fcn.0046bfb6
jmp 0x407034
cmp dword [ebx + 0x24], 0
jne 0x406031
push 0
push 0
push 0xfc3
xor eax, eax
push 0x6b3e60
inc eax
push eax
push 0x20
call fcn.005ce020
add esp, 0x10
mov ecx, eax
push 0x10
pop edx
call fcn.0046bf0b
mov esi, eax
mov eax, dword [ebp - 0x68]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [ebx + 0xb18]
cmp eax, 0xa
je 0x4063d2
inc eax
push eax
push str.Unable_to_open_database___d_10_..._r_n
call fcn.004010b4
inc dword [ebx + 0xb18]
pop ecx
pop ecx
mov ecx, dword [ebx]
push 0x405c0d
push 0x405c16
push 0x7d0
call fcn.0046c53e
mov edx, esi
mov ecx, eax
call fcn.0046f894
jmp 0x407031
push str.Unable_to_open_database._r_n
call fcn.004010b4
pop ecx
xor eax, eax
jmp 0x407037
and dword [ebp - 0x70], 0
test esi, esi
jle 0x4064db
mov edi, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x64]
push 0x13
lea eax, [edi + ebx]
push 0x6b41c4
push eax
call fcn.005c9c50
add esp, 0xc
test eax, eax
jne 0x406414
add edi, 0x13
cmp edi, esi
jl 0x4063f6
mov ebx, dword [ebp - 0x6c]
cmp edi, esi
mov edi, dword [ebp - 0x60]
jge 0x4064db
mov eax, dword [ebp - 0x58]
and dword [ebp - 0x80], 0
lea eax, [eax + 0x24]
call fcn.0059c6e0
mov edx, dword [ebp - 0x58]
xor eax, eax
mov ecx, esp
inc eax
push eax
push 4
call fcn.0046bf0b
push 0x400
push 0x6b41d8
mov dword [ebp - 0x70], eax
lea ecx, [eax + 4]
mov dword [eax], ecx
call fcn.005d06e0
mov ecx, dword [ebp - 0x58]
mov edx, 0x6b41ec
push ecx
push dword [ebp - 0x70]
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00473f3c
add esp, 0x1c
cmp dword [ebp - 0x58], 0
jle 0x4064bf
mov edi, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x80]
push 0x13
push str._00:00:00:00:00:00_
push edi
call fcn.005c9c50
add esp, 0xc
test eax, eax
je 0x4064a3
mov ecx, dword [ebp - 0x64]
mov edx, esi
push 0x13
push edi
call fcn.00470a09
pop ecx
pop ecx
test eax, eax
jns 0x4064b2
mov eax, dword [ebp - 0x58]
add ebx, 0x13
add edi, 0x13
cmp ebx, eax
jl 0x40647c
jmp 0x4064b5
mov eax, dword [ebp - 0x58]
mov edi, dword [ebp - 0x60]
cmp ebx, eax
mov ebx, dword [ebp - 0x6c]
jl 0x4064db
xor eax, eax
mov edx, str.LocalMacAddresses
inc eax
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebx + 0x24]
push esi
push dword [ebp - 0x64]
push 0x11
call fcn.00473d84
add esp, 0xc
mov ecx, edi
call fcn.0044a5cf
xor edi, edi
inc edi
cmp dword [ebp - 0x7c], edi
je 0x4064f5
mov ecx, ebx
call fcn.00402d2f
test eax, eax
je 0x40650b
mov ecx, ebx
call fcn.00402aa2
test eax, eax
je 0x40650b
push str.Certificate_error_r_n
call fcn.004010b4
pop ecx
mov ecx, ebx
call fcn.00402fa7
test eax, eax
je 0x406521
push str.Certificate_validation_error_r_n
call fcn.004010b4
pop ecx
and dword [ebp - 0x60], 0
mov edx, str..tag
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00402962
lea edx, [ebp - 0x60]
mov ecx, eax
call fcn.0046aa13
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebx + 0x24]
test esi, esi
je 0x406561
push eax
push esi
push 3
mov edx, 0x6b4264
call fcn.00473d84
push edi
push esi
call fcn.005cdee0
add esp, 0x14
jmp 0x40656e
push 3
mov edx, 0x6b4268
call fcn.00474086
pop ecx
mov ecx, dword [ebx + 0x24]
lea eax, [ebp - 0x34]
push 0xff
push eax
push 0xf
mov edx, str.ignoreProxyFile
call fcn.00473f3c
add esp, 0xc
test eax, eax
jne 0x4065df
and dword [ebp - 0x60], eax
mov edx, str..proxy
push ecx
mov ecx, dword [ebx + 0x1c]
call fcn.00402962
lea edx, [ebp - 0x60]
mov ecx, eax
call fcn.0046aa13
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x4065df
mov ecx, dword [ebx + 0x24]
test eax, eax
jle 0x4065c9
push eax
push esi
push 8
mov edx, 0x6b4284
call fcn.00473d84
add esp, 0xc
jmp 0x4065d6
push 8
mov edx, 0x6b4290
call fcn.00474086
pop ecx
push edi
push esi
call fcn.005cdee0
pop ecx
pop ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..mshx
call fcn.00402962
mov edx, eax
mov ecx, ebx
call fcn.00405872
test eax, eax
jne 0x406650
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6b42a4
call fcn.00402962
mov edx, eax
mov ecx, ebx
call fcn.00405872
test eax, eax
jne 0x406650
mov edx, str.mesh_linumshx
mov ecx, ebx
call fcn.00405872
test eax, eax
jne 0x406650
mov edx, str.mesh_limshx
mov ecx, ebx
call fcn.00405872
test eax, eax
jne 0x406650
mov ecx, ebx
call fcn.0040572a
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6b42c8
call fcn.00402962
mov edx, eax
mov ecx, ebx
call fcn.00405872
and dword [ebp - 0x60], 0
push 0x400
push 0x6b42d0
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b42e4
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
cmp eax, 4
jne 0x4066af
push 0x400
push 0x6b42f8
call fcn.005d06e0
push 4
lea ecx, [ebp - 0x60]
mov edx, str.AgentCapabilities
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00473f3c
add esp, 0x14
push dword [ebp - 0x60]
call dword [sym.imp.WS2_32.dll_ntohl]
or dword [ebx + 0x48], eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebx + 0xb24]
neg eax
push 0x6b4320
sbb eax, eax
add eax, reloc.WS2_32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x406af2
and dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
test byte [ebx + 0x48], 0x40
push eax
push 0x30
pop edx
jne 0x4069f6
lea ecx, [ebx + 0xad0]
call fcn.0046f5ef
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop ecx
mov ecx, eax
test ecx, ecx
jle 0x406753
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x406753
xor eax, eax
test ecx, ecx
jle 0x40672b
mov dl, byte [eax + esi]
cmp dl, 0x2b
jne 0x40671d
mov byte [eax + esi], 0x40
jmp 0x406726
cmp dl, 0x2f
jne 0x406726
mov byte [eax + esi], 0x24
inc eax
cmp eax, ecx
jl 0x40670f
push ecx
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6b4340
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005cdee0
and dword [ebp - 0x58], 0
pop ecx
pop ecx
jmp 0x40675d
push 0x6b4348
push dword [ebp - 0x5c]
call edi
mov esi, 0x76c080
lea ecx, [ebx + 0x9b8]
push esi
push 0x30
pop edx
call fcn.0046a7a9
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406776
sub ecx, edx
xor eax, eax
push ecx
push esi
inc eax
push eax
push 0
push 0x6b4350
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x400
push 0x6b435c
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b4364
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
mov esi, 0x76d080
test eax, eax
jne 0x4067cc
push 0x6b436c
jmp 0x406861
push 0x400
push 0x6b4374
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b437c
push 0x10000
push esi
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jle 0x40685c
lea ecx, [ebp - 0x58]
mov edx, eax
push ecx
mov ecx, esi
call fcn.0046f5ef
pop ecx
test eax, eax
jle 0x406855
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x406855
xor ecx, ecx
test eax, eax
jle 0x406831
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x406823
mov byte [ecx + esi], 0x40
jmp 0x40682c
cmp dl, 0x2f
jne 0x40682c
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, eax
jl 0x406815
push eax
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6b4384
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005cdee0
pop ecx
pop ecx
jmp 0x406866
push 0x6b438c
jmp 0x406861
push 0x6b4394
push dword [ebp - 0x5c]
call edi
push 0x400
push 0x6b439c
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov esi, 0x76d080
push 0x10000
push esi
push eax
mov edx, 0x6b43a8
call fcn.00473f3c
add esp, 0x14
test eax, eax
jne 0x4068a7
push 0x6b43b4
push dword [ebp - 0x5c]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4068cd
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4068ac
sub ecx, edx
xor eax, eax
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push 0
push 0x6b43c4
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6b43d4
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b43e0
push 0x10000
push 0x76d080
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jne 0x406907
push 0x6b43ec
push dword [ebp - 0x5c]
call edi
jmp 0x40692e
mov ecx, 0x76d080
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40690f
sub ecx, edx
xor eax, eax
push ecx
push 0x76d080
inc eax
push eax
push 0
push 0x6b43fc
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6b440c
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.WebProxy
push 0x10000
push 0x76d080
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jne 0x406968
push 0x6b4424
push dword [ebp - 0x5c]
call edi
jmp 0x40698f
mov ecx, 0x76d080
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406970
sub ecx, edx
xor eax, eax
push ecx
push 0x76d080
inc eax
push eax
push 0
push 0x6b442c
push dword [ebp - 0x5c]
call esi
push 0x400
push 0x6b4434
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b4438
push 0x10000
push 0x76d080
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jne 0x4069c9
push 0x6b443c
push dword [ebp - 0x5c]
call edi
jmp 0x4069ee
mov edi, 0x76d080
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4069d3
sub ecx, edx
xor eax, eax
push ecx
push edi
inc eax
push eax
push 0
push 0x6b4440
push dword [ebp - 0x5c]
call esi
lea edi, [ebx + 0xad0]
jmp 0x406a63
lea edi, [ebx + 0xad0]
mov ecx, edi
call fcn.0046f5ef
pop ecx
test eax, eax
jle 0x406a55
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x406a55
xor ecx, ecx
test eax, eax
jle 0x406a31
mov dl, byte [ecx + esi]
cmp dl, 0x2b
jne 0x406a23
mov byte [ecx + esi], 0x40
jmp 0x406a2c
cmp dl, 0x2f
jne 0x406a2c
mov byte [ecx + esi], 0x24
inc ecx
cmp ecx, eax
jl 0x406a15
push eax
push esi
xor eax, eax
inc eax
push eax
push 0
push 0x6b4444
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
inc eax
push eax
push esi
call fcn.005cdee0
pop ecx
pop ecx
jmp 0x406a63
push str.DiagnosticAgentNodeId
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x400
push 0x6b4474
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.SelfNodeCert
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jne 0x406ae6
push 0x400
push 0x6b4494
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov esi, 0x76c080
push 0x1000
push esi
push eax
mov edx, 0x6b449c
call fcn.00473f3c
add esp, 0x14
test eax, eax
je 0x406ad1
cmp eax, 0x30
jne 0x406ad1
xor ecx, ecx
mov eax, dword [edi + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x406ad1
inc ecx
cmp ecx, 0xc
jne 0x406ac1
jmp 0x406ae6
mov ecx, dword [ebx + 0x24]
mov edx, str.NodeID
push 0x30
push edi
push 6
call fcn.00473d84
add esp, 0xc
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea edx, [ebx + 0xa2c]
cmp dword [edx], 0
push ecx
mov ecx, dword [ebx + 0x20]
jne 0x406b07
push 0
xor edx, edx
jmp 0x406b0d
push dword [ebx + 0xa20]
call fcn.0047722c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x406ba3
mov eax, dword [ebp - 0x78]
cmp eax, edi
je 0x406ba3
push 2
pop esi
cmp eax, esi
jne 0x4063dd
mov eax, dword [ebp - 0x68]
mov edx, 0x6b44ac
mov eax, dword [eax + 4]
mov ecx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x6c]
jne 0x406b6c
cmp byte [ebp - 0x51], 0
je 0x406b68
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [ebp - 0x51], bl
mov ebx, dword [ebp - 0x6c]
jne 0x406b6c
add ecx, esi
add edx, esi
cmp byte [ebp - 0x51], 0
jne 0x406b3e
xor ecx, ecx
jmp 0x406b70
sbb ecx, ecx
or ecx, edi
test ecx, ecx
je 0x406ba3
mov ecx, 0x6b44b0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406b97
test dl, dl
je 0x406b93
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406b97
add eax, esi
add ecx, esi
test dl, dl
jne 0x406b79
xor eax, eax
jmp 0x406b9b
sbb eax, eax
or eax, edi
test eax, eax
jne 0x4063dd
mov ecx, dword [ebx + 0x1c]
mov edx, 0x6b44b8
call fcn.00402962
test eax, eax
je 0x406bbb
push eax
call fcn.005e49e0
pop ecx
mov ecx, dword [ebx + 0x1c]
mov edx, str..corereset
call fcn.00402962
mov esi, eax
push 0
push esi
call fcn.005e9850
pop ecx
pop ecx
test eax, eax
jne 0x406c03
push 0x400
push 0x6b44d0
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b44dc
push eax
call fcn.00474086
add esp, 0xc
test esi, esi
je 0x406c03
push esi
call fcn.005e49e0
pop ecx
cmp dword [ebx + 0x3c], 0
jne 0x406c31
push 0x400
push 0x6b44e8
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b44f4
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
mov esi, eax
jmp 0x406c33
xor esi, esi
push 0x400
push 0x6b4500
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.webSocketMaskOverride
push 0
push 0
push eax
call fcn.00473f3c
push 0x400
push 0x6b4530
mov dword [ebx + 0x9ac], eax
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b453c
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x28
test eax, eax
je 0x406cd3
push 0x400
push 0x6b4548
call fcn.005d06e0
push 0x10
lea ecx, [ebp + 0xcc]
mov edx, str.jsDebugPort
push ecx
mov ecx, dword [ebx + 0x24]
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
jle 0x406cd3
cmp eax, 0x10
jae 0x407055
mov byte [ebp + eax + 0xcc], 0
lea eax, [ebp + 0xcc]
push eax
call fcn.005cfd10
pop ecx
mov dword [ebx + 0x9b0], eax
push 0x400
push 0x6b4560
mov dword [ebx + 0x40], edi
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.showModuleNames
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
mov dword [0x76a54c], eax
cmp dword [ebx + 8], 0
je 0x406d5c
push dword [ebx]
push dword [ebx + 8]
call fcn.004023af
mov ecx, dword [ebx + 8]
or edx, 0xffffffff
push 0x6b4580
call fcn.0040ebba
mov ecx, dword [ebx + 8]
push 0xffffffffffffffff
push 0xfffffffffffffffe
pop edx
call fcn.0040f945
mov ecx, dword [ebx + 8]
mov edx, str.Ready
call fcn.004117ba
mov ecx, dword [ebx + 8]
mov edx, edi
push 0
call fcn.0040d9fa
add esp, 0x14
test eax, eax
je 0x406d54
mov ecx, dword [ebx + 8]
call fcn.0044a550
mov ecx, dword [ebx + 8]
call fcn.0041259d
xor eax, eax
cmp dword [ebx + 0x3c], eax
jne 0x406ed9
push eax
push eax
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [ebx + 0x24]
push eax
push dword [ebx]
push eax
call fcn.00461883
xor edx, edx
mov ecx, eax
call fcn.0046195b
push ebx
mov ecx, eax
mov dword [ebx + 8], eax
call fcn.00402903
mov ecx, dword [ebx + 8]
mov edx, 0x405bb6
push ebx
call fcn.0044a319
push 0x400
push 0x6b4590
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.coreDumpEnabled
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x3c
mov dword [ebx + 0x9b4], eax
test eax, eax
je 0x406de0
push 0xf08
push ecx
mov ecx, dword [ebx + 8]
mov edx, str.process.coreDumpLocation__process.platformwin32__process.execPath.replace_.exe__.dmp__:_process.execPath__.dmp__
call fcn.0040e466
pop ecx
pop ecx
test esi, esi
jle 0x406ed9
push 0x400
push 0x6b4630
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, str.noUpdateCoreModule
push 0
push 0
push eax
call fcn.00473f3c
add esp, 0x14
test eax, eax
je 0x406e8a
push str._CoreModule:_Update_Disabled_n
mov dword [ebx + 0x3c], edi
call fcn.004010b4
push 0
push 0
xor edx, edx
mov ecx, esi
call fcn.0046c097
push 0x400
push 0x6b467c
mov edi, eax
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov edx, 0x6b4688
push esi
push edi
push eax
call fcn.00473f3c
mov ecx, dword [ebx + 8]
lea eax, [esi - 4]
push 0xd
push 0x6b4694
push eax
lea edx, [edi + 4]
call fcn.00461ded
add esp, 0x2c
test eax, eax
jne 0x406e74
mov ecx, dword [ebx + 8]
call fcn.00461e76
test eax, eax
je 0x406e7c
mov ecx, dword [ebx + 8]
call fcn.0041259d
xor eax, eax
inc eax
push eax
push edi
call fcn.005cdee0
pop ecx
pop ecx
jmp 0x406ed9
mov ecx, dword [ebx + 8]
lea edx, [ebp - 0x80]
sub esp, 0xc
mov dword [ebp - 0x80], ebx
call fcn.0044a987
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x9a8], eax
call fcn.004119c6
mov edx, dword [ebx + 0x9a8]
mov ecx, dword [ebx + 8]
call fcn.004122ad
mov ecx, dword [ebx + 0x9a8]
call fcn.00449ca0
mov ecx, dword [ebx + 8]
push eax
push 0xfffffffffffffffe
pop edx
call fcn.0040ece7
mov ecx, dword [ebx + 8]
add esp, 0x10
call fcn.0041259d
mov ecx, dword [ebx]
mov edx, 0x405bc7
push ebx
call fcn.0046b220
mov ecx, ebx
call fcn.0040548b
mov dword [esp], 0x400
push 0x6b46a4
call fcn.005d06e0
mov ecx, dword [ebx + 0x24]
mov esi, 0x76c080
push 0x1000
push esi
push eax
mov edx, 0x6b46b0
call fcn.00473f3c
add esp, 0x14
cmp eax, 5
jle 0x407034
mov eax, dword [esi]
mov ecx, 0x6b46bc
cmp eax, dword [ecx]
jne 0x407034
movzx eax, byte [esi + 4]
cmp al, byte [ecx + 4]
jne 0x407034
xor eax, eax
lea edi, [ebp + 0xcc]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
call fcn.00470fe1
mov esi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
je 0x406f87
push 0x17
pop edi
push 0x425d
mov word [ebp - 0x50], di
call esi
mov word [ebp - 0x4e], ax
mov edx, str.FF02:0:0:0:0:0:0:FE
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.00471189
pop ecx
push 2
pop edi
push 0x425d
mov word [ebp + 0xcc], di
call esi
mov word [ebp + 0xce], ax
mov edx, str.239.255.255.235
lea eax, [ebp + 0xd0]
mov ecx, edi
push eax
call fcn.00471189
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0x425e
call fcn.0046b7bb
add esp, 0x18
mov dword [ebx + 0xb04], eax
test eax, eax
jne 0x406ff0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x1189
mov edx, 0x6b46e8
jmp 0x40702a
push ecx
push ebx
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
call fcn.0046b7bb
add esp, 0x18
mov dword [ebx + 0xb08], eax
test eax, eax
jne 0x407034
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xdb
push 0x118d
mov edx, str...meshcore_agentcore.c
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
xor eax, eax
inc eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
call fcn.0059b3f0
lea esp, [ebp + 0xe0]
pop ebp
ret
call fcn.0059b550
int3